code wiki / (root) / nx_execsurface_gate.nx
`nx_execsurface_gate.nx` source

↩ module page · 559 lines · 29488 B
1// nx_execsurface_gate.nx -- referee for nx_execsurface (2026-08-23, compare CE2).
2// END-TO-END: forks the DEPLOYED ./nx_execsurface.elf into a /tmp/<gate>/ fixture path (never the production
3// artifact), reads the rows back the way the shared classifier does, and checks BOTH directions of the
4// surface rule: a program the clock demonstrably runs is credited, a program only MENTIONED is not.
5//   T1 precondition  the organ did not exit 3 UNOBSERVABLE (gv_need -> SKIP, never RED)
6//   T2 exit 0 and the receipt names the artifact
7//   T3 the last line is the canonical stamp (# asof=...) with a non-zero asof
8//   T4 partition on_surface + ref_only + dark == organs (a partition is a claim)
9//   T5 full population: counted rows == organs declared, and == an INDEPENDENT count of *.elf at . and _offc/
10//   T6 positive control: a program the live clocksched- plane names (read here, FULL prefix, never bare)
11//      has clock=1 and first_surface=clock
12//   T7 neg-control: a fabricated name has no row
13//   T8 anti-vacuity of the 2-hop rule: at least one row is credited fork:<caller> AND that caller's own row is
14//      on a surface; at least one row is ref:<caller> AND that caller's own row is NOT on a surface
15//      (both directions present in the real population, so the rule demonstrably discriminates)
16//   T9 every clock-credited row's name really appears in the plane (no credit without a plane token)
17//   T10 plan expansion (2026-09-17): the first live clock row that runs nx_plan_run.elf <id> names a plan whose
18//      first tool has a census row on a surface (first_surface plan, or a direct surface); the pre-change census
19//      is the planted known-bad: it reads that tool REGISTERED-DARK and this tooth goes RED against it
20//   T11 a "../<x>.elf literal credits a fork (the regen-forked gapmap)
21//   T12 EVERY ROSTER CONF (2026-09-18): every gate row of every conf a live clock row runs through nx_gate_roster_run beat,
22//      whatever journal that beat writes, that has a census row reads roster=1. The confs and rows are re-derived HERE by an
23//      independent reading (the runner's grammar written again, never the organ's lib), so the organ cannot vouch for itself.
24//   T13 the other rosters: the same over the confs OTHER than the runner's default (the heavy and the slow rosters). The
25//      pre-change census is the planted known-bad: it read one conf by name, so those gates read roster=0 and T13 goes RED.
26//   T14/T15 two methods, one answer: the organ's receipt counts the same beats, and the same beats writing ANOTHER journal
27//      (credited too: the close ruler reads each of them from its own journal), as the gate's own reading of the plane.
28// license_tier: ORIGINAL   expect_exit: 0 GREEN | 1 RED | 3 SKIP
29import "nx_syscalls.nx"
30import "nx_tool_run.nx"
31import "nx_gate_verdict.nx"
32
33const EG_CAP: i64 = 65536
34const EG_PLANE_CAP: i64 = 1048576
35const EG_FIX_DIR: *u8 = "/tmp/nx_execsurface_gate"
36const EG_FIX_OUT: *u8 = "/tmp/nx_execsurface_gate/execsurface.tsv"
37const EG_RC_UNOBSERVABLE: i64 = 3
38const EG_DIRBUF: i64 = 131072
39
40func eg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
41func eg_starts(s: *u8, p: *u8) -> i64 { var i: i64 = 0; while p[i] != (0 as u8) { if s[i] != p[i] { return 0 } i = i + 1 } return 1 }
42func eg_ends(s: *u8, sfx: *u8) -> i64 {
  let n: i64 = eg_slen(s)
  let m: i64 = eg_slen(sfx)
  if n < m { return 0 }
  var k: i64 = 0
  while k < m { if s[n - m + k] != sfx[k] { return 0 } k = k + 1 }
  return 1
49}
50func eg_digits(b: *u8, i: i64) -> i64 {
  var v: i64 = 0
  var any: i64 = 0
  var j: i64 = i
  var go: i64 = 1
  while go == 1 {
      let c: i64 = b[j] as i64
      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; j = j + 1 } else { go = 0 } } else { go = 0 }
  }
  if any == 0 { return 0 - 1 }
  return v
61}
62func eg_kv(line: *u8, key: *u8) -> i64 {
  let kl: i64 = eg_slen(key)
  var i: i64 = 0
  while line[i] != (0 as u8) {
      if eg_starts((line as i64 + i) as *u8, key) == 1 { return eg_digits(line, i + kl) }
      i = i + 1
  }
  return 0 - 1
70}
