nx_domain_admit_gate.nx source

1// nx_domain_admit_gate.nx -- THE GATE FOR THE ADMISSION GATE. 2// 3// THE ABSENCE THIS CLOSES, quoted from the ship loop on 2026-08-25: 4// "PROVE NO-GATE-FOUND -- a NAMED absence, NOT a pass: NOTHING about this target has been proven." 5// nx_domain_admit decides whether every /compare domain may publish. It shipped TWO changes that day -- 6// C3 (resolve <domain>.gates in BOTH trees) and C4 (fresh-kill read from the bite records) -- with no 7// proof of its own. The organ that refuses on everyone else's behalf was the one thing nothing refused. 8// 9// WHAT IS UNDER TEST is the PURE decision core in nx_domain_admit_lib.nx, driven IN-PROCESS. This gate 10// deliberately does NOT fork an admission run: forking the deployed elf would make every mutant come 11// back NOT-REACHED, so the resulting GREEN would read exactly like a proof while proving nothing, and it 12// would also measure whatever the live /compare tree happened to contain this minute rather than the 13// code. Fixtures are built IN MEMORY where possible and under /tmp/nx_domain_admit_gate/ where a real 14// file is genuinely required -- never under knowledge/store, because a gate that shares a fixture with a 15// production beat measures the beat and not the code. 16// 17// THE ONE THING MEASURED AGAINST LIVE DATA is the C3 regression, and it is guarded by a PRECONDITION 18// rather than asserted: if knowledge/compare/lang.gates ever moves, this gate SKIPs with the missing 19// precondition named. A domain changing under the gate must never be able to turn it RED. 20// 21// ANTI-VACUITY, stated up front because "the classifier agrees with itself" is trivially true: 22// - da_wfind is proven to REFUSE a prefix, a suffix and an inner substring, and to skip a prefix hit 23// and find the real standalone occurrence later in the same buffer. A plain substring matcher passes 24// every other wfind tooth on this gate and fails that one. 25// - da_classify_row is proven to return FOUR DISTINCT values, so a constant classifier cannot pass. 26// - da_c4_partition is proven to reach all three buckets AND to report nothing on the empty map. 27// - every refusal is a gv_bite: it must fire on the crafted bad input and stay silent on the good one. 28// 100 percent sovereign. No hardware writes (Rule 26). license_tier: ORIGINAL expect_exit: 0 29import "nx_syscalls.nx" 30import "nx_gate_verdict.nx" 31import "nx_domain_admit_lib.nx" 32 33// 0755 for the fixture directories, 0644 for the fixture files -- the same octal-as-decimal spelling the 34// subject uses for DA_MODE_0644, named rather than repeated as a bare literal. 35const DG_MODE_DIR: i64 = 493 36const DG_MODE_FILE: i64 = 420 37const DG_ROOT: *u8 = "/tmp/nx_domain_admit_gate" 38const DG_D1: *u8 = "/tmp/nx_domain_admit_gate/d1" 39const DG_D2: *u8 = "/tmp/nx_domain_admit_gate/d2" 40// da_read_2dir concatenates <dir><domain><suffix>, so these MUST carry the trailing slash. 41const DG_D1S: *u8 = "/tmp/nx_domain_admit_gate/d1/" 42const DG_D2S: *u8 = "/tmp/nx_domain_admit_gate/d2/" 43const DG_ORGAN: *u8 = "/tmp/nx_domain_admit_gate/organ_a.nx" 44// NEVER CREATED. The C4 never-bitten bucket is only reachable if this really is absent, so the gate 45// asserts that before it believes the bucket -- assert the fixture reached the condition. 46const DG_MISSING_ORGAN: *u8 = "/tmp/nx_domain_admit_gate/organ_absent.nx" 47const DG_BITEPFX: *u8 = "/tmp/nx_domain_admit_gate/bite_" 48const DG_BITE_PROVEN: *u8 = "/tmp/nx_domain_admit_gate/bite_g_proven.verdict" 49const DG_BITE_ZERO: *u8 = "/tmp/nx_domain_admit_gate/bite_g_zero.verdict" 50const DG_BITE_NEVER: *u8 = "/tmp/nx_domain_admit_gate/bite_g_never.verdict" 51// The organ fixture declares da_landed_sym. da_landed is a PREFIX of it and must NOT ground a row; that 52// prefix tolerance is the defect the ADMISSION_STANDARD repaired across 11 rows in arrears. 53const DG_ORGAN_SRC: *u8 = "func da_landed_sym(a: i64) -> i64 { return 0 }\n" 54const DG_BUF: i64 = 4096 55const DG_SMALL: i64 = 256 56// The four da_classify_row outcomes, named so each tooth reads as the claim it makes. 57const DG_CLS_GAP: i64 = 0 58const DG_CLS_GROUNDED: i64 = 1 59const DG_CLS_UNGROUNDED: i64 = 2 60const DG_CLS_UNREADABLE: i64 = 3 61// The FIFTH outcome (2026-08-27): a WATCH contract on an organ that does not exist yet. Its own class 62// because it is neither a fault nor the plain gap -- the reasoning travels with da_classify_row. 63const DG_CLS_WATCHNEW: i64 = 4 64// Fixture bite records. killed=2 is bite-proven; killed=0 is a run that killed nothing, which is NOT the 65// same finding as no run at all -- the whole point of C4. 66const DG_REC_PROVEN: *u8 = "killed=2 valid_mutants=3 invalid=0 epoch=17 host=probe\n" 67const DG_REC_ZERO: *u8 = "killed=0 valid_mutants=1 invalid=0 epoch=17 host=probe\n" 68// The two-tree fixture: d1 and d2 hold DIFFERENT bytes for the same domain, so the tooth can prove WHICH 69// tree won rather than merely that something was found. 70const DG_D1_BODY: *u8 = "AAA\n" 71const DG_D2_BODY: *u8 = "BBBBBBBB\n" 72const DG_D2_ONLY: *u8 = "BB\n" 73const DG_CH_A: i64 = 65 74const DG_CH_B: i64 = 66 75 76// ---- C5 fixtures: the second method class ---- 77// A carrier holding a REAL row that is explicitly not signed -- class, verdict, scope, ran, witness, 78// observed, signer, and no pub= or sig= anywhere. This is the shape dcc carries today. 79const DG_EV_UNSIGNED: *u8 = "class=experiential verdict=fail scope=a-real-scope ran=r witness=an-outside-engine observed=o signer=nishi-machine-attestor\n" 80// A line whose class token is none of the five the verifier declares. It must NOT be admitted, and it must 81// NOT vanish: an unadmitted row that is also uncounted makes a populated carrier read ABSENT. 82const DG_EV_UNKNOWNCLASS: *u8 = "class=vibes verdict=pass scope=s witness=w signer=x\n" 83const DG_LIVE_EVCLASS: *u8 = "knowledge/status/evclass_typography.conf" 84const DG_SCOPETAG: *u8 = "scope=" 85const DG_HEX0: i64 = 48 86const DG_EVCAP: i64 = 65536 87// ---- C6 fixtures: the evidence stamp, in the exact shape ev_stamp writes ---- 88const DG_STAMP_OK: *u8 = "ok=1 epoch=17 grounded=18/18 gates=1/1 declared=1 hashed=1 redseen=1 host=h dig=d\n" 89const DG_STAMP_RED: *u8 = "ok=0 epoch=17 grounded=17/18 gates=0/1 declared=1 hashed=1 redseen=1 host=h dig=d\n" 90// ZERO present axes: the stamp did not judge the domain harshly, it never read it. Measured live on dcc. 91const DG_STAMP_BLIND: *u8 = "ok=0 epoch=17 grounded=0/0 gates=6/6 declared=6 hashed=6 redseen=6 host=h dig=d\n" 92const DG_MATBODY: *u8 = "L|runtime/x.nx|s|c1\n" 93const DG_AXESBODY: *u8 = "axis|a\n" 94const DG_BOARD_MAT_FIX: *u8 = "/tmp/nx_domain_admit_gate/d1/probe.matrix" 95const DG_BOARD_AXES_FIX: *u8 = "/tmp/nx_domain_admit_gate/d1/axesonly.axes" 96// The number of pairwise-distinct comparisons the four C5 states owe each other: 4 choose 2. 