nx_refusal_shape_gate.nx

nx_refusal_shape_gate.nx -- THE REFEREE FOR FM11 (/compare/failmodes rung: fc_refusal_shape). THE ACCEPT RULE THIS GATE ENFORCES, QUOTED FROM failmodes.plan BEFORE THE WORK BEGAN: "run it over the estate's EXISTING refusal messages and publish the pass rate; it is accepted only if it PASSES the three known-correct guards (the nx_fs read truncation envelope, the build-admission refusal, the capability-denied mint recipe) AND FAILS a crafted refusal that names no remedy." * A SHAPE CHECKER THAT FLAGS A KNOWN-GOOD GUARD IS WORSE THAN NONE, BECAUSE SOMEONE WILL ACT ON IT. * The three known-good teeth below read the REAL production sources, not a fixture: a control drawn from the population under test is not a control, and a control drawn from a fixture proves only that the fixture was written to pass. FIXTURES ARE ASSEMBLED AT RUNTIME UNDER /tmp AND THEIR REFUSAL TEXT COMES FROM THE CONF. A source-scanning detector finds its own fixture and accuses its author first, so not one refusal marker is written as a literal in this file: the fixtures splice marker[0] and remedy[0] out of the loaded vocabulary. That also makes the fixtures track the conf -- a fixture whose vocabulary has drifted from the detector's is a test of nothing. Scratch lives in /tmp/nx_refusal_shape_gate/ because a gate that shares a fixture with a production path reports on the fixture, and every fixture is rewritten on every run because a gate that is not idempotent reports on its first run and lies about every run after. THE BASELINE IS DELETED AT SETUP so the self-baseline direction is genuinely exercised; the ratchet is bite-proven in THREE directions, because a ratchet that rewrites its baseline on a rise launders itself green and can never fire twice. license_tier: ORIGINAL module: nishi-core.quality.refusal_shape capability: REFUSAL_EMITTER_SHAPE_GATE