code wiki / (root) / nx_content_put_gate.nx
`nx_content_put_gate.nx` source

↩ module page · 930 lines · 47484 B
1// nx_content_put_gate.nx -- THE GATE FOR THE CHUNKED UPLOAD DOOR: a real multi-MB payload round-trips
2// byte-identically, and every refusal the protocol promises actually fires.
3//
4// Subject: the DEPLOYED nx_content_put binary (fork-style e2e; argv[1] overrides the subject path so
5// a bite can point at a staged mutant without touching live). Fixture: REAL corpus bytes -- five
6// concatenations of knowledge/rigcorpus/human.nxmesh (517,832 B each, durable since 2026-08-23), so
7// the sha teeth exercise real entropy, never zeros. Scratch lives in /tmp/nx_content_put_gate/ (the
8// gate-fixture law) and destinations use the organ's /tmp allowlist lane.
9//
10// NOT ROSTER-ADMITTED: this gate forks the subject ~120 times and assembles megabytes -- a
11// multi-second subject (the voxchunk precedent); run it via nx_job_run, never on the 1.8s beat.
12//
13// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
14import "nx_syscalls.nx"
15import "nx_gate_verdict.nx"
16import "nx_base64.nx"
17import "nx_sha256.nx"
18import "nx_cdc_lib.nx"   // DI9: the gate cuts the fixture by the door's published parameters and must agree with `have` chunk for chunk
19
20const G_SUBJECT_DEFAULT: *u8 = "./nx_content_put.elf" as *u8
21const G_CORPUS: *u8 = "knowledge/rigcorpus/human.nxmesh" as *u8
22const G_NCOPIES: i64 = 5
23// "multi-MB" bound: multi means AT LEAST TWO -- derived from the word, stated, not tuned.
24const G_MULTI_MB: i64 = 2097152
25const G_SCRATCH: *u8 = "/tmp/nx_content_put_gate" as *u8
26const G_OUT: *u8 = "/tmp/nx_content_put_gate/out.txt" as *u8
27const G_DEST1: *u8 = "/tmp/nx_content_put_gate/dest1.bin" as *u8
28const G_DEST2: *u8 = "/tmp/nx_content_put_gate/dest2.bin" as *u8
29const G_DEST3: *u8 = "/tmp/nx_content_put_gate/dest3.bin" as *u8
30const G_DEST4: *u8 = "/tmp/nx_content_put_gate/dest4.bin" as *u8
31const G_DEST5: *u8 = "/tmp/nx_content_put_gate/dest5.bin" as *u8
32const G_SHAHEX: i64 = 64
33const G_DIGEST: i64 = 32
34const G_PATHCAP: i64 = 512
35
36func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
37func g_mkdir(path: *u8) -> i64 {
  let nbox: *i64 = sys_mmap(16) as *i64
  nbox[0] = 258
  let rc: i64 = __syscall(nbox[0], 0 - 100, path as i64, 0x1ed, 0, 0, 0)
  sys_munmap(nbox as *u8, 16)
  return rc
43}
44func g_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
45func g_itoa(v: i64, out: *u8) -> i64 {
  var m: i64 = v
  var k: i64 = 0
  if m < 0 { out[0] = 45 as u8; k = 1; m = 0 - m }
  let t: *u8 = sys_mmap(24)
  var d: i64 = 0
  if m == 0 { t[0] = 48 as u8; d = 1 }
  while m > 0 { t[d] = (48 + (m % 10)) as u8; m = m / 10; d = d + 1 }
  var i: i64 = 0
  while i < d { out[k + i] = t[d - 1 - i]; i = i + 1 }
  out[k + d] = 0 as u8
  return k + d
57}
58// substring search: offset of needle in hay (first n bytes), or -1
59func g_find(hay: *u8, n: i64, needle: *u8) -> i64 {
  let m: i64 = g_slen(needle)
  if m == 0 { return 0 - 1 }
  var i: i64 = 0
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if hay[i + j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
71}
72func g_num_after(hay: *u8, n: i64, key: *u8) -> i64 {
  let at: i64 = g_find(hay, n, key)
  if at < 0 { return 0 - 1 }
  var i: i64 = at + g_slen(key)
  var v: i64 = 0
  var seen: i64 = 0
  var neg: i64 = 0
  // a leading '-' is part of the number: before 2026-09-06 this parser read `clone_rc=-95` as NOT-FOUND and
  // returned its own -1 sentinel, which every reader then published as the kernel's answer (EPERM) on three hosts
  if i < n { if hay[i] == (45 as u8) { neg = 1; i = i + 1 } }
  while i < n { if hay[i] >= (48 as u8) { if hay[i] <= (57 as u8) { v = v * 10 + ((hay[i] as i64) - 48); seen = 1; i = i + 1 } else { break } } else { break } }
  if seen == 0 { return 0 - 1 }
  if neg == 1 { return 0 - v }
  return v
86}
87func g_hex_into(d: *u8, out: *u8) -> i64 {
  var i: i64 = 0
  while i < G_DIGEST {
      let v: i64 = d[i] as i64
      let hi: i64 = (v >> 4) & 15
      let lo: i64 = v & 15
      if hi < 10 { out[i * 2] = (48 + hi) as u8 } else { out[i * 2] = (87 + hi) as u8 }
      if lo < 10 { out[i * 2 + 1] = (48 + lo) as u8 } else { out[i * 2 + 1] = (87 + lo) as u8 }
      i = i + 1
  }
  out[G_SHAHEX] = 0 as u8
  return 0
99}
100// fork the subject with up to 4 args, stdout+stderr captured to G_OUT; returns exit code (127 = exec fail)
101func g_run(subject: *u8, a1: *u8, a2: *u8, a3: *u8, a4: *u8, a5: *u8, nargs: i64) -> i64 {
  let arr: *i64 = sys_mmap(64) as *i64
  arr[0] = subject as i64
  if nargs >= 1 { arr[1] = a1 as i64 }
  if nargs >= 2 { arr[2] = a2 as i64 }
  if nargs >= 3 { arr[3] = a3 as i64 }
  if nargs >= 4 { arr[4] = a4 as i64 }
  if nargs >= 5 { arr[5] = a5 as i64 }
  arr[nargs + 1] = 0
  let env: *i64 = sys_mmap(16) as *i64
  env[0] = 0
  let pid: i64 = sys_fork()
  if pid == 0 {
      let fd: i64 = sys_openat_wr(G_OUT, MODE_0644)
      if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) }
      sys_execve(subject, arr, env)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return wait_exit_code(st[0])
122}
123// read the capture; returns buf, len via slot (0-len buffer if absent)
124func g_read_out(lp: *i64) -> *u8 {
  let b: *u8 = sys_read_file(G_OUT, lp)
  if (b as i64) == 0 { lp[0] = 0; return sys_mmap(16) }
  return b
128}
129
130func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_content_put_gate -- a multi-MB payload round-trips byte-identically and every promised refusal fires" as *u8)
  var subject: *u8 = G_SUBJECT_DEFAULT
  if argc >= 2 { subject = argv[1] as *u8 }
  gv_puts("  subject: " as *u8); gv_puts(subject); gv_puts("\n" as *u8)
