nx_craft_erosion_shot_gate.nx source

1// nx_craft_erosion_shot_gate.nx -- IS THE PUBLISHED BEFORE/AFTER PAIR ACTUALLY A PAIR? (2026-08-25) 2// 3// THE SUBJECT IS THE PUBLISHED PIXELS, AND THAT IS DELIBERATE. The operator validates by LOOKING, so 4// the thing that must be true is a property of the four PNGs sitting in the docroot: they decode, 5// they are pictures of the shipped module's own frame, the craft pair DIFFER, both sides are VARIED, 6// and the control world -- one asked for with no relief at all -- produces two PIXEL-IDENTICAL 7// frames. This gate decodes the exact bytes a browser will decode, with the estate's own decoder, 8// and asserts those five things. 9// 10// * WHY IT DOES NOT RE-RENDER, STATED PLAINLY RATHER THAN LEFT AS A GAP. Re-deriving the pair means 11// worldgen, and worldgen through the wasm INTERPRETER was MEASURED at init_ms=119382 for ONE 12// scenario (nx_craft_erosion_shot, 2026-08-25, plus 4.84 ms per ray of render on top). Four 13// scenarios is roughly 10 minutes at the coarsest resolution the module offers. No roster deadline 14// in this estate admits that -- the slow roster's own beat allows 60000 ms -- so a re-rendering gate 15// could not be run by anything, and a gate nobody runs is a comment. The heavy live proof already 16// EXISTS and is not duplicated here: nx_wasm_craft_vm_gate runs the shipped wasm and measures that 17// the ground itself moves (talus 154/256, 509 of 576 lattice heights moved, rugosity 88 -> 75 18// permil) and that the renderer paints a varied frame. This gate owns the layer that one cannot see: 19// whether the pictures on the page are real, different, and honestly captioned. 20// 21// * AND THE PAIRING IS A FREE CROSS-CHECK, NOT A DUPLICATE RULER. The producer counts differing 22// pixels in the wasm FRAMEBUFFER; this gate counts them in the DECODED PNG. They are two 23// instruments over one claim with the encoder in between, so a disagreement between the two numbers 24// locates a defect in the encode/publish path that neither could find alone. Both numbers are 25// printed so the comparison is available to a reader without re-running anything. 26// 27// license_tier: ORIGINAL expect_exit: 0 28import "nx_syscalls.nx" 29import "nx_wasm_craft.nx" 30import "nx_png_decoder.nx" 31import "nx_gate_verdict.nx" 32 33// The four published frames. The SUBJECT is craft, which opts in (craft.html carries 34// const NXGP=[[64,1]]). The CONTROL is a world asked for with NO RELIEF (P_TAMP1=0, P_TAMP2=0 35// through the same GENP door) and then rendered at BOTH budgets: with no slope steeper than its own 36// average the measured talus is zero, erosion turns itself off, and the two frames must be pixel 37// identical. 38// 39// * THE CONTROL WAS CHOSEN BY MEASUREMENT, AND THE OBVIOUS ONE FAILED. The first attempt used 40// /beach -- the shipped world that never opts in -- on the assumption that its "near-flat warm sand" 41// would not erode. Rendered both ways it came back 24,489 of 36,000 pixels different (680 permil), 42// beside craft's 702: two worlds of completely different relief moving by almost the same amount. 43// So it proved nothing, and publishing it as a control would have published a falsehood. beach's 44// sand is NEAR-flat (P_TAMP1=2, P_TAMP2=1), not flat, and on a two-to-three block relief a 45// one-block shed moves most columns. The genuinely flat world is the control that discriminates, 46// and it measured 0 of 36,000. 