97const DG_C5_PAIRS: i64 = 6 98const DG_C6_PAIRS: i64 = 6 99const DG_STAMP_ABSENT_FIELDS: i64 = 5 100 101func dg_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 } 102func dg_pos(v: i64) -> i64 { if v > 0 { return 1 } return 0 } 103func dg_neg(v: i64) -> i64 { if v < 0 { return 1 } return 0 } 104func dg_streq(a: *u8, b: *u8) -> i64 { 105 var i: i64 = 0 106 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 107 if b[i] != (0 as u8) { return 0 } 108 return 1 109} 110func dg_write(path: *u8, content: *u8) -> i64 { 111 let fd: i64 = sys_openat_wr(path, DG_MODE_FILE) 112 if fd < 0 { return 0 - 1 } 113 let n: i64 = da_slen(content) 114 var off: i64 = 0 115 while off < n { 116 let r: i64 = sys_write(fd, ((content as i64) + off) as *u8, n - off) 117 if r <= 0 { sys_close(fd); return 0 - 2 } 118 off = off + r 119 } 120 sys_close(fd) 121 return n 122} 123// word-boundary search of a NUL-terminated haystack for a NUL-terminated needle 124func dg_find(hay: *u8, ned: *u8) -> i64 { return da_wfind(hay, da_slen(hay), ned, 0, da_slen(ned)) } 125// Build a matrix row "L|<organ>|<symbol>|c1" into buf and report the three pipe offsets da_classify_row 126// takes. Built in memory so no /compare file can change what this gate measures. 127func dg_row(buf: *u8, organ: *u8, sym: *u8, pp: *i64) -> i64 { 128 var o: i64 = da_cat(buf, 0, "L" as *u8) 129 pp[0] = o; buf[o] = DA_PIPE as u8; o = o + 1 130 o = da_cat(buf, o, organ) 131 pp[1] = o; buf[o] = DA_PIPE as u8; o = o + 1 132 o = da_cat(buf, o, sym) 133 pp[2] = o; buf[o] = DA_PIPE as u8; o = o + 1 134 o = da_cat(buf, o, "c1" as *u8) 135 buf[o] = 0 as u8 136 return o 137} 138func dg_cls(buf: *u8, pp: *i64, sb: *u8, organ: *u8, sym: *u8) -> i64 { 139 dg_row(buf, organ, sym, pp) 140 return da_classify_row(buf, pp[0], pp[1], pp[2], sb) 141} 142// tenths over a NUL-terminated literal 143func dg_tenths(s: *u8) -> i64 { return da_tenths(s, 0, da_slen(s)) } 144// whole-line membership over a NUL-terminated set and a NUL-terminated candidate 145func dg_has(set: *u8, cand: *u8) -> i64 { return da_hasline(set, da_slen(set), cand, 0, da_slen(cand)) } 146func dg_kv(buf: *u8, key: *u8) -> i64 { return da_kv(buf, da_slen(buf), key) } 147// den/class/shape over NUL-terminated literals -- the LENGTH is derived from the literal at every call 148// site, so a fixture can be retitled without silently moving the window every tooth reads. 149func dg_den(s: *u8, key: *u8) -> i64 { return da_kv_den(s, da_slen(s), key) } 150func dg_rowclass(s: *u8) -> i64 { return da_row_class(s, 0, da_slen(s)) } 151func dg_shape(s: *u8, e: i64) -> i64 { return da_row_signed_shape(s, 0, e) } 152 153func main(argc: i64, argv: *i64) -> i64 { 154 let ctr: *i64 = gv_ctr() 155 gv_head("nx_domain_admit_gate -- the pure decision core of the /compare admission gate, in-process" as *u8) 156 157 // ---------------- SETUP: fixtures, then PROVE they reached the condition ---------------- 158 sys_mkdir(DG_ROOT, DG_MODE_DIR) 159 sys_mkdir(DG_D1, DG_MODE_DIR) 160 sys_mkdir(DG_D2, DG_MODE_DIR) 161 let worg: i64 = dg_write(DG_ORGAN, DG_ORGAN_SRC) 162 let wpr: i64 = dg_write(DG_BITE_PROVEN, DG_REC_PROVEN) 163 let wze: i64 = dg_write(DG_BITE_ZERO, DG_REC_ZERO) 164 let p1b: i64 = dg_write("/tmp/nx_domain_admit_gate/d1/probe.gates" as *u8, DG_D1_BODY) 165 let p2b: i64 = dg_write("/tmp/nx_domain_admit_gate/d2/probe.gates" as *u8, DG_D2_BODY) 166 let p3b: i64 = dg_write("/tmp/nx_domain_admit_gate/d2/onlyb.gates" as *u8, DG_D2_ONLY) 167 let sb: *u8 = sys_mmap(DA_SCAP) 168 let vb: *u8 = sys_mmap(DG_BUF) 169 let rowb: *u8 = sys_mmap(DG_BUF) 170 let pp: *i64 = sys_mmap(DG_SMALL) as *i64 171 let out: *i64 = sys_mmap(DG_SMALL) as *i64 172 let out2: *i64 = sys_mmap(DG_SMALL) as *i64 173 let out3: *i64 = sys_mmap(DG_SMALL) as *i64 174 175 da_w(" fixtures: organ=" as *u8); da_n(worg) 176 da_w("B proven_rec=" as *u8); da_n(wpr) 177 da_w("B zero_rec=" as *u8); da_n(wze) 178 da_w("B d1=" as *u8); da_n(p1b) 179 da_w("B d2=" as *u8); da_n(p2b) 180 da_w("B d2only=" as *u8); da_n(p3b); da_w("B\n" as *u8) 181 182 var setup: i64 = 0 183 if worg > 0 { if wpr > 0 { if wze > 0 { if p1b > 0 { if p2b > 0 { if p3b > 0 { setup = 1 } } } } } } 184 gv_need("the /tmp/nx_domain_admit_gate fixture set could be written" as *u8, setup, ctr) 185 186 // The never-bitten bucket is only reachable if this record really is absent. A stale file left by an 187 // earlier run would silently move a gate from that bucket into another and the partition would still 188 // sum, so the absence is asserted rather than assumed -- and it makes this gate idempotent. 189 let nevern: i64 = dp_read(DG_BITE_NEVER, vb, DG_BUF - 8) 190 gv_check("fixture-the-never-bitten-record-is-genuinely-absent" as *u8, dg_eq(dg_pos(nevern), 0), ctr) 191 let missn: i64 = dp_read(DG_MISSING_ORGAN, vb, DG_BUF - 8) 192 gv_check("fixture-the-unreadable-organ-path-is-genuinely-absent" as *u8, dg_eq(dg_pos(missn), 0), ctr) 193 194 // ---------------- da_isword: the word-boundary alphabet ---------------- 195 gv_check("isword-accepts-a-digit" as *u8, dg_eq(da_isword(48), 1), ctr) 196 gv_check("isword-accepts-an-upper-letter" as *u8, dg_eq(da_isword(90), 1), ctr) 197 gv_check("isword-accepts-a-lower-letter" as *u8, dg_eq(da_isword(97), 1), ctr) 198 gv_check("isword-accepts-underscore" as *u8, dg_eq(da_isword(95), 1), ctr) 199 gv_check("isword-rejects-dot-slash-space-and-pipe" as *u8, dg_eq(da_isword(46) + da_isword(47) + da_isword(32) + da_isword(124), 0), ctr) 200 201 // ---------------- da_wfind: THE LIAR-KILL MECHANISM ---------------- 202 let w_stand: *u8 = "x da_foo y" 203 let w_prefix: *u8 = "da_foobar" 204 let w_suffix: *u8 = "xxda_foo" 205 let w_inner: *u8 = "a_da_foo_b" 206 let w_start: *u8 = "da_foo tail" 207 let w_end: *u8 = "head da_foo" 208 let w_punct: *u8 = "(da_foo)" 209 let w_multi: *u8 = "da_foobar da_foo" 210 let n_stand: i64 = dg_find(w_stand, "da_foo" as *u8) 211 let n_prefix: i64 = dg_find(w_prefix, "da_foo" as *u8) 212 let n_suffix: i64 = dg_find(w_suffix, "da_foo" as *u8) 213 let n_inner: i64 = dg_find(w_inner, "da_foo" as *u8) 214 let n_multi: i64 = dg_find(w_multi, "da_foo" as *u8) 215 da_w(" wfind: standalone=" as *u8); da_n(n_stand) 216 da_w(" prefix=" as *u8); da_n(n_prefix) 217 da_w(" suffix=" as *u8); da_n(n_suffix) 218 da_w(" inner=" as *u8); da_n(n_inner) 219 da_w(" multi=" as *u8); da_n(n_multi); da_w("\n" as *u8) 220 gv_check("wfind-matches-a-standalone-symbol-at-its-real-offset" as *u8, dg_eq(n_stand, 2), ctr) 221 gv_check("wfind-refuses-a-needle-that-is-only-a-PREFIX-of-a-longer-identifier" as *u8, dg_eq(n_prefix, 0 - 1), ctr) 222 gv_check("wfind-refuses-a-needle-that-is-only-a-SUFFIX-of-a-longer-identifier" as *u8, dg_eq(n_suffix, 0 - 1), ctr) 223 gv_check("wfind-refuses-a-needle-INSIDE-a-longer-identifier" as *u8, dg_eq(n_inner, 0 - 1), ctr) 224 gv_check("wfind-matches-at-offset-0-where-there-is-no-left-neighbour" as *u8, dg_eq(dg_find(w_start, "da_foo" as *u8), 0), ctr) 225 gv_check("wfind-matches-at-the-buffer-end-where-there-is-no-right-neighbour" as *u8, dg_eq(dg_find(w_end, "da_foo" as *u8), 5), ctr) 226 gv_check("wfind-treats-punctuation-as-a-boundary" as *u8, dg_eq(dg_find(w_punct, "da_foo" as *u8), 1), ctr) 227 // ANTI-VACUITY: a plain substring matcher returns 0 here (it stops at the prefix hit). Only a 228 // boundary-aware search skips it and reports the real standalone occurrence at offset 10. 229 gv_check("wfind-skips-a-prefix-hit-and-finds-the-real-standalone-occurrence-later" as *u8, dg_eq(n_multi, 10), ctr) 230 gv_check("wfind-refuses-an-empty-needle" as *u8, dg_eq(da_wfind(w_stand, da_slen(w_stand), "da_foo" as *u8, 0, 0), 0 - 1), ctr) 231 gv_check("wfind-refuses-a-needle-longer-than-the-haystack" as *u8, dg_eq(da_wfind("ab" as *u8, 2, "da_foo" as *u8, 0, 6), 0 - 1), ctr) 232 gv_bite("neg-control-wfind-refusal-fires-on-a-prefix-and-not-on-a-standalone" as *u8, dg_neg(n_prefix), dg_neg(n_stand), ctr) 233 gv_bite("neg-control-wfind-refusal-fires-on-a-suffix-and-not-on-a-standalone" as *u8, dg_neg(n_suffix), dg_neg(n_stand), ctr) 234 gv_bite("neg-control-wfind-refusal-fires-on-an-inner-substring-and-not-on-a-standalone" as *u8, dg_neg(n_inner), dg_neg(n_stand), ctr) 235 236 // ---------------- da_symstart: strip the watch contract prefix, and nothing else ---------------- 237 let sbuf: *u8 = sys_mmap(DG_BUF) 238 var so: i64 = da_cat(sbuf, 0, "_ABSENT_:da_x" as *u8) 239 gv_check("symstart-strips-the-9-byte-_ABSENT_-contract-prefix" as *u8, dg_eq(da_symstart(sbuf, 0, so), 9), ctr) 240 so = da_cat(sbuf, 0, "da_x" as *u8) 241 gv_check("symstart-leaves-a-plain-symbol-untouched" as *u8, dg_eq(da_symstart(sbuf, 0, so), 0), ctr) 242 so = da_cat(sbuf, 0, "_ABSENT_" as *u8) 243 gv_check("symstart-leaves-the-bare-_ABSENT_-gap-untouched" as *u8, dg_eq(da_symstart(sbuf, 0, so), 0), ctr) 244 so = da_cat(sbuf, 0, "_ABSENT_:" as *u8) 245 gv_check("symstart-leaves-a-contract-prefix-with-NO-symbol-after-it-untouched" as *u8, dg_eq(da_symstart(sbuf, 0, so), 0), ctr) 246 let sm_watch: i64 = da_cat(sbuf, 0, "_ABSENT_:da_x" as *u8) 247 let moved_watch: i64 = dg_pos(da_symstart(sbuf, 0, sm_watch)) 248 let sm_plain: i64 = da_cat(sbuf, 0, "da_xxxxxxxxxxxx" as *u8) 249 let moved_plain: i64 = dg_pos(da_symstart(sbuf, 0, sm_plain)) 250 gv_bite("neg-control-symstart-moves-only-for-a-real-contract-prefix" as *u8, moved_watch, moved_plain, ctr) 251 252 // ---------------- da_classify_row: all FOUR outcomes ---------------- 253 let c_grounded: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "da_landed_sym" as *u8) 254 let c_gap: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "_ABSENT_" as *u8) 255 let c_watch_land: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "_ABSENT_:da_landed_sym" as *u8) 256 let c_watch_open: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "_ABSENT_:da_never_landed" as *u8) 257 let c_ungrounded: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "da_not_there" as *u8) 258 let c_unreadable: i64 = dg_cls(rowb, pp, sb, DG_MISSING_ORGAN, "da_landed_sym" as *u8) 259 let c_watch_new: i64 = dg_cls(rowb, pp, sb, DG_MISSING_ORGAN, "_ABSENT_:da_landed_sym" as *u8) 260 let c_prefix: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "da_landed" as *u8) 261 da_w(" classify: grounded=" as *u8); da_n(c_grounded) 262 da_w(" gap=" as *u8); da_n(c_gap) 263 da_w(" watch_landed=" as *u8); da_n(c_watch_land) 264 da_w(" watch_open=" as *u8); da_n(c_watch_open) 265 da_w(" ungrounded=" as *u8); da_n(c_ungrounded) 266 da_w(" unreadable=" as *u8); da_n(c_unreadable) 267 da_w(" prefix_claim=" as *u8); da_n(c_prefix); da_w("\n" as *u8) 268 gv_check("classify-a-real-symbol-present-in-the-organ-its-row-names-is-GROUNDED" as *u8, dg_eq(c_grounded, DG_CLS_GROUNDED), ctr) 269 gv_check("classify-a-bare-_ABSENT_-is-a-DECLARED-GAP" as *u8, dg_eq(c_gap, DG_CLS_GAP), ctr) 270 gv_check("classify-a-watch-contract-whose-symbol-HAS-landed-is-GROUNDED" as *u8, dg_eq(c_watch_land, DG_CLS_GROUNDED), ctr) 271 gv_check("classify-a-watch-contract-whose-symbol-has-NOT-landed-is-a-DECLARED-GAP-not-a-false-claim" as *u8, dg_eq(c_watch_open, DG_CLS_GAP), ctr) 272 gv_check("classify-a-claimed-symbol-absent-from-its-own-organ-is-UNGROUNDED" as *u8, dg_eq(c_ungrounded, DG_CLS_UNGROUNDED), ctr) 273 gv_check("classify-an-organ-path-that-cannot-be-read-is-ORGAN-UNREADABLE" as *u8, dg_eq(c_unreadable, DG_CLS_UNREADABLE), ctr) 274 // THE FIFTH OUTCOME (2026-08-27). A plan for a new product names organs nobody has written yet; a watch 275 // contract on such a path asserts nothing about a file, so it must be neither the fault (3) nor the plain 276 // gap (0). Measured on the synthroom admission, where 19 of 20 contracts were refused as unreadable. 277 da_w(" classify: watch_new_organ=" as *u8); da_n(c_watch_new); da_w("\n" as *u8) 278 gv_check("classify-a-WATCH-contract-on-an-organ-that-does-not-exist-yet-is-a-NEW-ORGAN-contract-not-a-fault" as *u8, dg_eq(c_watch_new, DG_CLS_WATCHNEW), ctr) 279 gv_check("classify-the-new-organ-class-is-DISTINCT-from-unreadable-and-from-the-plain-gap" as *u8, dg_eq(dg_eq(c_watch_new, c_unreadable) + dg_eq(c_watch_new, c_gap), 0), ctr) 280 gv_bite("neg-control-the-new-organ-class-fires-for-a-WATCH-row-on-an-absent-organ-and-not-for-a-bare-claim-on-it" as *u8, dg_eq(c_watch_new, DG_CLS_WATCHNEW), dg_eq(c_unreadable, DG_CLS_WATCHNEW), ctr) 281 // THE LIAR-KILL AT ROW LEVEL: the organ declares da_landed_sym, so a row claiming da_landed is 282 // asserting coverage no file backs. A substring-based classifier calls this GROUNDED. 