nx_gate_bite.nx source

1// nx_gate_bite.nx -- NON-VACUITY BY MUTATION. Answers the one question a green gate cannot answer about 2// itself: CAN THIS GATE EVER FAIL? Closes debt seq1344; the two-operator design closes seq1413. 3// 4// REWRITTEN (rule 3, not patched a fourth time). The first version accumulated four corrections in one 5// session -- an anchor-blind judge, a vacuity overclaim, uncounted invalid mutants, and a single operator. 6// Each was a real defect and the accumulation was the signal to rewrite rather than keep patching. 7// 8// THE METHOD (mutation testing, the 2026 field standard): perturb the SOURCE the gate is supposed to be 9// judging, rebuild, and require the gate to go RED. Killing ONE mutant proves the gate bites; we stop at 10// the first kill because the question is binary, not a score. 11// 12// ★★TWO OPERATORS, ESCALATED -- because ONE OPERATOR CANNOT REACH EVERY ASSERTION SURFACE. 13// phase 1 COMPARISON (`==` -> `!=`): reaches logic. Kills nx_raci_gate, nx_medbill_{nsa,codes,recon,civic}. 14// phase 2 LITERAL (flip a letter inside a copy string): reaches OUTPUT. MEASURED: nx_healthhelp_site_gate 15// asserts on rendered page TEXT (tone phrases, absence of "fight"/"arsenal"), so a comparison flip in a 16// path that does not change emitted copy is a survivor BY CONSTRUCTION -- not a hollow gate. A 17// single-operator harness makes every text-asserting gate permanently unprovable and would slander all 18// of them. The operator must be chosen by what the gate ASSERTS ON, so we try both before concluding. 19// 20// ★A MUTANT THAT DOES NOT COMPILE IS NOT A KILL. nx_sov_build_run RUNS the gate as its final step, so a 21// non-zero build exit means EITHER the gate went RED (real kill) OR the source failed to compile (proves 22// only that I broke the code). Counting the second as the first would let this organ certify non-vacuity it 23// never observed -- the `green>=1` overclaim rebuilt inside the tool built to catch it. 24// 25// ★NO KILL IS NOT PROOF OF VACUITY. Killing one mutant proves a gate CAN fail; failing to kill N proves 26// only that those N perturbations did not reach its assertions. INCONCLUSIVE is the honest word. 27// 28// ★THE JUDGE IS DIALECT-TOLERANT. Gates do not all speak one form: nx_medbill_nsa_gate ends 29// `ADV3 ...: GREEN` with NO `verdict=` anchor. Reading "anchor absent" as "not green" made an earlier build 30// of this organ report a 21/21 gate as broken -- an instrument reporting its own blindness as the subject's 31// defect. Prefer the verdict line; fall back to the exit code; always print which judge decided. 32// 33// FAIL-SAFE BY CONSTRUCTION (rule 26 spirit): pristine bytes held before the first mutation, the mutation 34// window is the narrowest possible (mutate -> build -> RESTORE -> only then judge), the restore is 35// byte-verified, and the organ REFUSES to exit 0 if it cannot prove the restore. 36// 37// usage: nx_gate_bite <gate_target> <source.nx> [max_sites] [subject <subject_target>] [aim <func> <skip> | aimlist <func>] (CWD = nxc2 root) 38// AIMED MODE (2026-08-03, debt 1785779063): mutation testing has THREE axes -- assertion strength, fixture 39// coverage, and SITE REACHABILITY. Position-picked sites in a large shared subject land in guards, early 40// helpers and sibling codecs the gate never executes, and A TOOTH CANNOT KILL A MUTANT THAT NEVER EXECUTES. 41// `aim <func> <skip>` mutates numeric sites inside the ONE function the expert names, skipping the first 42// <skip> (the leading guard block); `aimlist <func>` prints every numeric site with context, NO mutation and 43// NO build, so the skip is chosen by reading, never by guessing. A kill stays a kill: the mutant must 44// compile and the gate must go RED -- aiming changes which mutants are TRIED, never what counts as proof. 45// **SUBJECT MODE (2026-08-25) -- `subject <subject_target>`, THE FIX FOR END-TO-END GATES.** 46// Without it this harness rebuilds THE GATE for every mutant, so a gate that FORKS a separate subject 47// binary can never be reached: every mutant returns NOT-REACHED, and a bite of the gate's OWN source then 48// returns a clean `verdict=GREEN (gate BITES)` that reads exactly like a subject proof and is not one. 49// MEASURED 2026-08-25 on nx_communitypulse_gate before the fix: 9 mutants, 9 NOT-REACHED, valid_mutants=0. 50// WITH it, gb_build compiles the SUBJECT, gb_rungate passes the freshly built subject artifact as the 51// gate's argv[1], and the artifact-identity check follows the SUBJECT. The gate must be substitutable 52// (`if argc >= 2 { subject = argv[1] }` over a defaulted subject path) -- exactly what the 53// NOT-SUBSTITUTABLE message already asks every such gate to provide. 54// The pair is CHECKED AND ANNOUNCED, deliberately NOT refused: a <source.nx> that is not <subject_target>.nx 55// draws a named NOTE, because it is LEGITIMATE -- and is the highest-value use of this mode -- when the file 56// is a LIBRARY INSIDE the subject's build closure (debt 1785787638 names exactly that: nx_intlog's arithmetic 57// inside nx_beir_eval, uncoverable until now because a fork boundary hid it). Only the artifact-identity 58// check can tell that apart from an unrelated file, and it already does: a source outside the closure yields 59// a byte-identical artifact and reads NOT-REACHED. 60// The build lane USED TO refresh-install UNDER --build-only, which made every mutant build a DEPLOY. 61// FIXED AT THE ROOT 2026-08-26: nx_sov_build_run delegates to nx_builddeploy_lib and --build-only now 62// installs NOTHING, so a mutant can no longer reach a consumer directory in the first place. 63// THE TWIN CUSTODY BELOW IS DELIBERATELY KEPT. It is now defence in depth rather than the sole guard, 64// and it is the ONLY thing that would notice if that root fix were ever reverted or bypassed by a 65// different install path: the pre-run digests of _offc/<t>.elf and <serving-root>/<t>.elf are banked 66// before the first build and re-checked after the cleanup build, so a mutant left live is a RED 67// (exit 3), not a footnote. A GUARD THAT BECAME REDUNDANT IS NOT A GUARD THAT BECAME UNNECESSARY. 