code wiki / (root) / nx_evidence_profile_gate.nx
`nx_evidence_profile_gate.nx` source

↩ module page · 628 lines · 42575 B
1// nx_evidence_profile_gate.nx -- the referee for the /compare EVIDENCE PROFILE.
2//
3// SUBJECT: nx_swcompare_evidence (the producer) + nx_evprofile_lib (the one reader).
4// Declared in knowledge/organ_gate.conf so nx_organ_ship resolves it BY DECLARATION rather than by the
5// <target>_gate naming convention, whose silent skip is the vacuous-test defect this estate already fixed
6// once. Check the ship receipt says resolved_by=organ_gate.conf-declaration.
7//
8// HOW IT PROVES ANYTHING, AND WHY THE PROOF IS NOT A MUTANT.
9// The subject elf is an ARGUMENT with a default. Run it against the promoted binary and every profile
10// tooth passes; run it against the banked PRE-CHANGE binary and every profile tooth fails, because that
11// binary writes a v1 stamp with no profile keys at all. That is a real before/after control, obtained
12// free, and it is strictly better evidence than a synthetic mutant: it is the actual incumbent.
13//   GREEN: nx_evidence_profile_gate
14//   RED  : nx_evidence_profile_gate knowledge/status/bank_nx_swcompare_evidence_pre1788197071.elf
15//
16// EVERY FIXTURE LIVES IN /tmp/<gate>/ AND IS BUILT AT SETUP, never beside a production beat: a gate that
17// shares its fixture with production measures the fixture, and a teardown does not run when a run crashes.
18// The whole fixture estate -- a compare tree, an organ source, a status dir -- is assembled under one
19// directory and the subject is forked with THAT as its working directory, so the referee grades a corpus
20// this gate authored and touches not one published board.
21//
22// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
23import "nx_syscalls.nx"
24import "nx_gate_verdict.nx"
25import "nx_tool_run.nx"
26import "nx_estate_path.nx"
27import "nx_evprofile_lib.nx"
28
29const EPG_NAME: *u8 = "NX-EVIDENCE-PROFILE-GATE"
30const EPG_DIR: *u8 = "/tmp/nx_evidence_profile_gate"
31const EPG_MODE_DIR: i64 = 493      // 0755
32const EPG_MODE_FILE: i64 = 420     // 0644
33const EPG_PATH_CAP: i64 = 512
34const EPG_OUT_CAP: i64 = 262144
35// The subject grades a 6-row fixture and forks nothing: measured at well under a second. 120 s is two
36// orders of magnitude of headroom AND IT IS A BOUND -- an instrument its subject can hang measures nothing.
37const EPG_RUN_MS: i64 = 120000
38const EPG_DEFAULT_SUBJ: *u8 = "_offc/nx_swcompare_evidence.elf"
39// THE SECOND SUBJECT: THE EMITTER. A profile is only worth computing if it REACHES A PUBLISHED BOARD.
40// Measured 2026-08-31 (nx_shelltool grep evstamp_ over buildroot/runtime, coverage_complete=1
41// corpus_complete=1): the referee had stamped 95 domains and NOT ONE GENERATOR READ THE STAMP, so the
42// profile reached the PM board and never reached a single published page. A measurement the organisation
43// is paying for and not collecting is this estate own named defect; these teeth are what stop it
44// recurring silently. Same method as the referee half: run against the promoted binary and the emitter
45// teeth pass; run against the BANKED PRE-CHANGE binary and they fail, because that binary renders no
46// band at all. The control is the incumbent itself, obtained free, and it beats any synthetic mutant.
47//   GREEN: nx_evidence_profile_gate
48//   RED  : nx_evidence_profile_gate _offc/nx_swcompare_evidence.elf knowledge/status/bank_nx_swcompare_matrix_pre1788213676.elf
49const EPG_DEFAULT_EMIT: *u8 = "_offc/nx_swcompare_matrix.elf"
50// The band markers, spelled ONCE. A probe repeated in two teeth is two literals that drift apart.
51const EPG_BAND_H2: *u8 = "Evidence profile"
52const EPG_BAND_PART: *u8 = "partition: grounded"
53const EPG_BAND_UNSTAMPED: *u8 = "Unstamped."
54// argv slots for the emitter fork: elf + domain + html + NUL, with one spare so a future flag cannot
55// silently overrun the vector.
56const EPG_EMIT_AV: i64 = 5
57// The control domain for the ambiguity tooth: any domain the estate has already stamped. The tooth
58// declares a NEED rather than asserting when no estate stamp exists, so a missing precondition reads as
59// "I could not look" and never as a pass.
60const EPG_AMBIG_DOM: *u8 = "mangagen"
61
62func epg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
63
64func epg_cat(d: *u8, o: i64, s: *u8) -> i64 {
  var p: i64 = o
  var i: i64 = 0
  while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 }
  d[p] = 0 as u8
  return p
70}
71
72func epg_write(path: *u8, s: *u8) -> i64 {
  let fd: i64 = sys_openat_wr(path, EPG_MODE_FILE)
  if fd < 0 { return 0 - 1 }
  let n: i64 = epg_slen(s)
  sys_write(fd, s, n)
  sys_close(fd)
  return n
79}
80
81// join EPG_DIR + "/" + rel into out
82func epg_fix(out: *u8, rel: *u8) -> i64 {
  var o: i64 = epg_cat(out, 0, EPG_DIR)
  o = epg_cat(out, o, "/" as *u8)
  o = epg_cat(out, o, rel)
  return o
87}
88
89func epg_mk(rel: *u8) -> i64 {
  let p: *u8 = sys_mmap(EPG_PATH_CAP)
  epg_fix(p, rel)
  sys_mkdir(p, EPG_MODE_DIR)
  return 0
94}
95
96// count how many of the two profile arrays differ, field by field, over the slots that describe GAPS.
97// THE ANTI-VACUITY MEASUREMENT: every plausible wrong implementation of this feature returns a CONSTANT
98// (a zero-filled profile, a hardcoded band, a wrong-root read that resolves nothing for every domain),
99// and a constant makes this number 0 no matter which two subjects are compared.
100func epg_profile_delta(a: *i64, b: *i64) -> i64 {
  var d: i64 = 0
  if a[EVP_F_GROUNDED] != b[EVP_F_GROUNDED] { d = d + 1 }
  if a[EVP_F_PRESENT] != b[EVP_F_PRESENT] { d = d + 1 }
  if a[EVP_F_UNGROUND] != b[EVP_F_UNGROUND] { d = d + 1 }
  if a[EVP_F_ABSENT] != b[EVP_F_ABSENT] { d = d + 1 }
  if a[EVP_F_ABSNAMED] != b[EVP_F_ABSNAMED] { d = d + 1 }
  if a[EVP_F_ABSBARE] != b[EVP_F_ABSBARE] { d = d + 1 }
  if a[EVP_F_LANDED] != b[EVP_F_LANDED] { d = d + 1 }
  return d
110}
111
112// are the ten v1 keys present, in their original order? THE ADDITIVE PROOF (rule 19): the new block is
113// inserted between redseen= and host=, so every v1 key must still parse AND still appear in sequence.