71// offset of the row whose first TAB field equals name; -1 absent
72func eg_row(b: *u8, n: i64, name: *u8) -> i64 {
  let nl: i64 = eg_slen(name)
  var i: i64 = 0
  while i < n {
      var e: i64 = i
      while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
      if e - i > nl { if b[i + nl] == (9 as u8) {
          var k: i64 = 0
          var same: i64 = 1
          while k < nl { if b[i + k] != name[k] { same = 0; k = nl } else { k = k + 1 } }
          if same == 1 { return i }
      } }
      i = e + 1
  }
  return 0 - 1
87}
88// copy TAB field f of the row at r into out; returns length or -1
89func eg_field(b: *u8, n: i64, r: i64, f: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = r
  var cur: i64 = 0
  while cur < f {
      while i < n { if b[i] == (9 as u8) { break } if b[i] == (10 as u8) { out[0] = 0 as u8; return 0 - 1 } i = i + 1 }
      if i >= n { out[0] = 0 as u8; return 0 - 1 }
      i = i + 1
      cur = cur + 1
  }
  var o: i64 = 0
  while i < n { if b[i] == (9 as u8) { break } if b[i] == (10 as u8) { break } if o < cap - 1 { out[o] = b[i]; o = o + 1 } i = i + 1 }
  out[o] = 0 as u8
  return o
102}
103// is the row at r on a surface? (any of clock/cron/daemon/roster/actlog == "1", or fork field != "-")
104func eg_on_surface(b: *u8, n: i64, r: i64) -> i64 {
  let f: *u8 = sys_mmap(160)
  var on: i64 = 0
  var k: i64 = 1
  while k <= 6 {
      eg_field(b, n, r, k, f, 160)
      if k == 4 { if f[0] != (45 as u8) { if f[0] != (0 as u8) { on = 1 } } }
      else { if f[0] == (49 as u8) { if f[1] == (0 as u8) { on = 1 } } }
      k = k + 1
  }
  // plan (2026-09-17): a tool a clock-run plan names is on a surface too; the token lives in field 7
  eg_field(b, n, r, 7, f, 160)
  if eg_starts(f, "plan" as *u8) == 1 { on = 1 }
  sys_munmap(f, 160)
  return on
119}
120// find lit inside [s,e) of b; returns its offset or -1
121func eg_find_in(b: *u8, s: i64, e: i64, lit: *u8) -> i64 {
  let m: i64 = eg_slen(lit)
  var i: i64 = s
  while i + m <= e {
      var k: i64 = 0
      var same: i64 = 1
      while k < m { if b[i + k] != lit[k] { same = 0; k = m } else { k = k + 1 } }
      if same == 1 { return i }
      i = i + 1
  }
  return 0 - 1
132}
133func eg_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } d[p] = 0 as u8; return p }
134func eg_count_elfs(dir: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(dir)
  if fd < 0 { return 0 }
  let dbuf: *u8 = sys_mmap(EG_DIRBUF)
  var cnt: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(fd, dbuf, EG_DIRBUF)
      if nr <= 0 { go = 0 } else {
          var o: i64 = 0
          while o < nr {
              let rec: *u8 = ((dbuf as i64) + o) as *u8
              if dirent_type(rec) != 4 { if eg_ends(dirent_name(rec), ".elf" as *u8) == 1 { cnt = cnt + 1 } }
              o = o + dirent_reclen(rec)
          }
      }
  }
  sys_close(fd)
  sys_munmap(dbuf, EG_DIRBUF)
  return cnt
154}
155
156// ---- T12/T13: the roster beats and their confs, read independently of the organ ----
157const EG_ROSTER_DEFAULT: *u8 = "knowledge/gateroster.conf"   // what the runner's beat reads when it names no conf
158const EG_ROSTER_JRNL: *u8 = "knowledge/status/gateroster.jrnl"   // the production journal: what the beat writes when it names none
159const EG_NOT_A_BEAT: i64 = 0 - 1
160const EG_BEAT_ELF: *u8 = "nx_gate_roster_run.elf beat"
161const EG_BEAT_BARE: *u8 = "nx_gate_roster_run beat"
162// the characters of a roster row's gate name, as the runner's grr_isid reads them
163func eg_isid(c: i64) -> i64 {
  if c >= 97 { if c <= 122 { return 1 } }
  if c >= 65 { if c <= 90 { return 1 } }
  if c >= 48 { if c <= 57 { return 1 } }
  if c == 95 { return 1 }
  if c == 45 { return 1 }
  if c == 46 { return 1 }
  if c == 47 { return 1 }
  return 0
172}
173func eg_sep(c: i64) -> i64 { if c == 32 { return 1 } if c == 9 { return 1 } if c == 13 { return 1 } return 0 }
174// the conf a plane row [s, e) runs through the roster beat, whatever journal it writes: its length with its offset in co[0]; 0
175// when the beat names no conf; EG_NOT_A_BEAT when the row is not a roster beat (the program must start a path segment or a
176// token, the verb must end at a separator). co[1] = 1 when the beat names a journal other than the production one.