136
  // SETUP (idempotent: reruns must not inherit a prior run's artifacts -- the gate-idempotency law)
  g_mkdir(G_SCRATCH)
  sys_unlinkat(G_DEST1)
  sys_unlinkat(G_DEST2)
  sys_unlinkat(G_DEST3)
  sys_unlinkat(G_DEST4)
  sys_unlinkat(G_DEST5)
144
  // fixture: real corpus bytes x5
  let lp: *i64 = sys_mmap(16) as *i64
  let one: *u8 = sys_read_file(G_CORPUS, lp)
  if (one as i64) == 0 {
      gv_check("fixture-corpus-readable (knowledge/rigcorpus/human.nxmesh)" as *u8, 0 == 1, ctr)
      return gv_verdict("NX-CONTENT-PUT" as *u8, ctr, "fixture unavailable -- nothing was examined" as *u8)
  }
  let on: i64 = lp[0]
  let total: i64 = on * G_NCOPIES
  let fix: *u8 = sys_mmap(total + 16)
  var c: i64 = 0
  while c < G_NCOPIES {
      var i: i64 = 0
      while i < on { fix[c * on + i] = one[i]; i = i + 1 }
      c = c + 1
  }
  sys_free_file(one, on)
  let fixsha: *u8 = sys_mmap(G_SHAHEX + 8)
  let dg: *u8 = sys_mmap(G_DIGEST + 8)
  sha256_digest(fix, total, dg)
  g_hex_into(dg, fixsha)
  gv_puts("  fixture_bytes=" as *u8); gv_num(total)
  gv_puts(" sha256=" as *u8); gv_puts(fixsha); gv_puts("\n" as *u8)
  gv_check("fixture-reached-multi-mb (multi means at least two, from the word)" as *u8, total >= G_MULTI_MB, ctr)
169
  let tb: *u8 = sys_mmap(64)
171
  // ---- transfer 1: the clean round trip --------------------------------------------------------
  g_itoa(total, tb)
  var rc: i64 = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, 0 as *u8, 4)
  var ob: *u8 = g_read_out(lp)
  var onn: i64 = lp[0]
  let id1: i64 = g_num_after(ob, onn, "id=" as *u8)
  let craw: i64 = g_num_after(ob, onn, "chunk_raw=" as *u8)
  let nch: i64 = g_num_after(ob, onn, "nchunks=" as *u8)
  var nch_expect: i64 = 0
  if craw > 0 { nch_expect = (total + craw - 1) / craw }
  gv_puts("  begin rc=" as *u8); gv_num(rc)
  gv_puts(" id=" as *u8); gv_num(id1)
  gv_puts(" chunk_raw=" as *u8); gv_num(craw)
  gv_puts(" nchunks=" as *u8); gv_num(nch)
  gv_puts("\n" as *u8)
  var t1: i64 = 0
  if rc == 0 { if id1 > 0 { if craw > 0 { if craw < 65536 { if nch == nch_expect { if nch >= 2 { t1 = 1 } } } } } }
  gv_check("begin-receipt-parses-and-chunk-size-derived-below-wire-cap (nchunks independently recomputed)" as *u8, t1 == 1, ctr)
190
  let idb: *u8 = sys_mmap(32)
  g_itoa(id1, idb)
  let ixb: *u8 = sys_mmap(32)
  let b64cap: i64 = (craw / 3 + 2) * 4 + 16
  let bb: *u8 = sys_mmap(b64cap)
  var sent: i64 = 0
  var allok: i64 = 1
  var k: i64 = 0
  while k < nch {
      var cn: i64 = craw
      if k == nch - 1 { cn = total - (nch - 1) * craw }
      let en: i64 = b64_encode(((fix as i64) + k * craw) as *u8, cn, bb)
      bb[en] = 0 as u8
      g_itoa(k, ixb)
      rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
      if rc == 0 { sent = sent + 1 } else { allok = 0 }
      k = k + 1
  }
  gv_puts("  chunks sent=" as *u8); gv_num(sent)
  gv_puts("/" as *u8); gv_num(nch)
  gv_puts("\n" as *u8)
  var t3: i64 = 0
  if allok == 1 { if sent == nch { if nch >= 2 { t3 = 1 } } }
  gv_check("all-chunks-accepted (count bound in condition, empty set cannot pass)" as *u8, t3 == 1, ctr)
  ob = g_read_out(lp)
  onn = lp[0]
  gv_check("chunk-receipt-declares-its-durability-point (durable=at-commit: a staged chunk is not fsynced, commit re-hashes and fsyncs)" as *u8, g_find(ob, onn, "durable=at-commit" as *u8) >= 0, ctr)
218
  // duplicate identical resend of index 0 -> receipted no-op
  let cn0: i64 = craw
  let en0: i64 = b64_encode(fix, cn0, bb)
  bb[en0] = 0 as u8
  g_itoa(0, ixb)
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  var t4: i64 = 0
  if rc == 0 { if g_find(ob, onn, "noop=1" as *u8) >= 0 { t4 = 1 } }
  gv_check("duplicate-identical-chunk-is-receipted-noop (a blind retry cannot double-apply)" as *u8, t4 == 1, ctr)
230
  // CAS: index 0 resent with DIFFERENT bytes -> refused naming the index
  let mut0: *u8 = sys_mmap(craw + 16)
  var mi: i64 = 0
  while mi < cn0 { mut0[mi] = fix[mi]; mi = mi + 1 }
  mut0[0] = (mut0[0] + (1 as u8))
  let enm: i64 = b64_encode(mut0, cn0, bb)
  bb[enm] = 0 as u8
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  var t5: i64 = 0
  if rc == 5 { if g_find(ob, onn, "CHUNK-CAS" as *u8) >= 0 { t5 = 1 } }
  gv_check("neg-control-duplicate-different-chunk-refused-by-cas (fires on bad, silent on good)" as *u8, t5 == 1, ctr)
244
  // commit -> ok, partition printed and summing
  rc = g_run(subject, "commit" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  let recv: i64 = g_num_after(ob, onn, "received=" as *u8)
  var t6: i64 = 0
  if rc == 0 { if recv == nch { if g_find(ob, onn, "CP-COMMIT OK" as *u8) >= 0 { t6 = 1 } } }
  gv_check("commit-ok-and-partition-sums (received equals declared)" as *u8, t6 == 1, ctr)
253
  // independent verify: hash the destination ourselves
  let db2: *u8 = sys_read_file(G_DEST1, lp)
  var t7: i64 = 0
  if (db2 as i64) != 0 {
      let dn2: i64 = lp[0]
      sha256_digest(db2, dn2, dg)
      let dhex: *u8 = sys_mmap(G_SHAHEX + 8)
      g_hex_into(dg, dhex)
      var same: i64 = 1
      var s: i64 = 0
      while s < G_SHAHEX { if dhex[s] != fixsha[s] { same = 0; s = G_SHAHEX } else { s = s + 1 } }
      if dn2 == total { if same == 1 { t7 = 1 } }
      sys_free_file(db2, dn2)
  }
  gv_check("dest-byte-identical-to-fixture (independent re-read and re-hash, not the organ's word)" as *u8, t7 == 1, ctr)
269
  // ---- transfer 2: missing chunk -> commit refuses NAMING the index; status names it too --------
  rc = g_run(subject, "begin" as *u8, G_DEST2, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id2: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id2, idb)
  k = 0
  while k < nch {
      if k != 1 {
          var cn2: i64 = craw
