code wiki / (root) / nx_civicmap_gate.nx
`nx_civicmap_gate.nx` source

↩ module page · 500 lines · 36912 B
1// nx_civicmap_gate.nx -- GATE for the civic quality-of-life map: CM1 admission, CM2 county join,
2// CM3 the honest choropleth. Subject: nx_civicmap_lib.nx, imported and exercised IN-PROCESS, so this
3// gate can never report on a stale deployed artifact instead of the source it names.
4//
5// WHAT THIS GATE IS ACTUALLY FOR. The easy version of every one of these teeth is vacuous:
6//   * A deny-suite alone proves nothing -- ★A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST.
7//     So the first tooth is a POSITIVE control (a complete row MUST be admitted) and every refusal
8//     tooth asserts WHICH RULE FIRED, not merely that something was refused.
9//   * "The map rendered" proves nothing about honesty. The load-bearing tooth is ARITHMETIC: the number
10//     of data-value attributes in the emitted page must EQUAL the number of PRESENT counties. An
11//     implementation that painted suppressed counties with the bottom bucket still renders, still looks
12//     like a map, and fails that count. That is the tooth the trivial wrong version cannot pass.
13//   * Every fixture is built HERE, at runtime, under /tmp/nx_civicmap_gate/ -- never in knowledge/store,
14//     because a gate that shares a fixture with a production beat measures the beat's races and reports
15//     them as the subject's defects.
16// Preconditions use gv_need, so "I could not write my own fixture" ends SKIP and never RED: a gate that
17// reports a broken environment in the same word as a broken subject teaches everyone to ignore it.
18// license_tier: ORIGINAL   No hardware writes (Rule 26).
19import "nx_syscalls.nx"
20import "nx_gate_verdict.nx"
21import "nx_geo_raster.nx"
22import "nx_civicmap_lib.nx"
23
24const CG_DIR: *u8 = "/tmp/nx_civicmap_gate"
25const CG_COUNTIES: *u8 = "/tmp/nx_civicmap_gate/counties.conf"
26const CG_DIRTY: *u8 = "/tmp/nx_civicmap_gate/dirty.conf"
27const CG_OUT: *u8 = "/tmp/nx_civicmap_gate/map.html"
28const CG_MODE_755: i64 = 493
29const CG_MODE_644: i64 = 420
30const CG_SCRATCH: i64 = 64
31// ---- FIXTURE CONSTANTS, NAMED FOR WHAT THEY PROBE ----------------------------------------------------
32// Rule 11 in a gate is not bureaucracy: a bare 40500000 in a probe tells the next reader nothing about
33// WHY that point was chosen, and the whole value of these teeth is that a reader can see the fixture was
34// built to reach the condition under test. Named for purpose, never for the value -- a const called
35// CG_MAGIC_40500000 would satisfy the counter and teach nobody anything.
36const CG_PROBE_LAT: i64 = 40500000           // a latitude inside BOTH fixture squares
37const CG_PROBE_LON_WEST: i64 = 74500000      // |longitude| inside the WEST fixture county
38const CG_PROBE_LON_EAST: i64 = 72500000      // |longitude| inside the EAST fixture county
39const CG_PROBE_LON_NOWHERE: i64 = 60000000   // |longitude| outside EVERY fixture county
40const CG_FIPS_WEST: i64 = 10001
41const CG_FIPS_EAST: i64 = 10002
42// one index fixture county per observation regime, so each tooth has an unambiguous subject
43const CG_QOL_FULL: i64 = 20001               // observed on every declared axis
44const CG_QOL_PARTIAL: i64 = 20002            // observed on exactly one
45const CG_QOL_NONE: i64 = 20003               // observed on nothing at all
46const CG_QOL_DIRPROBE: i64 = 20004           // exists only to probe axis direction
47// one acre fixture county in a disclosure state and one in a non-disclosure state
48const CG_ACRE_DISCLOSE: i64 = 30001
49const CG_ACRE_NONDISCLOSE: i64 = 48001
50// asking prices chosen RELATIVE to the fixture band of 1000..9000 per acre
51const CG_ASK_TYPICAL: i64 = 5000             // sits inside the recorded band
52const CG_ASK_ABSURD: i64 = 500000            // far above the recorded ceiling
53const CG_BAND_MEDIAN: i64 = 5000             // the median the fixture band must produce
54const CG_BAND_TOP: i64 = 9000                // the highest recorded per-acre sale in the fixture
55const CG_MEAN_DRAG_FLOOR: i64 = 180000       // the mean must exceed this once the outliers are added
56const CG_CAP_TINY: i64 = 3
57const CG_STATE_LEN: i64 = 2                  // a USPS state code is two letters
58const CG_PCTL_LO: i64 = 100                  // band floor, as a permil percentile of recorded sales
59const CG_PCTL_HI: i64 = 900                  // band ceiling, likewise
60const CG_SAMPLE_CAP: i64 = 64                // comparables the fixture may hold
61const CG_MIN_SALES: i64 = 5                  // declared minimum comparables for a usable band
62const CG_MIN_SALES_UNREACHABLE: i64 = 50     // a minimum this fixture deliberately cannot meet
63const CG_ACRE_ONE: i64 = 1000                // milli-acres in one acre
64const CG_ASK_CHEAP: i64 = 100                // an asking price far BELOW the recorded floor
65const CG_GRID: i64 = 16
66const CG_PIX: i64 = 256
67
68func cg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
69
70func cg_write_file(path: *u8, body: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, CG_MODE_644)
  if fd < 0 { return 0 }
  sys_write(fd, body, cg_len(body))
  sys_close(fd)
  return 1
76}
77
78// count non-overlapping occurrences of lit in buf[0..n).