114// A key-name-order check, not a byte diff: the values legitimately change run to run.
115func epg_v1_order(buf: *u8, n: i64) -> i64 {
  let k: *i64 = sys_mmap(8 * 10) as *i64
  k[0] = evp_find(buf, n, EVP_K_OK)
  k[1] = evp_find(buf, n, EVP_K_EPOCH)
  k[2] = evp_find(buf, n, EVP_K_GROUNDED)
  k[3] = evp_find(buf, n, EVP_K_GATES)
  k[4] = evp_find(buf, n, EVP_K_SKIPPED)
  k[5] = evp_find(buf, n, EVP_K_DECLARED)
  k[6] = evp_find(buf, n, EVP_K_HASHED)
  k[7] = evp_find(buf, n, EVP_K_REDSEEN)
  var i: i64 = 0
  while i < 8 { if k[i] < 0 { return 0 } i = i + 1 }
  i = 1
  while i < 8 { if k[i] <= k[i-1] { return 0 } i = i + 1 }
  // and host= / dig= must still be the tail, AFTER the inserted block
  let h: i64 = evp_find(buf, n, " host=" as *u8)
  let g: i64 = evp_find(buf, n, " dig=" as *u8)
  if h <= k[7] { return 0 }
  if g <= h { return 0 }
  return 1
135}
136
137func epg_has(buf: *u8, n: i64, s: *u8) -> i64 { if evp_find(buf, n, s) >= 0 { return 1 } return 0 }
138
139func main(argc: i64, argv: *i64) -> i64 {
  gv_head(EPG_NAME)
  let ctr: *i64 = gv_ctr()
142
  // ---- the subject, ABSOLUTE, resolved BEFORE any chdir ----
  var subjrel: *u8 = EPG_DEFAULT_SUBJ
  if argc >= 2 { subjrel = argv[1] as *u8 }
  let subj: *u8 = sys_mmap(EPG_PATH_CAP)
  var so: i64 = epg_cat(subj, 0, EP_ROOT)
  so = epg_cat(subj, so, subjrel)
  gv_puts("  subject elf: " as *u8); gv_puts(subj); gv_puts("\n" as *u8)
150
  // ---- SETUP: build the whole fixture estate under /tmp/<gate>/ ----
  sys_mkdir(EPG_DIR, EPG_MODE_DIR)
  epg_mk("runtime" as *u8)
  epg_mk("knowledge" as *u8)
  epg_mk("knowledge/compare" as *u8)
  epg_mk("knowledge/status" as *u8)
157
  let p: *u8 = sys_mmap(EPG_PATH_CAP)
  // the fixture ORGAN: real source, real symbols, so grounding does real work on a file this gate owns
  epg_fix(p, "runtime/nx_evpfix_organ.nx" as *u8)
  epg_write(p, "func evpfix_alpha() -> i64 { return 1 }\nfunc evpfix_beta() -> i64 { return 2 }\nfunc evpfix_gamma() -> i64 { return 3 }\nfunc evpfix_delta() -> i64 { return 4 }\nfunc evpfix_epsilon() -> i64 { return 5 }\nfunc evpfix_landed() -> i64 { return 6 }\n" as *u8)
162
  // THE GAPPY FIXTURE. Six rows, one of every state the referee can classify, so every counter has a
  // known-correct answer that is NOT zero and NOT equal to any other counter -- a fixture whose expected
  // values are all the same number cannot tell a working counter from a copied one.
  //   2 plain grounded  +  1 ungrounded  +  1 bare _ABSENT_  +  1 unlanded watch  +  1 LANDED watch
  //   => present 4 (2 grounded + 1 ungrounded + 1 landed) . grounded 3 . ungrounded 1
  //      absent 2 . absent_named 1 . absent_bare 1 . landed 1
  epg_fix(p, "knowledge/compare/evpfix.matrix" as *u8)
  epg_write(p, "@title EVP fixture\n@cols A|B|C|D\nGrounded one|runtime/nx_evpfix_organ.nx|evpfix_alpha|0|1|0|0|0|grounded control\nGrounded two|runtime/nx_evpfix_organ.nx|evpfix_beta|0|1|0|0|0|grounded control\nAn unsupported claim|runtime/nx_evpfix_organ.nx|evpfix_never_shipped_qq|0|1|0|0|0|MUST read UNGROUNDED\nA gap with no contract|runtime/nx_evpfix_organ.nx|_ABSENT_|0|0|0|0|0|MUST read absent_bare\nA gap that names its contract|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_future_qq|0|0|0|0|0|MUST read absent_named\nA contract that has landed|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_landed|0|0|0|0|0|MUST read LANDED\nShipped but the precondition file is ABSENT|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_gamma:knowledge/evpfix_missing_qq.tsv|0|0|0|0|0|MUST read WITHHELD\nShipped but the ledger has no rows|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_delta:knowledge/evpfix_headeronly.tsv|0|0|0|0|0|MUST read WITHHELD\nWithheld while the precondition is MET|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_epsilon:knowledge/evpfix_hasdata.tsv|0|0|0|0|0|neg-control MUST read WITHHELD-REFUSED\nWithheld for a mechanism that never shipped|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_never_shipped_qq:knowledge/evpfix_missing_qq.tsv|0|0|0|0|0|neg-control MUST read WITHHELD-UNSHIPPED and must NOT count as withheld\nThe SAME symbol as the landed row, in withheld form|runtime/nx_evpfix_organ.nx|_ABSENT_:evpfix_landed:knowledge/evpfix_missing_qq.tsv|0|0|0|0|0|MUST read WITHHELD not LANDED -- the FORM decides, never the symbol\n" as *u8)
171
  // THE PRECONDITION FIXTURES. Three states the test must tell apart: a file that holds ONLY comments,
  // the SAME file plus one data row, and a path never written at all. The two written files differ by
  // EXACTLY that one row, so a test that passes on both is measuring something other than the row.