283 gv_check("classify-a-row-claiming-only-a-PREFIX-of-a-declared-symbol-is-UNGROUNDED" as *u8, dg_eq(c_prefix, DG_CLS_UNGROUNDED), ctr) 284 // ANTI-VACUITY: a constant classifier passes any single tooth above. Four distinct answers cannot be 285 // produced by one. 286 var distinct: i64 = 0 287 if c_gap != c_grounded { if c_grounded != c_ungrounded { if c_ungrounded != c_unreadable { if c_gap != c_ungrounded { if c_gap != c_unreadable { if c_grounded != c_unreadable { distinct = 1 } } } } } } 288 gv_check("classify-returns-FOUR-DISTINCT-outcomes-so-it-cannot-be-a-constant" as *u8, distinct, ctr) 289 gv_bite("neg-control-ungrounded-fires-on-a-false-claim-and-not-on-a-true-one" as *u8, dg_eq(c_ungrounded, DG_CLS_UNGROUNDED), dg_eq(c_grounded, DG_CLS_UNGROUNDED), ctr) 290 gv_bite("neg-control-unreadable-fires-on-a-bad-path-and-not-on-a-readable-organ" as *u8, dg_eq(c_unreadable, DG_CLS_UNREADABLE), dg_eq(c_grounded, DG_CLS_UNREADABLE), ctr) 291 // The historical defect, as a control: the SAME undelivered symbol must read UNGROUNDED when it is 292 // claimed outright and NOT UNGROUNDED when it is declared as a watch contract. 293 let c_open_plain: i64 = dg_cls(rowb, pp, sb, DG_ORGAN, "da_never_landed" as *u8) 294 gv_bite("neg-control-a-watch-contract-is-exempt-from-the-false-claim-verdict-a-bare-claim-is-not" as *u8, dg_eq(c_open_plain, DG_CLS_UNGROUNDED), dg_eq(c_watch_open, DG_CLS_UNGROUNDED), ctr) 295 296 // ---------------- da_tenths ---------------- 297 da_w(" tenths: 1.5=" as *u8); da_n(dg_tenths("1.5" as *u8)) 298 da_w(" 2=" as *u8); da_n(dg_tenths("2" as *u8)) 299 da_w(" 0.5=" as *u8); da_n(dg_tenths("0.5" as *u8)) 300 da_w(" 1.25=" as *u8); da_n(dg_tenths("1.25" as *u8)) 301 da_w(" nodigit=" as *u8); da_n(dg_tenths("u" as *u8)) 302 da_w(" zero=" as *u8); da_n(dg_tenths("0" as *u8)); da_w("\n" as *u8) 303 gv_check("tenths-1.5-is-15" as *u8, dg_eq(dg_tenths("1.5" as *u8), 15), ctr) 304 gv_check("tenths-2-is-20" as *u8, dg_eq(dg_tenths("2" as *u8), 20), ctr) 305 gv_check("tenths-0.5-is-5" as *u8, dg_eq(dg_tenths("0.5" as *u8), 5), ctr) 306 gv_check("tenths-truncates-past-one-decimal-1.25-is-12-not-13" as *u8, dg_eq(dg_tenths("1.25" as *u8), 12), ctr) 307 gv_check("tenths-an-empty-field-is-minus-one" as *u8, dg_eq(da_tenths("" as *u8, 0, 0), 0 - 1), ctr) 308 gv_check("tenths-a-field-with-no-digit-is-minus-one" as *u8, dg_eq(dg_tenths("u" as *u8), 0 - 1), ctr) 309 // AN UNESTIMATED RUNG IS NOT A RUNG ESTIMATED AT ZERO. 310 gv_check("tenths-an-explicit-zero-is-0-and-is-NOT-the-same-answer-as-no-digit" as *u8, dg_eq(dg_tenths("0" as *u8), 0), ctr) 311 gv_bite("neg-control-tenths-minus-one-fires-for-no-digit-and-not-for-an-explicit-zero" as *u8, dg_neg(dg_tenths("u" as *u8)), dg_neg(dg_tenths("0" as *u8)), ctr) 312 313 // ---------------- da_count_lines / da_hasline: the ratchet's set logic ---------------- 314 let setbuf: *u8 = "alpha\nbeta\nalphabet\n" 315 gv_check("count_lines-counts-terminated-lines" as *u8, dg_eq(da_count_lines("a\nb\n" as *u8, 4), 2), ctr) 316 gv_check("count_lines-does-not-count-an-unterminated-tail" as *u8, dg_eq(da_count_lines("a\nb" as *u8, 3), 1), ctr) 317 gv_check("count_lines-of-an-empty-buffer-is-zero" as *u8, dg_eq(da_count_lines("" as *u8, 0), 0), ctr) 318 gv_check("hasline-finds-a-whole-line-member" as *u8, dg_eq(dg_has(setbuf, "beta" as *u8), 1), ctr) 319 gv_check("hasline-finds-the-first-line-of-the-set" as *u8, dg_eq(dg_has(setbuf, "alpha" as *u8), 1), ctr) 320 gv_check("hasline-refuses-a-PREFIX-of-a-member" as *u8, dg_eq(dg_has(setbuf, "bet" as *u8), 0), ctr) 321 gv_check("hasline-refuses-a-member-with-extra-trailing-bytes" as *u8, dg_eq(dg_has(setbuf, "betaX" as *u8), 0), ctr) 322 gv_check("hasline-refuses-a-line-that-EXTENDS-a-member-alpha-does-not-match-alphabet" as *u8, dg_eq(da_hasline("alphabet\n" as *u8, 9, "alpha" as *u8, 0, 5), 0), ctr) 323 gv_check("hasline-over-an-EMPTY-set-is-false-not-vacuously-true" as *u8, dg_eq(da_hasline("" as *u8, 0, "beta" as *u8, 0, 4), 0), ctr) 324 gv_bite("neg-control-hasline-fires-on-a-member-and-not-on-its-prefix" as *u8, dg_has(setbuf, "beta" as *u8), dg_has(setbuf, "bet" as *u8), ctr) 325 326 // ---------------- da_kv: ABSENT is not ZERO. This distinction IS C4. ---------------- 327 let kvrec: *u8 = "killed=2 valid_mutants=3 invalid=0 epoch=17 host=probe" 328 let k_killed: i64 = dg_kv(kvrec, "killed" as *u8) 329 let k_invalid: i64 = dg_kv(kvrec, "invalid" as *u8) 330 let k_absent: i64 = dg_kv(kvrec, "nosuchkey" as *u8) 331 da_w(" kv: killed=" as *u8); da_n(k_killed) 332 da_w(" invalid=" as *u8); da_n(k_invalid) 333 da_w(" absent_key=" as *u8); da_n(k_absent); da_w("\n" as *u8) 334 gv_check("kv-reads-the-integer-after-the-key" as *u8, dg_eq(k_killed, 2), ctr) 335 gv_check("kv-reads-a-multi-word-key" as *u8, dg_eq(dg_kv(kvrec, "valid_mutants" as *u8), 3), ctr) 336 gv_check("kv-reads-a-key-present-with-value-ZERO-as-0" as *u8, dg_eq(k_invalid, 0), ctr) 337 gv_check("kv-reads-an-ABSENT-key-as-minus-one" as *u8, dg_eq(k_absent, 0 - 1), ctr) 338 // THE WHOLE POINT: no record of a kill, and a run that killed nothing, are different findings with 339 // different remedies. If these two ever compared equal, C4 could not tell them apart. 