79func cg_count(buf: *u8, n: i64, lit: *u8) -> i64 {
  let m: i64 = cg_len(lit)
  if m <= 0 { return 0 }
  var c: i64 = 0
  var i: i64 = 0
  while i + m <= n {
      var k: i64 = 0
      var same: i64 = 1
      while k < m {
          if buf[i + k] != lit[k] { same = 0; k = m } else { k = k + 1 }
      }
      if same == 1 { c = c + 1; i = i + m } else { i = i + 1 }
  }
  return c
93}
94
95// admit one row given as a NUL-terminated literal -- the whole CM1 surface with no file anywhere.
96func cg_admit_lit(row: *u8, f: *i64) -> i64 {
  return cm_layer_admit(row, 0, cg_len(row), f)
98}
99
100func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_civicmap_gate -- the civic map's admission door, county join and abstention contract" as *u8)
103
  let f: *i64 = sys_mmap(CG_SCRATCH) as *i64
105
  // ---- CM1: the refusing door. -------------------------------------------------------------------
  // THE POSITIVE CONTROL FIRST. Without it a guard that refused every row on earth would score a
  // perfect run on the seven teeth below it.
  let good: *u8 = "layer|nbi|National Bridge Inventory|https://www.fhwa.dot.gov/bridge/nbi/ascii2025.cfm|US Government work|bridge point|annual|knowledge/fetched/cmp_civicmap_nbi.html" as *u8
  let v_good: i64 = cg_admit_lit(good, f)
  gv_check("neg-control-positive-a-complete-row-IS-admitted (a door that refuses everything passes every deny test)" as *u8, v_good == CM_ADMIT, ctr)
112
  let no_lic: *u8 = "layer|x|T|https://example.gov/d|-|county|annual|knowledge/fetched/m.html" as *u8
  gv_check("T2 a row with no licence is refused BY THE LICENCE RULE" as *u8, cg_admit_lit(no_lic, f) == CM_REF_LICENCE, ctr)
115
  let unk_lic: *u8 = "layer|x|T|https://example.gov/d|UNKNOWN|county|annual|knowledge/fetched/m.html" as *u8
  gv_check("T3 licence UNKNOWN is refused BY THE LICENCE RULE (a placeholder is not a licence)" as *u8, cg_admit_lit(unk_lic, f) == CM_REF_LICENCE, ctr)
118
  let no_mir: *u8 = "layer|x|T|https://example.gov/d|CC0|county|annual|-" as *u8
  gv_check("T4 a row with no evidence mirror is refused BY THE MIRROR RULE" as *u8, cg_admit_lit(no_mir, f) == CM_REF_MIRROR, ctr)
121
  let short: *u8 = "layer|x|T|https://example.gov/d|CC0" as *u8
  gv_check("T5 a short row is refused BY THE SHAPE RULE" as *u8, cg_admit_lit(short, f) == CM_REF_FIELDS, ctr)
124
  let bad_url: *u8 = "layer|x|T|ftp://example.gov/d|CC0|county|annual|knowledge/fetched/m.html" as *u8
  gv_check("T6 a non-http source is refused BY THE URL RULE" as *u8, cg_admit_lit(bad_url, f) == CM_REF_URL, ctr)
127
  let no_res: *u8 = "layer|x|T|https://example.gov/d|CC0| |annual|knowledge/fetched/m.html" as *u8
  gv_check("T7 a row with no declared resolution is refused BY THE RESOLUTION RULE" as *u8, cg_admit_lit(no_res, f) == CM_REF_RES, ctr)
130
  let no_cad: *u8 = "layer|x|T|https://example.gov/d|CC0|county|-|knowledge/fetched/m.html" as *u8
  gv_check("T8 a row with no declared cadence is refused BY THE CADENCE RULE" as *u8, cg_admit_lit(no_cad, f) == CM_REF_CADENCE, ctr)
133
  // EVERY RULE MUST BE INDIVIDUALLY REACHABLE. Eight rows, eight distinct verdicts: if two rules
  // collapsed onto one code the refusals would still all "pass" above while naming the wrong cause.
  var distinct: i64 = 1
  if cm_layer_admit(no_lic, 0, cg_len(no_lic), f) == cm_layer_admit(no_mir, 0, cg_len(no_mir), f) { distinct = 0 }
  if cm_layer_admit(no_res, 0, cg_len(no_res), f) == cm_layer_admit(no_cad, 0, cg_len(no_cad), f) { distinct = 0 }
  if cm_layer_admit(short, 0, cg_len(short), f) == cm_layer_admit(bad_url, 0, cg_len(bad_url), f) { distinct = 0 }
  gv_check("T9 the refusal rules are DISTINGUISHABLE from each other (a shared code would name the wrong cause)" as *u8, distinct == 1, ctr)
141
  // BITE: the licence rule must FIRE on the unlicensed row and stay SILENT on the licensed one.