  // '#' cannot appear in an nx string literal -- the lexer refuses it -- so the comment marker is POKED
  // in by byte code, the same idiom the compare generators use for colours.
  let pcbuf: *u8 = sys_mmap(EPG_PATH_CAP)
  var pco: i64 = 0
  pcbuf[pco] = 35 as u8; pco = pco + 1
  pco = epg_cat(pcbuf, pco, " a ledger with a header and NO ROWS -- the precondition is UNMET\n" as *u8)
  pcbuf[pco] = 35 as u8; pco = pco + 1
  pco = epg_cat(pcbuf, pco, " still no rows\n" as *u8)
  epg_fix(p, "knowledge/evpfix_headeronly.tsv" as *u8)
  epg_write(p, pcbuf)
185
  let pdbuf: *u8 = sys_mmap(EPG_PATH_CAP)
  var pdo: i64 = 0
  pdbuf[pdo] = 35 as u8; pdo = pdo + 1
  pdo = epg_cat(pdbuf, pdo, " a ledger with the SAME header, and then ONE data row -- the precondition is MET\n" as *u8)
  pdo = epg_cat(pdbuf, pdo, "swatch1 sku1 blank1 0 55.2 1.1 -3.4\n" as *u8)
  epg_fix(p, "knowledge/evpfix_hasdata.tsv" as *u8)
  epg_write(p, pdbuf)
193
  // THE CLEAN CONTROL. Five grounded rows, no gaps at all: present 5, grounded 5, everything else 0,
  // and present>=5 so its conj differs from the gappy fixture's in TWO positions rather than one.
  epg_fix(p, "knowledge/compare/evpclean.matrix" as *u8)
  epg_write(p, "@title EVP clean fixture\n@cols A|B|C|D\nOne|runtime/nx_evpfix_organ.nx|evpfix_alpha|0|1|0|0|0|clean\nTwo|runtime/nx_evpfix_organ.nx|evpfix_beta|0|1|0|0|0|clean\nThree|runtime/nx_evpfix_organ.nx|evpfix_gamma|0|1|0|0|0|clean\nFour|runtime/nx_evpfix_organ.nx|evpfix_delta|0|1|0|0|0|clean\nFive|runtime/nx_evpfix_organ.nx|evpfix_epsilon|0|1|0|0|0|clean\n" as *u8)
198
  // A HAND-WRITTEN v1 STAMP -- exactly the shape every stamp on the estate had before this change.
  // The reader must call it UNKNOWN, never "a board with zero gaps".
  // A THIRD FIXTURE, DELIBERATELY NEVER STAMPED -- the emitter neg-control. A domain the referee has
  // never graded must render as UNSTAMPED with NOT ONE numeric field. A zero-filled profile is a
  // fabricated constant wearing the shape of a measurement, and it would read as a board with no gaps,
  // which is the one wrong answer nobody would question.
  epg_fix(p, "knowledge/compare/evpnostamp.matrix" as *u8)
  epg_write(p, "@title EVP unstamped fixture\n@cols A|B|C|D\nOne|runtime/nx_evpfix_organ.nx|evpfix_alpha|0|1|0|0|0|this domain is never stamped\n" as *u8)
207
  epg_fix(p, "knowledge/status/evstamp_evpv1.verdict" as *u8)
  epg_write(p, "ok=1 epoch=1788190000 grounded=50/50 gates=0/0 skipped=0 declared=0 hashed=0 redseen=0 host=west_nas dig=ABSENT\n" as *u8)
210
  // A STAMP WHOSE PARTITION LEAKS. present does not equal grounded+ungrounded and absent does not equal
  // its two parts: the reconciliation must SEE that, or a partition is decoration.
  epg_fix(p, "knowledge/status/evstamp_evpleak.verdict" as *u8)
  epg_write(p, "ok=1 epoch=1788190000 grounded=7/99 gates=1/1 skipped=0 declared=1 hashed=1 redseen=0 ungrounded=3 absent=9 absent_named=1 absent_bare=1 landed=0 vacuous=0 conj=GPQN mroot=PRIMARY mbytes=100 mcapped=0 gatesroot=PRIMARY host=west_nas dig=ABSENT\n" as *u8)
215
  // A DECOY for the ambiguity control: a stamp for a domain the ESTATE has already stamped, planted
  // under this gate's own working directory with different numbers. Two different files then answer to
  // one name, and no reader may silently pick one.
  let dpath: *u8 = sys_mmap(EPG_PATH_CAP)
  var dpo: i64 = epg_cat(dpath, 0, EPG_DIR)
  dpo = epg_cat(dpath, dpo, "/knowledge/status/evstamp_" as *u8)
  dpo = epg_cat(dpath, dpo, EPG_AMBIG_DOM)
  dpo = epg_cat(dpath, dpo, ".verdict" as *u8)
  epg_write(dpath, "ok=0 epoch=1 grounded=99999/99999 gates=0/0 skipped=0 declared=0 hashed=0 redseen=0 host=DECOY dig=ABSENT\n" as *u8)
225
  // fixture reached the condition? Assert the corpus this run will grade is actually there and is the
  // shape the expectations below assume, BEFORE asserting one thing about the outcome.
  let fb: *u8 = sys_mmap(EVP_STAMP_CAP)
  epg_fix(p, "knowledge/compare/evpfix.matrix" as *u8)
  let mfix: i64 = evp_read(p, fb, EVP_STAMP_CAP)
  gv_check("fixture-gappy-matrix-written-and-readable" as *u8, (mfix > 0) as i64, ctr)
  epg_fix(p, "runtime/nx_evpfix_organ.nx" as *u8)
  let forg: i64 = evp_read(p, fb, EVP_STAMP_CAP)
  var orgok: i64 = 0
  if forg > 0 { if epg_has(fb, forg, "evpfix_landed" as *u8) == 1 { if epg_has(fb, forg, "evpfix_never_shipped_qq" as *u8) == 0 { orgok = 1 } } }
  gv_check("fixture-organ-carries-the-landed-symbol-and-not-the-absent-one" as *u8, orgok, ctr)
237
  // ---- RUN the subject INSIDE the fixture directory: children inherit the working directory, so the
  // referee resolves knowledge/compare/ and writes knowledge/status/ entirely within the fixture. ----
  let ob: *u8 = sys_mmap(EPG_OUT_CAP)
  let olen: *i64 = sys_mmap(16) as *i64
  let av: *i64 = sys_mmap(8 * 4) as *i64
  var chdir_ok: i64 = 0
  if sys_chdir(EPG_DIR) == 0 { chdir_ok = 1 }
  gv_check("fixture-cwd-entered-so-the-subject-cannot-touch-a-published-board" as *u8, chdir_ok, ctr)
246
  let dom_gappy: *u8 = "evpfix" as *u8
  let dom_clean: *u8 = "evpclean" as *u8
  av[0] = subj as i64
  av[1] = dom_gappy as i64
  av[2] = 0
  olen[0] = 0
  let rc1: i64 = tr_run_capture_to(subj, av, ob, EPG_OUT_CAP, olen, EPG_RUN_MS)
  let out1: i64 = olen[0]
  gv_check("subject-elf-ran-within-its-deadline-and-produced-output" as *u8,
           ((((rc1 != TR_ERR_TIMEOUT) as i64)) & ((out1 > 0) as i64)), ctr)
257
  av[1] = dom_clean as i64
  olen[0] = 0
  tr_run_capture_to(subj, av, ob, EPG_OUT_CAP, olen, EPG_RUN_MS)
261
  // ---- the ambiguity teeth, still inside the fixture working directory ----
  let lb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let lp: *u8 = sys_mmap(EPG_PATH_CAP)
  let fl: *i64 = sys_mmap(8 * EVP_NFLAG) as *i64
266
  // POSITIVE CONTROL FIRST. A deny-guard that refuses everything passes every negative test, so the
  // ordinary case -- one copy, under the caller's own directory, no estate twin -- must RESOLVE.