340 gv_check("kv-ABSENT-and-PRESENT-WITH-ZERO-are-different-answers" as *u8, dg_eq(dg_eq(k_absent, k_invalid), 0), ctr) 341 gv_check("kv-honours-the-word-boundary-notkilled-7-does-not-answer-for-killed" as *u8, dg_eq(dg_kv("notkilled=7 killed=3" as *u8, "killed" as *u8), 3), ctr) 342 gv_check("kv-a-key-with-no-equals-sign-is-ABSENT-not-zero" as *u8, dg_eq(dg_kv("killed 1" as *u8, "killed" as *u8), 0 - 1), ctr) 343 gv_check("kv-a-key-whose-value-is-not-a-digit-is-ABSENT-not-zero" as *u8, dg_eq(dg_kv("killed=x" as *u8, "killed" as *u8), 0 - 1), ctr) 344 gv_bite("neg-control-kv-minus-one-fires-for-an-absent-key-and-not-for-a-key-holding-zero" as *u8, dg_neg(k_absent), dg_neg(k_invalid), ctr) 345 346 // ---------------- C3: the <domain>.gates map resolved in BOTH trees, in ORDER ---------------- 347 let g_both: i64 = da_read_2dir(DG_D1S, DG_D2S, "probe" as *u8, DA_GATESSUF, sb, DA_SCAP - 4) 348 let both_first: i64 = sb[0] as i64 349 let g_only2: i64 = da_read_2dir(DG_D1S, DG_D2S, "onlyb" as *u8, DA_GATESSUF, sb, DA_SCAP - 4) 350 let only2_first: i64 = sb[0] as i64 351 let g_none: i64 = da_read_2dir(DG_D1S, DG_D2S, "nosuchdomain" as *u8, DA_GATESSUF, sb, DA_SCAP - 4) 352 da_w(" 2dir: both=" as *u8); da_n(g_both) 353 da_w("B first_byte=" as *u8); da_n(both_first) 354 da_w(" only_second=" as *u8); da_n(g_only2) 355 da_w("B first_byte=" as *u8); da_n(only2_first) 356 da_w(" neither=" as *u8); da_n(g_none); da_w("\n" as *u8) 357 gv_check("2dir-when-BOTH-trees-hold-the-map-the-FIRST-tree-wins" as *u8, dg_eq(both_first, DG_CH_A), ctr) 358 gv_check("2dir-when-only-the-SECOND-tree-holds-it-the-second-is-still-found" as *u8, dg_eq(only2_first, DG_CH_B), ctr) 359 gv_check("2dir-when-NEITHER-tree-holds-it-the-read-reports-nothing" as *u8, dg_eq(dg_pos(g_none), 0), ctr) 360 // The shipped constants ARE the 2026-08-25 fix. Pinning them here is what stops a silent revert to 361 // the single publishing-tree policy that read has_gates=0 for every domain in the estate. 362 gv_check("C3-the-gates-map-tree-is-knowledge-compare" as *u8, dg_streq(DA_GATESDIR, "knowledge/compare/" as *u8), ctr) 363 gv_check("C3-the-publishing-tree-is-buildroot-knowledge-compare" as *u8, dg_streq(DA_CDIRS, "buildroot/knowledge/compare/" as *u8), ctr) 364 gv_check("C3-the-two-trees-are-genuinely-different-paths" as *u8, dg_eq(dg_streq(DA_GATESDIR, DA_CDIRS), 0), ctr) 365 gv_bite("neg-control-2dir-returns-the-FIRST-tree-copy-only-when-the-first-tree-has-it" as *u8, dg_eq(both_first, DG_CH_A), dg_eq(only2_first, DG_CH_A), ctr) 366 gv_bite("neg-control-2dir-reports-nothing-only-when-neither-tree-has-it" as *u8, dg_eq(dg_pos(g_none), 0), dg_eq(dg_pos(g_both), 0), ctr) 367 368 // ---------------- C3 against LIVE data, precondition-guarded ---------------- 369 // knowledge/compare/lang.gates is real and its publishing-tree twin does not exist, so this pair is 370 // the 2026-08-25 regression itself: the shipped resolver finds it, the pre-fix one could not. 371 // A PRECONDITION, not an assertion: if the map ever moves, this gate SKIPs with the reason named. 372 let langn: i64 = da_gates_read("lang" as *u8, sb) 373 if gv_need("knowledge/compare/lang.gates is readable" as *u8, dg_pos(langn), ctr) == 1 { 374 let langold: i64 = da_read_2dir(DA_CDIRS, DA_CDIRS, "lang" as *u8, DA_GATESSUF, sb, DA_SCAP - 4) 375 da_w(" C3 live: shipped_resolver=" as *u8); da_n(langn) 376 da_w("B pre-fix-publishing-tree-only=" as *u8); da_n(langold); da_w("B\n" as *u8) 377 gv_check("C3-live-a-real-domain-whose-map-is-in-knowledge-compare-reads-has_gates-1" as *u8, dg_eq(dg_pos(langn), 1), ctr) 378 gv_check("C3-live-the-pre-fix-publishing-tree-only-policy-would-have-read-has_gates-0" as *u8, dg_eq(dg_pos(langold), 0), ctr) 379 } 380 381 // ---------------- C4: the fresh-kill partition ---------------- 382 // The gates map is built IN MEMORY. The leading comment byte is written rather than spelled in a 383 // string literal because this dialect does not admit that character inside one. 384 let gmap: *u8 = sys_mmap(DG_BUF) 385 var go: i64 = 0 386 gmap[go] = DA_HASH as u8; go = go + 1 387 go = da_cat(gmap, go, " a comment row -- must never be counted as declared\n" as *u8) 388 go = da_cat(gmap, go, "g_proven.elf|x|label|src\n" as *u8) 389 go = da_cat(gmap, go, "g_never.elf|x|label|src\n" as *u8) 390 go = da_cat(gmap, go, "g_zero.elf|x|label|src\n" as *u8) 391 go = da_cat(gmap, go, "a_row_with_no_pipe_at_all\n" as *u8) 392 let proven: i64 = da_c4_partition(gmap, go, DG_BITEPFX, out) 393 da_w(" C4 fixture: declared=" as *u8); da_n(out[0]) 394 da_w(" bite-proven=" as *u8); da_n(out[1]) 395 da_w(" never-bitten=" as *u8); da_n(out[2]) 396 da_w(" bitten-zero-kill=" as *u8); da_n(out[3]) 397 da_w(" sum=" as *u8); da_n(out[1] + out[2] + out[3]); da_w("\n" as *u8) 398 // BIND THE ASSERTION TO ITS DENOMINATOR: a partition over zero rows sums perfectly and proves nothing. 399 gv_check("C4-the-fixture-map-declared-exactly-the-three-piped-non-comment-rows" as *u8, dg_eq(out[0], 3), ctr) 400 gv_check("C4-bucket-BITE-PROVEN-is-reachable-and-holds-the-gate-whose-record-says-killed-2" as *u8, dg_eq(out[1], 1), ctr) 401 gv_check("C4-bucket-NEVER-BITTEN-is-reachable-and-holds-the-gate-with-no-record-at-all" as *u8, dg_eq(out[2], 1), ctr) 402 gv_check("C4-bucket-BITTEN-ZERO-KILL-is-reachable-and-holds-the-gate-whose-record-says-killed-0" as *u8, dg_eq(out[3], 1), ctr) 403 gv_check("C4-the-partition-SUMS-to-declared-every-declared-gate-is-in-exactly-one-bucket" as *u8, dg_eq(out[1] + out[2] + out[3], out[0]), ctr) 404 gv_check("C4-the-return-value-is-the-bite-proven-count" as *u8, dg_eq(proven, out[1]), ctr) 405 gv_check("C4-the-.elf-suffix-is-stripped-so-g_proven.elf-resolves-bite_g_proven.verdict" as *u8, dg_eq(out[1], 1), ctr) 406 // EMPTY SET: a partition over no rows must report no coverage, not a clean bill of health. 407 let emptyproven: i64 = da_c4_partition(gmap, 0, DG_BITEPFX, out2) 408 gv_check("C4-over-an-EMPTY-map-declares-nothing-and-proves-nothing" as *u8, dg_eq(out2[0] + out2[1] + out2[2] + out2[3] + emptyproven, 0), ctr) 409 // The bucket must be decided by the RECORD, not by the gate's name being present in the map. 410 let nokill: *u8 = "g_never.elf|x|label|src\ng_zero.elf|x|label|src\n" 411 let nokillproven: i64 = da_c4_partition(nokill, da_slen(nokill), DG_BITEPFX, out3) 412 da_w(" C4 no-kill map: declared=" as *u8); da_n(out3[0]) 413 da_w(" bite-proven=" as *u8); da_n(out3[1]) 414 da_w(" never-bitten=" as *u8); da_n(out3[2]) 415 da_w(" bitten-zero-kill=" as *u8); da_n(out3[3]); da_w("\n" as *u8) 416 gv_check("C4-a-map-of-two-unproven-gates-still-declares-two" as *u8, dg_eq(out3[0], 2), ctr) 417 gv_bite("neg-control-C4-bite-proven-fires-on-a-map-holding-a-killing-record-and-not-on-one-without" as *u8, dg_pos(proven), dg_pos(nokillproven), ctr) 418 gv_bite("neg-control-C4-never-bitten-fires-only-where-a-record-is-missing" as *u8, dg_pos(out3[2]), dg_pos(out2[2]), ctr) 419 420 // ---------------- da_eol / da_sl_eq: the row scanners underneath everything ---------------- 421 gv_check("eol-returns-the-newline-offset" as *u8, dg_eq(da_eol("ab\ncd" as *u8, 5, 0), 2), ctr) 422 gv_check("eol-with-no-newline-returns-the-buffer-length-not-an-error" as *u8, dg_eq(da_eol("abcd" as *u8, 4, 0), 4), ctr) 423 gv_check("sl_eq-matches-an-exact-slice" as *u8, dg_eq(da_sl_eq("xxabcyy" as *u8, 2, 5, "abc" as *u8), 1), ctr) 424 gv_check("sl_eq-refuses-a-slice-of-the-wrong-length" as *u8, dg_eq(da_sl_eq("xxabcyy" as *u8, 2, 4, "abc" as *u8), 0), ctr) 425 gv_bite("neg-control-sl_eq-fires-on-an-exact-slice-and-not-on-a-prefix-slice" as *u8, da_sl_eq("xxabcyy" as *u8, 2, 5, "abc" as *u8), da_sl_eq("xxabcyy" as *u8, 2, 4, "abc" as *u8), ctr) 426 427 // ================= C5: THE SECOND METHOD CLASS ================= 428 // From the day nx_domain_admit was written until 2026-08-25 this check printed one hard-coded literal, 429 // UNVERIFIED, for every domain in the estate. What follows is the proof that it now measures. 