  var lic_bad: i64 = 0
  if cg_admit_lit(no_lic, f) == CM_REF_LICENCE { lic_bad = 1 }
  var lic_good: i64 = 0
  if cg_admit_lit(good, f) == CM_REF_LICENCE { lic_good = 1 }
  gv_bite("neg-control-licence-rule-bite" as *u8, lic_bad, lic_good, ctr)
148
  // ---- fixtures for CM2/CM3. Written under /tmp so no production plane can be touched. -----------
  sys_mkdir(CG_DIR, CG_MODE_755)
  // two disjoint square counties in microdegrees: 10001 spans lat 40.0-41.0 lon -75.0--74.0,
  // 10002 spans lat 40.0-41.0 lon -73.0--72.0. Synthetic GEOMETRY, and labelled as such: these are
  // not real county boundaries and this gate makes no claim that they are.
  let cbody: *u8 = "county|10001|Fixture West|XX|40000000,-75000000 41000000,-75000000 41000000,-74000000 40000000,-74000000\ncounty|10002|Fixture East|XX|40000000,-73000000 41000000,-73000000 41000000,-72000000 40000000,-72000000\n" as *u8
  let wrote: i64 = cg_write_file(CG_COUNTIES, cbody)
  if gv_need("the gate can write its own /tmp fixture" as *u8, wrote, ctr) == 1 {
157
      let ctx: *i64 = sys_mmap(CM_CTX_BYTES) as *i64
      let nc: i64 = cm_load_counties(CG_COUNTIES, ctx)
      // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME. A join tooth over
      // zero loaded counties passes for the wrong reason and reads exactly like a working join.
      gv_check("T10 the fixture actually loaded TWO counties (a join over an empty base proves nothing)" as *u8, nc == 2, ctr)
      gv_subjects("counties loaded" as *u8, nc, ctr)
164
      // ---- REGRESSION FOR A BUG THIS ORGAN SHIPPED WITH ------------------------------------------
      // The first loader carried a guessed 4096-vertex ceiling and dropped any county that did not
      // fit SILENTLY, through nested ifs whose every failing branch just skipped the row. Against a
      // real national bank that would have discarded most of the country while the map still
      // rendered and still looked correct. The caps are now DERIVED from the input so overflow is
      // impossible by construction, and every drop is counted under its OWN reason. These teeth are
      // the proof, and the dirty fixture below is the shape that used to vanish without trace.
      gv_check("T10b the clean fixture drops NOTHING and its partition sums" as *u8, cm_load_report(1, ctx) == 1, ctr)
      var clean_drops: i64 = ctx[CM_CTX_D_SHAPE] + ctx[CM_CTX_D_FIPS] + ctx[CM_CTX_D_RING] + ctx[CM_CTX_D_SHORT] + ctx[CM_CTX_D_CAP]
      gv_check("T10c the clean fixture reports ZERO drops of every named reason" as *u8, clean_drops == 0, ctr)
175
      let dirty: *u8 = "county|10001|Good|XX|40000000,-75000000 41000000,-75000000 41000000,-74000000 40000000,-74000000\ncounty|10002|Too few fields\ncounty|BADFIPS|Unparseable key|XX|40000000,-75000000 41000000,-75000000 41000000,-74000000\ncounty|10004|Degenerate ring|XX|40000000,-75000000 41000000,-75000000\n" as *u8
      if gv_need("the gate can write its dirty fixture" as *u8, cg_write_file(CG_DIRTY, dirty), ctr) == 1 {
          let dctx: *i64 = sys_mmap(CM_CTX_BYTES) as *i64
          let dn: i64 = cm_load_counties(CG_DIRTY, dctx)
          gv_check("T10d the dirty fixture SAW four county rows (the denominator is the rows offered, not the rows kept)" as *u8, dctx[CM_CTX_SEEN] == 4, ctr)
          gv_check("T10e exactly the ONE well-formed county loaded" as *u8, dn == 1, ctr)
          gv_check("T10f the malformed row is counted under SHAPE" as *u8, dctx[CM_CTX_D_SHAPE] == 1, ctr)
          gv_check("T10g the unparseable key is counted under FIPS, not folded into shape" as *u8, dctx[CM_CTX_D_FIPS] == 1, ctr)
          gv_check("T10h the degenerate ring is counted under RING-SHORT (three reasons, three buckets, three remedies)" as *u8, dctx[CM_CTX_D_SHORT] == 1, ctr)
          gv_check("T10i no capacity drop can occur now that the caps are DERIVED from the input" as *u8, dctx[CM_CTX_D_CAP] == 0, ctr)
          gv_check("T10j the dirty partition SUMS: seen == loaded + every named reason" as *u8, cm_load_report(1, dctx) == 1, ctr)
          // BITE: the drop accounting must FIRE on the dirty fixture and stay SILENT on the clean one.