  let nfix: i64 = evp_load("evpfix" as *u8, lb, EVP_STAMP_CAP, lp, fl)
  gv_check("positive-control-ordinary-single-copy-resolves-and-is-not-called-ambiguous" as *u8,
           (((nfix > 0) as i64) & ((fl[EVP_FL_AMBIG] == 0) as i64)), ctr)
272
  // Does the estate actually hold a stamp for the control domain? If not this cannot be tested, and
  // "I could not look" must read as a NEED, never as a pass.
  let ep2: *u8 = sys_mmap(EPG_PATH_CAP)
  var eo: i64 = epg_cat(ep2, 0, EP_ROOT)
  eo = epg_cat(ep2, eo, "knowledge/status/evstamp_" as *u8)
  eo = epg_cat(ep2, eo, EPG_AMBIG_DOM)
  eo = epg_cat(ep2, eo, ".verdict" as *u8)
  let estn: i64 = evp_read(ep2, lb, EVP_STAMP_CAP)
  gv_need("estate-stamp-for-the-ambiguity-control-domain" as *u8, (estn > 0) as i64, ctr)
  if estn > 0 {
      let namb: i64 = evp_load(EPG_AMBIG_DOM, lb, EVP_STAMP_CAP, lp, fl)
      gv_check("neg-control-two-different-files-answering-to-one-name-are-REFUSED-not-picked" as *u8,
               (((namb == EVP_RC_AMBIGUOUS) as i64) & ((fl[EVP_FL_AMBIG] == 1) as i64)), ctr)
  }
287
  let nmiss: i64 = evp_load("evp_no_such_domain_qq" as *u8, lb, EVP_STAMP_CAP, lp, fl)
  gv_check("neg-control-unresolvable-domain-refuses-and-returns-an-empty-path" as *u8,
           (((nmiss == EVP_RC_UNRESOLVED) as i64) & ((lp[0] == (0 as u8)) as i64)), ctr)
291
  // ---- read the two stamps the subject just wrote, then leave the fixture ----
  let gb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let cb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let vb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let kb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let gn: i64 = evp_read("knowledge/status/evstamp_evpfix.verdict" as *u8, gb, EVP_STAMP_CAP)
  let cn: i64 = evp_read("knowledge/status/evstamp_evpclean.verdict" as *u8, cb, EVP_STAMP_CAP)
  let vn: i64 = evp_read("knowledge/status/evstamp_evpv1.verdict" as *u8, vb, EVP_STAMP_CAP)
  let kn: i64 = evp_read("knowledge/status/evstamp_evpleak.verdict" as *u8, kb, EVP_STAMP_CAP)
  // ---- THE EMITTER HALF: DOES THE PROFILE ACTUALLY REACH A PUBLISHED BOARD? ----
  // Still inside the fixture working directory on purpose: the emitter resolves knowledge/compare/
  // and evp_load probes the caller CWD first, so this grades a corpus THIS GATE AUTHORED and touches
  // not one published board.
  var emitrel: *u8 = EPG_DEFAULT_EMIT
  if argc >= 3 { emitrel = argv[2] as *u8 }
  let emit: *u8 = sys_mmap(EPG_PATH_CAP)
  var emo: i64 = epg_cat(emit, 0, EP_ROOT)
  emo = epg_cat(emit, emo, emitrel)
  gv_puts("  emitter elf: " as *u8); gv_puts(emit); gv_puts("\n" as *u8)
311
  let pgb: *u8 = sys_mmap(EPG_OUT_CAP)
  let pcb: *u8 = sys_mmap(EPG_OUT_CAP)
  let pub: *u8 = sys_mmap(EPG_OUT_CAP)
  let plen: *i64 = sys_mmap(16) as *i64
  let eav: *i64 = sys_mmap(8 * EPG_EMIT_AV) as *i64
  let d_gappy: *u8 = "evpfix" as *u8
  let d_clean: *u8 = "evpclean" as *u8
  let d_nost: *u8 = "evpnostamp" as *u8
  let m_html: *u8 = "html" as *u8
  eav[0] = emit as i64
  eav[2] = m_html as i64
  eav[3] = 0
324
  eav[1] = d_gappy as i64
  plen[0] = 0
  tr_run_capture_to(emit, eav, pgb, EPG_OUT_CAP, plen, EPG_RUN_MS)
  let pgn: i64 = plen[0]
329
  eav[1] = d_clean as i64
  plen[0] = 0
  tr_run_capture_to(emit, eav, pcb, EPG_OUT_CAP, plen, EPG_RUN_MS)
  let pcn: i64 = plen[0]
334
  eav[1] = d_nost as i64
  plen[0] = 0
  tr_run_capture_to(emit, eav, pub, EPG_OUT_CAP, plen, EPG_RUN_MS)
  let pun: i64 = plen[0]
339
  gv_puts("  pages: gappy=" as *u8); gv_num(pgn)
  gv_puts(" clean=" as *u8); gv_num(pcn)
  gv_puts(" unstamped=" as *u8); gv_num(pun)
  gv_puts("\n" as *u8)
344
  // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING ANY OUTCOME: three pages had to render
  // at all, or every probe below would pass or fail for a reason that has nothing to do with the band.
  gv_check("emitter-rendered-a-page-for-all-three-fixture-domains" as *u8,
           ((((pgn > 0) as i64)) & ((pcn > 0) as i64) & ((pun > 0) as i64)), ctr)
  gv_check("emitter-renders-the-evidence-profile-band-onto-the-published-page" as *u8,
           (epg_has(pgb, pgn, EPG_BAND_H2) == 1) as i64, ctr)
351
  // THE COUNTS ON THE PAGE ARE THE REFEREE OWN, NOT A CONSTANT. Every value below is the fixture
  // known-correct answer and NO TWO OF THEM ARE THE SAME NUMBER, so a counter that was copied from
  // its neighbour cannot pass. The denominator is inside the probe, not printed beside it.