          if k == nch - 1 { cn2 = total - (nch - 1) * craw }
          let en2: i64 = b64_encode(((fix as i64) + k * craw) as *u8, cn2, bb)
          bb[en2] = 0 as u8
          g_itoa(k, ixb)
          g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
      }
      k = k + 1
  }
  rc = g_run(subject, "commit" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  var t8: i64 = 0
  if rc == 6 { if g_find(ob, onn, "MISSING-CHUNKS" as *u8) >= 0 { if g_find(ob, onn, " 1 " as *u8) >= 0 { if g_exists(G_DEST2) == 0 { t8 = 1 } } } }
  if t8 == 0 { if rc == 6 { if g_find(ob, onn, "MISSING-CHUNKS" as *u8) >= 0 { if g_find(ob, onn, " 1 -" as *u8) >= 0 { if g_exists(G_DEST2) == 0 { t8 = 1 } } } } }
  gv_check("neg-control-missing-chunk-commit-refuses-naming-index-1-and-writes-nothing" as *u8, t8 == 1, ctr)
295
  rc = g_run(subject, "status" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  var t9: i64 = 0
  if rc == 0 { if g_find(ob, onn, "missing: 1 " as *u8) >= 0 { t9 = 1 } }
  gv_check("status-names-the-missing-index (the resume contract)" as *u8, t9 == 1, ctr)
  // DI7: the Upload-Offset shape -- index 1 is the first missing chunk, so the contiguous prefix is exactly one chunk
  let roff: i64 = g_num_after(ob, onn, "resume_offset=" as *u8)
  gv_check_eq("status-resume-offset-is-the-contiguous-prefix (first missing index 1 -> offset = 1 x chunk_raw)" as *u8, roff, craw, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
306
  // ---- DI6 verified streaming: a chunk corrupted ON DISK after acceptance is caught BEFORE assembly, by index --------
  // (transfer 3 below corrupts the SENT bytes and is caught by the whole-file sha; this transfer corrupts the STORED
  // staging file, which the whole-file check would also catch but only after assembling everything -- the streaming
  // check names the index and assembles nothing)
  rc = g_run(subject, "begin" as *u8, G_DEST2, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id6: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id6, idb)
  k = 0
  while k < nch {
      var cn6: i64 = craw
      if k == nch - 1 { cn6 = total - (nch - 1) * craw }
      let en6: i64 = b64_encode(((fix as i64) + k * craw) as *u8, cn6, bb)
      bb[en6] = 0 as u8
      g_itoa(k, ixb)
      g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
      k = k + 1
  }
  // corrupt staged chunk 2 in place: flip its first byte (same length, so a size check could never see it)
  let cpath6: *u8 = sys_mmap(G_PATHCAP)
  var p6: i64 = 0
  let cdir: *u8 = "knowledge/contentput/" as *u8
  while cdir[p6] != (0 as u8) { cpath6[p6] = cdir[p6]; p6 = p6 + 1 }
  p6 = p6 + g_itoa(id6, ((cpath6 as i64) + p6) as *u8)
  cpath6[p6] = 46 as u8
  cpath6[p6 + 1] = 99 as u8
  cpath6[p6 + 2] = 50 as u8
  cpath6[p6 + 3] = 0 as u8
  let sc: *u8 = sys_read_file(cpath6, lp)
  var reached6: i64 = 0
  if (sc as i64) != 0 {
      let scn: i64 = lp[0]
      sc[0] = sc[0] + (1 as u8)
      let wfd: i64 = sys_openat_wr(cpath6, MODE_0644)
      if wfd >= 0 { sys_write(wfd, sc, scn); sys_close(wfd); reached6 = 1 }
      sys_free_file(sc, scn)
  }
  gv_check("fixture-reached-the-condition: staged chunk 2 rewritten with one flipped byte" as *u8, reached6 == 1, ctr)
  rc = g_run(subject, "commit" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  var t6b: i64 = 0
  if rc == 7 { if g_find(ob, onn, "CP-REFUSED-CHUNK-CORRUPT index=2" as *u8) >= 0 { if g_exists(G_DEST2) == 0 { t6b = 1 } } }
  gv_check("neg-control-disk-corrupt-chunk-refused-by-index-before-assembly (stream verify fires, whole-file check never reached)" as *u8, t6b == 1, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
353
  // ---- DI5 the content-defined plan over the committed artifact: data a client can diff against a prior generation ----
  rc = g_run(subject, "cdcplan" as *u8, G_DEST1, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  let pt: i64 = g_num_after(ob, onn, "total=" as *u8)
  let pc: i64 = g_num_after(ob, onn, "chunks=" as *u8)
  let pmax: i64 = g_num_after(ob, onn, " max=" as *u8)
  gv_check_eq("cdcplan-total-is-the-artifact-size" as *u8, pt, total, ctr)
  gv_check_eq("cdcplan-max-is-the-wire-chunk (every content-defined chunk still fits one call)" as *u8, pmax, craw, ctr)
  var t5c: i64 = 0
  if rc == 0 { if pc >= 2 { if pc * craw >= total { t5c = 1 } } }
  gv_check("cdcplan-yields-a-plan-that-covers-the-artifact (chunks x max >= total, at least two chunks)" as *u8, t5c == 1, ctr)
  rc = g_run(subject, "cdcplan" as *u8, "knowledge/../etc/passwd" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  var t5d: i64 = 0
  if rc == 4 { t5d = 1 }
  gv_check("neg-control-cdcplan-dotdot-source-refused" as *u8, t5d == 1, ctr)
370
  // ---- the CAS token's two spellings and its malformed refusal (the clients' grammar is expect=<hex|absent>) ----
  // G_DEST1 holds the committed fixture, so a token naming fixsha is the RIGHT token for it
  let exq: *u8 = sys_mmap(G_SHAHEX + 16)
  var xo: i64 = 0
  let exp7: *u8 = "expect=" as *u8
  while exp7[xo] != (0 as u8) { exq[xo] = exp7[xo]; xo = xo + 1 }
  var xs: i64 = 0
  while xs < G_SHAHEX { exq[xo + xs] = fixsha[xs]; xs = xs + 1 }
  exq[xo + xs] = 0 as u8
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, exq, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  let idq: i64 = g_num_after(ob, onn, "id=" as *u8)
  var t7q: i64 = 0
  if rc == 0 { if idq > 0 { t7q = 1 } }
  gv_check("the-clients'-spelling-expect=<hex>-is-accepted-at-begin (the door owns one token grammar with two prefixes)" as *u8, t7q == 1, ctr)
  if idq > 0 { g_itoa(idq, idb); g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2) }
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, "expect=notahexdigest" as *u8, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  var t7m: i64 = 0