177func eg_beat_conf(p: *u8, s: i64, e: i64, co: *i64) -> i64 {
  var at: i64 = eg_find_in(p, s, e, EG_BEAT_ELF)
  var kl: i64 = eg_slen(EG_BEAT_ELF)
  if at < 0 { at = eg_find_in(p, s, e, EG_BEAT_BARE); kl = eg_slen(EG_BEAT_BARE) }
  if at < 0 { return EG_NOT_A_BEAT }
  if at > s { let pc: i64 = p[at - 1] as i64; if pc != 47 { if eg_sep(pc) == 0 { return EG_NOT_A_BEAT } } }
  var q: i64 = at + kl
  if q < e { if eg_sep(p[q] as i64) == 0 { return EG_NOT_A_BEAT } }
  while q < e { if eg_sep(p[q] as i64) == 1 { q = q + 1 } else { break } }
  var t: i64 = q
  while t < e { if eg_sep(p[t] as i64) == 1 { break } t = t + 1 }
  co[0] = q
  co[1] = 0
  if t == q { return 0 }
  // the journal: the next token, when there is one; anything but the production journal is another journal
  var j: i64 = t
  while j < e { if eg_sep(p[j] as i64) == 1 { j = j + 1 } else { break } }
  var je: i64 = j
  while je < e { if eg_sep(p[je] as i64) == 1 { break } je = je + 1 }
  if je > j {
      if je - j != eg_slen(EG_ROSTER_JRNL) { co[1] = 1 } else { if eg_find_in(p, j, je, EG_ROSTER_JRNL) != j { co[1] = 1 } }
  }
  return t - q
200}
201// is the NUL-terminated path already a line of seen[0, sn)?
202func eg_seen(seen: *u8, sn: i64, path: *u8) -> i64 {
  let pl: i64 = eg_slen(path)
  var i: i64 = 0
  while i < sn {
      var e: i64 = i
      while e < sn { if seen[e] == (10 as u8) { break } e = e + 1 }
      if e - i == pl { var k: i64 = 0; var same: i64 = 1; while k < pl { if seen[i + k] != path[k] { same = 0; k = pl } else { k = k + 1 } } if same == 1 { return 1 } }
      i = e + 1
  }
  return 0
212}
213// check every gate row of one conf against the census: cnt[0] rows with a census row, cnt[1] credited roster=1, cnt[2] NOT credited
214// (each named), cnt[3] rows whose gate has no census row (not promoted: nothing to credit). Returns 1 when the conf was read.