47const EG_CRAFT_OFF: *u8 = "sites/nishifamily/world/erosion_craft_off.png" 48const EG_CRAFT_ON: *u8 = "sites/nishifamily/world/erosion_craft_on.png" 49const EG_FLAT_OFF: *u8 = "sites/nishifamily/world/erosion_flat_off.png" 50const EG_FLAT_ON: *u8 = "sites/nishifamily/world/erosion_flat_on.png" 51const EG_SUBJECTS: i64 = 4 52const EG_BOX: i64 = 16 53const EG_PERMIL: i64 = 1000 54const EG_FLATVAL: i64 = 77 // the single value the synthetic FLAT frame is filled with. Any 55 // value works -- the point is that every pixel is the SAME one 56 // -- so it is named rather than left as a bare literal. 57 58func eg_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 59func eg_n(v: i64) -> i64 { gv_num(v); return 0 } 60 61// Decode one published frame. Returns 0 when the file is absent or the bytes are not a PNG this 62// decoder accepts -- the caller says WHICH, because "no file" and "bad file" want different work. 63func eg_load(path: *u8) -> *NxPngResult { 64 let box: *i64 = sys_mmap(EG_BOX) as *i64 65 let buf: *u8 = sys_read_file(path, box) 66 if (buf as i64) == 0 { return 0 as *NxPngResult } 67 let r: *NxPngResult = nx_png_decode(buf, box[0]) 68 if (r as i64) == 0 { return 0 as *NxPngResult } 69 if r.error_code != NX_PNG_OK { return 0 as *NxPngResult } 70 return r 71} 72 73// Is this frame a legitimate quality step of the SHIPPED module, or just some image? The engine 74// renders exactly W/q by H/q pixels for an integer q in 1..Q_MAX -- one ray per pixel -- so a frame 75// that matches no q was not produced by this renderer at all. Returns the q, or -1. 76func eg_qstep(w: i64, h: i64) -> i64 { 77 var q: i64 = 1 78 while q <= Q_MAX { 79 if W/q == w { if H/q == h { return q } } 80 q = q + 1 81 } 82 return 0 - 1 83} 84 85// THE NON-VACUITY DETECTOR ITSELF: does this frame carry more than one colour? An all-black frame, 86// a single-colour frame, or a frame the renderer never wrote are exactly what a broken capture 87// produces, and each of them would still publish as a perfectly valid PNG. gv_bite below proves 88// this detector FIRES on a flat frame and stays SILENT on the real one -- a variety check that has 89// only ever seen good frames has not been shown to work. 90func eg_is_flat(px: *u8, n: i64) -> i64 { 91 if n <= 0 { return 1 } 92 var i: i64 = 1 93 while i < n { if px[i] != px[0] { return 0 } i = i + 1 } 94 return 1 95} 96 97// differing PIXELS (not bytes) between two decoded frames of identical geometry 98func eg_diff_px(a: *NxPngResult, b: *NxPngResult) -> i64 { 99 let w: i64 = a.header.width 100 let h: i64 = a.header.height 101 let na: i64 = a.bytes_per_pix 102 let nb: i64 = b.bytes_per_pix 103 var diff: i64 = 0 104 var p: i64 = 0 105 while p < w*h { 106 var d: i64 = 0 107 var c: i64 = 0 108 while c < na { 109 if a.pixels[p*na + c] != b.pixels[p*nb + c] { d = 1 } 110 c = c + 1 111 } 112 diff = diff + d 113 p = p + 1 114 } 115 return diff 116} 117 118func eg_describe(tag: *u8, r: *NxPngResult) -> i64 { 119 eg_w(" " as *u8); eg_w(tag) 120 eg_w(" decoded " as *u8); eg_n(r.header.width); eg_w("x" as *u8); eg_n(r.header.height) 121 eg_w(" channels=" as *u8); eg_n(r.n_channels) 122 eg_w(" bytes=" as *u8); eg_n(r.pixels_size) 123 eg_w(" qstep=" as *u8); eg_n(eg_qstep(r.header.width, r.header.height)) 124 eg_w("\n" as *u8) 125 return 0 126} 127 128func main() -> i64 { 129 let ctr: *i64 = gv_ctr() 130 gv_head("=== NX-CRAFT EROSION SHOT gate (the PUBLISHED before/after pair, decoded) ===" as *u8) 131 132 let co: *NxPngResult = eg_load(EG_CRAFT_OFF) 133 let cn: *NxPngResult = eg_load(EG_CRAFT_ON) 134 let bo: *NxPngResult = eg_load(EG_FLAT_OFF) 