  if rc == 3 { if g_find(ob, onn, "CP-REFUSED-EXPECT-MALFORMED" as *u8) >= 0 { t7m = 1 } }
  gv_check("neg-control-a-malformed-CAS-token-is-refused-BY-NAME-not-as-a-stale-file (a caller defect must not read as a changed destination)" as *u8, t7m == 1, ctr)
394
  // ---- DI10 refuse ON ARRIVAL: a declared chunk digest that does not match what arrived is refused before staging ----
  rc = g_run(subject, "begin" as *u8, G_DEST4, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id10: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id10, idb)
  let en10: i64 = b64_encode(fix, craw, bb)
  bb[en10] = 0 as u8
  g_itoa(0, ixb)
  // the RIGHT digest of chunk 0, and a WRONG one (the digest of the mutated chunk from transfer 3)
  let d10: *u8 = sys_mmap(G_SHAHEX + 16)
  let w10: u8 = 0 as u8
  var o10: i64 = 0
  let pre10: *u8 = "sha256=" as *u8
  while pre10[o10] != w10 { d10[o10] = pre10[o10]; o10 = o10 + 1 }
  sha256_digest(fix, craw, dg)
  let rhex10: *u8 = sys_mmap(G_SHAHEX + 8)
  g_hex_into(dg, rhex10)
  sha256_digest(mut0, craw, dg)
  let whex10: *u8 = sys_mmap(G_SHAHEX + 8)
  g_hex_into(dg, whex10)
  var q10: i64 = 0
  while q10 < G_SHAHEX { d10[o10 + q10] = whex10[q10]; q10 = q10 + 1 }
  d10[o10 + q10] = 0 as u8
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, d10, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  // the staged chunk file must be ABSENT: nothing reached staging
  let cpath10: *u8 = sys_mmap(G_PATHCAP)
  var p10: i64 = 0
  while cdir[p10] != (0 as u8) { cpath10[p10] = cdir[p10]; p10 = p10 + 1 }
  p10 = p10 + g_itoa(id10, ((cpath10 as i64) + p10) as *u8)
  cpath10[p10] = 46 as u8
  cpath10[p10 + 1] = 99 as u8
  cpath10[p10 + 2] = 48 as u8
  cpath10[p10 + 3] = 0 as u8
  var t10a: i64 = 0
  if rc == 7 { if g_find(ob, onn, "CP-REFUSED-CHUNK-DIGEST index=0" as *u8) >= 0 { if g_exists(cpath10) == 0 { t10a = 1 } } }
  gv_check("neg-control-chunk-with-WRONG-declared-digest-refused-ON-ARRIVAL-naming-index-0-and-nothing-staged (exit 7)" as *u8, t10a == 1, ctr)
  q10 = 0
  while q10 < G_SHAHEX { d10[o10 + q10] = rhex10[q10]; q10 = q10 + 1 }
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, d10, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  var t10b: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-CHUNK OK" as *u8) >= 0 { if g_exists(cpath10) == 1 { t10b = 1 } } }
  gv_check("POSITIVE-CONTROL-chunk-with-the-RIGHT-declared-digest-is-accepted-and-staged" as *u8, t10b == 1, ctr)
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, "sha256=nothex" as *u8, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  var t10c: i64 = 0
  if rc == 3 { if g_find(ob, onn, "CP-REFUSED-CHUNK-DIGEST-MALFORMED index=0" as *u8) >= 0 { t10c = 1 } }
  gv_check("neg-control-a-MALFORMED-declared-digest-is-refused-by-name-not-as-a-bad-chunk (exit 3)" as *u8, t10c == 1, ctr)
  // a TRUNCATED final chunk is refused on arrival with its index named (one byte short of the declared tail)
  let lastlen: i64 = total - (nch - 1) * craw
  let ent: i64 = b64_encode(((fix as i64) + (nch - 1) * craw) as *u8, lastlen - 1, bb)
  bb[ent] = 0 as u8
  g_itoa(nch - 1, ixb)
  rc = g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let ixs: *u8 = sys_mmap(48)
  var ixo: i64 = 0
  let ixpre: *u8 = " index=" as *u8
  while ixpre[ixo] != w10 { ixs[ixo] = ixpre[ixo]; ixo = ixo + 1 }
  ixo = ixo + g_itoa(nch - 1, ((ixs as i64) + ixo) as *u8)
  ixs[ixo] = 0 as u8
  var t10d: i64 = 0
  if rc == 3 { if g_find(ob, onn, "chunk size mismatch" as *u8) >= 0 { if g_find(ob, onn, ixs) >= 0 { t10d = 1 } } }
  gv_check("neg-control-a-TRUNCATED-final-chunk-is-refused-on-arrival-NAMING-its-index (the size refusal carries index=)" as *u8, t10d == 1, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
466
  // ---- DI9 dedupe on the wire: plan-addressed transfer, the incumbent's digests, reuse rows verified against the incumbent ----
  // G_DEST1 holds the committed fixture (the incumbent). A second transfer to G_DEST1 of the SAME bytes, cut by the
  // door's own parameters, must be assembled almost entirely from reuse rows; a row whose digest does not match the
  // incumbent must be refused by index.
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, exq, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  let id9: i64 = g_num_after(ob, onn, "id=" as *u8)
  let c9min: i64 = g_num_after(ob, onn, "cdc_min=" as *u8)
  let c9avg: i64 = g_num_after(ob, onn, "cdc_avg=" as *u8)
  let c9max: i64 = g_num_after(ob, onn, "cdc_max=" as *u8)
  g_itoa(id9, idb)
  gv_check("begin-publishes-the-door's-content-defined-parameters (cdc_min cdc_avg cdc_max derived from chunk_raw)" as *u8, ((c9min > 0) as i64) * ((c9avg > c9min) as i64) * ((c9max == craw) as i64), ctr)
  // the local plan by the door's parameters (the same lib the door uses; the gate proves the two sides agree)
  let tbl9: *u8 = sys_mmap(CDC_GEAR_BYTES)
  cdc_gear_table(tbl9)
  let pcap9: i64 = total / c9min + 2
  let poffs9: *i64 = sys_mmap(pcap9 * 8) as *i64
  let pcount9: i64 = cdc_plan(tbl9, fix, total, c9min, c9avg, c9max, poffs9, pcap9)
  gv_check("the-local-plan-cut-by-the-door's-parameters-yields-at-least-two-chunks" as *u8, (pcount9 >= 2) as i64, ctr)
  let pcb: *u8 = sys_mmap(32)
  g_itoa(pcount9, pcb)
  rc = g_run(subject, "plan" as *u8, idb, pcb, 0 as *u8, 0 as *u8, 3)
  ob = g_read_out(lp)
  onn = lp[0]
  var t9p: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-PLAN OK" as *u8) >= 0 { if g_num_after(ob, onn, "nchunks=" as *u8) == pcount9 { t9p = 1 } } }
  gv_check("plan-switches-the-transfer-to-plan-addressed-chunks-and-echoes-the-count" as *u8, t9p == 1, ctr)