  gv_check("band-carries-the-referee-count-grounded-3-of-4-denominator-included" as *u8,
           (epg_has(pgb, pgn, "grounded <b>3</b>/<b>4</b>" as *u8) == 1) as i64, ctr)
  gv_check("band-carries-unsupported-1-and-open-2-and-unnamed-1-and-flips-1" as *u8,
           ((((epg_has(pgb, pgn, "unsupported <b>1</b>" as *u8) == 1) as i64))
            & ((epg_has(pgb, pgn, "open gaps <b>7</b>" as *u8) == 1) as i64)
            & ((epg_has(pgb, pgn, "of them proof withheld <b>4</b>" as *u8) == 1) as i64)
            & ((epg_has(pgb, pgn, "of them unnamed <b>1</b>" as *u8) == 1) as i64)
            & ((epg_has(pgb, pgn, "flips ready <b>1</b>" as *u8) == 1) as i64)), ctr)
  gv_check("band-prints-the-partition-and-declares-that-it-reconciles" as *u8,
           ((((epg_has(pgb, pgn, EPG_BAND_PART) == 1) as i64)) & ((epg_has(pgb, pgn, "both reconcile" as *u8) == 1) as i64)), ctr)
365
  // THE FAILING CONJUNCT IS NAMED IN WORDS ON THE PAGE. A bare RED is a disjunction and the reader
  // always guesses the alarming third; these two boards fail on DIFFERENT conjuncts and say so.
  gv_check("band-names-the-failing-conjunct-in-words-grounded-on-the-gappy-board" as *u8,
           (epg_has(pgb, pgn, "first failing conjunct: <b>grounded</b>" as *u8) == 1) as i64, ctr)
  gv_check("band-names-a-DIFFERENT-failing-conjunct-quorum-on-the-clean-board" as *u8,
           (epg_has(pcb, pcn, "first failing conjunct: <b>quorum</b>" as *u8) == 1) as i64, ctr)
372
  // ---- ANTI-VACUITY. EVERY plausible wrong implementation of this feature renders a CONSTANT: a
  // hardcoded band, a zero-filled profile, a no-evidence stub, or a wrong-root read that resolves
  // nothing for all 96 domains. All of them pass any the-band-rendered test. The ONLY way two pages
  // can name different GAP CLASSES is to have actually opened and parsed two different stamps.
  var bandelta: i64 = 0
  if epg_has(pgb, pgn, "UNSUPPORTED-CLAIM" as *u8) == 1 { if epg_has(pcb, pcn, "UNSUPPORTED-CLAIM" as *u8) == 0 { bandelta = bandelta + 1 } }
  if epg_has(pgb, pgn, "FLIP-READY" as *u8) == 1 { if epg_has(pcb, pcn, "FLIP-READY" as *u8) == 0 { bandelta = bandelta + 1 } }
  if epg_has(pgb, pgn, "UNNAMED-GAP" as *u8) == 1 { if epg_has(pcb, pcn, "UNNAMED-GAP" as *u8) == 0 { bandelta = bandelta + 1 } }
  if epg_has(pgb, pgn, "PROOF-WITHHELD" as *u8) == 1 { if epg_has(pcb, pcn, "PROOF-WITHHELD" as *u8) == 0 { bandelta = bandelta + 1 } }
  if epg_has(pgb, pgn, "WITHHELD-REFUSED" as *u8) == 1 { if epg_has(pcb, pcn, "WITHHELD-REFUSED" as *u8) == 0 { bandelta = bandelta + 1 } }
  gv_puts("  band gap-class delta=" as *u8); gv_num(bandelta); gv_puts("\n" as *u8)
  gv_check("anti-vacuity-the-two-boards-name-3-or-more-DIFFERENT-gap-classes" as *u8,
           (bandelta >= 3) as i64, ctr)
386
  // ---- NEG-CONTROLS ----
  gv_check("neg-control-unstamped-domain-renders-UNSTAMPED-and-NOT-ONE-numeric-field" as *u8,
           ((((epg_has(pub, pun, EPG_BAND_UNSTAMPED) == 1) as i64)) & ((epg_has(pub, pun, EPG_BAND_PART) == 0) as i64)), ctr)
  // A FIELD-SHAPED PROBE, AND THE TOOTH NAME SAYS SO. The surrounding page legitimately contains the
  // word scored, so a bare substring probe would go RED for the wrong reason -- and a RED for the wrong
  // reason is the easiest false proof to accept. This looks for the KEY forms only, and claims no more.
  var nogradepg: i64 = 1
  if epg_has(pgb, pgn, "grade=" as *u8) == 1 { nogradepg = 0 }
  if epg_has(pgb, pgn, "score=" as *u8) == 1 { nogradepg = 0 }
  if epg_has(pgb, pgn, "rating=" as *u8) == 1 { nogradepg = 0 }
  if epg_has(pgb, pgn, "permil=" as *u8) == 1 { nogradepg = 0 }
  gv_check("neg-control-no-scalar-grade-FIELD-is-emitted-field-shaped-probe" as *u8, nogradepg, ctr)
399
  sys_chdir(EP_ROOT)
401
  gv_check("gappy-fixture-stamp-was-written-by-the-subject" as *u8, (gn > 0) as i64, ctr)
  gv_check("clean-fixture-stamp-was-written-by-the-subject" as *u8, (cn > 0) as i64, ctr)
404
  let g: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let c: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let v: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let k: *i64 = sys_mmap(8 * EVP_NF) as *i64
  evp_parse(gb, gn, g)
  evp_parse(cb, cn, c)
  evp_parse(vb, vn, v)
  evp_parse(kb, kn, k)
413
  gv_puts("  gappy : v=" as *u8); gv_num(g[EVP_F_V])
  gv_puts(" present=" as *u8); gv_num(g[EVP_F_PRESENT])
  gv_puts(" grounded=" as *u8); gv_num(g[EVP_F_GROUNDED])
  gv_puts(" ungrounded=" as *u8); gv_num(g[EVP_F_UNGROUND])
  gv_puts(" absent=" as *u8); gv_num(g[EVP_F_ABSENT])
  gv_puts(" named=" as *u8); gv_num(g[EVP_F_ABSNAMED])
  gv_puts(" bare=" as *u8); gv_num(g[EVP_F_ABSBARE])
  gv_puts(" landed=" as *u8); gv_num(g[EVP_F_LANDED])
  gv_puts(" mbytes=" as *u8); gv_num(g[EVP_F_MBYTES])
  gv_puts(" conj_fail=" as *u8); gv_num(evp_conj_fail(g))
  gv_puts("\n" as *u8)
  gv_puts("  clean : v=" as *u8); gv_num(c[EVP_F_V])
  gv_puts(" present=" as *u8); gv_num(c[EVP_F_PRESENT])
  gv_puts(" grounded=" as *u8); gv_num(c[EVP_F_GROUNDED])
  gv_puts(" ungrounded=" as *u8); gv_num(c[EVP_F_UNGROUND])
  gv_puts(" absent=" as *u8); gv_num(c[EVP_F_ABSENT])
  gv_puts(" landed=" as *u8); gv_num(c[EVP_F_LANDED])
  gv_puts(" conj_fail=" as *u8); gv_num(evp_conj_fail(c))
  gv_puts("  delta=" as *u8); gv_num(epg_profile_delta(g, c))
  gv_puts("\n" as *u8)
434
  // ---- THE PROFILE ITSELF ----
  // v3 NOW: the stamp carries the withheld keys. THIS EXPECTATION WAS MOVED 2 -> 3 DELIBERATELY rather
  // than loosened to >= 2 -- a version tooth that accepts any future version has stopped testing version.
