nx_segopen_absent_gate.nx

nx_segopen_absent_gate.nx -- THE REFEREE FOR ss_open2's FAIL-SAFE SEGMENT ADMISSION (2026-09-02, debt 1788361379). WHY THIS GATE EXISTS, MEASURED: nishifamily.com/search was 503 for ~16h. The serving daemon's parent SIGSEGV'd inside the accept-path shard refresh, and the guard's respawn then SPUN 15.9h of user CPU inside ss_open2 with the listen port never opened (State R, voluntary ctxsw 8, nonvoluntary 26.1M). Its /proc maps held one manifest segment with its .idx mapped and NO .docs: ss_open2 sized that segment's live map from dsz (== 0, one page) but bounded the marks by the .post doc count, so the marks wrote past the page -- SIGSEGV when the next page was unmapped, silent table corruption and an endless probe when it was mapped. The fix makes an index-present/docs-absent row contribute NO live docs and ANNOUNCES it on stderr. IN-PROCESS over nx_seg_store.nx, deliberately: the subject is a library function, the fixture plane lives in /tmp/<gate>/ (never knowledge/store, which the segguard beat sweeps), and every outcome tooth is preceded by a fixture-reached-the-condition tooth so a setup failure cannot pass for a verdict. STATE, NOT MESSAGE: the live-map bytes of the handle are read directly (h[1 + 8*ns + s]), because a leaking or overflowing open answers the same bytes to every caller -- only the map can prove it. The segment NAME is read back from the manifest the writer produced, never recomputed from the id the gate asked for: ss_commit re-derives the id under the plane lock, so a leftover file from an earlier run would otherwise make the gate rename the wrong file and fail its own fixture tooth. PRE-FIX this gate reads RED on exactly the two load-bearing teeth (marks written for absent docs, no announce) and GREEN on every fixture tooth; POST-FIX it reads GREEN throughout. That asymmetry is the bite.