  // have: the incumbent's digests must equal the local plan's digests, chunk for chunk
  rc = g_run(subject, "have" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  let hchunks: i64 = g_num_after(ob, onn, " chunks=" as *u8)
  gv_check_eq("have-lists-as-many-incumbent-chunks-as-the-local-plan (both sides cut by one rule)" as *u8, hchunks, pcount9, ctr)
  // reuse EVERY chunk from the incumbent (rows k off len sha built from the local plan), in one batch
  let rows9: *u8 = sys_mmap(pcount9 * (G_SHAHEX + 80) + 64)
  var ro9: i64 = 0
  var k9: i64 = 0
  let hx9: *u8 = sys_mmap(G_SHAHEX + 8)
  while k9 < pcount9 {
      let a9: i64 = poffs9[k9]
      let b9: i64 = poffs9[k9 + 1]
      sha256_digest(((fix as i64) + a9) as *u8, b9 - a9, dg)
      g_hex_into(dg, hx9)
      ro9 = ro9 + g_itoa(k9, ((rows9 as i64) + ro9) as *u8)
      rows9[ro9] = 32 as u8
      ro9 = ro9 + 1
      ro9 = ro9 + g_itoa(a9, ((rows9 as i64) + ro9) as *u8)
      rows9[ro9] = 32 as u8
      ro9 = ro9 + 1
      ro9 = ro9 + g_itoa(b9 - a9, ((rows9 as i64) + ro9) as *u8)
      rows9[ro9] = 32 as u8
      ro9 = ro9 + 1
      var s9: i64 = 0
      while s9 < G_SHAHEX { rows9[ro9] = hx9[s9]; ro9 = ro9 + 1; s9 = s9 + 1 }
      rows9[ro9] = 10 as u8
      ro9 = ro9 + 1
      k9 = k9 + 1
  }
  let rb9: *u8 = sys_mmap((ro9 / 3 + 2) * 4 + 16)
  let re9: i64 = b64_encode(rows9, ro9, rb9)
  rb9[re9] = 0 as u8
  rc = g_run(subject, "reuse" as *u8, idb, rb9, 0 as *u8, 0 as *u8, 3)
  ob = g_read_out(lp)
  onn = lp[0]
  let st9: i64 = g_num_after(ob, onn, "staged=" as *u8)
  let rf9: i64 = g_num_after(ob, onn, "refused=" as *u8)
  var t9r: i64 = 0
  if rc == 0 { if st9 == pcount9 { if rf9 == 0 { t9r = 1 } } }
  gv_check("reuse-stages-every-plan-chunk-from-the-incumbent-with-NOTHING-sent-on-the-wire (staged = plan chunks, refused 0)" as *u8, t9r == 1, ctr)
  rc = g_run(subject, "commit" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  var t9c: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-COMMIT OK" as *u8) >= 0 { if g_find(ob, onn, fixsha) >= 0 { t9c = 1 } } }
  gv_check("a-transfer-assembled-entirely-from-reuse-rows-commits-to-the-fixture's-own-sha256" as *u8, t9c == 1, ctr)
  // ---- DI14 reuse stages by link, never by copy: the batch receipt partitions staged into cloned + copied and names
  // the kernel's refusal when it fell back. The /tmp fixture above is on tmpfs beside a btrfs staging dir on the NAS,
  // so that batch is expected to COPY (EXDEV); the same-volume witness below stages a stage-slot fixture whose bytes
  // the gate copied itself, so a clone can actually happen where the filesystem supports it. Both are announced.
  var st14: i64 = 0
  var cl14: i64 = 0
  var cp14: i64 = 0
  var rc14: i64 = 0
  var fi14: i64 = 0
  var fd14: i64 = 0
  var fo14: i64 = 0
  var fl14: i64 = 0
  var bt14: i64 = 0
  // DI17 commit-clone witnesses (read from the CP-ASSEMBLE receipt of a commit over the identical incumbent)
  var cm17: i64 = 0
  var fi17: i64 = 0
  var ru17: i64 = 0
  var cb17: i64 = 0
  var ic17: i64 = 0
  var cc17: i64 = 0
  var rc17: i64 = 0
  var bk17: i64 = 0
  var ms17: i64 = 0
  let slot14: *u8 = "nx_content_put_gate_fixture.sov.elf.new" as *u8
  sys_unlinkat(slot14)
  let sfd14: i64 = sys_openat_wr(slot14, MODE_0644)
  var wrote14: i64 = 0
  if sfd14 >= 0 {
      var w14: i64 = 0
      var wok14: i64 = 1
      while w14 < total { let r14: i64 = sys_write(sfd14, ((fix as i64) + w14) as *u8, total - w14); if r14 <= 0 { wok14 = 0; w14 = total } else { w14 = w14 + r14 } }
      sys_close(sfd14)
      wrote14 = wok14
  }
  gv_check("di14-fixture-a-same-volume-incumbent-was-written-into-a-stage-slot (the clone witness needs one filesystem)" as *u8, wrote14 == 1, ctr)
  var t14b: i64 = 0
  if wrote14 == 1 {
      let ex14: *u8 = sys_mmap(G_SHAHEX + 24)
      var eo14: i64 = 0
      let exp14: *u8 = "expect_sha256=" as *u8
      while exp14[eo14] != (0 as u8) { ex14[eo14] = exp14[eo14]; eo14 = eo14 + 1 }
      var es14: i64 = 0
      while es14 < G_SHAHEX { ex14[eo14] = fixsha[es14]; eo14 = eo14 + 1; es14 = es14 + 1 }
      ex14[eo14] = 0 as u8
      rc = g_run(subject, "begin" as *u8, slot14, tb, fixsha, ex14, 5)
      ob = g_read_out(lp)
      onn = lp[0]
      let id14: i64 = g_num_after(ob, onn, "CP-BEGIN id=" as *u8)
      if rc == 0 { if id14 > 0 {
          let idb14: *u8 = sys_mmap(32)
          let il14: i64 = g_itoa(id14, idb14)
          idb14[il14] = 0 as u8
          let pcb14: *u8 = sys_mmap(32)
          let pl14: i64 = g_itoa(pcount9, pcb14)
          pcb14[pl14] = 0 as u8
          rc = g_run(subject, "plan" as *u8, idb14, pcb14, 0 as *u8, 0 as *u8, 3)
          if rc == 0 {
              let ms0: i64 = sys_now_ms()
              rc = g_run(subject, "reuse" as *u8, idb14, rb9, 0 as *u8, 0 as *u8, 3)
              bt14 = sys_now_ms() - ms0
              ob = g_read_out(lp)
              onn = lp[0]
              st14 = g_num_after(ob, onn, "staged=" as *u8)
              cl14 = g_num_after(ob, onn, "cloned=" as *u8)
              cp14 = g_num_after(ob, onn, "copied=" as *u8)
              rc14 = g_num_after(ob, onn, "clone_rc=" as *u8)
              fi14 = g_num_after(ob, onn, "inc_fd:" as *u8)
              fd14 = g_num_after(ob, onn, "dst_fd:" as *u8)
              fo14 = g_num_after(ob, onn, ",off:" as *u8)
              fl14 = g_num_after(ob, onn, ",len:" as *u8)
              if rc == 0 { if st14 == pcount9 { t14b = 1 } }
              // DI17: commit over the IDENTICAL incumbent -- every reused chunk keeps its offset, so the whole file
              // is one offset-preserving run and its block-aligned interior is the clone window
              if t14b == 1 {
                  let ms1: i64 = sys_now_ms()