  gv_check("profile-keys-present-so-the-stamp-is-v3" as *u8, (g[EVP_F_V] == 3) as i64, ctr)
  // STILL 1, AND THIS IS NOW THE LOAD-BEARING TOOTH OF THE WHOLE WITHHELD CLASS. The fixture adds FOUR
  // rows whose symbols ARE ALL PRESENT in the organ, and landed MUST NOT MOVE. If a withheld row could
  // still land it would still fire FLIP-READY, and the exact defect this class closes would be open again.
  gv_check("landed-stays-1-so-a-withheld-row-can-never-become-a-flip" as *u8, (g[EVP_F_LANDED] == 1) as i64, ctr)
  gv_check("bare-absent-counted-separately-from-named-absent-not-3-and-0" as *u8,
           (((g[EVP_F_ABSBARE] == 1) as i64) & ((g[EVP_F_ABSNAMED] == 2) as i64)), ctr)
  // ---- THE WITHHELD CLASS. FIVE fixture rows carry the form; ONE names a symbol that is not in the
  // organ, so it is NOT withheld -- it is an ordinary unlanded contract and lands in absent_named.
  gv_check("withheld-counted-and-the-population-is-the-expected-4" as *u8, (g[EVP_F_WITHHELD] == 4) as i64, ctr)
  // NEG-CONTROL, AND THE REASON THE FORM IS NOT A SILENCE BUTTON. Exactly TWO rows must be refused: the
  // one whose precondition file HOLDS DATA, and the one whose mechanism never shipped. A referee that
  // honoured every withheld row would read 0 here and would still pass every other tooth on this page.
  gv_check("neg-control-a-withheld-row-whose-precondition-is-MET-is-REFUSED-not-honoured" as *u8,
           (g[EVP_F_WHREF] == 2) as i64, ctr)
  // AND THE FORM DECIDES, NOT THE SYMBOL. evpfix_landed appears TWICE in the fixture: once as a plain
  // watch contract and once in withheld form. If classification keyed on the symbol those two rows would
  // agree; landed==1 alongside withheld==4 is the proof that they did not.
  gv_check("the-FORM-decides-not-the-symbol-one-symbol-reads-LANDED-in-one-row-and-WITHHELD-in-another" as *u8,
           ((((g[EVP_F_LANDED] == 1) as i64)) & ((g[EVP_F_WITHHELD] == 4) as i64)), ctr)
  gv_check("ungrounded-claim-measured" as *u8, (g[EVP_F_UNGROUND] == 1) as i64, ctr)
  // THE DENOMINATOR IS IN THE CONDITION, not merely printed beside it: a sum check over an empty scan
  // passes for the wrong reason, so the expected population is asserted in the same predicate.
  gv_check("partition-present-sums-and-the-population-is-the-expected-4" as *u8,
           ((((g[EVP_F_GROUNDED] + g[EVP_F_UNGROUND]) == g[EVP_F_PRESENT]) as i64) & ((g[EVP_F_PRESENT] == 4) as i64)), ctr)
  // THREE PARTS NOW, DENOMINATOR STILL INSIDE THE CONDITION: 2 named + 1 bare + 4 withheld = 7. Every
  // gap row increments exactly ONE part, so this sum can genuinely fail -- which is the only reason a
  // partition is worth printing. withheld_refused is NOT in this sum: it overlaps two parts and is a
  // separate axis, and folding it in would break a check whose whole value is that it CAN break.
  gv_check("partition-absent-sums-over-THREE-parts-and-the-population-is-the-expected-7" as *u8,
           ((((g[EVP_F_ABSNAMED] + g[EVP_F_ABSBARE] + g[EVP_F_WITHHELD]) == g[EVP_F_ABSENT]) as i64) & ((g[EVP_F_ABSENT] == 7) as i64)), ctr)
  gv_check("evp-reconciles-agrees-with-both-partitions" as *u8, (evp_reconciles(g) == 1) as i64, ctr)
  gv_check("conj-names-the-FIRST-failing-conjunct-grounded" as *u8, (evp_conj_fail(g) == 0) as i64, ctr)
  gv_check("mroot-names-the-tree-that-answered" as *u8, (g[EVP_F_MROOT] == EVP_TREE_PRIMARY) as i64, ctr)
  gv_check("mbytes-names-the-size-of-the-document-that-was-graded" as *u8, (g[EVP_F_MBYTES] == mfix) as i64, ctr)
  gv_check("gatesroot-reads-NONE-when-the-domain-declares-no-gates-map" as *u8,
           (((g[EVP_F_GATESROOT] == EVP_TREE_NONE) as i64) & ((g[EVP_F_RAN] == 0) as i64)), ctr)
  gv_check("v1-keys-preserved-in-name-and-in-order-with-host-and-dig-still-the-tail" as *u8,
           epg_v1_order(gb, gn), ctr)
477
  // ---- ANTI-VACUITY. Two subjects, two profiles, and they must DIFFER. Every trivial wrong
  // implementation of this feature returns a constant, and a constant scores 0 here. ----
  gv_check("anti-vacuity-profile-discriminates-two-different-boards-in-3-or-more-fields" as *u8,
           (epg_profile_delta(g, c) >= 3) as i64, ctr)
  gv_check("anti-vacuity-the-two-boards-fail-on-DIFFERENT-conjuncts" as *u8,
           (((evp_conj_fail(g) == 0) as i64) & ((evp_conj_fail(c) == 2) as i64)), ctr)
  gv_check("clean-board-reports-no-gaps-of-any-kind" as *u8,
           (((c[EVP_F_UNGROUND] == 0) as i64) & ((c[EVP_F_ABSENT] == 0) as i64) & ((c[EVP_F_LANDED] == 0) as i64) & ((c[EVP_F_PRESENT] == 5) as i64)), ctr)
486
  // ---- NEG-CONTROLS ----
  // A v1 stamp carries no profile at all. A reader that fills those slots with 0 publishes a gapless
  // board for a domain it never measured -- and it fails in the flattering direction, which nobody audits.
  gv_check("neg-control-v1-stamp-reads-as-UNKNOWN-never-as-a-board-with-zero-gaps" as *u8,
           (((v[EVP_F_V] == 1) as i64) & ((v[EVP_F_UNGROUND] == 0 - 1) as i64) & ((evp_reconciles(v) == 0 - 1) as i64)), ctr)
  gv_check("neg-control-a-leaking-partition-is-DETECTED-not-summed-away" as *u8,
           (evp_reconciles(k) == 0) as i64, ctr)
  // NO SCALAR GRADE, ANYWHERE. A stored grade is a field a seat can edit; counts with their
  // denominators are not. This goes RED the day someone adds one.