          // Without this the teeth above could be satisfied by a counter that is simply always zero.
          var dirty_fires: i64 = 0
          if dctx[CM_CTX_D_SHAPE] + dctx[CM_CTX_D_FIPS] + dctx[CM_CTX_D_SHORT] > 0 { dirty_fires = 1 }
          var clean_fires: i64 = 0
          if clean_drops > 0 { clean_fires = 1 }
          gv_bite("neg-control-drop-accounting-bite (a silently dropped county is the bug this replaced)" as *u8, dirty_fires, clean_fires, ctr)
      }
195
      if nc == 2 {
          let pool: *i64 = ctx[0] as *i64
          let off: *i64 = ctx[1] as *i64
          let cnt: *i64 = ctx[2] as *i64
          let fips: *i64 = ctx[3] as *i64
201
          // CM2: a point inside the WEST square, a point inside the EAST square, a point in neither.
          let pts: *i64 = sys_mmap(8 * 6) as *i64
          pts[0] = CG_PROBE_LAT
          pts[1] = 0 - CG_PROBE_LON_WEST
          pts[2] = CG_PROBE_LAT
          pts[3] = 0 - CG_PROBE_LON_EAST
          pts[4] = CG_PROBE_LAT
          pts[5] = 0 - CG_PROBE_LON_NOWHERE
          let outf: *i64 = sys_mmap(8 * 3) as *i64
          let hit: i64 = cm_fips_join(pts, 3, pool, off, cnt, 2, fips, outf)
          gv_check("T11 a point inside the west county joins to ITS OWN fips" as *u8, outf[0] == CG_FIPS_WEST, ctr)
          gv_check("T12 a point inside the east county joins to the OTHER fips (the join DISCRIMINATES, it does not just answer)" as *u8, outf[1] == CG_FIPS_EAST, ctr)
          gv_check("neg-control-point-outside-every-county-is-NOT-assigned (an unjoined point is outside coverage, never a zero)" as *u8, outf[2] == (0 - 1), ctr)
          gv_check("T13 the join reports exactly the number of points that landed" as *u8, hit == 2, ctr)
216
          // BITE the join: it must FIRE (assign) inside and stay SILENT (refuse) outside.
          var j_in: i64 = 0
          if outf[0] == CG_FIPS_WEST { j_in = 1 }
          var j_out: i64 = 0
          if outf[2] >= 0 { j_out = 1 }
          gv_bite("neg-control-join-bite" as *u8, j_in, j_out, ctr)
223
          // AN INDEPENDENT SECOND METHOD ON THE SAME QUESTION. geo_raster_fill decides coverage by
          // integer scanline crossings; geo_pip_off decides it by an integer ray cast. They share no
          // code path, so agreeing on the same square is triangulation rather than one ruler twice.
          let sq: *i64 = sys_mmap(8 * 8) as *i64
          sq[0] = 2
          sq[1] = 2
          sq[2] = 12
          sq[3] = 2
          sq[4] = 12
          sq[5] = 12
          sq[6] = 2
          sq[7] = 12
          let grid: *u8 = sys_mmap(CG_PIX)
          let filled: i64 = geo_raster_fill(sq, 4, CG_GRID, CG_GRID, grid)
          gv_check("T14 the raster oracle fills a real area for a real polygon (an empty raster would make every coverage claim vacuous)" as *u8, filled > 0, ctr)
          var agree: i64 = 0
          if geo_raster_get(grid, CG_GRID, 7, 7) == 1 {
              if geo_pip_off(sq, 0, 4, 7, 7) == 1 { agree = 1 }
          }
          gv_check("T15 raster fill and the ray-cast predicate AGREE that an interior point is inside (two independent methods, one answer)" as *u8, agree == 1, ctr)
          var agree_out: i64 = 0
          if geo_raster_get(grid, CG_GRID, 15, 15) == 0 {
              if geo_pip_off(sq, 0, 4, 15, 15) == 0 { agree_out = 1 }
          }
          gv_check("neg-control-both-methods-agree-an-exterior-point-is-OUTSIDE" as *u8, agree_out == 1, ctr)
249
          // ---- CM3: the abstention contract, which is the whole thesis of this domain. -----------
          // West = a real observation. East = SUPPRESSED. Both are drawn; only one may carry a value.
          let val: *i64 = sys_mmap(8 * 4) as *i64
          let st: *i64 = sys_mmap(8 * 4) as *i64
          val[0] = 42
          st[0] = CM_V_PRESENT
          val[1] = 0
          st[1] = CM_V_SUPPRESSED
          let pj: *i64 = sys_mmap(8 * 8) as *i64
          pj[0] = 0 - 75000000
          pj[1] = 41000000
          pj[2] = 3000000
          pj[3] = 1000000
          pj[4] = 600
          pj[5] = 300
          pj[6] = 0
          pj[7] = 100
          let empty: *u8 = "" as *u8
          let drawn: i64 = cm_choropleth_emit(CG_OUT, pool, off, cnt, fips, val, st, 2, pj, "Gate Fixture Map" as *u8, empty, 0)
          gv_check("T16 the emitter drew EVERY loaded county (a county silently dropped from a map is a coverage lie)" as *u8, drawn == 2, ctr)
270
          let ln: *i64 = sys_mmap(8) as *i64
          let page: *u8 = sys_read_file(CG_OUT, ln)
          let pn: i64 = ln[0]
          gv_check("T17 the emitted page is readable and non-empty" as *u8, pn > 0, ctr)
275
          let n_val: i64 = cg_count(page, pn, "data-value=" as *u8)
          let n_unobs: i64 = cg_count(page, pn, "data-state='UNOBSERVABLE'" as *u8)
          let n_pres: i64 = cg_count(page, pn, "data-state='PRESENT'" as *u8)
          let n_supp: i64 = cg_count(page, pn, "suppressed-small-count" as *u8)
280
          // ★★★ THE LOAD-BEARING TOOTH. Not "did it render" but "does the number of painted values
          // EQUAL the number of things actually measured". A build that painted the suppressed county
          // with the bottom bucket renders a perfectly good-looking map and fails exactly here.
