nx_stderronly.nx

nx_stderronly.nx -- THE SILENT-STDERR-GUARD DETECTOR. THE DEFECT. A guard that detects a fault, writes its refusal ONLY to the error channel, and then leaves the enclosing status function on a SUCCESS path reaches its caller as SILENCE: the caller reads a success code, sees nothing, and proceeds. Measured live 2026-08-20 in nx_clockjob, where a refused write was indistinguishable from a successful one. SCOPE, STATED PLAINLY -- THIS IS SOURCE-SHAPE ANALYSIS, NOT RUNTIME. It cannot observe which channel a message actually took at run time, because the estate has no fd-capture primitive: a sibling proved that nx_job_run MERGES fd1 and fd2 (one refusing write appeared exactly twice in a single capture), so a runtime channel test is currently unwritable. That missing primitive is filed separately as nx_fdcapture. Everything below is decided from the bytes of the source with comment bodies and string bodies masked out of the code view. WHAT IT THEREFORE CANNOT SEE: a verdict carried through a flag variable that is returned later; a refusal whose message is built across several lines; a condition spread over several lines; a caller that already holds the failure code (a reason-printer); any refusal worded outside the published vocabulary; anything at all at run time. THE SIGNAL IS A CONJUNCTION, AND EVERY CONJUNCT IS PUBLISHED AS ITS OWN BUCKET SO THE FUNNEL CAN BE AUDITED RATHER THAN TRUSTED: 1. the site is an fd-2 emission -- a write whose fd argument is the literal 2 OR a file-level const whose VALUE is 2 (THE SAME CONSTANT IN TWO SPELLINGS IS TWO CONSTANTS TO EVERY SCANNER: the estate writes both, so resolving by value is the only complete rule), OR a call to a same-file UNCONDITIONAL stderr helper 2. it is NOT inside such a helper's own body (a printer is not a guard) 3. its innermost enclosing block is an `if` guard, not a function body / else / loop 4. the emitted literal carries a REFUSAL token from the published vocabulary 5. the guard block carries NO non-zero verdict (no non-zero return, no non-zero sys_exit) 6. the enclosing function PROVES IT USES EXIT CODES -- it carries a non-zero verdict SOMEWHERE 7. the guard block does no other work (no assignment, so it cannot be setting a failure flag) CONJUNCT 6 IS THE DISCRIMINATOR AND IT WAS EARNED, NOT GUESSED. Without it the rule fires on every reason-printer in the estate (nx_gunzip.gu_reason, nx_refcorpus.rc_reason: a fan of `if rc == -N { emit(...) }` lines whose CALLER already holds the failure code). Such a function has no non-zero verdict anywhere, so it is not a status function at all, and its silence is correct by design. A FUNCTION THAT NEVER RETURNS A NON-ZERO CODE IS NOT FAILING TO REPORT -- IT WAS NEVER THE REPORTER. CONJUNCT 7 WAS EARNED THE SAME WAY: the corpus is full of `if x < 0 { write(fd2,"-"); x = 0 - x }` number formatters and `if p2 == 0 { werr("T2 ...") }` selftest teeth whose verdict lives in a