                  rc = g_run(subject, "commit" as *u8, idb14, 0 as *u8, 0 as *u8, 0 as *u8, 2)
                  ms17 = sys_now_ms() - ms1
                  ob = g_read_out(lp)
                  onn = lp[0]
                  if rc == 0 { if g_find(ob, onn, "CP-COMMIT" as *u8) >= 0 { cm17 = 1 } }
                  fi17 = g_num_after(ob, onn, "from_incumbent=" as *u8)
                  ru17 = g_num_after(ob, onn, "clone_runs=" as *u8)
                  cb17 = g_num_after(ob, onn, "cloned_bytes=" as *u8)
                  ic17 = g_num_after(ob, onn, "incumbent_copied_bytes=" as *u8)
                  cc17 = g_num_after(ob, onn, "chunk_copied_bytes=" as *u8)
                  rc17 = g_num_after(ob, onn, "clone_rc=" as *u8)
                  bk17 = g_num_after(ob, onn, "blk=" as *u8)
              }
              if cm17 == 0 { g_run(subject, "abort" as *u8, idb14, 0 as *u8, 0 as *u8, 0 as *u8, 2) }
          }
      } }
  }
  sys_unlinkat(slot14)
  gv_kv("di14_slot_batch_rows" as *u8, st14)
  gv_kv("di14_slot_batch_cloned" as *u8, cl14)
  gv_kv("di14_slot_batch_copied" as *u8, cp14)
  gv_kv("di14_slot_batch_clone_rc" as *u8, rc14)
  gv_kv("di14_first_refusal_inc_fd" as *u8, fi14)
  gv_kv("di14_first_refusal_dst_fd" as *u8, fd14)
  gv_kv("di14_first_refusal_off" as *u8, fo14)
  gv_kv("di14_first_refusal_len" as *u8, fl14)
  gv_kv("di14_slot_batch_ms" as *u8, bt14)
  gv_check("di14-same-volume-reuse-batch-staged-every-plan-chunk (the slot's transfer is then aborted and the slot removed)" as *u8, t14b == 1, ctr)
  gv_check_eq("di14-receipt-partitions-staged-into-cloned-plus-copied" as *u8, cl14 + cp14, st14, ctr)
  var t14h: i64 = 1
  if cp14 == 0 { if rc14 != 0 { t14h = 0 } }
  if cl14 == 0 { if cp14 != st14 { t14h = 0 } }
  gv_check("di14-receipt-is-honest (no refusal rc when nothing copied; everything copied when nothing cloned) -- WHICH path staged is printed above, a clone is witnessed only on a reflink volume" as *u8, t14h == 1, ctr)
  // ---- DI17 commit-clone: the reflink win lives at COMMIT, on offset-preserving runs, never in a chunk file
  gv_kv("di17_commit_ok" as *u8, cm17)
  gv_kv("di17_from_incumbent_chunks" as *u8, fi17)
  gv_kv("di17_clone_runs" as *u8, ru17)
  gv_kv("di17_cloned_bytes" as *u8, cb17)
  gv_kv("di17_incumbent_copied_bytes" as *u8, ic17)
  gv_kv("di17_chunk_copied_bytes" as *u8, cc17)
  gv_kv("di17_clone_rc" as *u8, rc17)
  gv_kv("di17_blk" as *u8, bk17)
  gv_kv("di17_commit_ms" as *u8, ms17)
  gv_check("di17-commit-over-the-identical-incumbent-succeeds (the slot is rewritten with the same bytes and verified by re-read)" as *u8, cm17 == 1, ctr)
  gv_check_eq("di17-assemble-receipt-partitions-the-total-into-cloned-plus-incumbent-copied-plus-chunk-copied" as *u8, cb17 + ic17 + cc17, total, ctr)
  gv_check_eq("di17-every-reused-chunk-was-sourced-from-the-incumbent-run-not-from-its-staged-copy" as *u8, fi17, pcount9, ctr)
  var t17h: i64 = 0
  if cb17 > 0 { if rc17 == 0 { if bk17 > 0 { if cb17 % bk17 == 0 { if cb17 == (total / bk17) * bk17 { if ru17 == 1 { t17h = 1 } } } } } }
  if cb17 == 0 { if rc17 != 0 { t17h = 1 } }
  if cb17 == 0 { if bk17 == 0 { t17h = 1 } }
  gv_check("di17-a-clone-is-exactly-the-block-aligned-interior-of-the-one-run-and-a-zero-clone-carries-the-kernel's-refusal (reflink volume: cloned == floor(total/blk)*blk in one run; other volumes: clone_rc names why)" as *u8, t17h == 1, ctr)
  // neg-control: a reuse row whose digest does not match the incumbent's bytes is refused BY INDEX and the batch stops
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, exq, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  let id9b: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id9b, idb)
  g_run(subject, "plan" as *u8, idb, pcb, 0 as *u8, 0 as *u8, 3)
  // row 0 with the digest of chunk 1: the bytes at chunk 0's offset do not hash to it
  var rb: i64 = 0
  rb = rb + g_itoa(0, ((rows9 as i64) + rb) as *u8)
  rows9[rb] = 32 as u8
  rb = rb + 1
  rb = rb + g_itoa(poffs9[0], ((rows9 as i64) + rb) as *u8)
  rows9[rb] = 32 as u8
  rb = rb + 1
  rb = rb + g_itoa(poffs9[1] - poffs9[0], ((rows9 as i64) + rb) as *u8)
  rows9[rb] = 32 as u8
  rb = rb + 1
  sha256_digest(((fix as i64) + poffs9[1]) as *u8, poffs9[2] - poffs9[1], dg)
  g_hex_into(dg, hx9)
  var s9b: i64 = 0
  while s9b < G_SHAHEX { rows9[rb] = hx9[s9b]; rb = rb + 1; s9b = s9b + 1 }
  rows9[rb] = 10 as u8
  rb = rb + 1
  let re9b: i64 = b64_encode(rows9, rb, rb9)
  rb9[re9b] = 0 as u8
  rc = g_run(subject, "reuse" as *u8, idb, rb9, 0 as *u8, 0 as *u8, 3)
  ob = g_read_out(lp)
  onn = lp[0]
  var t9n: i64 = 0
  if rc == 7 { if g_find(ob, onn, "CP-REFUSED-REUSE-DIGEST index=0" as *u8) >= 0 { if g_num_after(ob, onn, "staged=" as *u8) == 0 { t9n = 1 } } }
  gv_check("neg-control-a-reuse-row-whose-digest-does-not-match-the-incumbent-is-refused-BY-INDEX-and-stages-nothing (a stale have-list cannot splice)" as *u8, t9n == 1, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  // neg-control: reuse on a fixed-size transfer is refused (plan first)
  rc = g_run(subject, "begin" as *u8, G_DEST2, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id9c: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id9c, idb)
  rc = g_run(subject, "reuse" as *u8, idb, rb9, 0 as *u8, 0 as *u8, 3)
  ob = g_read_out(lp)
  onn = lp[0]
  var t9m: i64 = 0
  if rc == 3 { if g_find(ob, onn, "CP-REFUSED-REUSE-MODE" as *u8) >= 0 { t9m = 1 } }
  gv_check("neg-control-reuse-on-a-fixed-size-transfer-is-refused-by-name (plan first)" as *u8, t9m == 1, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
715
  // ---- DI11 byte-offset append per the IETF draft: accepted only at the current upload_offset, refused naming it otherwise ----