135 let bn: *NxPngResult = eg_load(EG_FLAT_ON) 136 var loaded: i64 = 0 137 if (co as i64) != 0 { loaded = loaded + 1 } 138 if (cn as i64) != 0 { loaded = loaded + 1 } 139 if (bo as i64) != 0 { loaded = loaded + 1 } 140 if (bn as i64) != 0 { loaded = loaded + 1 } 141 eg_w(" published frames that decoded: " as *u8); eg_n(loaded) 142 eg_w(" of " as *u8); eg_n(EG_SUBJECTS); eg_w("\n" as *u8) 143 gv_check("all four published frames are present in the docroot and DECODE with the estate's own PNG decoder -- the same bytes a browser is handed" as *u8, (loaded == EG_SUBJECTS) as i64, ctr) 144 if loaded != EG_SUBJECTS { 145 // ABSTAIN, DO NOT ACQUIT. Every tooth below reads pixels; with a frame missing they would 146 // pass on the empty set, which is the vacuous-tooth defect wearing a publish costume. 147 eg_w(" REFUSING TO SCORE THE REST: a missing or undecodable frame makes every pixel tooth\n" as *u8) 148 eg_w(" below vacuous. Run nx_craft_erosion_shot for both worlds, then re-run this gate.\n" as *u8) 149 return gv_verdict("CRAFT-EROSION-SHOT-GATE" as *u8, ctr, "the published erosion pair could not be read, so nothing about it was asserted" as *u8) 150 } 151 gv_subjects("published frames decoded and measured" as *u8, EG_SUBJECTS, ctr) 152 eg_describe("craft_off" as *u8, co) 153 eg_describe("craft_on " as *u8, cn) 154 eg_describe("flat_off " as *u8, bo) 155 eg_describe("flat_on " as *u8, bn) 156 157 // (1) THE FRAMES ARE THIS RENDERER'S FRAMES. A picture of the right thing at the wrong size did 158 // not come out of this module, and a pair captured at two different sizes is not an A/B at all. 159 var steps_ok: i64 = 0 160 if eg_qstep(co.header.width, co.header.height) > 0 { 161 if eg_qstep(cn.header.width, cn.header.height) > 0 { 162 if eg_qstep(bo.header.width, bo.header.height) > 0 { 163 if eg_qstep(bn.header.width, bn.header.height) > 0 { steps_ok = 1 } } } } 164 gv_check("every published frame is a legitimate quality step of the SHIPPED module: its dimensions are exactly (W/q, H/q) for an integer q in 1..Q_MAX, so the picture came out of this renderer and not from somewhere else" as *u8, steps_ok, ctr) 165 166 var samesize: i64 = 0 167 if co.header.width == cn.header.width { 168 if co.header.height == cn.header.height { 169 if bo.header.width == bn.header.width { 170 if bo.header.height == bn.header.height { samesize = 1 } } } } 171 gv_check("each pair shares ONE frame size, so the before/after compares like with like -- two frames at different resolutions would differ everywhere for a reason that is not erosion" as *u8, samesize, ctr) 172 if samesize == 0 { 173 return gv_verdict("CRAFT-EROSION-SHOT-GATE" as *u8, ctr, "the published frames are not comparable geometry, so no pixel difference was asserted" as *u8) 174 } 175 176 // (2) BOTH SIDES ARE VARIED. A pair of black rectangles differ in zero pixels and a pair where 177 // one side is black would still "differ" -- so variety is asserted on BOTH frames, separately 178 // from the difference, and the detector that says so is bite-proven immediately below. 