215func eg_roster_check(b: *u8, datalen: i64, conf: *u8, cnt: *i64) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let t: *u8 = sys_read_file(conf, lp)
  if (t as i64) == 0 { return 0 }
  let tn: i64 = lp[0]
  let nm: *u8 = sys_mmap(tn + 1)
  let f5: *u8 = sys_mmap(160)
  var p: i64 = 0
  while p < tn {
      var e: i64 = p
      while e < tn { if t[e] == (10 as u8) { break } e = e + 1 }
      var c0: i64 = p
      while c0 < e { if t[c0] == (32 as u8) { c0 = c0 + 1 } else { break } }
      var named: i64 = 0
      if c0 < e { if t[c0] != (35 as u8) { if t[c0] != (59 as u8) { named = 1 } } }
      if named == 1 {
          var q: i64 = c0
          while q < e { if eg_isid(t[q] as i64) == 1 { q = q + 1 } else { break } }
          if q > c0 {
              var k: i64 = 0
              while k < q - c0 { nm[k] = t[c0 + k]; k = k + 1 }
              nm[q - c0] = 0 as u8
              let r: i64 = eg_row(b, datalen, nm)
              if r < 0 { cnt[3] = cnt[3] + 1 } else {
                  cnt[0] = cnt[0] + 1
                  eg_field(b, datalen, r, 5, f5, 160)
                  if f5[0] == (49 as u8) { cnt[1] = cnt[1] + 1 } else {
                      cnt[2] = cnt[2] + 1
                      gv_puts("  ROSTER-NOT-CREDITED conf=" as *u8); gv_puts(conf); gv_puts(" gate=" as *u8); gv_puts(nm); gv_puts("\n" as *u8)
                  }
              }
          }
      }
      p = e + 1
  }
  return 1
251}
252
253func main(argc: i64, argv: *i64) -> i64 {
  gv_head("NX-EXECSURFACE-GATE: which surface runs this program, end to end against the live planes" as *u8)
  let ctr: *i64 = gv_ctr()
  sys_mkdir(EG_FIX_DIR, MODE_0755)
  let av: *i64 = sys_mmap(3 * 8) as *i64
  av[0] = "./nx_execsurface.elf" as *u8 as i64
  av[1] = EG_FIX_OUT as i64
  av[2] = 0
  let cap: *u8 = sys_mmap(EG_CAP)
  let clen: *i64 = sys_mmap(16) as *i64
  let rc: i64 = tr_run_capture("./nx_execsurface.elf" as *u8, av, cap, EG_CAP - 1, clen)
  cap[clen[0]] = 0 as u8
  gv_puts("  rc=" as *u8); gv_num(rc); gv_puts(" receipt: " as *u8); gv_puts(cap); gv_puts("\n" as *u8)
  var ok1: i64 = 1
  if rc == EG_RC_UNOBSERVABLE { ok1 = 0 }
  if gv_need("organ could enumerate organs (did not exit 3 UNOBSERVABLE)" as *u8, ok1, ctr) == 0 {
      return gv_verdict("EXECSURFACE-GATE" as *u8, ctr, "execution-surface census" as *u8)
  }
  var t2: i64 = 0
  if rc == 0 { if tr_contains(cap, clen[0], " of=/tmp/nx_execsurface_gate/execsurface.tsv" as *u8) == 1 { t2 = 1 } }
  gv_check("T2 organ exits 0 and names its artifact in the receipt" as *u8, t2, ctr)
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(EG_FIX_OUT, lp)
  var n: i64 = lp[0]
  if (b as i64) == 0 { n = 0 }
  var ok3: i64 = 0
  var asof: i64 = 0 - 1
  var organs: i64 = 0 - 1
  var on_s: i64 = 0 - 1
  var refo: i64 = 0 - 1
  var dark: i64 = 0 - 1
  var datalen: i64 = 0
  if n > 2 {
      var ls: i64 = n - 1
      if b[ls] == (10 as u8) { ls = ls - 1 }
      while ls > 0 { if b[ls - 1] == (10 as u8) { break } ls = ls - 1 }
      datalen = ls
      let last: *u8 = sys_mmap(n - ls + 2)
      var q: i64 = 0
      while ls + q < n { if b[ls + q] == (10 as u8) { break } last[q] = b[ls + q]; q = q + 1 }
      last[q] = 0 as u8
      if eg_starts(last, "# asof=" as *u8) == 1 { ok3 = 1 }
      asof = eg_kv(last, "asof=" as *u8)
      organs = eg_kv(last, "organs=" as *u8)
      on_s = eg_kv(last, "on_surface=" as *u8)
      refo = eg_kv(last, "ref_only=" as *u8)
      dark = eg_kv(last, "dark=" as *u8)
      gv_puts("  stamp: " as *u8); gv_puts(last); gv_puts("\n" as *u8)
  }
  var t3: i64 = 0
  if ok3 == 1 { if asof > 0 { t3 = 1 } }
  gv_check("T3 last line is the canonical stamp with a non-zero asof" as *u8, t3, ctr)