430 // THE STATES MUST BE DISTINCT ANSWERS. An UNSIGNED-CANDIDATE that reads as SIGNED lets anyone certify 431 // their own work by writing a file; one that reads as ABSENT deletes the honest work of producing the 432 // witness. SIGNED-BUT-REFUSED reading as UNSIGNED merges a forged or stale signature with an honest 433 // absence of one -- a bucket named for how the reader failed rather than for what the subject is. 434 var c5d: i64 = 0 435 if DA_C5_SIGNED != DA_C5_UNSIGNED { c5d = c5d + 1 } 436 if DA_C5_UNSIGNED != DA_C5_ABSENT { c5d = c5d + 1 } 437 if DA_C5_SIGNED != DA_C5_ABSENT { c5d = c5d + 1 } 438 if DA_C5_REFUSED != DA_C5_SIGNED { c5d = c5d + 1 } 439 if DA_C5_REFUSED != DA_C5_UNSIGNED { c5d = c5d + 1 } 440 if DA_C5_REFUSED != DA_C5_ABSENT { c5d = c5d + 1 } 441 gv_check("C5-the-four-states-are-pairwise-DISTINCT-none-can-be-mistaken-for-another" as *u8, dg_eq(c5d, DG_C5_PAIRS), ctr) 442 gv_check("C5-the-loadable-carrier-is-the-name-ss_class_load-globs" as *u8, dg_streq(DA_EVPFX, "knowledge/status/evclass_" as *u8), ctr) 443 gv_check("C5-the-unsigned-twin-carries-a-DIFFERENT-suffix-so-nothing-loads-it" as *u8, dg_eq(dg_streq(DA_EVSUF, DA_EVCAND), 0), ctr) 444 445 // ---- the class vocabulary, all five spellings pinned, and the unknown answer ---- 446 gv_check("C5-class-human-maps-to-the-verifiers-own-human-class" as *u8, dg_eq(dg_rowclass("class=human s" as *u8), AT_CLASS_HUMAN), ctr) 447 gv_check("C5-class-llm-maps-to-the-llm-class" as *u8, dg_eq(dg_rowclass("class=llm s" as *u8), AT_CLASS_LLM), ctr) 448 gv_check("C5-class-mech-maps-to-the-machine-class" as *u8, dg_eq(dg_rowclass("class=mech s" as *u8), AT_CLASS_MECH), ctr) 449 gv_check("C5-class-oracle-maps-to-the-oracle-class" as *u8, dg_eq(dg_rowclass("class=oracle s" as *u8), AT_CLASS_ORACLE), ctr) 450 gv_check("C5-class-experiential-maps-to-the-experiential-class" as *u8, dg_eq(dg_rowclass("class=experiential s" as *u8), AT_CLASS_EXPERIENTIAL), ctr) 451 gv_check("C5-an-unrecognised-class-token-maps-to-nothing-permitted-by-omission-is-not-permitted" as *u8, dg_eq(dg_rowclass("class=vibes s" as *u8), 0), ctr) 452 gv_bite("neg-control-the-class-reader-answers-for-a-declared-token-and-refuses-an-undeclared-one" as *u8, dg_pos(dg_rowclass("class=oracle s" as *u8)), dg_pos(dg_rowclass("class=vibes s" as *u8)), ctr) 453 454 // ---- the signature SHAPE check, with both hex lengths derived from their own constants ---- 455 let shp: *u8 = sys_mmap(DG_BUF) 456 var so2: i64 = da_cat(shp, 0, "class=mech verdict=pass scope=s signer=x epoch=1 pub=" as *u8) 457 var z: i64 = 0 458 while z < DA_C5_PUBHEX { shp[so2] = DG_HEX0 as u8; so2 = so2 + 1; z = z + 1 } 459 let pubend: i64 = so2 460 so2 = da_cat(shp, so2, " sig=" as *u8) 461 z = 0 462 while z < DA_C5_SIGHEX { shp[so2] = DG_HEX0 as u8; so2 = so2 + 1; z = z + 1 } 463 shp[so2] = 0 as u8 464 da_w(" C5 shape fixture: full=" as *u8); da_n(so2) 465 da_w("B pub_ends=" as *u8); da_n(pubend) 466 da_w(" full_shape=" as *u8); da_n(dg_shape(shp, so2)) 467 da_w(" one_hex_short=" as *u8); da_n(dg_shape(shp, so2 - 1)) 468 da_w(" pub_only=" as *u8); da_n(dg_shape(shp, pubend)); da_w("\n" as *u8) 469 gv_check("C5-shape-accepts-a-row-carrying-a-full-length-pub-and-sig" as *u8, dg_eq(dg_shape(shp, so2), 1), ctr) 470 gv_check("C5-shape-refuses-a-row-whose-signature-is-ONE-hex-digit-short" as *u8, dg_eq(dg_shape(shp, so2 - 1), 0), ctr) 471 gv_check("C5-shape-refuses-a-row-carrying-a-key-and-no-signature" as *u8, dg_eq(dg_shape(shp, pubend), 0), ctr) 472 gv_check("C5-shape-refuses-the-unsigned-row-fixture-outright" as *u8, dg_eq(dg_shape(DG_EV_UNSIGNED, da_slen(DG_EV_UNSIGNED)), 0), ctr) 473 gv_bite("neg-control-shape-fires-on-a-complete-signature-and-not-on-a-truncated-one" as *u8, dg_eq(dg_shape(shp, so2), 1), dg_eq(dg_shape(shp, so2 - 1), 1), ctr) 474 475 // ---- the three states over fixtures ---- 476 let keys: *u8 = sys_mmap(DG_EVCAP) 477 let kn: i64 = dp_read(DA_KEYREG, keys, DG_EVCAP - 4) 478 let c5a: *i64 = sys_mmap(DG_SMALL) as *i64 479 let c5b: *i64 = sys_mmap(DG_SMALL) as *i64 480 let c5c: *i64 = sys_mmap(DG_SMALL) as *i64 481 let c5e: *i64 = sys_mmap(DG_SMALL) as *i64 482 let s_uns: i64 = da_c5_classify(DG_EV_UNSIGNED, da_slen(DG_EV_UNSIGNED), keys, kn, 1, c5a) 483 // The comment-only carrier is built at RUNTIME because this dialect admits no comment byte inside a 484 // string literal -- the same reason the C4 gates-map fixture writes DA_HASH by hand. 485 let conly: *u8 = sys_mmap(DG_BUF) 486 var co: i64 = 0 487 conly[co] = DA_HASH as u8 488 co = co + 1 489 co = da_cat(conly, co, " a carrier that is readable and holds no row at all\n" as *u8) 490 let s_cmt: i64 = da_c5_classify(conly, co, keys, kn, 1, c5b) 491 let s_empty: i64 = da_c5_classify(conly, 0, keys, kn, 1, c5c) 492 let s_unk: i64 = da_c5_classify(DG_EV_UNKNOWNCLASS, da_slen(DG_EV_UNKNOWNCLASS), keys, kn, 1, c5e) 493 da_w(" C5 fixtures: unsigned=" as *u8); da_n(s_uns) 494 da_w(" rows=" as *u8); da_n(c5a[0]) 495 da_w(" shape=" as *u8); da_n(c5a[1]) 496 da_w(" dissent=" as *u8); da_n(c5a[5]) 497 da_w(" comment_only=" as *u8); da_n(s_cmt) 498 da_w(" no_carrier=" as *u8); da_n(s_empty) 499 da_w(" unknown_class=" as *u8); da_n(s_unk) 500 da_w(" counted=" as *u8); da_n(c5e[7]) 501 da_w(" keyreg_bytes=" as *u8); da_n(kn); da_w("\n" as *u8) 502 gv_check("C5-a-readable-row-carrying-no-signature-is-UNSIGNED-CANDIDATE" as *u8, dg_eq(s_uns, DA_C5_UNSIGNED), ctr) 503 gv_check("C5-fixture-that-unsigned-carrier-really-held-exactly-one-row" as *u8, dg_eq(c5a[0], 1), ctr) 504 gv_check("C5-and-that-row-carried-no-signature-shape-so-nothing-was-verified" as *u8, dg_eq(c5a[1] + c5a[2] + c5a[3], 0), ctr) 505 gv_check("C5-a-verdict-fail-row-is-counted-as-DISSENT-rather-than-discarded" as *u8, dg_eq(c5a[5], 1), ctr) 506 gv_check("C5-a-readable-carrier-holding-only-a-comment-is-ABSENT-not-UNSIGNED" as *u8, dg_eq(s_cmt, DA_C5_ABSENT), ctr) 507 gv_check("C5-fixture-the-comment-only-carrier-really-was-non-empty-bytes-with-zero-rows" as *u8, dg_eq(dg_pos(co) + c5b[0], 1), ctr) 508 gv_check("C5-no-carrier-at-all-is-ABSENT" as *u8, dg_eq(s_empty, DA_C5_ABSENT), ctr) 509 gv_check("C5-a-line-with-an-undeclared-class-admits-no-row" as *u8, dg_eq(s_unk, DA_C5_ABSENT), ctr) 510 gv_check("C5-but-that-undeclared-line-is-COUNTED-so-a-populated-carrier-cannot-read-as-empty" as *u8, dg_eq(c5e[7], 1), ctr) 511 gv_bite("neg-control-ABSENT-fires-on-a-carrier-with-no-row-and-not-on-one-holding-a-real-unsigned-row" as *u8, dg_eq(s_cmt, DA_C5_ABSENT), dg_eq(s_uns, DA_C5_ABSENT), ctr) 512 513 // ---- THE VERIFIER ITSELF, exercised against a LIVE signed row, precondition-guarded ---- 514 // A shipped signed attestation is the only input that can prove the cryptographic leg runs at all, and 515 // a ONE-BYTE tamper is the negative control the ADMISSION_STANDARD demands: the witness must be shown 516 // able to FAIL. Held behind a precondition rather than asserted, because a key may legitimately be 517 // revoked by deleting one registry line, and a gate that goes RED on a lawful operator act is a 518 // false-positive generator. 519 let evb: *u8 = sys_mmap(DG_EVCAP) 520 let evn: i64 = dp_read(DG_LIVE_EVCLASS, evb, DG_EVCAP - 8) 521 let lv: *i64 = sys_mmap(DG_SMALL) as *i64 522 let tv: *i64 = sys_mmap(DG_SMALL) as *i64 523 let uv: *i64 = sys_mmap(DG_SMALL) as *i64 524 let nv: *i64 = sys_mmap(DG_SMALL) as *i64 525 var live_state: i64 = 0 - 1 526 if evn > 0 { if kn > 0 { live_state = da_c5_classify(evb, evn, keys, kn, 1, lv) } } 527 da_w(" C5 live: carrier=" as *u8); da_w(DG_LIVE_EVCLASS) 528 da_w(" bytes=" as *u8); da_n(evn) 529 da_w(" state=" as *u8); da_n(live_state) 530 da_w(" rows=" as *u8); da_n(lv[0]) 531 da_w(" signed_shape=" as *u8); da_n(lv[1]) 532 da_w(" verified=" as *u8); da_n(lv[2]); da_w("\n" as *u8) 533 if gv_need("a live SIGNED evclass row and a readable key registry, so the cryptographic leg can be exercised at all" as *u8, dg_eq(live_state, DA_C5_SIGNED), ctr) == 1 { 534 gv_check("C5-live-a-real-signed-row-under-a-REGISTERED-key-reads-SIGNED" as *u8, dg_eq(live_state, DA_C5_SIGNED), ctr) 535 gv_check("C5-live-every-signed-shaped-row-in-that-carrier-actually-verified" as *u8, dg_eq(lv[1], lv[2]), ctr) 536 let tb: *u8 = sys_mmap(DG_EVCAP) 537 var t: i64 = 0 538 while t < evn { tb[t] = evb[t]; t = t + 1 } 539 let sc: i64 = at_find(tb, 0, evn, DG_SCOPETAG, da_slen(DG_SCOPETAG)) 540 let tpos: i64 = sc + da_slen(DG_SCOPETAG) 541 let before: i64 = tb[tpos] as i64 542 tb[tpos] = (before + 1) as u8 543 let after: i64 = tb[tpos] as i64 544 da_w(" C5 tamper: scope_at=" as *u8); da_n(sc) 545 da_w(" byte " as *u8); da_n(before); da_w(" -> " as *u8); da_n(after); da_w("\n" as *u8) 546 // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME. 547 gv_check("C5-fixture-the-tamper-found-the-scope-field-and-really-changed-one-byte" as *u8, dg_eq(dg_pos(sc) + dg_eq(dg_eq(before, after), 0), 2), ctr) 548 let t_state: i64 = da_c5_classify(tb, evn, keys, kn, 1, tv) 549 gv_check("C5-a-ONE-BYTE-tamper-inside-the-signed-claim-makes-the-verifier-REFUSE" as *u8, dg_eq(t_state, DA_C5_REFUSED), ctr) 550 gv_check("C5-and-the-refusal-is-BAD-SIGNATURE-by-name-not-a-generic-no" as *u8, dg_eq(tv[4], AT_ERR_BADSIG), ctr) 551 // ANTI-VACUITY: the tampered row still LOOKS signed. A shape-only check calls it SIGNED. 552 gv_check("C5-the-tampered-row-still-carries-a-full-signature-shape-so-shape-alone-would-pass-it" as *u8, dg_eq(tv[1], 1), ctr) 553 gv_bite("neg-control-the-witness-can-fail-accepted-on-the-real-row-refused-on-the-tampered-one" as *u8, dg_eq(t_state, DA_C5_REFUSED), dg_eq(live_state, DA_C5_REFUSED), ctr) 554 // AN UNREACHABLE VERIFIER MUST LOWER THE CLAIM, NEVER RAISE IT, AND NEVER INVENT A REFUSAL. 555 let u_state: i64 = da_c5_classify(evb, evn, keys, 0, 1, uv) 556 gv_check("C5-with-no-readable-key-registry-a-genuinely-signed-row-is-capped-at-UNSIGNED" as *u8, dg_eq(u_state, DA_C5_UNSIGNED), ctr) 557 gv_check("C5-and-no-REFUSED-finding-is-manufactured-out-of-our-own-blindness" as *u8, dg_eq(uv[3], 0), ctr) 558 gv_bite("neg-control-SIGNED-needs-the-registry-the-same-row-reads-SIGNED-with-it-and-not-without" as *u8, dg_eq(live_state, DA_C5_SIGNED), dg_eq(u_state, DA_C5_SIGNED), ctr) 559 // THE CARRIER NAME IS PART OF THE CLAIM: a perfect signature in a file nothing loads is not a 560 // second method class, and the cap is REPORTED rather than silent. 561 let n_state: i64 = da_c5_classify(evb, evn, keys, kn, 0, nv) 562 gv_check("C5-the-same-verifying-row-in-a-carrier-nothing-loads-is-capped-at-UNSIGNED-CANDIDATE" as *u8, dg_eq(n_state, DA_C5_UNSIGNED), ctr) 563 gv_check("C5-and-that-cap-is-counted-not-silent-verified-but-unloadable-is-1" as *u8, dg_eq(nv[6], 1), ctr) 564 gv_bite("neg-control-SIGNED-is-reachable-only-from-the-carrier-the-loader-actually-reads" as *u8, dg_eq(live_state, DA_C5_SIGNED), dg_eq(n_state, DA_C5_SIGNED), ctr) 565 } 566 567 // ================= C6: THE STAMP AND THE BOARD ================= 568 // C6 always ABSTAINS. What is proven here is that its abstention carries a MEASUREMENT: the stamp half 569 // is read and classified, and the board half names which conjunct could not be evaluated. 570 gv_check("C6-the-stamp-source-is-the-artifact-nx_swcompare_evidence-materialises" as *u8, dg_streq(DA_STAMPPFX, "knowledge/status/evstamp_" as *u8), ctr) 571 gv_check("C6-the-board-tree-is-the-one-nx_sota_status-enumerates" as *u8, dg_streq(DA_BOARDDIR, "knowledge/compare/" as *u8), ctr) 572 gv_check("C6-the-board-tree-is-NOT-the-publishing-tree-this-gate-audits-for-C1" as *u8, dg_eq(dg_streq(DA_BOARDDIR, DA_CDIRS), 0), ctr) 573 // ADDED 2026-08-27 alongside the second board prefix. The two teeth above are UNCHANGED and still 574 // pass: the primary tree is still knowledge/compare and it is still not the publishing tree. This 575 // one pins the FALLBACK, because nx_sota_status was widened on 2026-08-26 to enumerate both trees 576 // and a mirror that tracked only one reported a blindness that no longer existed. A behaviour 577 // added without a tooth is a behaviour nobody is holding to account. 