  var nograde: i64 = 1
  if epg_has(gb, gn, "grade=" as *u8) == 1 { nograde = 0 }
  if epg_has(gb, gn, "score=" as *u8) == 1 { nograde = 0 }
  if epg_has(gb, gn, "rating=" as *u8) == 1 { nograde = 0 }
  if epg_has(gb, gn, "permil" as *u8) == 1 { nograde = 0 }
  gv_check("neg-control-no-scalar-grade-score-rating-or-permil-is-ever-stamped" as *u8, nograde, ctr)
502
  // ---- THE GATE-OUTCOME SPLIT: AN ABSTENTION IS NOT A FAILURE (added 2026-08-31) ----
  // The referee counts a SKIPped gate INSIDE ran and OUTSIDE green -- ev_gates' own source says
  // `ran[1] = 0   // gates that ABSTAINED (exit EV_RC_SKIP): counted, never convicted` -- so a
  // `green < ran` reading convicts every board whose non-green gates merely abstained. Live witness
  // when this was fixed: smallos stamped `gates=1/3 skipped=2 ... conj=GPQN`, i.e. ZERO failing
  // gates and quorum HELD per the referee's own conjunct string, and it was published as failing.
  // FOUR STAMPS, FOUR DIFFERENT ANSWERS, NO TWO ALIKE -- a predicate copied from its neighbour, or
  // one that simply returns a constant, cannot pass all four.
  // Written and read through epg_fix (ABSOLUTE, under this gate's own /tmp dir), so these teeth are
  // cwd-independent and cannot touch a published stamp.
  let q1: *u8 = sys_mmap(EPG_PATH_CAP)
  let q2: *u8 = sys_mmap(EPG_PATH_CAP)
  let q3: *u8 = sys_mmap(EPG_PATH_CAP)
  let q4: *u8 = sys_mmap(EPG_PATH_CAP)
  // 1. ABSTAIN-ONLY: ran 3 = green 1 + skipped 2, failing 0. This is the smallos shape verbatim.
  epg_fix(q1, "knowledge/status/evstamp_evpskip.verdict" as *u8)
  epg_write(q1, "ok=1 epoch=1788190000 grounded=23/23 gates=1/3 skipped=2 declared=3 hashed=3 redseen=1 ungrounded=0 absent=10 absent_named=0 absent_bare=10 landed=0 vacuous=0 conj=GPQN mroot=PRIMARY mbytes=100 mcapped=0 gatesroot=PRIMARY host=west_nas dig=ABSENT\n" as *u8)
  // 2. GENUINELY FAILING: ran 4 = green 1 + skipped 1 + failing 2. THE POSITIVE CONTROL.
  epg_fix(q2, "knowledge/status/evstamp_evpfail.verdict" as *u8)
  epg_write(q2, "ok=0 epoch=1788190000 grounded=9/9 gates=1/4 skipped=1 declared=4 hashed=4 redseen=1 ungrounded=0 absent=0 absent_named=0 absent_bare=0 landed=0 vacuous=0 conj=GPqN mroot=PRIMARY mbytes=100 mcapped=0 gatesroot=PRIMARY host=west_nas dig=ABSENT\n" as *u8)
  // 3. TOO OLD TO SAY: gates=1/3 and NO ` skipped=` key at all. Neither failing nor clean -- UNKNOWN.
  epg_fix(q3, "knowledge/status/evstamp_evpold.verdict" as *u8)
  epg_write(q3, "ok=1 epoch=1788190000 grounded=5/5 gates=1/3 declared=3 hashed=3 redseen=0 host=west_nas dig=ABSENT\n" as *u8)
  // 4. AN IMPOSSIBLE GATE PARTITION: green 3 + skipped 2 EXCEEDS ran 2. The remainder goes negative
  //    and that is the one falsifiable thing this partition can say, so it must say it.
  epg_fix(q4, "knowledge/status/evstamp_evpgleak.verdict" as *u8)
  epg_write(q4, "ok=1 epoch=1788190000 grounded=5/5 gates=3/2 skipped=2 declared=2 hashed=2 redseen=0 host=west_nas dig=ABSENT\n" as *u8)
530
  let sk: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let fa: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let ol: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let gl: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let qb: *u8 = sys_mmap(EVP_STAMP_CAP)
  let n_sk: i64 = evp_read(q1, qb, EVP_STAMP_CAP)
  evp_parse(qb, n_sk, sk)
  let n_fa: i64 = evp_read(q2, qb, EVP_STAMP_CAP)
  evp_parse(qb, n_fa, fa)
  let n_ol: i64 = evp_read(q3, qb, EVP_STAMP_CAP)
  evp_parse(qb, n_ol, ol)
  let n_gl: i64 = evp_read(q4, qb, EVP_STAMP_CAP)
  evp_parse(qb, n_gl, gl)
544
  // ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING ANY OUTCOME. If these four stamps did
  // not parse to the shape the teeth below assume, every one of them would pass or fail for a reason
  // that has nothing to do with the split under test.
  var shape: i64 = 0
  if n_sk > 0 { if n_fa > 0 { if n_ol > 0 { if n_gl > 0 {
      if sk[EVP_F_RAN] == 3 { if sk[EVP_F_GREEN] == 1 { if sk[EVP_F_SKIPPED] == 2 {
      if fa[EVP_F_RAN] == 4 { if fa[EVP_F_SKIPPED] == 1 {
      if ol[EVP_F_RAN] == 3 { if ol[EVP_F_SKIPPED] == 0 - 1 { shape = 1 } } } } } } }
  } } } }
  gv_check("fixture-four-gate-stamps-parsed-to-the-shapes-these-teeth-assume" as *u8, shape, ctr)
555
  gv_puts("  gates: skip fail_n=" as *u8); gv_num(evp_gate_failing_n(sk))
  gv_puts(" | fail fail_n=" as *u8); gv_num(evp_gate_failing_n(fa))
  gv_puts(" | old fail_n=" as *u8); gv_num(evp_gate_failing_n(ol))
  gv_puts(" | leak recon=" as *u8); gv_num(evp_gates_reconcile(gl))
  gv_puts("\n" as *u8)
561
  // THE DEFECT ITSELF: 1 green + 2 skipped is ZERO failing gates and must not be convicted.
  gv_check("an-abstaining-board-is-NOT-convicted-as-failing-and-IS-listed-as-skipped" as *u8,
           ((((evp_gate_failing(sk) == 0) as i64)) & ((evp_gate_failing_n(sk) == 0) as i64)
            & ((evp_gate_skipped(sk) == 1) as i64) & ((evp_gate_unknown(sk) == 0) as i64)), ctr)
  // POSITIVE CONTROL. A predicate that refuses to convict ANYTHING passes the tooth above, so the
  // fix is only real if a board with genuine failures is still caught -- and caught with the right
  // COUNT, not merely flagged. THIS IS THE TOOTH THAT STOPS THE FIX BECOMING AN ACQUITTAL.
