nx_wasmemit_guard_gate.nx

nx_wasmemit_guard_gate.nx -- EVERY ORGAN THAT EMITS A FRAMEBUFFER WASM PAGE MUST CALL THE FIT GUARD. WHY. /craft shipped BLACK twice because its framebuffer had outgrown the module's own declared linear memory. The guard that refuses that (nx_wasmfit's wf_guard) used to live inside nx_game_page_emit under a header claiming every wasm page in the estate was built through it. nx_wasmpage_census then measured all 62,906 shipped pages: 25 carry an embedded module and only 9 reach that function. ★★★★★★A GUARD PLACED IN "THE" SHARED PATH IS ONLY AS BROAD AS THE CLAIM THAT THE PATH IS SHARED, AND THAT CLAIM IS A MEASUREMENT NOBODY TOOK. The census is the after-the-fact audit -- it catches a bad page once it is already on disk. This is the BEFORE: a static check that every emitter is wired to the one ruler, so a new emitter cannot be written without the guard and pass unnoticed. ★A LAW I HAVE TO REMEMBER IS A LAW I WILL SKIP; PUT IT IN THE PATH. THE SUBJECT IS DEFINED BY A CONJUNCTION, NOT A GUESS. An organ is a framebuffer-page emitter iff its source carries all three literals of the blit shim it writes into the page: the instantiate call, and the ww/fb_off accessor reads. That matters because organs which merely MENTION wasm must not be swept in -- nx_sitegen_game_gate CHECKS emitted pages for "WebAssembly.instantiate" and would be a false positive on that literal alone. ★A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE, and ★A SCANNER CANNOT TELL A CALL FROM A RENDERING OF A CALL -- so the rule is stated, narrow, and its misses are declared rather than hidden: an emitter that builds the shim string in pieces is NOT seen by this gate. That is a floor on coverage, printed as one. license_tier: ORIGINAL