68// ORDER: [max_sites] is positional and still REFUSES a non-numeric argv[3], so keyword arguments come 69// after it; `subject` and `aim`/`aimlist` may then appear in either order. 70// exit 0 = BITES 1 = INCONCLUSIVE 2 = UNCONTROLLED (not green at baseline) 3 = RESTORE FAILED 4 = AIM-ABSENT 5 = BASELINE-UNBUILDABLE (pristine source fails the build lane; every judgment would run the PROMOTED elf) 71// 4 = SUBJECT-UNREADABLE (the .gates 4th field names a file we cannot open -- a CONFIG fault). 72// Split out of 2 on 2026-08-01: sharing a code with UNCONTROLLED made every missing subject read 73// as a broken gate. AN EXIT CODE IS A DIAGNOSIS; two failures under one code is a misdiagnosis 74// waiting to be printed. 75// license_tier: ORIGINAL 76import "nx_syscalls.nx" 77import "nx_gate_green.nx" 78import "nx_sha256.nx" 79import "nx_artifact_root.nx" 80import "nx_guarded_run.nx" 81const GB_MAGIC_4096: i64 = 4096 82const GB_MAGIC_1024: i64 = 1024 83 84const GB_MAXSRC: i64 = 4194304 85const GB_DEF_SITES: i64 = 4 86 87// BUILD-LANE EXIT CODES, NAMED (2026-08-25). gb_build returns 3=compile 4=asm 6=admit 88// 7=canon. Those numbers were spelled out in the two baseline messages below and then 89// tested as a bare `!= 0`, so ADMIT -- which means the GOVERNOR DECLINED AND NOTHING WAS 90// COMPILED -- was reported as "the source is not reproducible", a claim about the subject 91// that the run had no evidence for. The mutation loop already got this right (gb_void 92// treats ASM-FAIL/ADMIT/CANON as VOID); only the baseline branches were left behind, which 93// is a law applied in one branch and not its sibling. 94// MEASURED 2026-08-25: a lane shipping the package rung hit this twice under load from a 95// concurrent fan-out and was told its healthy, byte-reproducible gate was unbuildable; the 96// control refuted it by rebuilding the live sha exactly. 97const GB_BUILD_ADMIT: i64 = 6 // the build governor refused; nothing was compiled 98const GB_EXIT_BUILD_REFUSED: i64 = 6 // our exit: UNPROVEN, never a verdict about the subject 99 100// Shared run state as module statics, declared ABOVE every reader (a function defined textually before a 101// static it reads does not resolve to that datum). This also keeps the mutate/build/judge helper down to 102// two scalar arguments, avoiding the multi-pointer-arg call gotchas. 103static gb_orig: *u8 104static gb_work: *u8 105static gb_src: *u8 106static gb_target: *u8 107static gb_outp: *u8 108static gb_on: i64 109static gb_tried: i64 110static gb_invalid: i64 111static gb_void: i64 // build-lane faults (ASM-FAIL/ADMIT/CANON): no fresh artifact, judgment VOID -- neither valid nor invalid-mutant 112static gb_judge_kind: i64 113static gb_timedout: i64 114// ★★★THE GENERAL INVARIANT THE TWO EARLIER FIXES EACH APPROXIMATED. This organ has twice been bitten by 115// mutants that SURVIVED against a binary the mutation never entered -- once when the build lane failed 116// (fixed by the rc!=0 VOID branch) and once when the PROMOTED elf was resolved instead of the fresh one 117// (fixed by preferring _build/). Both are special cases of ONE fact: IF THE JUDGED ARTIFACT IS 118// BYTE-IDENTICAL TO THE BASELINE ARTIFACT, THE MUTATION DID NOT ENTER THE BINARY UNDER TEST, so the 119// gate's verdict is necessarily unchanged and 'SURVIVED' is a false negative. 120// It is a DISTINCT counter from gb_void because the REMEDY is different: void = fix the build lane; 121// not-reached = the mutated source is not in this gate's build closure (typically an end-to-end gate 122// that FORKS its subject instead of importing it), so make the subject substitutable. 123// TWO SKIP-CAUSES WITH OPPOSITE REMEDIES MUST NOT SHARE ONE COUNTER. 124// SAFE BY CONSTRUCTION: an identical binary has identical behaviour, so such a mutant would have been 125// scored SURVIVED anyway -- reclassifying can never suppress a real kill, only name a false one. 126static gb_noreach: i64 127static gb_base_art: *u8 128static gb_base_artn: i64 129// ★THE ARTIFACT THAT RAN, NOT A RE-DERIVED GUESS AT IT. gb_rungate already resolves the binary through 130// ar_resolve with a _build/-then-serving-root preference; re-deriving that path in a second place would 131// be a duplicate resolver, and the two would drift into hashing a different file than the verdict came 132// from. Recording the resolved pointer makes them the SAME file by construction. 133static gb_last_elf: *u8 134// A mutant that never TERMINATES has not SURVIVED -- it never emitted a verdict at all. Observed live 135// 2026-08-01: a comparison mutation in nx_media_extract.nx spun in state R for 11 minutes (the subject 136// has ZERO network calls, so this was an induced infinite loop, not an I/O block) and the old unbounded 137// sys_wait4 simply waited -- later sites were never scored, so the domain could never reach redseen>0. 138// Wired to nx_guarded_run, which ALREADY solved this (fork + wait4 WNOHANG + deadline + SIGKILL). 139const GB_MUTANT_DEADLINE_MS: i64 = 120000 140// Per-gate override rows: knowledge/bite_deadline.conf `<gate_target><TAB><deadline_ms>` -- the default 141// above is the induced-infinite-loop killer for seconds-class gates; a full-sweep bench (nx_vcodec_bgop_bench 142// ~40min qp10-40) legitimately outruns it, and under the flat cap its BASELINE read exit=124 -> UNCONTROLLED: 143// the instrument indicting a subject it never let finish (2026-08-03). Rule-11: the threshold is now data. 144static gb_deadline_ms: i64 145 146// ---- SUBJECT MODE (2026-08-25) ------------------------------------------------------------------- 147// **THE HARNESS COULD NOT DO, FOR END-TO-END GATES, THE ONE THING IT EXISTS TO DO.