          gv_check("T18 data-value appears EXACTLY once per PRESENT county -- never for a suppressed one" as *u8, n_val == 1, ctr)
          gv_check("T19 the suppressed county rendered as UNOBSERVABLE" as *u8, n_unobs == 1, ctr)
          gv_check("T20 the measured county rendered as PRESENT" as *u8, n_pres == 1, ctr)
          gv_check("T21 the UNOBSERVABLE cell NAMES its reason (suppressed is a different remedy from unmeasured)" as *u8, n_supp == 1, ctr)
          gv_check("T22 the state partition SUMS to the counties drawn" as *u8, n_pres + n_unobs == drawn, ctr)
289
          // BITE the abstention checker itself: it must fire on a body that paints a value onto an
          // unobservable cell, and stay silent on the honest body we just emitted. Without this the
          // counting teeth above could be satisfied by a checker that cannot see the defect at all.
          let bad_body: *u8 = "<path data-state='UNOBSERVABLE' data-value='7'/><path data-state='PRESENT' data-value='42'/>" as *u8
          var bad_fires: i64 = 0
          if cg_count(bad_body, cg_len(bad_body), "data-value=" as *u8) != cg_count(bad_body, cg_len(bad_body), "data-state='PRESENT'" as *u8) { bad_fires = 1 }
          var good_fires: i64 = 0
          if n_val != n_pres { good_fires = 1 }
          gv_bite("neg-control-abstention-checker-bite (fires when a value is painted on an unobservable cell)" as *u8, bad_fires, good_fires, ctr)
299
          // the page must carry its own coverage, so a reader never sees a figure without its denominator.
          gv_check("T23 the page publishes its coverage table beside the map" as *u8, cg_count(page, pn, "UNOBSERVABLE" as *u8) > 0, ctr)
          gv_check("T24 the page states the scope it does NOT claim" as *u8, cg_count(page, pn, "claims no coverage beyond them" as *u8) == 1, ctr)
          gv_check("neg-control-no-third-party-map-library-is-referenced" as *u8, cg_count(page, pn, "leaflet" as *u8) + cg_count(page, pn, "mapbox.js" as *u8) + cg_count(page, pn, "maps.googleapis" as *u8) == 0, ctr)
304
      // ---- CM11: the composite index that always carries its denominator -------------------------
      // Three axes DECLARED. County 20001 is observed on all three; 20002 on ONE; 20003 on none.
      // 'crash' is declared lower-is-better, so a raw 1000 there is the WORST possible reading and must
      // contribute 0 -- that is the tooth that catches a hardcoded bigger-is-better.
      let axes: *u8 = "axis|jobs|Jobs per capita|higher|1\naxis|crash|Fatal crashes|lower|1\naxis|water|Drinking water compliance|higher|1\n" as *u8
      let obs: *u8 = "obs|20001|jobs|1000\nobs|20001|crash|0\nobs|20001|water|1000\nobs|20002|jobs|1000\n" as *u8
      let an: i64 = cg_len(axes)
      let on: i64 = cg_len(obs)
      let ix: *i64 = sys_mmap(CM_IX_BYTES) as *i64
314
      let m1: i64 = cm_qol_index(axes, an, obs, on, CG_QOL_FULL, f, ix)
      cm_index_print(1, CG_QOL_FULL, ix)
      gv_check("T25 a fully observed county is MEASURED on every declared axis" as *u8, m1 == 1, ctr)
      gv_check("T26 its denominator says so: observed == declared" as *u8, ix[CM_IX_OBSERVED] == 3, ctr)
      // jobs 1000 (higher) -> 1000, crash 0 (lower) -> 1000, water 1000 (higher) -> 1000. Mean = 1000.
      gv_check("T27 a county at the good end of EVERY axis scores 1000 -- including the lower-is-better one, which would score 0 if direction were ignored" as *u8, ix[CM_IX_SCORE] == 1000, ctr)
321
      let m2: i64 = cm_qol_index(axes, an, obs, on, CG_QOL_PARTIAL, f, ix)
      cm_index_print(1, CG_QOL_PARTIAL, ix)
      gv_check("T28 a partially observed county is still MEASURED" as *u8, m2 == 1, ctr)
      gv_check("T29 and its denominator EXPOSES the partiality: observed=1 of declared=3" as *u8, ix[CM_IX_OBSERVED] == 1, ctr)
      // ★ THE LOAD-BEARING TOOTH. One axis observed at 1000, two axes absent. If the absent axes were
      // imputed as zero -- the ordinary, invisible way to build a composite index -- this county would
      // score 1000/3 = 333 and be ranked as poor when nothing about it was ever measured as poor.
      // Dropping them from the denominator instead gives 1000. The two implementations render the same
      // map and disagree only here.
      gv_check("T30 an UNMEASURED axis is DROPPED from the denominator, never imputed as zero (333 would mean imputation)" as *u8, ix[CM_IX_SCORE] == 1000, ctr)
      gv_check("T31 the declared count is unchanged by absence -- the instrument is still 3 axes wide" as *u8, ix[CM_IX_DECLARED] == 3, ctr)
333
      let m3: i64 = cm_qol_index(axes, an, obs, on, CG_QOL_NONE, f, ix)
      cm_index_print(1, CG_QOL_NONE, ix)
      gv_check("neg-control-a-county-observed-on-NOTHING-is-UNOBSERVABLE-not-zero" as *u8, m3 == 0, ctr)
      gv_check("T32 an unobservable county carries NO score to be mistaken for a low rank" as *u8, ix[CM_IX_MEASURED] == 0, ctr)
338
      // BITE the direction rule: an inverted reading must move the score, and the correct one must not.