  var t4: i64 = 0
  if organs > 0 { if on_s + refo + dark == organs { t4 = 1 } }
  gv_check("T4 partition on_surface+ref_only+dark == organs" as *u8, t4, ctr)
  // count rows + independent population count
  var rows: i64 = 0
  var i: i64 = 0
  while i < datalen {
      var e: i64 = i
      while e < datalen { if b[e] == (10 as u8) { break } e = e + 1 }
      if e > i { rows = rows + 1 }
      i = e + 1
  }
  gv_subjects("rows in the artifact" as *u8, rows, ctr)
  // the independent count: *.elf at . plus *.elf under _offc/ minus those present in BOTH (the organ dedupes by name)
  let root_elfs: i64 = eg_count_elfs("." as *u8)
  let offc_elfs: i64 = eg_count_elfs("_offc" as *u8)
  gv_puts("  rows=" as *u8); gv_num(rows); gv_puts(" organs_declared=" as *u8); gv_num(organs); gv_puts(" root_elfs=" as *u8); gv_num(root_elfs); gv_puts(" offc_elfs=" as *u8); gv_num(offc_elfs); gv_puts("\n" as *u8)
  var t5: i64 = 0
  if rows > 0 { if rows == organs { if rows <= root_elfs + offc_elfs { if rows >= root_elfs { if rows >= offc_elfs { t5 = 1 } } } } }
  gv_check("T5 full population: rows == organs declared, within [max(root,offc), root+offc] of an independent *.elf count" as *u8, t5, ctr)
  // T6: read the live plane (FULL prefix) and pick the first organ column token that has a row
  let pav: *i64 = sys_mmap(8 * 8) as *i64
  pav[0] = "./nx_store_put.elf" as *u8 as i64
  pav[1] = "knowledge/store/clocksched-" as *u8 as i64
  pav[2] = "load" as *u8 as i64
  pav[3] = 0
  let plane: *u8 = sys_mmap(EG_PLANE_CAP)
  let plen: *i64 = sys_mmap(16) as *i64
  plen[0] = 0
  tr_run_capture("./nx_store_put.elf" as *u8, pav, plane, EG_PLANE_CAP - 1, plen)
  var t6: i64 = 0
  var t9_bad: i64 = 0
  let pick: *u8 = sys_mmap(160)
  pick[0] = 0 as u8
  var pp: i64 = 0
  var picked: i64 = 0
  while pp < plen[0] {
      var pe: i64 = pp
      while pe < plen[0] { if plane[pe] == (10 as u8) { break } pe = pe + 1 }
      var tabs: i64 = 0
      var c4: i64 = 0 - 1
      var q2: i64 = pp
      while q2 < pe { if plane[q2] == (9 as u8) { tabs = tabs + 1; if tabs == 3 { c4 = q2 + 1; q2 = pe } } q2 = q2 + 1 }
      if c4 >= 0 { if picked == 0 {
          // organ token: strip ./ and .elf
          var s: i64 = c4
          if plane[s] == (46 as u8) { if plane[s+1] == (47 as u8) { s = s + 2 } }
          var o: i64 = 0
          var t: i64 = s
          while t < pe { if plane[t] == (32 as u8) { break } if o < 159 { pick[o] = plane[t]; o = o + 1 } t = t + 1 }
          pick[o] = 0 as u8
          if eg_ends(pick, ".elf" as *u8) == 1 { pick[o - 4] = 0 as u8 }
          let r6: i64 = eg_row(b, datalen, pick)
          if r6 >= 0 {
              picked = 1
              let f1: *u8 = sys_mmap(160)
              let f7: *u8 = sys_mmap(160)
              eg_field(b, datalen, r6, 1, f1, 160)
              eg_field(b, datalen, r6, 7, f7, 160)
              gv_puts("  positive control from the live plane: " as *u8); gv_puts(pick); gv_puts(" clock=" as *u8); gv_puts(f1); gv_puts(" first_surface=" as *u8); gv_puts(f7); gv_puts("\n" as *u8)
              if f1[0] == (49 as u8) { if eg_starts(f7, "clock" as *u8) == 1 { t6 = 1 } }
          }
      } }
      pp = pe + 1
  }
  if gv_need("live clocksched- plane loadable with an organ that has a row" as *u8, picked, ctr) == 1 {
      gv_check("T6 positive control: a clock-plane organ is credited clock=1, first_surface=clock" as *u8, t6, ctr)
  }
  var t7: i64 = 0
  if eg_row(b, datalen, "nx_definitely_not_an_organ_zzz" as *u8) < 0 { t7 = 1 }
  gv_check("T7 neg-control: a fabricated name has no row" as *u8, t7, ctr)
  // T8 + T9: walk every row
  var fork_ok: i64 = 0
  var ref_ok: i64 = 0
  var fork_bad: i64 = 0