** gb_build has always 148// compiled gb_target -- THE GATE -- so for the 152 gates that FORK a separate subject binary, mutating the 149// subject source could never reach the artifact under test: every mutant came back NOT-REACHED, byte- 150// identical to baseline, and a bite of the GATE's own source returned a clean verdict=GREEN (gate BITES) 151// that reads exactly like a subject proof and is not one. The estate's doctrine even claimed a 4th 152// subject_target argument was MANDATORY for such gates; NO SUCH ARGUMENT EXISTED IN THIS BINARY, so the 153// instruction was not executable and every seat that followed it was proving nothing while believing it. 154// **A MUTATION TESTER THAT REBUILDS THE TEST BUT NOT THE SUBJECT PROVES NOTHING** -- this organ's own law, 155// and this organ was the estate's standing instance of it. 156// The remedy is the one this organ's NOT-SUBSTITUTABLE message already prescribes to gates: the gate takes 157// its subject path as argv[1], so the harness builds the SUBJECT and hands over the artifact it just built. 158static gb_subject: *u8 // subject TARGET basename (e.g. nx_communitypulse); 0 = classic gate mode 159static gb_buildwhat: *u8 // WHICH target gb_build compiles this call -- always the MUTATED one 160// NOTE ON gb_last_elf (declared above): it names THE ARTIFACT THE MUTATION MUST HAVE ENTERED -- the gate 161// binary in classic mode, the SUBJECT binary in subject mode. That distinction is load-bearing, not 162// cosmetic: in subject mode the gate is never rebuilt, so leaving this pointed at the gate would make 163// gb_art_same_as_base report NOT-REACHED for every mutant -- rebuilding the exact blindness removed here. 164// 165// ---- CONSUMER-TWIN CUSTODY ----------------------------------------------------------------------- 166// nx_sov_build_run's refresh-IF-PRESENT installs a successful build to BOTH consumer locations -- 167// _offc/<name>.elf and <serving-root>/<name>.elf -- and it does so UNDER --build-only. So every mutant 168// build of a target that has a twin IS A DEPLOY OF THAT MUTANT, and the only thing that undoes it is the 169// final clean rebuild at the end of main, whose exit code this organ used to discard entirely. 170// **SOURCE RESTORE IS ONLY HALF THE CUSTODY: A HARNESS THAT DEPLOYS ITS MUTANTS MUST PROVE IT PUT THE 171// PRISTINE BINARY BACK.** Digests are taken BEFORE the first build, or the check compares a mutant to 172// itself and certifies the corruption -- the same trap gb_recover_pristine already closes for the source. 173static gb_tw_offc: *u8 174static gb_tw_root: *u8 175static gb_tw_offc_dig: *u8 176static gb_tw_root_dig: *u8 177static gb_tw_offc_have: i64 178static gb_tw_root_have: i64 179// ★★★★★★THE UNDO PATH MUST NOT TRAVERSE THE THING THAT IS BUSY BECAUSE OF US. MEASURED 2026-08-25: 180// a bite of nx_cjc_panel_gate KILLED its mutant, then `cleanup_build_exit=6` -- the build governor 181// REFUSED the cleanup build, because THIS HARNESS'S OWN BUILDS had loaded the box -- and two deployed 182// twins of nx_charjudge_census were left MUTANT-LIVE where every consumer forks them (both 328500 B, 183// f75539ec.. against the pristine 3ce1a6fc.., so only a DIGEST could see it; a size check could not). 184// The organ detected it correctly and exited 3 -- but DETECTION IS NOT REPAIR, and the only remedy it 185// could offer was another governed build: the one thing a saturated governor will not grant. The 186// operator then had to rebuild and reinstall by hand, under the same refusal, to un-deploy a mutant 187// this harness had installed. 188// So BANK THE TWIN BYTES, not merely their digest, and restore by DIRECT WRITE -- no build, no 189// governor, no permission. gb_dig_path ALREADY reads each twin in full to hash it and then discards 190// the bytes; keeping them costs one pointer and makes the rollback path independent BY CONSTRUCTION. 191static gb_tw_offc_by: *u8 192static gb_tw_offc_ln: i64 193static gb_tw_root_by: *u8 194static gb_tw_root_ln: i64 195const GB_DIGEST_BYTES: i64 = 32 196const GB_PATH_CAP: i64 = 512 197 198func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 199func wn(v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 } 200 201func gb_read(path: *u8, buf: *u8, cap: i64) -> i64 { 202 let fd: i64 = sys_openat_rd(path) 203 if fd < 0 { return 0 - 1 } 204 var tot: i64 = 0 205 var go: i64 = 1 206 while go == 1 { 207 let n: i64 = sys_read(fd, ((buf as i64)+tot) as *u8, cap - tot) 208 if n <= 0 { go = 0 } else { tot = tot + n; if tot >= cap { go = 0 } } 209 } 210 sys_close(fd) 211 return tot 212} 213func gb_write(path: *u8, buf: *u8, n: i64) -> i64 { 214 let fd: i64 = sys_openat_wr(path, 0x1a4) 215 if fd < 0 { return 0 - 1 } 216 sys_write(fd, buf, n) 217 sys_close(fd) 218 return n 219} 220 221// ★★★★★★A CRITICAL SECTION MADE SAFE AGAINST YOUR OWN CONTROL FLOW IS NOT SAFE AGAINST PROCESS DEATH. 222// gb_try held the ONLY pristine copy in ANONYMOUS MEMORY across gb_build() -- the longest step in the 223// organ (a full compile). Any death in that window -- SIGPIPE when the caller's transport drops (the 224// estate's banked gate-killer), an outer deadline, OOM, an operator kill -- takes the pristine bytes with 225// it and STRANDS THE MUTANT ON DISK, silently and permanently. The old comment "mutation window closes 226// before we even look at the result" reasoned about CONTROL FLOW; nothing reasoned about not returning. 227// MEASURED CONSEQUENCE 2026-08-06: a phase-1 `==`->`!=` mutant sat in runtime/nx_mcu_ready.nx rdy_reason, 228// inverting every operator-facing MCU bring-up reason string -- a board BLOCKED on SAFETY reported 229// "READY -- fits the target and the write is reversible", the exact Rule-26 inversion T4/T5 exist to 230// prevent -- and was misattributed to an nx_cc codegen defect across FOUR investigation rounds at sev-9. 231// THE FIX IS A WRITE-AHEAD INTENT RECORD (a journalling filesystem's shape): pristine bytes land ON DISK 232// before the first mutation and are removed only after the restore is byte-verified. At every instant the 233// sidecar is either ABSENT (no mutation in flight) or HOLDS THE PRISTINE BYTES, so recovery is possible 234// from a COLD START BY ANY PROCESS. That is what fail-safe BY CONSTRUCTION means, as opposed to 235// fail-safe BY FINISHING, which is all the previous design could offer. 236static gb_armed: i64 237 238func gb_pristine_path(out: *u8) -> i64 { 239 var i: i64 = 0 240 while gb_src[i] != (0 as u8) { out[i] = gb_src[i]; i = i + 1 } 241 let sfx: *u8 = ".bitepristine" 242 var j: i64 = 0 243 while sfx[j] != (0 as u8) { out[i] = sfx[j]; i = i + 1; j = j + 1 } 244 out[i] = 0 as u8 245 return i 246} 247 248// RECOVERY -- runs BEFORE the on-disk subject is trusted as pristine. A sidecar means the previous run 249// died inside its mutation window, so what is on disk may be a MUTANT; banking it as pristine would make 250// the corruption permanent AND self-certifying. Announce loudly: a silent recovery is how a damaged corpus 251// stays believable. 