      // Without this, cm_orient could ignore `dir` entirely and every tooth above still passes except T27.
      let obs_bad: *u8 = "obs|20004|crash|1000\n" as *u8
      let obs_good: *u8 = "obs|20004|crash|0\n" as *u8
      cm_qol_index(axes, an, obs_bad, cg_len(obs_bad), CG_QOL_DIRPROBE, f, ix)
      let s_bad: i64 = ix[CM_IX_SCORE]
      cm_qol_index(axes, an, obs_good, cg_len(obs_good), CG_QOL_DIRPROBE, f, ix)
      let s_good: i64 = ix[CM_IX_SCORE]
      var dir_fires: i64 = 0
      if s_bad == 0 { dir_fires = 1 }
      var dir_quiet: i64 = 0
      if s_good != 1000 { dir_quiet = 1 }
      gv_bite("neg-control-lower-is-better-direction-bite (the worst reading scores 0, the best scores 1000)" as *u8, dir_fires, dir_quiet, ctr)
352
      // TWO COUNTIES, IDENTICAL SCORES, DIFFERENT DENOMINATORS -- and they must be distinguishable.
      // A ranking built on the score alone would tie them; the whole point of this index is that the
      // reader can see one of them was barely measured.
      cm_qol_index(axes, an, obs, on, CG_QOL_FULL, f, ix)
      let d1: i64 = ix[CM_IX_OBSERVED]
      let sc1: i64 = ix[CM_IX_SCORE]
      cm_qol_index(axes, an, obs, on, CG_QOL_PARTIAL, f, ix)
      var tie_same_score: i64 = 0
      if sc1 == ix[CM_IX_SCORE] { tie_same_score = 1 }
      var denom_differs: i64 = 0
      if d1 != ix[CM_IX_OBSERVED] { denom_differs = 1 }
      gv_check("T33 two counties tie on score yet REMAIN DISTINGUISHABLE by their denominators (a bare rank would hide this)" as *u8, tie_same_score + denom_differs == 2, ctr)
365
      // ---- CM15: the dollars-per-acre ruler -------------------------------------------------------
      // County 30001 sits in NY (prices ARE public record); county 48001 sits in TX (they are NOT).
      // Nine recorded sales in 30001 at a clean 1000..9000 per acre. Band declared as the 10th and 90th
      // percentile with a minimum of 5 comparables -- DECLARED, so the numbers that decide a flag can
      // be pointed at rather than found buried in this file.
      let sales: *u8 = "sale|30001|1000|1000\nsale|30001|2000|1000\nsale|30001|3000|1000\nsale|30001|4000|1000\nsale|30001|5000|1000\nsale|30001|6000|1000\nsale|30001|7000|1000\nsale|30001|8000|1000\nsale|30001|9000|1000\nsale|48001|7000|1000\nsale|48001|8000|1000\nsale|48001|9000|1000\nsale|48001|1000|1000\nsale|48001|2000|1000\nsale|48001|3000|1000\n" as *u8
      let ndl: *u8 = "nd|AK\nnd|ID\nnd|KS\nnd|LA\nnd|MS\nnd|MT\nnd|NM\nnd|TX\nnd|UT\nnd|WY\n" as *u8
      let sn: i64 = cg_len(sales)
      let nn: i64 = cg_len(ndl)
      let samp: *i64 = sys_mmap(8 * CG_SAMPLE_CAP) as *i64
      let at: *i64 = sys_mmap(CM_AT_BYTES) as *i64
      let ny: *u8 = "NY" as *u8
      let tx: *u8 = "TX" as *u8
379
      let v_in: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_TYPICAL, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_SAMPLE_CAP, at)
      cm_acre_print(1, v_in, at)
      gv_check("T34 a listing priced inside the recorded band reads INSIDE" as *u8, v_in == CM_AT_INSIDE, ctr)
      gv_check("T35 the band came from the NINE recorded sales in that county, not from all fifteen rows" as *u8, at[CM_AT_N] == 9, ctr)
      gv_check("T36 the median of 1000..9000 is 5000 -- the ruler's centre is the recorded middle" as *u8, at[CM_AT_MED] == CG_BAND_MEDIAN, ctr)
385
      let v_hi: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_ABSURD, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_SAMPLE_CAP, at)
      cm_acre_print(1, v_hi, at)
      gv_check("T37 a listing at 500000 per acre against a 9000 ceiling reads ABOVE-RECORDED-BAND" as *u8, v_hi == CM_AT_ABOVE, ctr)
      gv_check("T38 and it PUBLISHES its grounds -- the asking figure, the band and n -- so the flag is a measurement, not an accusation" as *u8, at[CM_AT_PA] == CG_ASK_ABSURD, ctr)
390
      let v_lo: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_CHEAP, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_SAMPLE_CAP, at)
      gv_check("T39 an implausibly CHEAP listing is flagged too (a bargain is as much a signal as a markup)" as *u8, v_lo == CM_AT_BELOW, ctr)
393
      // ★ THE LOAD-BEARING TOOTH. County 48001 HAS six recorded sales in the fixture -- enough to build
      // a band -- and sits in a non-disclosure state. The ruler must refuse ANYWAY. If the law check ran
      // after the arithmetic, or not at all, this would happily return a verdict computed from data that
      // in reality does not exist. THE LAW HAS TO WIN OVER THE AVAILABLE ARITHMETIC.