578 gv_check("C6-the-board-mirror-ALSO-probes-buildroot-because-nx_sota_status-now-enumerates-both" as *u8, dg_streq(DA_BOARDDIR2, "buildroot/knowledge/compare/" as *u8), ctr) 579 gv_check("C6-the-two-board-prefixes-are-DISTINCT-so-the-fallback-is-a-second-tree-and-not-a-retry" as *u8, dg_eq(dg_streq(DA_BOARDDIR, DA_BOARDDIR2), 0), ctr) 580 var c6d: i64 = 0 581 if DA_C6A_HONEST != DA_C6A_RED { c6d = c6d + 1 } 582 if DA_C6A_HONEST != DA_C6A_BLIND { c6d = c6d + 1 } 583 if DA_C6A_HONEST != DA_C6A_ABSENT { c6d = c6d + 1 } 584 if DA_C6A_RED != DA_C6A_BLIND { c6d = c6d + 1 } 585 if DA_C6A_RED != DA_C6A_ABSENT { c6d = c6d + 1 } 586 if DA_C6A_BLIND != DA_C6A_ABSENT { c6d = c6d + 1 } 587 gv_check("C6-the-four-stamp-answers-are-pairwise-DISTINCT" as *u8, dg_eq(c6d, DG_C6_PAIRS), ctr) 588 589 // ---- da_kv_den: could-not-look must never read as zero, because ZERO is the finding ---- 590 gv_check("kv_den-reads-the-denominator-after-the-slash" as *u8, dg_eq(dg_den("grounded=17/18" as *u8, "grounded" as *u8), 18), ctr) 591 gv_check("kv_den-reads-a-genuine-ZERO-denominator-as-0" as *u8, dg_eq(dg_den("grounded=0/0" as *u8, "grounded" as *u8), 0), ctr) 592 gv_check("kv_den-an-absent-key-is-minus-one" as *u8, dg_eq(dg_den("gates=1/1" as *u8, "grounded" as *u8), 0 - 1), ctr) 593 gv_check("kv_den-a-key-with-no-slash-is-minus-one-not-zero" as *u8, dg_eq(dg_den("grounded=18" as *u8, "grounded" as *u8), 0 - 1), ctr) 594 gv_check("kv_den-a-slash-with-nothing-after-it-is-minus-one" as *u8, dg_eq(dg_den("grounded=18/" as *u8, "grounded" as *u8), 0 - 1), ctr) 595 gv_check("kv_den-no-numerator-at-all-is-minus-one" as *u8, dg_eq(dg_den("grounded=/5" as *u8, "grounded" as *u8), 0 - 1), ctr) 596 gv_check("kv_den-honours-the-word-boundary-ungrounded-does-not-answer-for-grounded" as *u8, dg_eq(dg_den("ungrounded=1/2 grounded=3/4" as *u8, "grounded" as *u8), 4), ctr) 597 gv_bite("neg-control-kv_den-minus-one-fires-when-it-could-not-look-and-not-on-a-real-zero" as *u8, dg_neg(dg_den("grounded=18" as *u8, "grounded" as *u8)), dg_neg(dg_den("grounded=0/0" as *u8, "grounded" as *u8)), ctr) 598 599 // ---- the stamp classifier: FOUR answers, and the BLIND/RED split decided by OUR row count ---- 600 let k1: *i64 = sys_mmap(DG_SMALL) as *i64 601 let k2: *i64 = sys_mmap(DG_SMALL) as *i64 602 let k3: *i64 = sys_mmap(DG_SMALL) as *i64 603 let k4: *i64 = sys_mmap(DG_SMALL) as *i64 604 let k5: *i64 = sys_mmap(DG_SMALL) as *i64 605 let a_ok: i64 = da_c6a_classify(DG_STAMP_OK, da_slen(DG_STAMP_OK), 65, k1) 606 let a_red: i64 = da_c6a_classify(DG_STAMP_RED, da_slen(DG_STAMP_RED), 65, k2) 607 let a_blind: i64 = da_c6a_classify(DG_STAMP_BLIND, da_slen(DG_STAMP_BLIND), 65, k3) 608 let a_blind0: i64 = da_c6a_classify(DG_STAMP_BLIND, da_slen(DG_STAMP_BLIND), 0, k4) 609 let a_abs: i64 = da_c6a_classify(DG_STAMP_OK, 0, 65, k5) 610 da_w(" C6 stamp fixtures: ok=" as *u8); da_n(a_ok) 611 da_w(" red=" as *u8); da_n(a_red) 612 da_w(" blind=" as *u8); da_n(a_blind) 613 da_w(" same-stamp-no-rows=" as *u8); da_n(a_blind0) 614 da_w(" absent=" as *u8); da_n(a_abs) 615 da_w(" parsed ok/grounded/present/epoch/redseen=" as *u8); da_n(k1[0]); da_w("/" as *u8); da_n(k1[2]) 616 da_w("/" as *u8); da_n(k1[1]); da_w("/" as *u8); da_n(k1[3]); da_w("/" as *u8); da_n(k1[4]); da_w("\n" as *u8) 617 gv_check("C6-a-stamp-reporting-ok-1-is-MEASURED-HONEST" as *u8, dg_eq(a_ok, DA_C6A_HONEST), ctr) 618 gv_check("C6-fixture-the-healthy-stamps-fields-were-really-parsed-not-defaulted" as *u8, dg_eq(k1[0] + k1[1] + k1[2] + k1[4], 1 + 18 + 18 + 1), ctr) 619 gv_check("C6-a-stamp-reporting-ok-0-over-axes-it-actually-read-is-RED" as *u8, dg_eq(a_red, DA_C6A_RED), ctr) 620 gv_check("C6-a-stamp-with-ZERO-present-axes-for-a-domain-whose-matrix-has-rows-is-BLIND" as *u8, dg_eq(a_blind, DA_C6A_BLIND), ctr) 621 gv_check("C6-fixture-the-blind-stamp-really-did-report-zero-present-axes" as *u8, dg_eq(k3[1], 0), ctr) 622 // ANTI-VACUITY: a classifier reading ONLY the stamp cannot produce these two different answers from 623 // the same stamp. The second opinion -- this gate's own row count -- is what separates them. 624 gv_check("C6-the-SAME-empty-stamp-with-no-rows-on-our-side-is-an-honest-RED-not-BLIND" as *u8, dg_eq(a_blind0, DA_C6A_RED), ctr) 625 gv_check("C6-no-stamp-at-all-is-ABSENT" as *u8, dg_eq(a_abs, DA_C6A_ABSENT), ctr) 626 gv_check("C6-an-absent-stamp-reports-every-field-as-could-not-look-never-as-zero" as *u8, dg_eq(k5[0] + k5[1] + k5[2] + k5[3] + k5[4], 0 - DG_STAMP_ABSENT_FIELDS), ctr) 627 gv_bite("neg-control-BLIND-fires-on-a-zero-axis-stamp-and-not-on-a-healthy-one" as *u8, dg_eq(a_blind, DA_C6A_BLIND), dg_eq(a_ok, DA_C6A_BLIND), ctr) 628 gv_bite("neg-control-the-BLIND-versus-RED-split-is-decided-by-OUR-row-count-not-by-the-stamp" as *u8, dg_eq(a_blind, DA_C6A_BLIND), dg_eq(a_blind0, DA_C6A_BLIND), ctr) 629 630 // ---- the board DOMAIN SET, over /tmp fixtures so no live compare tree can change this verdict ---- 631 let bm: i64 = dg_write(DG_BOARD_MAT_FIX, DG_MATBODY) 632 let ba: i64 = dg_write(DG_BOARD_AXES_FIX, DG_AXESBODY) 633 gv_check("C6-fixture-the-board-set-fixtures-were-written" as *u8, dg_eq(dg_pos(bm) + dg_pos(ba), 2), ctr) 634 let in_mat: i64 = da_boardset_in(DG_D1S, "probe" as *u8, sb) 635 let in_axes: i64 = da_boardset_in(DG_D1S, "axesonly" as *u8, sb) 636 let in_none: i64 = da_boardset_in(DG_D1S, "nosuchdomain" as *u8, sb) 637 da_w(" C6 boardset: matrix=" as *u8); da_n(in_mat) 638 da_w(" axes_only=" as *u8); da_n(in_axes) 639 da_w(" neither=" as *u8); da_n(in_none); da_w("\n" as *u8) 640 gv_check("C6-a-domain-with-a-matrix-in-the-boards-tree-IS-in-the-board-set" as *u8, dg_eq(in_mat, DA_C6B_IN_SET), ctr) 641 gv_check("C6-a-domain-with-only-an-axes-file-is-ALSO-in-the-board-set" as *u8, dg_eq(in_axes, DA_C6B_IN_SET), ctr) 642 gv_check("C6-a-domain-with-neither-can-never-appear-in-the-board-output-at-all" as *u8, dg_eq(in_none, DA_C6B_NOT_IN_SET), ctr) 643 gv_bite("neg-control-board-set-membership-fires-on-a-present-file-and-not-on-a-missing-one" as *u8, dg_eq(in_mat, DA_C6B_IN_SET), dg_eq(in_none, DA_C6B_IN_SET), ctr) 644 645 let rc: i64 = gv_verdict("DOMAIN-ADMIT" as *u8, ctr, "the /compare admission core, driven in-process over in-memory rows and /tmp fixtures" as *u8) 646 sys_exit(rc) 647 return rc 648}