252func gb_recover_pristine() -> i64 { 253 let p: *u8 = sys_mmap(GB_MAGIC_1024) 254 gb_pristine_path(p) 255 let b: *u8 = sys_mmap(GB_MAXSRC) 256 let n: i64 = gb_read(p, b, GB_MAXSRC) 257 if n <= 0 { return 0 } 258 gb_write(gb_src, b, n) 259 sys_unlinkat(p) 260 w(" RECOVERED: a prior run died inside its mutation window -- restored "); wn(n) 261 w(" pristine bytes over "); w(gb_src); w(" (A STRANDED MUTANT WAS ON DISK)\n") 262 return 1 263} 264 265// ARM -- the write-ahead record, placed at the TRUE start of the window (first mutation), never earlier: 266// aimlist and the baseline checks exit without mutating and must leave no sidecar behind. 267func gb_arm_pristine() -> i64 { 268 let p: *u8 = sys_mmap(GB_MAGIC_1024) 269 gb_pristine_path(p) 270 return gb_write(p, gb_orig, gb_on) 271} 272 273// DISARM -- ONLY after the restore is byte-verified. On RESTORE-FAILED the sidecar deliberately SURVIVES 274// so the next run repairs the tree instead of inheriting the damage. 275func gb_disarm_pristine() -> i64 { 276 let p: *u8 = sys_mmap(GB_MAGIC_1024) 277 gb_pristine_path(p) 278 return sys_unlinkat(p) 279} 280 281// Load the per-gate run deadline: last matching `<gate><TAB><ms>` row of knowledge/bite_deadline.conf wins; 282// absent file/row -> GB_MUTANT_DEADLINE_MS. A conf value <= 0 is ignored (fail-safe: never a zero deadline). 283func gb_load_deadline(target: *u8) -> i64 { 284 gb_deadline_ms = GB_MUTANT_DEADLINE_MS 285 let b: *u8 = sys_mmap(GB_MAGIC_4096) 286 let n: i64 = gb_read("knowledge/bite_deadline.conf\x00" as *u8, b, GB_MAGIC_4096 - 1) 287 if n <= 0 { return 0 } 288 var tl: i64 = 0 289 while target[tl] != (0 as u8) { tl = tl + 1 } 290 var i: i64 = 0 291 while i < n { 292 var m: i64 = 1 293 var j: i64 = 0 294 while j < tl { 295 if i + j >= n { m = 0; j = tl } else { if b[i+j] != target[j] { m = 0; j = tl } else { j = j + 1 } } 296 } 297 if m == 1 { if i + tl < n { if b[i+tl] == (9 as u8) { 298 var v: i64 = 0 299 var k2: i64 = i + tl + 1 300 while k2 < n { 301 let c: i64 = b[k2] as i64 302 if c < 48 { k2 = n } else { if c > 57 { k2 = n } else { v = v*10 + (c - 48); k2 = k2 + 1 } } 303 } 304 if v > 0 { gb_deadline_ms = v } 305 } } } 306 while i < n { if b[i] == (10 as u8) { break } i = i + 1 } 307 i = i + 1 308 } 309 return 0 310} 311 312// Is offset p inside a `//` comment line? Mutating a comment yields a no-op mutant -- a guaranteed survivor 313// that would slander the gate. An operator that can emit no-op mutants measures the OPERATOR, not the gate. 314func gb_in_comment(b: *u8, p: i64) -> i64 { 315 var s: i64 = p 316 while s > 0 { if b[s-1] == (10 as u8) { break } s = s - 1 } 317 var i: i64 = s 318 while i < p { if b[i] != (32 as u8) { if b[i] != (9 as u8) { break } } i = i + 1 } 319 if i + 1 < p { if b[i] == (47 as u8) { if b[i+1] == (47 as u8) { return 1 } } } 320 // TRAILING comments too (2026-08-03, debt 1785779063): `var xe: i64 = 4 // cols 4,8` -- the 4,8 in 321 // the comment were eligible numeric sites, and a mutant in a comment is a survivor BY CONSTRUCTION 322 // that burns a full gate run and slanders the gate. Quote-parity keeps string content ("https://") out. 323 var q: i64 = 0 324 var j: i64 = s 325 while j < p { 326 if b[j] == (34 as u8) { var esc2: i64 = 0; if j > 0 { if b[j-1] == (92 as u8) { esc2 = 1 } } if esc2 == 0 { q = q + 1 } } 327 if b[j] == (47 as u8) { if j + 1 < p { if b[j+1] == (47 as u8) { if (q % 2) == 0 { return 1 } } } } 328 j = j + 1 329 } 330 return 0 331} 332 333// ---- OPERATOR 1: COMPARISON. Offset of the k-th mutable `==` OR `!=`, or -1. ---- 334// ★★★★★★OPERATOR REPERTOIRE IS A COVERAGE AXIS IN ITS OWN RIGHT. Until 2026-08-04 this matched ONLY `==` 335// and SKIPPED `!=` outright, so nx_probe_ctor -- whose single assertion is `if (o as i64) != 0` -- reported 336// ZERO comparison sites: operator 1 printed a header and nothing else, the run fell through to weaker 337// operators, and the verdict came back killed=0 INCONCLUSIVE. THAT IS INDISTINGUISHABLE FROM A VACUOUS 338// GATE AT A GLANCE and it was nothing of the kind: the one mutation that flips the assertion (`!=` -> `==`) 339// simply did not exist in the instrument's vocabulary. `if x != 0` is the estate's standard refusal shape, 340// so the blind spot was aimed squarely at the code we most want witnessed. Fix is symmetric and additive: 341// both directions are sites, gb_cmp_flip picks the byte, and a kill still demands COMPILES + gate goes RED. 342func gb_site_cmp(b: *u8, n: i64, k: i64) -> i64 { 343 var seen: i64 = 0 344 var i: i64 = 1 345 while i < n - 2 { 346 if b[i] == (33 as u8) { if b[i+1] == (61 as u8) { 347 var okn: i64 = 1 348 if b[i+2] == (61 as u8) { okn = 0 } 349 if b[i-1] == (61 as u8) { okn = 0 } 350 if okn == 1 { if gb_in_comment(b, i) == 1 { okn = 0 } } 351 if okn == 1 { if seen == k { return i } seen = seen + 1; i = i + 1 } 352 } } 353 if b[i] == (61 as u8) { if b[i+1] == (61 as u8) { 354 var ok: i64 = 1 355 if b[i-1] == (61 as u8) { ok = 0 } 356 if b[i-1] == (33 as u8) { ok = 0 } 357 if b[i-1] == (60 as u8) { ok = 0 } 358 if b[i-1] == (62 as u8) { ok = 0 } 359 if b[i+2] == (61 as u8) { ok = 0 } 360 if ok == 1 { if gb_in_comment(b, i) == 1 { ok = 0 } } 361 if ok == 1 { if seen == k { return i } seen = seen + 1; i = i + 1 } 362 } } 363 i = i + 1 364 } 365 return 0 - 1 366} 367 368// ---- OPERATOR 3: NUMERIC CONSTANT. The operator that reaches CONSTANT-TIME CODE. ---- 369// MEASURED 2026-08-01 on nx_x25519_kat_gate: operator 1 found ZERO `==` sites in a 21500 B subject and 370// the whole run returned valid_mutants=0 -- INCONCLUSIVE, so browser could not reach redseen>0 at all. 371// THE REASON IS STRUCTURAL, NOT A BUG IN THE SUBJECT: constant-time crypto is deliberately BRANCHLESS. 