179 let cnp: i64 = co.header.width * co.header.height * co.bytes_per_pix 180 let flat_co: i64 = eg_is_flat(co.pixels, cnp) 181 let flat_cn: i64 = eg_is_flat(cn.pixels, cnp) 182 eg_w(" variety: craft_off flat=" as *u8); eg_n(flat_co) 183 eg_w(" craft_on flat=" as *u8); eg_n(flat_cn); eg_w("\n" as *u8) 184 var both_varied: i64 = 0 185 if flat_co == 0 { if flat_cn == 0 { both_varied = 1 } } 186 gv_check("BOTH published craft frames are VARIED -- an all-black or single-colour capture publishes as a perfectly valid PNG, and a pair containing one would prove nothing while looking exactly like evidence" as *u8, both_varied, ctr) 187 188 // the bite: the variety detector must FIRE on a frame that really is flat, or its silence on the 189 // real frames is worth nothing. The bad input is synthesised here at the real frame's own size. 190 let flatbuf: *u8 = sys_mmap(cnp + EG_BOX) 191 var f: i64 = 0 192 while f < cnp { flatbuf[f] = EG_FLATVAL as u8; f = f + 1 } 193 gv_bite("neg-control-the-variety-detector-fires-on-a-flat-frame: a synthetic single-colour frame of the published frame's own size is judged FLAT, while the real published frame is not" as *u8, eg_is_flat(flatbuf, cnp), eg_is_flat(cn.pixels, cnp), ctr) 194 sys_munmap(flatbuf, cnp + EG_BOX) 195 196 // (3) THE HEADLINE: the opted-in world is a DIFFERENT PICTURE. 197 let cdiff: i64 = eg_diff_px(co, cn) 198 let cpix: i64 = co.header.width * co.header.height 199 var cperm: i64 = 0 200 if cpix > 0 { cperm = cdiff*EG_PERMIL/cpix } 201 eg_w(" craft (OPTED IN, spec idx 64 = 1): differing pixels " as *u8); eg_n(cdiff) 202 eg_w(" of " as *u8); eg_n(cpix) 203 eg_w(" = " as *u8); eg_n(cperm); eg_w(" permil\n" as *u8) 204 gv_check("EROSION IS VISIBLE: the world that opted in publishes two DIFFERENT pictures -- more than zero pixels change between budget 0 and budget 1 at the same seed, same variant, same camera" as *u8, (cdiff > 0) as i64, ctr) 205 206 // (4) THE CONTROL, AND IT CARRIES TWO PROOFS AT ONCE. A world asked for with NO RELIEF has no 207 // slope steeper than its own average, so the measured talus is zero and erosion turns itself 208 // off -- which means budget 0 and budget 1 describe the SAME world. Two full, independent 209 // worldgen-and-render passes must therefore produce a PIXEL-IDENTICAL frame, and that single 210 // fact proves BOTH that the capture is deterministic AND that the operator does nothing without 211 // slopes. An implementation that painted noise, drifted with wall-clock time, added an offset or 212 // blurred the ground would fail it no matter what erosion did elsewhere. 213 let bdiff: i64 = eg_diff_px(bo, bn) 214 let bpix: i64 = bo.header.width * bo.header.height 215 eg_w(" flat control (P_TAMP1=0, P_TAMP2=0, rendered at BOTH budgets): differing pixels " as *u8); eg_n(bdiff) 216 eg_w(" of " as *u8); eg_n(bpix); eg_w(" (must be 0)\n" as *u8) 217 gv_check("neg-control-a-world-with-NO-RELIEF-publishes-two-IDENTICAL-frames: asked for erosion, a flat world measures zero talus, the operator turns itself off, and two independent worldgen-and-render passes agree on every pixel -- so this capture is deterministic AND cannot be manufacturing differences on its own" as *u8, (bdiff == 0) as i64, ctr) 218 219 // (5) DISCRIMINATION, not merely presence: the opted-in world must move MORE than the control. 220 // Stated as a comparison rather than a threshold on purpose -- a permil bar would be a number 221 // picked by taste, while "more than the world where erosion is off" is the actual claim. 222 gv_check("THE DIFFERENCE IS ATTRIBUTABLE TO THE TERRAIN: the craft pair differ in strictly more pixels than the flat control pair, so the change tracks real slopes being shed and not the capture" as *u8, (cdiff > bdiff) as i64, ctr) 223 224 return gv_verdict("CRAFT-EROSION-SHOT-GATE" as *u8, ctr, "the published before/after pair was decoded as a browser would decode it: both frames varied, the eroded world different, the world with no relief pixel-identical" as *u8) 225}