      let v_nd: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_NONDISCLOSE, tx, CG_STATE_LEN, CG_ASK_ABSURD, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_SAMPLE_CAP, at)
      cm_acre_print(1, v_nd, at)
      gv_check("T40 a non-disclosure state returns UNPROVABLE even though comparables are present in the input" as *u8, v_nd == CM_AT_ND, ctr)
      gv_check("T41 and it computes NO band there -- nothing to be mistaken for a finding" as *u8, at[CM_AT_MED] == (0 - 1), ctr)
402
      // THIN is a DIFFERENT refusal from ND, because one is fixable by gathering data and one never is.
      let v_thin: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_TYPICAL, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES_UNREACHABLE, f, samp, CG_SAMPLE_CAP, at)
      gv_check("T42 a comparable set below the declared minimum reads UNPROVABLE-THIN, never INSIDE" as *u8, v_thin == CM_AT_THIN, ctr)
      gv_check("T43 THIN and NON-DISCLOSURE are DISTINGUISHABLE verdicts (one is fixable by more data, the other never is)" as *u8, CM_AT_THIN != CM_AT_ND, ctr)
407
      let v_bad: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_TYPICAL, 0, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_SAMPLE_CAP, at)
      gv_check("neg-control-zero-acreage-is-REFUSED-not-fabricated (treating 0 acres as 1 would invent the very number under test)" as *u8, v_bad == CM_AT_BADINPUT, ctr)
410
      // ★★ THE ANTI-GAMING PROPERTY, PROVEN NUMERICALLY RATHER THAN ASSERTED IN A COMMENT.
      // Two absurd sales are added to the same county. The MEDIAN barely moves and stays inside the
      // original recorded range; the MEAN is dragged more than twenty times outside it. That difference
      // IS the reason this ruler uses a median: a minority of extreme values cannot move the reference,
      // so the band cannot be walked upward by whoever posts the most extreme numbers.
      let salesx: *u8 = "sale|30001|1000|1000\nsale|30001|2000|1000\nsale|30001|3000|1000\nsale|30001|4000|1000\nsale|30001|5000|1000\nsale|30001|6000|1000\nsale|30001|7000|1000\nsale|30001|8000|1000\nsale|30001|9000|1000\nsale|30001|1000000|1000\nsale|30001|1000000|1000\n" as *u8
      let dropx: *i64 = sys_mmap(16) as *i64
      let nx2: i64 = cm_acre_samples(salesx, cg_len(salesx), CG_ACRE_DISCLOSE, f, samp, CG_SAMPLE_CAP, dropx)
      let med_x: i64 = cm_pctl(samp, nx2, CM_PERMIL / 2)
      var sum_x: i64 = 0
      var k2: i64 = 0
      while k2 < nx2 { sum_x = sum_x + samp[k2]; k2 = k2 + 1 }
      var mean_x: i64 = 0
      if nx2 > 0 { mean_x = sum_x / nx2 }
      cm_w(1, "  outlier probe: n=" as *u8)
      cm_n(1, nx2)
      cm_w(1, " median=" as *u8)
      cm_n(1, med_x)
      cm_w(1, " mean=" as *u8)
      cm_n(1, mean_x)
      cm_w(1, "\n" as *u8)
      gv_check("T44 the fixture actually reached the condition: eleven samples including the two outliers" as *u8, nx2 == 11, ctr)
      gv_check("T45 two absurd sales leave the MEDIAN inside the original recorded range" as *u8, med_x <= CG_BAND_TOP, ctr)
      gv_check("T46 the same two sales drag the MEAN more than twentyfold outside it -- which is why this ruler is a median" as *u8, mean_x > CG_MEAN_DRAG_FLOOR, ctr)
435
      // BITE the non-disclosure rule: it must FIRE for a listed state and stay SILENT for one that is not.
      var nd_fires: i64 = 0
      if cm_is_nondisclosure(ndl, nn, tx, CG_STATE_LEN) == 1 { nd_fires = 1 }
      var nd_quiet: i64 = 0
      if cm_is_nondisclosure(ndl, nn, ny, CG_STATE_LEN) == 1 { nd_quiet = 1 }
      gv_bite("neg-control-non-disclosure-rule-bite (fires for TX, silent for NY)" as *u8, nd_fires, nd_quiet, ctr)
442
      // ---- REGRESSIONS FOR THREE DEFECTS AN ADVERSARIAL AUDIT CONFIRMED 2026-08-28 ---------------
      // All three are the SAME family as the silent-cap bug already fixed in the county loader: an
      // input that was offered, discarded, and never counted -- with the discard then rendering as a
      // positive claim about the world. That family keeps reappearing, so each fix gets a tooth.