  rc = g_run(subject, "begin" as *u8, G_DEST3, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id11: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id11, idb)
  rc = g_run(subject, "status" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  gv_check_eq("status-publishes-upload_offset-0-for-a-fresh-transfer (the draft's vocabulary beside resume_offset)" as *u8, g_num_after(ob, onn, "upload_offset=" as *u8), 0, ctr)
  let en11: i64 = b64_encode(fix, craw, bb)
  bb[en11] = 0 as u8
  let ob11: *u8 = sys_mmap(32)
  g_itoa(0, ob11)
  q10 = 0
  while q10 < G_SHAHEX { d10[o10 + q10] = rhex10[q10]; q10 = q10 + 1 }
  rc = g_run(subject, "append" as *u8, idb, ob11, bb, d10, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  var t11a: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-APPEND OK" as *u8) >= 0 { if g_num_after(ob, onn, "upload_offset=" as *u8) == craw { t11a = 1 } } }
  gv_check("append-at-the-current-offset-lands-and-advances-upload_offset-by-its-length" as *u8, t11a == 1, ctr)
  rc = g_run(subject, "append" as *u8, idb, ob11, bb, d10, 5)
  ob = g_read_out(lp)
  onn = lp[0]
  var t11b: i64 = 0
  if rc == 5 { if g_find(ob, onn, "CP-REFUSED-OFFSET" as *u8) >= 0 { if g_num_after(ob, onn, "current=" as *u8) == craw { t11b = 1 } } }
  gv_check("neg-control-an-append-at-a-STALE-offset-is-refused-NAMING-the-current-offset (never silently re-based)" as *u8, t11b == 1, ctr)
  g_itoa(craw + 1, ob11)
  rc = g_run(subject, "append" as *u8, idb, ob11, bb, d10, 5)
  var t11c: i64 = 0
  if rc == 5 { t11c = 1 }
  gv_check("neg-control-an-append-at-a-FUTURE-offset-is-refused (no holes)" as *u8, t11c == 1, ctr)
  rc = g_run(subject, "status" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  gv_check_eq("status-upload_offset-equals-the-bytes-appended-so-far" as *u8, g_num_after(ob, onn, "upload_offset=" as *u8), craw, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
754
  // ---- transfer 3: corrupt chunk -> commit refuses on whole-file sha; staging kept -------------
  rc = g_run(subject, "begin" as *u8, G_DEST3, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  let id3: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(id3, idb)
  k = 0
  while k < nch {
      var cn3: i64 = craw
      if k == nch - 1 { cn3 = total - (nch - 1) * craw }
      var src: *u8 = ((fix as i64) + k * craw) as *u8
      if k == 0 { src = mut0 }
      let en3: i64 = b64_encode(src, cn3, bb)
      bb[en3] = 0 as u8
      g_itoa(k, ixb)
      g_run(subject, "chunk" as *u8, idb, ixb, bb, 0 as *u8, 4)
      k = k + 1
  }
  rc = g_run(subject, "commit" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  ob = g_read_out(lp)
  onn = lp[0]
  var t10: i64 = 0
  if rc == 7 { if g_find(ob, onn, "SHA-MISMATCH" as *u8) >= 0 { if g_exists(G_DEST3) == 0 { t10 = 1 } } }
  gv_check("neg-control-corrupt-chunk-commit-refuses-whole-file-sha-and-writes-nothing" as *u8, t10 == 1, ctr)
  rc = g_run(subject, "status" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  var t11: i64 = 0
  if rc == 0 { t11 = 1 }
  gv_check("staging-kept-for-repair-after-sha-refusal (status still answers)" as *u8, t11 == 1, ctr)
  g_run(subject, "abort" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  rc = g_run(subject, "status" as *u8, idb, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  var t12: i64 = 0
  if rc != 0 { t12 = 1 }
  gv_check("abort-removes-staging (status refuses afterwards)" as *u8, t12 == 1, ctr)
788
  // ---- destination guard --------------------------------------------------------------------
  rc = g_run(subject, "begin" as *u8, "runtime/evil.bin" as *u8, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  var t13: i64 = 0
  if rc == 4 { if g_find(ob, onn, "CP-REFUSED-DEST" as *u8) >= 0 { t13 = 1 } }
  gv_check("neg-control-dest-outside-allowlist-refused-by-name" as *u8, t13 == 1, ctr)
  rc = g_run(subject, "begin" as *u8, "knowledge/fetched/../evil.bin" as *u8, tb, fixsha, 0 as *u8, 4)
  var t14: i64 = 0
  if rc == 4 { t14 = 1 }
  gv_check("neg-control-dotdot-destination-refused" as *u8, t14 == 1, ctr)
  // ---- EC24 stage slot: a bare <target>.sov.elf.new is the ONE root-level destination accepted ----
  rc = g_run(subject, "begin" as *u8, "nx_cpgate_stagetest.sov.elf.new" as *u8, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp)
  onn = lp[0]
  var t15: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-BEGIN" as *u8) >= 0 { t15 = 1 } }
  gv_check("stage-slot-bare-target.sov.elf.new-accepted-by-begin (EC24)" as *u8, t15 == 1, ctr)
  let idst: i64 = g_num_after(ob, onn, "id=" as *u8)
  let idsb: *u8 = sys_mmap(32)
  g_itoa(idst, idsb)
  if idst > 0 { g_run(subject, "abort" as *u8, idsb, 0 as *u8, 0 as *u8, 0 as *u8, 2) }
  rc = g_run(subject, "begin" as *u8, "buildroot/nx_cpgate_stagetest.sov.elf.new" as *u8, tb, fixsha, 0 as *u8, 4)
  var t16: i64 = 0
  if rc == 4 { t16 = 1 }
  gv_check("neg-control-stage-slot-under-a-directory-refused (the rule is bare on purpose)" as *u8, t16 == 1, ctr)
  rc = g_run(subject, "begin" as *u8, "nx_cpgate_stagetest.elf" as *u8, tb, fixsha, 0 as *u8, 4)
  var t17: i64 = 0
  if rc == 4 { t17 = 1 }
  gv_check("neg-control-bare-name-without-the-stage-suffix-refused" as *u8, t17 == 1, ctr)
819
  // ---- INTERLEAVED TRANSFERS: the concurrency class the sequential teeth above cannot see ------
  // A 14/14 GREEN on serial behaviour was TRUE and did not cover this: a first production consumer
  // hit "unknown transfer id" at commit because a sibling transfer's code path swept shared
  // staging. THE TOOTH: two transfers open at once, the first COMMITS while the second is
  // mid-flight, and the second must still commit byte-correctly afterwards.