372// Data-dependent comparisons are exactly what such code is written to avoid, so a mutation operator that 373// only flips `==` is blind to the entire class -- and that class is the KAT gates, i.e. the ORACLE-eligible 374// evidence, the most independent we have. 375// ★★★★★★A MUTATION OPERATOR THAT ONLY TARGETS BRANCHES CANNOT SCORE BRANCHLESS CODE -- AND THE CODE MOST 376// WORTH PROVING IS OFTEN THE CODE WRITTEN NOT TO BRANCH. 377// Perturbing a numeric literal is the right probe here: a KAT compares against published vectors, so ANY 378// changed constant must falsify it. A gate that survives a changed constant is not checking arithmetic. 379// Bump the LAST digit of a decimal run (9 -> 8 so we never create a leading-zero or overflow shape), and 380// ONE PREDICATE FOR BOTH SCANNERS (2026-09-06). gb_site_num and gb_num_at each carried a copy of the 381// preceding-character test that had to agree by discipline -- but the duplication was not the defect, the 382// test itself was. It read only b[i-1], the character before the LAST digit of a run, so a SINGLE-digit 383// identifier tail like u8 was correctly excluded (its 8 is preceded by u) while every MULTI-digit tail 384// slipped straight through, because the 4 of i64 and the 2 of uxr_w32 are each preceded by ANOTHER DIGIT 385// and no rule ever excluded a digit. Such sites can never compile, and they consumed the whole 386// per-operator site budget -- which is how a gate that genuinely imports and calls its subject came to 387// report valid_mutants=0 and read as UNREACHABLE. MEASURED 2026-09-06 on nx_uxf_mp4box_gate: all four 388// aimed sites in uxr_box_end were identifier digits (two i64 and the 32 of uxr_w32) and every mutant 389// returned build_exit=3, while u8 -- the single-digit case the old test already handled -- never appeared. 390// This walks back across the WHOLE digit run and returns the character before its FIRST digit, so the 391// existing letter, underscore, dot and hex exclusions finally see the character they were always meant to 392// test. It also closes a latent hex hole: in 0x10 the trailing 0 was preceded by 1 and used to pass. 393// A space is returned when the run starts the buffer, because a run with nothing before it is a literal. 394// The walk is driven by an explicit flag rather than by clobbering the cursor -- that idiom has erased its 395// own answer four times in this estate and is banned for exactly this shape of loop. 396func gb_pre_run(b: *u8, i: i64) -> i64 { 397 var s: i64 = i 398 var walking: i64 = 1 399 while walking == 1 { 400 if s <= 0 { walking = 0 } else { 401 let pd: i64 = b[s-1] as i64 402 if pd >= 48 { if pd <= 57 { s = s - 1 } else { walking = 0 } } else { walking = 0 } 403 } 404 } 405 if s <= 0 { return 32 } 406 return b[s-1] as i64 407} 408 409// skip hex (0x..) so we do not corrupt the multi-limb field constants into uncompilable tokens. 410func gb_site_num(b: *u8, n: i64, k: i64) -> i64 { 411 var seen: i64 = 0 412 var i: i64 = 1 413 while i < n - 1 { 414 let c: i64 = b[i] as i64 415 if c >= 48 { if c <= 57 { 416 // last digit of the run only 417 let nx: i64 = b[i+1] as i64 418 var islast: i64 = 1 419 if nx >= 48 { if nx <= 57 { islast = 0 } } 420 if islast == 1 { 421 let pv: i64 = gb_pre_run(b, i) 422 var ok: i64 = 1 423 // not an identifier tail (a1, x2), not hex, not a version-ish dotted token 424 if pv == 120 { ok = 0 } 425 if pv >= 97 { if pv <= 122 { ok = 0 } } 426 if pv >= 65 { if pv <= 90 { ok = 0 } } 427 if pv == 95 { ok = 0 } 428 if pv == 46 { ok = 0 } 429 if ok == 1 { if gb_in_comment(b, i) == 1 { ok = 0 } } 430 if ok == 1 { if seen == k { return i } seen = seen + 1 } 431 } 432 } } 433 i = i + 1 434 } 435 return 0 - 1 436} 437 438// ---- OPERATOR 2a: NEEDLE-GUIDED LITERAL. Aim at what the gate SAYS it checks. ---- 439// MEASURED cost of NOT aiming: nx_healthhelp_site_gate needed 27 valid mutants (27 full rebuilds) before a 440// linear scan happened to land on the phrase it asserts. Comparison kills, by contrast, land at site 0-1. 441// But the gate is not a black box -- its source NAMES its needles (`mbc_contains(page, "working with your 442// provider")`). Reading them and mutating those phrases FIRST turns a linear hunt into a direct hit. 443// ★This is the honest form of test-aware mutation: we are not weakening the test to make it pass, we are 444// using the test's own declared expectations to find the perturbation that would falsify it. If a needle 445// the gate names does not appear in the subject at all, that is itself informative -- the gate is asserting 446// on text this subject never produces. 447static gb_gsrc: *u8 448static gb_gn: i64 449 450func gb_find(hay: *u8, hn: i64, ned: *u8, nl: i64) -> i64 { 451 if nl <= 0 { return 0 - 1 } 452 var i: i64 = 0 453 while i + nl <= hn { 454 var j: i64 = 0 455 var m: i64 = 1 456 while j < nl { if hay[i+j] != ned[j] { m = 0; j = nl } else { j = j + 1 } } 457 if m == 1 { return i } 458 i = i + 1 459 } 460 return 0 - 1 461} 462 463// Load the gate's own source so we can read its needles. Two known homes for a gate organ. 464func gb_load_gate_src(target: *u8) -> i64 { 465 let cand: *u8 = sys_mmap(512) 466 let res: *u8 = sys_mmap(512) 467 var o: i64 = 0 468 let p1: *u8 = "runtime/" 469 var q: i64 = 0 470 while p1[q] != (0 as u8) { cand[o] = p1[q]; o = o + 1; q = q + 1 } 471 q = 0 472 while target[q] != (0 as u8) { cand[o] = target[q]; o = o + 1; q = q + 1 } 473 let sfx: *u8 = ".nx" 474 q = 0 475 while sfx[q] != (0 as u8) { cand[o] = sfx[q]; o = o + 1; q = q + 1 } 476 cand[o] = 0 as u8 477 gb_gsrc = sys_mmap(GB_MAXSRC) 478 if ar_resolve(cand, res) == 1 { gb_gn = gb_read(res, gb_gsrc, GB_MAXSRC); return gb_gn } 479 o = 0 480 let p2: *u8 = "runtime/_hdl_build/" 481 q = 0 482 while p2[q] != (0 as u8) { cand[o] = p2[q]; o = o + 1; q = q + 1 } 483 q = 0 484 while target[q] != (0 as u8) { cand[o] = target[q]; o = o + 1; q = q + 1 } 485 q = 0 486 while sfx[q] != (0 as u8) { cand[o] = sfx[q]; o = o + 1; q = q + 1 } 487 cand[o] = 0 as u8 488 if ar_resolve(cand, res) == 1 { gb_gn = gb_read(res, gb_gsrc, GB_MAXSRC); return gb_gn } 489 gb_gn = 0 490 return 0 491} 492 493// ★MISDIRECTED-GATE AUDIT. Count the gate's named needles that are NOT present in the declared subject. 