  var ref_bad: i64 = 0
  var clock_rows: i64 = 0
  let f7: *u8 = sys_mmap(160)
  let f1b: *u8 = sys_mmap(160)
  let f0: *u8 = sys_mmap(160)
  i = 0
  while i < datalen {
      var e: i64 = i
      while e < datalen { if b[e] == (10 as u8) { break } e = e + 1 }
      if e > i {
          eg_field(b, datalen, i, 7, f7, 160)
          eg_field(b, datalen, i, 1, f1b, 160)
          eg_field(b, datalen, i, 0, f0, 160)
          if eg_starts(f7, "fork:" as *u8) == 1 {
              let cr: i64 = eg_row(b, datalen, (f7 as i64 + 5) as *u8)
              if cr >= 0 { if eg_on_surface(b, datalen, cr) == 1 { fork_ok = fork_ok + 1 } else { fork_bad = fork_bad + 1 } } else { fork_bad = fork_bad + 1 }
          }
          if eg_starts(f7, "ref:" as *u8) == 1 {
              let cr2: i64 = eg_row(b, datalen, (f7 as i64 + 4) as *u8)
              if cr2 >= 0 { if eg_on_surface(b, datalen, cr2) == 0 { ref_ok = ref_ok + 1 } else { ref_bad = ref_bad + 1 } } else { ref_ok = ref_ok + 1 }
          }
          if f1b[0] == (49 as u8) {
              clock_rows = clock_rows + 1
              // the name must appear in the plane text (credit without a plane token = a parser defect)
              if tr_contains(plane, plen[0], f0) == 0 { t9_bad = t9_bad + 1 }
          }
      }
      i = e + 1
  }
  gv_puts("  fork-credited-with-surfaced-caller=" as *u8); gv_num(fork_ok); gv_puts(" fork-credited-BAD=" as *u8); gv_num(fork_bad); gv_puts(" ref-only-with-dark-caller=" as *u8); gv_num(ref_ok); gv_puts(" ref-only-BAD=" as *u8); gv_num(ref_bad); gv_puts(" clock_rows=" as *u8); gv_num(clock_rows); gv_puts(" clock-credited-without-plane-token=" as *u8); gv_num(t9_bad); gv_puts("\n" as *u8)
  var t8: i64 = 0
  if fork_ok > 0 { if ref_ok > 0 { if fork_bad == 0 { if ref_bad == 0 { t8 = 1 } } } }
  gv_check("T8 2-hop rule discriminates: fork credits only surfaced callers, refs only dark callers, both classes present" as *u8, t8, ctr)
  var t9: i64 = 0
  if clock_rows > 0 { if t9_bad == 0 { t9 = 1 } }
  gv_check("T9 every clock-credited row is named in the live plane" as *u8, t9, ctr)
  // T10 (2026-09-17): PLAN EXPANSION. A clock row that runs nx_plan_run.elf <id> causes every tool the rows of
  // knowledge/store/plan-<id>- name to run, so the census credits them (first_surface plan). Positive control from
  // the live plane: the first plan-run row's plan, its first tool, must have a census row on a surface. Before this
  // the workflows-as-data plane was invisible and every plan-run organ read REGISTERED-DARK.
  var t10: i64 = 0
  var t10_picked: i64 = 0
  let ptool: *u8 = sys_mmap(160)
  ptool[0] = 0 as u8
  let pid: *u8 = sys_mmap(160)
  pid[0] = 0 as u8
  let f7p: *u8 = sys_mmap(160)
  f7p[0] = 0 as u8
  pp = 0
  while pp < plen[0] {
      var pe: i64 = pp
      while pe < plen[0] { if plane[pe] == (10 as u8) { break } pe = pe + 1 }
      if t10_picked == 0 {
          let at: i64 = eg_find_in(plane, pp, pe, "nx_plan_run.elf " as *u8)
          if at >= 0 {
              var s2: i64 = at + 16
              var o2: i64 = 0
              while s2 < pe { if plane[s2] == (32 as u8) { break } if plane[s2] == (9 as u8) { break } if o2 < 159 { pid[o2] = plane[s2]; o2 = o2 + 1 } s2 = s2 + 1 }
              pid[o2] = 0 as u8
              if o2 > 0 {
                  let pfx: *u8 = sys_mmap(512)
                  var po: i64 = eg_cat(pfx, 0, "knowledge/store/plan-" as *u8)
                  po = eg_cat(pfx, po, pid)
                  po = eg_cat(pfx, po, "-" as *u8)
                  let qav: *i64 = sys_mmap(8 * 8) as *i64
                  qav[0] = "./nx_store_put.elf" as *u8 as i64
                  qav[1] = pfx as i64
                  qav[2] = "load" as *u8 as i64