  // Deliberately SMALL payloads (2 chunks each): the property under test is isolation between
  // transfers, not size -- the multi-MB round-trip is already proven above, and a 54-chunk
  // interleave would double a gate that already forks ~200 times. Stated, not hidden.
  let small: i64 = craw + 1000
  let smallsha: *u8 = sys_mmap(G_SHAHEX + 8)
  sha256_digest(fix, small, dg)
  g_hex_into(dg, smallsha)
  let sb2: *u8 = sys_mmap(64)
  g_itoa(small, sb2)
  let idbA: *u8 = sys_mmap(32)
  let idbB: *u8 = sys_mmap(32)
836
  rc = g_run(subject, "begin" as *u8, G_DEST4, sb2, smallsha, 0 as *u8, 4)
  ob = g_read_out(lp); onn = lp[0]
  let idA: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(idA, idbA)
  rc = g_run(subject, "begin" as *u8, G_DEST5, sb2, smallsha, 0 as *u8, 4)
  ob = g_read_out(lp); onn = lp[0]
  let idB: i64 = g_num_after(ob, onn, "id=" as *u8)
  g_itoa(idB, idbB)
  gv_puts("  interleaved idA=" as *u8); gv_num(idA)
  gv_puts(" idB=" as *u8); gv_num(idB)
  gv_puts(" small_total=" as *u8); gv_num(small)
  gv_puts("\n" as *u8)
849
  // B goes mid-flight FIRST (chunk 0 only), then A completes and commits underneath it
  let enb0: i64 = b64_encode(fix, craw, bb)
  bb[enb0] = 0 as u8
  g_itoa(0, ixb)
  g_run(subject, "chunk" as *u8, idbB, ixb, bb, 0 as *u8, 4)
  g_run(subject, "chunk" as *u8, idbA, ixb, bb, 0 as *u8, 4)
  let ena1: i64 = b64_encode(((fix as i64) + craw) as *u8, small - craw, bb)
  bb[ena1] = 0 as u8
  g_itoa(1, ixb)
  g_run(subject, "chunk" as *u8, idbA, ixb, bb, 0 as *u8, 4)
  let rcA: i64 = g_run(subject, "commit" as *u8, idbA, 0 as *u8, 0 as *u8, 0 as *u8, 2)
861
  // B must still be alive: status answers, its remaining chunk lands, and commit succeeds
  let rcS: i64 = g_run(subject, "status" as *u8, idbB, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  var t15: i64 = 0
  if rcA == 0 { if rcS == 0 { t15 = 1 } }
  gv_check("interleaved-sibling-survives-a-commit (B's staging still answers after A completes)" as *u8, t15 == 1, ctr)
867
  g_run(subject, "chunk" as *u8, idbB, ixb, bb, 0 as *u8, 4)
  let rcB: i64 = g_run(subject, "commit" as *u8, idbB, 0 as *u8, 0 as *u8, 0 as *u8, 2)
  var t16: i64 = 0
  if rcB == 0 {
      let vb: *u8 = sys_read_file(G_DEST5, lp)
      if (vb as i64) != 0 {
          let vn: i64 = lp[0]
          sha256_digest(vb, vn, dg)
          let vhex: *u8 = sys_mmap(G_SHAHEX + 8)
          g_hex_into(dg, vhex)
          var vsame: i64 = 1
          var vi: i64 = 0
          while vi < G_SHAHEX { if vhex[vi] != smallsha[vi] { vsame = 0; vi = G_SHAHEX } else { vi = vi + 1 } }
          if vn == small { if vsame == 1 { t16 = 1 } }
          sys_free_file(vb, vn)
      }
  }
  gv_puts("  interleaved commitA_rc=" as *u8); gv_num(rcA)
  gv_puts(" statusB_rc=" as *u8); gv_num(rcS)
  gv_puts(" commitB_rc=" as *u8); gv_num(rcB)
  gv_puts("\n" as *u8)
  gv_check("neg-control-interleaved-second-transfer-commits-byte-correctly (a shared-staging sweep fires here)" as *u8, t16 == 1, ctr)
  // ---- EC26: source roots land only under a CAS token, re-checked at commit -------------------------
  rc = g_run(subject, "begin" as *u8, "buildroot/runtime/nx_cpgate_source_fixture.nx" as *u8, tb, fixsha, 0 as *u8, 4)
  ob = g_read_out(lp); onn = lp[0]
  var t18: i64 = 0
  if rc == 4 { if g_find(ob, onn, "CP-REFUSED-SOURCE-NEEDS-EXPECT" as *u8) >= 0 { t18 = 1 } }
  gv_check("neg-control-source-root-destination-without-an-expect-token-refused-by-name (EC26)" as *u8, t18 == 1, ctr)
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, "expect_sha256=0000000000000000000000000000000000000000000000000000000000000000" as *u8, 5)
  ob = g_read_out(lp); onn = lp[0]
  var t19: i64 = 0
  if rc == 5 { if g_find(ob, onn, "CP-REFUSED-STALE-EXPECT" as *u8) >= 0 { t19 = 1 } }
  gv_check("neg-control-wrong-expect-token-refused-at-begin-naming-the-current-sha (EC26)" as *u8, t19 == 1, ctr)
  let xarg: *u8 = sys_mmap(G_SHAHEX + 32)
  var xp: i64 = 0
  let xpre: *u8 = "expect_sha256=" as *u8
  while xpre[xp] != (0 as u8) { xarg[xp] = xpre[xp]; xp = xp + 1 }
  var xq: i64 = 0
  while xq < G_SHAHEX { xarg[xp + xq] = fixsha[xq]; xq = xq + 1 }
  xarg[xp + xq] = 0 as u8
  rc = g_run(subject, "begin" as *u8, G_DEST1, tb, fixsha, xarg, 5)
  ob = g_read_out(lp); onn = lp[0]
  var t20: i64 = 0
  if rc == 0 { if g_find(ob, onn, "CP-BEGIN" as *u8) >= 0 { t20 = 1 } }
  gv_check("right-expect-token-accepted-at-begin (the destination holds the fixture and the token names its sha) (EC26)" as *u8, t20 == 1, ctr)
  let idx26: i64 = g_num_after(ob, onn, "id=" as *u8)
  let idx26b: *u8 = sys_mmap(32)
  g_itoa(idx26, idx26b)
  // change the destination under the open transfer, then commit: the re-check must refuse before any presence pass
  let cfd: i64 = sys_openat_wr(G_DEST1, MODE_0644)
  var t21: i64 = 0
  if cfd >= 0 {
      sys_write(cfd, "changed under you" as *u8, 17)
      sys_close(cfd)
      rc = g_run(subject, "commit" as *u8, idx26b, 0 as *u8, 0 as *u8, 0 as *u8, 2)
      ob = g_read_out(lp); onn = lp[0]
      if rc == 5 { if g_find(ob, onn, "CP-REFUSED-CHANGED-UNDER-YOU" as *u8) >= 0 { t21 = 1 } }
  }
  gv_check("neg-control-destination-changed-between-begin-and-commit-refuses-the-whole-commit (EC26)" as *u8, t21 == 1, ctr)
  if idx26 > 0 { g_run(subject, "abort" as *u8, idx26b, 0 as *u8, 0 as *u8, 0 as *u8, 2) }
928
  return gv_verdict("NX-CONTENT-PUT" as *u8, ctr, "a real multi-MB payload round-trips byte-identically, refusals fire by name, a blind retry cannot corrupt, and a sibling transfer cannot destroy an in-flight one" as *u8)
930}
nx_content_put_gate.nx source

`nx_content_put_gate.nx` source