494// This is a finding, not noise: a gate asserting on text the subject never produces means the .gates 4th 495// field points at the wrong file, and every mutation of that file is doomed to be INCONCLUSIVE. Without 496// this line the symptom (no kill) looks identical to a weak gate -- which is precisely the confusion that 497// cost this session two false accusations. Report the ratio; do not guess a better subject. 498func gb_ident_ch(c: i64) -> i64 { 499 if c >= 48 { if c <= 57 { return 1 } } 500 if c >= 65 { if c <= 90 { return 1 } } 501 if c >= 97 { if c <= 122 { return 1 } } 502 if c == 95 { return 1 } 503 return 0 504} 505 506// First mutable == OR != at or after `from`. Predicate MIRRORS gb_site_cmp; gb_site_cmp itself is UNTOUCHED. 507// ★OPERATOR REPERTOIRE IS A FOURTH COVERAGE AXIS (2026-08-04, found on nx_probe_ctor): this used to match 508// ONLY `==` and to EXPLICITLY SKIP `!=` (the b[i-1]=='!' guard below), so a subject whose only comparison 509// is `!=` reported ZERO comparison sites -- operator 1 printed nothing at all and the bite fell through to 510// weaker operators and returned killed=0. That reads exactly like a vacuous gate and is NOT one: the ONE 511// mutation that would have flipped the assertion was not in the instrument's vocabulary. Refusal-style 512// code (`if x != 0 { ok = 1 }`) is precisely where this bites, and that shape is everywhere in this estate. 513// Both directions are now sites; gb_cmp_flip decides which byte to write, so a kill still requires the 514// mutant to COMPILE and the gate to go RED -- the bar is unchanged, only the reachable mutant set grows. 515func gb_cmp_flip(b: *u8, off: i64) -> i64 { 516 if b[off] == (33 as u8) { return 61 } 517 return 33 518} 519func gb_cmp_at(b: *u8, n: i64, from: i64) -> i64 { 520 var i: i64 = from 521 if i < 1 { i = 1 } 522 while i < n - 2 { 523 if b[i] == (33 as u8) { if b[i+1] == (61 as u8) { 524 var okn: i64 = 1 525 if b[i+2] == (61 as u8) { okn = 0 } 526 if b[i-1] == (61 as u8) { okn = 0 } 527 if okn == 1 { if gb_in_comment(b, i) == 1 { okn = 0 } } 528 if okn == 1 { return i } 529 } } 530 if b[i] == (61 as u8) { if b[i+1] == (61 as u8) { 531 var ok: i64 = 1 532 if b[i-1] == (61 as u8) { ok = 0 } 533 if b[i-1] == (33 as u8) { ok = 0 } 534 if b[i-1] == (60 as u8) { ok = 0 } 535 if b[i-1] == (62 as u8) { ok = 0 } 536 if b[i+2] == (61 as u8) { ok = 0 } 537 if ok == 1 { if gb_in_comment(b, i) == 1 { ok = 0 } } 538 if ok == 1 { return i } 539 } } 540 i = i + 1 541 } 542 return 0 - 1 543} 544 545// k-th identifier in the GATE source immediately followed by ( -- i.e. a call the gate makes. 546// First mutable numeric constant at or after `from`. Predicate MIRRORS gb_site_num; that fn is UNTOUCHED. 547func gb_num_at(b: *u8, n: i64, from: i64) -> i64 { 548 var i: i64 = from 549 if i < 1 { i = 1 } 550 while i < n - 1 { 551 let c: i64 = b[i] as i64 552 if c >= 48 { if c <= 57 { 553 let nx: i64 = b[i+1] as i64 554 var islast: i64 = 1 555 if nx >= 48 { if nx <= 57 { islast = 0 } } 556 if islast == 1 { 557 let pv: i64 = gb_pre_run(b, i) 558 var ok: i64 = 1 559 if pv == 120 { ok = 0 } 560 if pv >= 97 { if pv <= 122 { ok = 0 } } 561 if pv >= 65 { if pv <= 90 { ok = 0 } } 562 if pv == 95 { ok = 0 } 563 if pv == 46 { ok = 0 } 564 if ok == 1 { if gb_in_comment(b, i) == 1 { ok = 0 } } 565 if ok == 1 { return i } 566 } 567 } } 568 i = i + 1 569 } 570 return 0 - 1 571} 572 573// ---- AIMED-MODE SUPPORT (2026-08-03, debt 1785779063). Locate `func <name>(` in the SUBJECT and bound it 574// by the next top-level `\nfunc ` so aimed sites stay inside the ONE function the expert named. ---- 575static gb_aim_end: i64 576func gb_aim_find(name: *u8) -> i64 { 577 let apat: *u8 = sys_mmap(240) 578 var po: i64 = 0 579 let fw2: *u8 = "func " as *u8 580 var z2: i64 = 0 581 while z2 < 5 { apat[po] = fw2[z2]; po = po + 1; z2 = z2 + 1 } 582 z2 = 0 583 while name[z2] != (0 as u8) { if po < 230 { apat[po] = name[z2]; po = po + 1 } z2 = z2 + 1 } 584 apat[po] = 40 as u8 585 po = po + 1 586 let d: i64 = gb_find(gb_orig, gb_on, apat, po) 587 gb_aim_end = gb_on 588 if d < 0 { return 0 - 1 } 589 let nf: *u8 = "\nfunc " as *u8 590 var sc2: i64 = d + po 591 while sc2 < gb_on - 6 { 592 var mm: i64 = 1 593 var mj: i64 = 0 594 while mj < 6 { if gb_orig[sc2 + mj] != nf[mj] { mm = 0; mj = 6 } else { mj = mj + 1 } } 595 if mm == 1 { gb_aim_end = sc2; sc2 = gb_on } else { sc2 = sc2 + 1 } 596 } 597 return d 598} 599 600func gb_gate_call(k: i64, out: *u8, cap: i64) -> i64 { 601 var seen: i64 = 0 602 var i: i64 = 0 603 while i < gb_gn { 604 var start: i64 = 0 605 let c: i64 = gb_gsrc[i] as i64 606 if c >= 97 { if c <= 122 { start = 1 } } 607 if c == 95 { start = 1 } 608 var prev_id: i64 = 0 609 if i > 0 { if gb_ident_ch(gb_gsrc[i-1] as i64) == 1 { prev_id = 1 } } 610 var nxt: i64 = i + 1 611 if start == 1 { if prev_id == 0 { 612 var e: i64 = i 613 while e < gb_gn { if gb_ident_ch(gb_gsrc[e] as i64) == 0 { break } e = e + 1 } 614 if e > i { nxt = e } 615 if e < gb_gn { if gb_gsrc[e] == (40 as u8) { 616 let L: i64 = e - i 617 if L >= 4 { if L < cap - 1 { 618 if seen == k { 619 var q: i64 = 0 620 while q < L { out[q] = gb_gsrc[i+q]; q = q + 1 } 621 out[L] = 0 as u8 622 return L 623 } 624 seen = seen + 1 625 } } 626 } } 627 } } 628 i = nxt 629 } 630 return 0 - 1 631} 632 633func gb_needle_audit(b: *u8, n: i64) -> i64 { 634 if gb_gn <= 0 { return 0 } 635 let ned: *u8 = sys_mmap(GB_MAGIC_4096) 636 var found: i64 = 0 637 var missing: i64 = 0 638 var i: i64 = 0 639 while i < gb_gn - 1 { 640 if gb_gsrc[i] == (34 as u8) { 641 var j: i64 = i + 1 642 var spaces: i64 = 0 643 var ended: i64 = 0 644 while j < gb_gn { 645 let c: i64 = gb_gsrc[j] as i64 646 if c == 34 { ended = 1; break } 647 if c == 10 { break } 648 if c == 32 { spaces = spaces + 1 } 649 j = j + 1 650 } 651 var clen: i64 = j - i - 1 652 if clen >= 4 { if gb_gsrc[i+1+clen-4] == (92 as u8) { clen = clen - 4 } } 653 if ended == 1 { if clen >= 10 { if spaces >= 1 { 654 var c2: i64 = 0 655 while c2 < clen { ned[c2] = gb_gsrc[i+1+c2]; c2 = c2 + 1 } 656 if gb_find(b, n, ned, clen) >= 0 { found = found + 1 } else { missing = missing + 1 } 657 } } } 658 i = j + 1 659 } else { i = i + 1 } 660 } 661 // ⚠HONEST READING OF THIS RATIO: `absent` is INFLATED by design. This counts every prose literal in the 662 // gate, and most of a gate's literals are its own chk() LABELS ("TONE: partnership framing present"), 663 // which were never claims about the subject. So a high `absent` is expected and means nothing on its 664 // own. Only found==0 is a real signal, and that is the only case that warns. Separating true needles 665 // from labels needs call-site parsing (which literal is an argument to a contains-style assertion) -- 666 // a real rung, deliberately not faked here with a keyword guess. 