      //
      // (a) AN UNRECOGNISED AXIS DIRECTION MUST REFUSE, NOT DEFAULT. A lower-is-better axis written
      // any way but exactly "lower" used to fall through to higher-is-better and score BACKWARDS for
      // every county, with no diagnostic anywhere.
      let axes_bad: *u8 = "axis|jobs|Jobs|higher|1\naxis|crash|Crashes|Lower|1\naxis|water|Water|higher|1\n" as *u8
      let obs_b: *u8 = "obs|20001|jobs|1000\nobs|20001|crash|1000\nobs|20001|water|1000\n" as *u8
      cm_qol_index(axes_bad, cg_len(axes_bad), obs_b, cg_len(obs_b), CG_QOL_FULL, f, ix)
      cm_index_print(1, CG_QOL_FULL, ix)
      gv_check("T47 an axis whose direction is not exactly higher or lower is REFUSED and counted, never defaulted" as *u8, ix[CM_IX_BADAXIS] == 1, ctr)
      gv_check("T48 the refused axis is DROPPED from declared, so it cannot silently widen a denominator" as *u8, ix[CM_IX_DECLARED] == 2, ctr)
      gv_check("T49 and it contributes NOTHING -- a mis-spelled lower-is-better axis cannot score backwards" as *u8, ix[CM_IX_OBSERVED] == 2, ctr)
      var badaxis_fires: i64 = 0
      if ix[CM_IX_BADAXIS] > 0 { badaxis_fires = 1 }
      cm_qol_index(axes, an, obs, on, CG_QOL_FULL, f, ix)
      var badaxis_quiet: i64 = 0
      if ix[CM_IX_BADAXIS] > 0 { badaxis_quiet = 1 }
      gv_bite("neg-control-unknown-direction-bite (fires on a mis-cased direction, silent on the clean spec)" as *u8, badaxis_fires, badaxis_quiet, ctr)
464
      // (b) A COMPARABLE SET THAT HIT ITS CAP MUST REFUSE TO PUBLISH A BAND. What it retained is a
      // PREFIX of the sales file, and an export sorted by price or date makes that prefix biased in a
      // KNOWN direction -- which would flag honest listings systematically and look authoritative.
      let at2: *i64 = sys_mmap(CM_AT_BYTES) as *i64
      let v_trunc: i64 = cm_acre_truth(sales, sn, ndl, nn, CG_ACRE_DISCLOSE, ny, CG_STATE_LEN, CG_ASK_TYPICAL, CG_ACRE_ONE, CG_PCTL_LO, CG_PCTL_HI, CG_MIN_SALES, f, samp, CG_CAP_TINY, at2)
      cm_acre_print(1, v_trunc, at2)
      gv_check("T50 a comparable set that hit its cap REFUSES rather than publishing a band from a biased prefix" as *u8, v_trunc == CM_AT_TRUNC, ctr)
      gv_check("T51 and the drop is COUNTED, so a truncated sample can never be mistaken for a small county" as *u8, at2[CM_AT_DROP_CAP] > 0, ctr)
      gv_check("T52 TRUNCATED is a DIFFERENT verdict from THIN -- three refusals now, three different remedies" as *u8, CM_AT_TRUNC != CM_AT_THIN, ctr)
474
      // a sale with no stated acreage is unpriceable per acre; it must be COUNTED, not vanish
      let sales_noacre: *u8 = "sale|30001|1000|1000\nsale|30001|2000|0\nsale|30001|3000|1000\nsale|30001|4000|1000\nsale|30001|5000|1000\nsale|30001|6000|1000\n" as *u8
      let dropy: *i64 = sys_mmap(16) as *i64
      let n_noacre: i64 = cm_acre_samples(sales_noacre, cg_len(sales_noacre), CG_ACRE_DISCLOSE, f, samp, CG_SAMPLE_CAP, dropy)
      gv_check("T53 a sale with no stated acreage is COUNTED as dropped, never silently discarded" as *u8, dropy[0] == 1, ctr)
      gv_check("T54 and the surviving comparables are exactly the priceable ones" as *u8, n_noacre == 5, ctr)
481
      // (c) AN OBSERVATION THAT WAS OFFERED AND COULD NOT BE READ IS NOT 'NOBODY MEASURED THIS'.
      // Rendering it as no-observation publishes a FALSE named reason on the one page whose entire
      // thesis is that an unobservable cell names a TRUE one.
      gv_check("T55 a rejected observation has its OWN state, distinct from never-observed" as *u8, CM_V_REJECTED != CM_V_ABSENT, ctr)
      var rej_named: i64 = 0
      if cg_count(cm_state_reason(CM_V_REJECTED), cg_len(cm_state_reason(CM_V_REJECTED)), "unreadable" as *u8) == 1 { rej_named = 1 }
      var abs_named: i64 = 0
      if cg_count(cm_state_reason(CM_V_ABSENT), cg_len(cm_state_reason(CM_V_ABSENT)), "no-observation" as *u8) == 1 { abs_named = 1 }
      gv_check("T56 and it says so in its own words rather than borrowing the never-measured reason" as *u8, rej_named + abs_named == 2, ctr)
491
492
493
      }
  }
496
  let rc: i64 = gv_verdict("CIVICMAP-GATE" as *u8, ctr, "admission refuses by NAMED rule, the join discriminates and abstains, and an unobservable cell can never be read as a number" as *u8)
  sys_exit(rc)
  return rc
500}
nx_civicmap_gate.nx source

`nx_civicmap_gate.nx` source