                  qav[3] = 0
                  let pb: *u8 = sys_mmap(EG_PLANE_CAP)
                  let pl: *i64 = sys_mmap(16) as *i64
                  pl[0] = 0
                  tr_run_capture("./nx_store_put.elf" as *u8, qav, pb, EG_PLANE_CAP - 1, pl)
                  var q3: i64 = 0
                  while q3 < pl[0] { if pb[q3] == (9 as u8) { break } if pb[q3] == (10 as u8) { break } q3 = q3 + 1 }
                  if q3 < pl[0] { if pb[q3] == (9 as u8) {
                      q3 = q3 + 1
                      var o3: i64 = 0
                      while q3 < pl[0] { if pb[q3] == (9 as u8) { break } if pb[q3] == (10 as u8) { break } if pb[q3] == (32 as u8) { break } if o3 < 159 { ptool[o3] = pb[q3]; o3 = o3 + 1 } q3 = q3 + 1 }
                      ptool[o3] = 0 as u8
                      if eg_ends(ptool, ".elf" as *u8) == 1 { ptool[o3 - 4] = 0 as u8 }
                      let rt: i64 = eg_row(b, datalen, ptool)
                      if rt >= 0 {
                          t10_picked = 1
                          eg_field(b, datalen, rt, 7, f7p, 160)
                          if eg_starts(f7p, "plan" as *u8) == 1 { t10 = 1 } else { if eg_on_surface(b, datalen, rt) == 1 { t10 = 1 } }
                      }
                  } }
              }
          }
      }
      pp = pe + 1
  }
  gv_puts("  plan control from the live plane: plan=" as *u8); gv_puts(pid); gv_puts(" tool=" as *u8); gv_puts(ptool); gv_puts(" first_surface=" as *u8); gv_puts(f7p); gv_puts("\n" as *u8)
  if gv_need("live plane has an nx_plan_run row whose plan's first tool has a census row" as *u8, t10_picked, ctr) == 1 {
      gv_check("T10 plan expansion: a tool named by a clock-run plan is credited (first_surface plan, or a direct surface)" as *u8, t10, ctr)
  }
  // T11 (2026-09-17): a "../<x>.elf fork literal credits a fork. nx_compare_regen chdirs into buildroot and forks
  // ../nx_swcompare_gapmap.elf per domain; the census recognised only the "./ and "_offc/ openers, so the gapmap read
  // REGISTERED-DARK on every regen receipt while the regen ran it daily. Witness: the gapmap row's first_surface is
  // fork:<caller>. A ref: reading here means the caller itself is dark (the 2-hop rule), a finding, not a pass.
  let f7g: *u8 = sys_mmap(160)
  f7g[0] = 0 as u8
  let rg: i64 = eg_row(b, datalen, "nx_swcompare_gapmap" as *u8)
  var t11: i64 = 0
  if rg >= 0 { eg_field(b, datalen, rg, 7, f7g, 160); if eg_starts(f7g, "fork:" as *u8) == 1 { t11 = 1 } }
  gv_puts("  dotdot fork witness: nx_swcompare_gapmap first_surface=" as *u8); gv_puts(f7g); gv_puts("\n" as *u8)
  if gv_need("census has a row for nx_swcompare_gapmap (the ../ fork witness)" as *u8, (rg >= 0) as i64, ctr) == 1 {
      gv_check("T11 a ../<x>.elf literal credits a fork: the regen-forked gapmap is fork-credited, not dark" as *u8, t11, ctr)
  }
  // T12/T13 (2026-09-18): EVERY ROSTER CONF, re-derived from the live plane read above by the gate's own reading
  let seen: *u8 = sys_mmap(plen[0] + eg_slen(EG_ROSTER_DEFAULT) + 3)
  seen[0] = 0 as u8
  var sn: i64 = 0
  let co: *i64 = sys_mmap(16) as *i64
  let rall: *i64 = sys_mmap(4 * 8) as *i64      // the default conf: rows with a census row, credited, NOT credited, no census row
  let roth: *i64 = sys_mmap(4 * 8) as *i64      // every other conf a beat runs, the same four counts
  var rz: i64 = 0
  while rz < 4 { rall[rz] = 0; roth[rz] = 0; rz = rz + 1 }
  var r_beats: i64 = 0
  var r_otherj: i64 = 0
  var r_confs: i64 = 0
  var r_other: i64 = 0
  var r_unread: i64 = 0
  pp = 0
  while pp < plen[0] {
      var pe: i64 = pp
      while pe < plen[0] { if plane[pe] == (10 as u8) { break } pe = pe + 1 }