667 w(" needle audit: present_in_subject="); wn(found); w(" not_found="); wn(missing) 668 w(" (not_found is inflated: gate labels are literals too -- only present=0 is a signal)") 669 // ⚠SUPPRESSED WHEN THE GATE IMPORTS THE SUBJECT. Measured 2026-08-01: this fired on 670 // nx_x25519_kat_gate, whose .gates subject is CORRECT (runtime/nx_x25519.nx exists and the gate 671 // imports it at line 14). Its assertion labels are EXTERNAL CITATIONS -- "T1 RFC 7748 5.2 test-1" -- 672 // which by construction never appear in an implementation file, so found==0 is expected for the whole 673 // KAT class. ★★★★★A HEURISTIC THAT ASSUMES A GATE QUOTES ITS SUBJECT MISFIRES ON EXACTLY THE GATES 674 // WHOSE LABELS CITE AN EXTERNAL AUTHORITY -- i.e. on the ORACLE-eligible evidence, the most 675 // independent we have. An import is hard proof the pairing is intentional, so it outranks the guess. 676 var imports_subject: i64 = 0 677 if gb_gn > 0 { 678 var sb: i64 = 0 679 var se: i64 = 0 680 var z: i64 = 0 681 while gb_src[z] != (0 as u8) { if gb_src[z] == (47 as u8) { sb = z + 1 } z = z + 1 } 682 se = z 683 if se - sb > 3 { if gb_find(gb_gsrc, gb_gn, ((gb_src as i64) + sb) as *u8, se - sb) >= 0 { imports_subject = 1 } } 684 } 685 if imports_subject == 1 { w(" (gate names this subject in its own source -- pairing confirmed, misdirection check suppressed)") } 686 if imports_subject == 0 { if found == 0 { if missing > 0 { w("\n <- MISDIRECTED-GATE: no named phrase of this gate appears in the declared subject; the .gates 4th field is likely the wrong file") } } } 687 w("\n") 688 return found 689} 690 691// The k-th needle-guided site: take the k-th prose literal from the GATE source, locate it in the SUBJECT, 692// and return a mutable word-start inside that occurrence. 693func gb_site_needle(b: *u8, n: i64, k: i64) -> i64 { 694 if gb_gn <= 0 { return 0 - 1 } 695 let ned: *u8 = sys_mmap(GB_MAGIC_4096) 696 var seen: i64 = 0 697 var i: i64 = 0 698 while i < gb_gn - 1 { 699 if gb_gsrc[i] == (34 as u8) { 700 var j: i64 = i + 1 701 var spaces: i64 = 0 702 var ended: i64 = 0 703 while j < gb_gn { 704 let c: i64 = gb_gsrc[j] as i64 705 if c == 34 { ended = 1; break } 706 if c == 10 { break } 707 if c == 32 { spaces = spaces + 1 } 708 j = j + 1 709 } 710 var clen: i64 = j - i - 1 711 // strip a trailing \x00 -- the gate writes needles NUL-terminated, the subject embeds the bare text 712 if clen >= 4 { if gb_gsrc[i+1+clen-4] == (92 as u8) { clen = clen - 4 } } 713 if ended == 1 { if clen >= 10 { if spaces >= 1 { 714 var c2: i64 = 0 715 while c2 < clen { ned[c2] = gb_gsrc[i+1+c2]; c2 = c2 + 1 } 716 let at: i64 = gb_find(b, n, ned, clen) 717 if at >= 0 { 718 var w: i64 = at + 1 719 let lim: i64 = at + clen 720 while w < lim { 721 let cc: i64 = b[w] as i64 722 if b[w-1] == (32 as u8) { 723 var isal: i64 = 0 724 if cc >= 97 { if cc <= 121 { isal = 1 } } 725 if cc >= 65 { if cc <= 89 { isal = 1 } } 726 if isal == 1 { 727 if seen == k { return w } 728 seen = seen + 1 729 w = lim 730 } 731 } 732 w = w + 1 733 } 734 } 735 } } } 736 i = j + 1 737 } else { i = i + 1 } 738 } 739 return 0 - 1 740} 741 742// ---- OPERATOR 2: LITERAL. Offset of a mutable letter inside the k-th eligible string literal, or -1. ---- 743// ★THE SELECTION RULE IS "FIRST LETTER OF AN INTERIOR WORD" -- a position preceded by a SPACE and followed 744// by a letter. That is prose BY CONSTRUCTION, so it can never land inside an escape sequence, and it needs 745// no blacklist to stay safe. 746// The first cut blacklisted backslash, '/' and '.' to avoid mutating paths, and consequently selected 747// NOTHING: every literal in this codebase ends `\x00`, and prose is full of '.' and '/' ("CPT/HCPCS/ICD-10"). 748// MEASURED: it reported `valid_mutants=0` on nx_healthhelp_site.nx while the very phrase the gate asserts on 749// -- "working with your provider" -- sat in that file. ★A FILTER THAT EXCLUDES ITS OWN TARGET CLASS reports 750// "nothing to test" and reads exactly like "nothing to find"; requiring a SPACE separates prose from paths 751// far better than banning the characters prose is made of. 752// ★ENUMERATE WORD-STARTS GLOBALLY, NOT ONE PER LITERAL. The first version offered a single position per 753// string literal, which is far too coarse here: this codebase emits page copy as HUGE HTML blobs (one 754// literal on nx_healthhelp_site.nx:53 is ~1000 chars). Mutating one word in a 1000-char blob almost never 755// touches the specific phrase a gate asserts on, so 17 mutants across 17 literals all survived while the 756// asserted phrase sat untouched inside one of them. Site k is now the k-th mutable word-start ANYWHERE 757// inside any string literal, which actually covers the copy. 758func gb_site_lit(b: *u8, n: i64, k: i64) -> i64 { 759 var seen: i64 = 0 760 var inlit: i64 = 0 761 var i: i64 = 0 762 while i < n - 1 { 763 let c: i64 = b[i] as i64 764 if c == 34 { 765 var esc: i64 = 0 766 if i > 0 { if b[i-1] == (92 as u8) { esc = 1 } } 767 if esc == 0 { if inlit == 1 { inlit = 0 } else { if gb_in_comment(b, i) == 0 { inlit = 1 } } } 768 i = i + 1 769 } else { 770 if inlit == 1 { if c == 10 { inlit = 0 } else { 771 if b[i-1] == (32 as u8) { 772 var isal: i64 = 0 773 if c >= 97 { if c <= 121 { isal = 1 } } 774 if c >= 65 { if c <= 89 { isal = 1 } } 775 if isal == 1 { 776 let d: i64 = b[i+1] as i64 777 var nxal: i64 = 0 778 if d >= 97 { if d <= 122 { nxal = 1 } } 779 if d >= 65 { if d <= 90 { nxal = 1 } } 780 if nxal == 1 { 781 if seen == k { return i } 782 seen = seen + 1 783 } 784 } 785 } 786 } } 787 i = i + 1 788 } 789 } 790 return 0 - 1 791} 792 793const GB_ASCII_SLASH: i64 = 47 794const GB_ASCII_DOT: i64 = 46 795const