  gv_check("positive-control-a-genuinely-failing-board-is-STILL-convicted-with-the-right-count" as *u8,
           ((((evp_gate_failing(fa) == 1) as i64)) & ((evp_gate_failing_n(fa) == 2) as i64)), ctr)
  // I COULD NOT LOOK IS NOT IT IS FINE, and it is not IT IS BROKEN either.
  gv_check("neg-control-a-stamp-with-no-skipped-field-abstains-rather-than-convicting-or-acquitting" as *u8,
           ((((evp_gate_unknown(ol) == 1) as i64)) & ((evp_gate_failing(ol) == 0) as i64)
            & ((evp_gate_failing_n(ol) == 0 - 1) as i64) & ((evp_gates_reconcile(ol) == 0 - 1) as i64)), ctr)
  // THE PARTITION, WITH ITS POPULATION IN THE CONDITION rather than merely printed beside it.
  gv_check("gate-partition-green-plus-skipped-plus-failing-equals-ran-on-both-measurable-boards" as *u8,
           (((sk[EVP_F_GREEN] + sk[EVP_F_SKIPPED] + evp_gate_failing_n(sk) == sk[EVP_F_RAN]) as i64)
            & ((sk[EVP_F_RAN] == 3) as i64)
            & ((fa[EVP_F_GREEN] + fa[EVP_F_SKIPPED] + evp_gate_failing_n(fa) == fa[EVP_F_RAN]) as i64)
            & ((fa[EVP_F_RAN] == 4) as i64)), ctr)
  gv_check("neg-control-an-impossible-gate-partition-is-DETECTED-not-summed-away" as *u8,
           ((((evp_gates_reconcile(gl) == 0) as i64)) & ((evp_gates_reconcile(sk) == 1) as i64)), ctr)
  // THE SENTINEL-COLLISION BOUNDARY, AND IT IS THE ONE CASE THE FIXTURES ABOVE CANNOT REACH.
  // evp_gate_failing_n returns -1 as its NOT-MEASURABLE sentinel, and -1 is ALSO a legitimate
  // remainder -- green + skipped exactly ONE more than ran. A reconcile built on that helper reports
  // this board as "I could not measure" when it is in fact a LEAK: a negative answer that cannot say
  // which negative it is, which is the whole defect this change exists to remove.
  // gl (green 3 + skipped 2 vs ran 2) gives a remainder of -3 and is caught EITHER WAY, so it does
  // NOT exercise this. Only a remainder of exactly -1 does. WITHOUT THIS FIXTURE THE FIX IS
  // UNEXERCISED AND ITS TOOTH WOULD BE VACUOUS -- measured: with gl alone, live-vs-staged came back
  // IDENTICAL (first_diff_off=-1) across the sentinel fix, i.e. nothing in the suite could see it.
  let q5: *u8 = sys_mmap(EPG_PATH_CAP)
  epg_fix(q5, "knowledge/status/evstamp_evpedge.verdict" as *u8)
  epg_write(q5, "ok=1 epoch=1788190000 grounded=5/5 gates=2/2 skipped=1 declared=2 hashed=2 redseen=0 host=west_nas dig=ABSENT\n" as *u8)
  let ed: *i64 = sys_mmap(8 * EVP_NF) as *i64
  let n_ed: i64 = evp_read(q5, qb, EVP_STAMP_CAP)
  evp_parse(qb, n_ed, ed)
  gv_puts("  edge : ran=" as *u8); gv_num(ed[EVP_F_RAN])
  gv_puts(" green=" as *u8); gv_num(ed[EVP_F_GREEN])
  gv_puts(" skipped=" as *u8); gv_num(ed[EVP_F_SKIPPED])
  gv_puts(" fail_n=" as *u8); gv_num(evp_gate_failing_n(ed))
  gv_puts(" recon=" as *u8); gv_num(evp_gates_reconcile(ed))
  gv_puts("\n" as *u8)
  // FIXTURE REACHED THE CONDITION: assert the remainder really is the sentinel value BEFORE
  // asserting what the reconcile does with it, or this tooth passes for an unrelated reason.
  gv_check("fixture-edge-board-remainder-is-EXACTLY-the--1-sentinel-value" as *u8,
           ((((n_ed > 0) as i64)) & ((ed[EVP_F_RAN] == 2) as i64) & ((ed[EVP_F_GREEN] == 2) as i64)
            & ((ed[EVP_F_SKIPPED] == 1) as i64) & ((evp_gate_failing_n(ed) == 0 - 1) as i64)), ctr)
  gv_check("a-remainder-of-exactly--1-reads-as-a-LEAK-not-as-not-measurable-sentinel-collision" as *u8,
           (evp_gates_reconcile(ed) == 0) as i64, ctr)
  // ANTI-VACUITY: the three measurable boards must not all answer alike. A constant scores 0 here.
  var gdelta: i64 = 0
  if evp_gate_failing_n(sk) != evp_gate_failing_n(fa) { gdelta = gdelta + 1 }
  if evp_gate_unknown(sk) != evp_gate_unknown(ol) { gdelta = gdelta + 1 }
  if evp_gates_reconcile(sk) != evp_gates_reconcile(gl) { gdelta = gdelta + 1 }
  gv_check("anti-vacuity-the-gate-predicates-discriminate-3-or-more-DIFFERENT-boards" as *u8,
           (gdelta >= 3) as i64, ctr)
  // THE RENAME IS AN ALIAS, NOT A SECOND RULER. evp_fabricated must DELEGATE to
  // evp_ungrounded_claim, so the two can never drift apart; they are checked on a board where the
  // answer is 1 and on one where it is 0, because two functions that both return a constant agree
  // trivially on a single case.
  gv_check("deprecated-evp_fabricated-alias-DELEGATES-and-cannot-drift-from-evp_ungrounded_claim" as *u8,
           ((((evp_fabricated(g) == evp_ungrounded_claim(g)) as i64)) & ((evp_ungrounded_claim(g) == 1) as i64)
            & ((evp_fabricated(c) == evp_ungrounded_claim(c)) as i64) & ((evp_ungrounded_claim(c) == 0) as i64)), ctr)
625
  return gv_verdict(EPG_NAME, ctr,
      "the evidence profile is MEASURED end-to-end: the promoted referee is forked inside a fixture compare tree this gate authored, and every counter it writes is checked against a fixture with a known-correct, all-different answer. Point argv[1] at the banked pre-change binary to see the profile teeth go RED -- that control is the incumbent itself, not a synthetic mutant." as *u8)
628}
nx_evidence_profile_gate.nx source

`nx_evidence_profile_gate.nx` source