      let cl: i64 = eg_beat_conf(plane, pp, pe, co)
      if cl >= 0 {
          r_beats = r_beats + 1
          if co[1] == 1 { r_otherj = r_otherj + 1 }
          let cpath: *u8 = sys_mmap(cl + eg_slen(EG_ROSTER_DEFAULT) + 1)
          if cl > 0 {
              var ck: i64 = 0
              while ck < cl { cpath[ck] = plane[co[0] + ck]; ck = ck + 1 }
              cpath[cl] = 0 as u8
          } else { eg_cat(cpath, 0, EG_ROSTER_DEFAULT) }
          if eg_seen(seen, sn, cpath) == 0 {
              sn = eg_cat(seen, sn, cpath)
              seen[sn] = 10 as u8
              sn = sn + 1
              seen[sn] = 0 as u8
              r_confs = r_confs + 1
              var isdef: i64 = 0
              if eg_slen(cpath) == eg_slen(EG_ROSTER_DEFAULT) { if eg_starts(cpath, EG_ROSTER_DEFAULT) == 1 { isdef = 1 } }
              var rd: i64 = 0
              if isdef == 1 { rd = eg_roster_check(b, datalen, cpath, rall) } else { r_other = r_other + 1; rd = eg_roster_check(b, datalen, cpath, roth) }
              if rd == 0 { r_unread = r_unread + 1 }
              gv_puts("  roster conf from the live plane: " as *u8); gv_puts(cpath); gv_puts(" read=" as *u8); gv_num(rd); gv_puts("\n" as *u8)
          }
      }
      pp = pe + 1
  }
  let r_checked: i64 = rall[0] + roth[0]
  let r_missing: i64 = rall[2] + roth[2]
  gv_puts("  roster control: beats=" as *u8); gv_num(r_beats); gv_puts(" confs=" as *u8); gv_num(r_confs); gv_puts(" other_confs=" as *u8); gv_num(r_other)
  gv_puts(" gates_with_census_row=" as *u8); gv_num(r_checked); gv_puts(" credited=" as *u8); gv_num(rall[1] + roth[1]); gv_puts(" NOT-credited=" as *u8); gv_num(r_missing)
  gv_puts(" no_census_row=" as *u8); gv_num(rall[3] + roth[3]); gv_puts(" other_conf_gates=" as *u8); gv_num(roth[0]); gv_puts(" other_conf_NOT-credited=" as *u8); gv_num(roth[2]); gv_puts("\n" as *u8)
  if gv_need("live plane has a roster beat whose confs name gates that have census rows" as *u8, (r_checked > 0) as i64, ctr) == 1 {
      gv_check("T12 every gate a live roster beat runs is roster-credited, over EVERY conf the beats run" as *u8, (r_missing == 0) as i64, ctr)
  }
  if gv_need("live plane has a beat running a conf OTHER than the runner's default whose gates have census rows" as *u8, (roth[0] > 0) as i64, ctr) == 1 {
      gv_check("T13 the other rosters are read: every gate of a non-default conf a live beat runs is roster-credited, whatever journal the beat writes" as *u8, (roth[2] == 0) as i64, ctr)
  }
  // T14/T15: two methods, one answer -- the organ's receipt against the gate's own reading of the same plane
  gv_check_eq("T14 the organ and the gate count the same roster beats, whatever journal each writes" as *u8, eg_kv(cap, " roster_beats=" as *u8), r_beats, ctr)
  gv_check_eq("T15 the organ counts the roster beats writing ANOTHER journal exactly as the gate does (credited, and read from that journal by the close ruler)" as *u8, eg_kv(cap, " roster_beats_other_journal=" as *u8), r_otherj, ctr)
  gv_values_head()
  gv_kv("roster_beats" as *u8, r_beats)
  gv_kv("roster_beats_other_journal" as *u8, r_otherj)
  gv_kv("roster_confs" as *u8, r_confs)
  gv_kv("roster_confs_unread" as *u8, r_unread)
  gv_kv("roster_gates_with_census_row" as *u8, r_checked)
  gv_kv("roster_gates_not_credited" as *u8, r_missing)
  gv_kv("other_conf_gates" as *u8, roth[0])
  gv_kv("receipt_roster_confs_read" as *u8, eg_kv(cap, " roster_confs=" as *u8))
  gv_kv("organs" as *u8, organs)
  return gv_verdict("EXECSURFACE-GATE" as *u8, ctr, "execution surfaces: rows, stamp, partition, population, both directions of the 2-hop rule" as *u8)
559}
nx_execsurface_gate.nx source

`nx_execsurface_gate.nx` source
