nx_scm_rights_gate.nx

nx_scm_rights_gate.nx -- does SCM_RIGHTS descriptor passing ACTUALLY MOVE A DESCRIPTOR? 2026-08-21, /compare/trafficsafety ITEM 2. sys_sendmsg was ABSENT-PROVEN from the whole tree (corpus_complete=1) until today, so SCM_RIGHTS -- the mechanism nginx, HAProxy and Envoy all use to replace a process WITHOUT releasing its listening socket -- could not be written at all. WHY THE TEETH LOOK LIKE THIS. A wrong msghdr or cmsghdr layout DOES NOT FAIL LOUD: sendmsg still returns a positive byte count and simply transfers nothing, and recvmsg still returns a positive byte count having delivered no ancillary data. A gate that read return codes would be GREEN on a shim that moves no descriptor at all. So every proof here is BEHAVIOURAL and runs between two REAL processes: the parent hands a descriptor over, RELEASES ITS OWN COPY, and only then does the child use it in a way the parent can observe from the other side. THE ANTI-VACUITY DESIGN IS THE SUBJECT'S CREATION ORDER. Every descriptor under test is created AFTER the fork, so the child cannot possibly have inherited it -- a child that "succeeded" by using an inherited descriptor number is impossible by construction, not merely unlikely. AND THE ORDERING IS DETERMINISTIC, NOT HOPEFUL. The child waits for a go-byte that the parent writes only AFTER closing its own copy, so "the descriptor outlives the sender letting go of it" is a proven sequence rather than a race the test usually wins. PHASE 2 IS THE TS1 INVARIANT IN MINIATURE: the descriptor passed is a LISTENING SOCKET, the parent closes its copy, and then the parent CONNECTS TO THE PORT. That connect can only succeed if a listener still exists, and the only process holding one is the child that received it. This is the property SO_REUSEPORT co-binding can never demonstrate: not "two processes can bind", but "the socket never stopped existing while its owner changed". TRANSPORT NOTE, MEASURED NOT ASSUMED: the control channel is a NAMED AF_UNIX rendezvous rather than a socketpair, because socketpair returns EFAULT for every input on this host (pinned by controls in nx_scm_probe; the note lives beside sys_socketpair in the shim). Named rendezvous is also what the field actually uses, so nothing is lost by the substitution. NEG-CONTROL: a receiver must REFUSE to invent a descriptor. An ordinary byte with no ancillary data must come back as the NAMED refusal SCM_ERR_NO_CMSG, never as a plausible small integer that a caller would happily use as an fd. expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).