GB_ASCII_N: i64 = 110 796const GB_ASCII_X: i64 = 120 797const GB_NXEXT_LEN: i64 = 3 // strlen(".nx") 798const GB_LP_BYTES: i64 = 16 // two i64 slots for sys_read_file's length out-param 799 800// Resolve <name>'s artifact the way this organ has always resolved the gate's: prefer the FRESHLY BUILT 801// _build/<name>.sov.elf, fall back to the promoted <name>.elf. FACTORED OUT of gb_rungate rather than 802// re-typed for the subject -- **A BUG YOU FIX BY REWRITING THE LINE IS A BUG YOU WILL WRITE AGAIN**, and 803// two copies of a resolver drift into hashing a different file than the verdict came from. 804func gb_resolve_artifact(name: *u8) -> *u8 { 805 let gpath: *u8 = sys_mmap(GB_MAGIC_1024) 806 var gn: i64 = 0 807 while name[gn] != (0 as u8) { gpath[gn] = name[gn]; gn = gn + 1 } 808 let sfx: *u8 = ".elf\x00" as *u8 809 var sj: i64 = 0 810 while sfx[sj] != (0 as u8) { gpath[gn] = sfx[sj]; gn = gn + 1; sj = sj + 1 } 811 gpath[gn] = 0 as u8 812 let bpath: *u8 = sys_mmap(GB_MAGIC_1024) 813 var bn2: i64 = 0 814 let bpre: *u8 = "_build/\x00" as *u8 815 var bk: i64 = 0 816 while bpre[bk] != (0 as u8) { bpath[bn2] = bpre[bk]; bn2 = bn2 + 1; bk = bk + 1 } 817 bk = 0 818 while name[bk] != (0 as u8) { bpath[bn2] = name[bk]; bn2 = bn2 + 1; bk = bk + 1 } 819 let bsfx: *u8 = ".sov.elf\x00" as *u8 820 bk = 0 821 while bsfx[bk] != (0 as u8) { bpath[bn2] = bsfx[bk]; bn2 = bn2 + 1; bk = bk + 1 } 822 bpath[bn2] = 0 as u8 823 let gres: *u8 = sys_mmap(GB_MAGIC_1024) 824 if ar_resolve(bpath, gres) == 1 { return gres } 825 let gres2: *u8 = sys_mmap(GB_MAGIC_1024) 826 if ar_resolve(gpath, gres2) == 1 { return gres2 } 827 return gpath 828} 829 830// <prefix><name>.elf -- the two places nx_sov_build_run's refresh-IF-PRESENT actually writes. 831func gb_twin_path(prefix: *u8, name: *u8) -> *u8 { 832 let p: *u8 = sys_mmap(GB_PATH_CAP) 833 var o: i64 = 0 834 var i: i64 = 0 835 while prefix[i] != (0 as u8) { p[o] = prefix[i]; o = o + 1; i = i + 1 } 836 i = 0 837 while name[i] != (0 as u8) { p[o] = name[i]; o = o + 1; i = i + 1 } 838 let sfx: *u8 = ".elf\x00" as *u8 839 i = 0 840 while sfx[i] != (0 as u8) { p[o] = sfx[i]; o = o + 1; i = i + 1 } 841 p[o] = 0 as u8 842 return p 843} 844 845// sha256 of a whole file. CAPLESS (sys_read_file sizes its buffer from the file), because a guessed 846// ceiling would hash a PREFIX and call two different binaries identical -- the same false identity 847// gb_art_read already refuses. Returns 1 when a digest was taken and 0 when the file could not be read: 848// the caller must treat 0 as UNOBSERVABLE, never as "unchanged". **A CHECK THAT CANNOT OBSERVE MUST NOT 849// ACQUIT.** 850// Read a twin ONCE and yield BOTH its digest and its BYTES. sys_read_file sizes its buffer from the 851// file and cannot short-read, so this is the whole artifact or nothing. 852// gb_dig_path DELEGATES to this, so every existing caller is bit-identical BY CONSTRUCTION and there 853// is still exactly ONE reader of a deployed twin -- an extension of the incumbent, not a second ruler. 854func gb_bank_path(p: *u8, out: *u8, lenout: *i64) -> *u8 { 855 let bl: *i64 = sys_mmap(GB_LP_BYTES) as *i64 856 let bb: *u8 = sys_read_file(p, bl) 857 if (bb as i64) == 0 { return 0 as *u8 } 858 if bl[0] <= 0 { return 0 as *u8 } 859 sha256_digest(bb, bl[0], out) 860 lenout[0] = bl[0] 861 return bb 862} 863func gb_dig_path(p: *u8, out: *u8) -> i64 { 864 let dl: *i64 = sys_mmap(GB_LP_BYTES) as *i64 865 if (gb_bank_path(p, out, dl) as i64) == 0 { return 0 } 866 return 1 867} 868 869// RESTORE ONE DEPLOYED TWIN FROM ITS BANKED BYTES. No build, no governor, no permission asked. 870// ⚠MODE 0755 (0x1ed), NEVER gb_write's 0644: A BYTE-FOR-BYTE VERIFY IS STRUCTURALLY BLIND TO MODE, so a 871// 0644 "successful" restore would leave a byte-perfect INERT binary that every fork reads as exit 127 -- 872// which the caller then blames on the organ rather than on the copy. Measured law, banked 2026-08-14. 873func gb_twin_restore(p: *u8, by: *u8, ln: i64) -> i64 { 874 if (by as i64) == 0 { return 0 } 875 if ln <= 0 { return 0 } 876 let fd: i64 = sys_openat_wr(p, 0x1ed) 877 if fd < 0 { return 0 } 878 sys_write(fd, by, ln) 879 sys_close(fd) 880 return 1 881} 882func gb_dig_eq(a: *u8, b: *u8) -> i64 { 883 var i: i64 = 0 884 while i < GB_DIGEST_BYTES { if a[i] != b[i] { return 0 } i = i + 1 } 885 return 1 886} 887// One deployed twin, one verdict. 0 RESTORED (byte-identical to what we found), 1 REFRESHED (differs from 888// what we found but IS the pristine baseline build -- pre-existing drift, no mutant deployed), 2 MUTANT-LIVE 889// or unreadable. Factored into one function so the two consumer locations cannot drift into two rulers. 890func gb_twin_check(p: *u8, banked: *u8, basedig: *u8, have_base: i64) -> i64 { 891 let nowdig: *u8 = sys_mmap(GB_DIGEST_BYTES) 892 if gb_dig_path(p, nowdig) != 1 { 893 w(" twin UNREADABLE after the run: ") 894 w(p) 895 w("\n") 896 return 2 897 } 898 if gb_dig_eq(nowdig, banked) == 1 { 899 w(" twin RESTORED: ") 900 w(p) 901 w("\n") 902 return 0 903 } 904 if have_base == 1 { 905 if gb_dig_eq(nowdig, basedig) == 1 { 906 w(" twin REFRESHED (pre-existing drift; the pristine build of this source is now installed): ") 907 w(p) 908 w("\n") 909 return 1 910 } 911 } 912 w(" twin MUTANT-LIVE (neither the bytes we found nor the pristine baseline build): ") 913 w(p) 914 w("\n") 915 return 2 916} 917 918// Is <name>.nx the final path component of <path>? 919// **MUTATING SOURCE A WHILE BUILDING TARGET B IS THE MEASURED-A-DIFFERENT-SUBJECT DEFECT WEARING A FLAG**, 920// and it has NO symptom: every mutant compiles, the gate stays green, and the run publishes a confident 921// INCONCLUSIVE about a file it never perturbed. Refuse the pair rather than trust two arguments to agree. 922func gb_basename_is(path: *u8, name: *u8) -> i64 { 923 var n: i64 = 0 924 while path[n] != (0 as u8) { n = n + 1 } 925 var cut: i64 = 0 926 var i: i64 = 0 927 while i < n { if path[i] == (GB_ASCII_SLASH as u8) { cut = i + 1 } i = i + 1 } 928 var j: i64 = 0 929 var ok: i64 = 1 930 while name[j] != (0 as u8) { 931 if cut + j >= n { ok = 0 } 932 if ok == 1 { if path[cut + j] != name[j] { ok = 0 } } 933 j = j + 1 934 } 935 if ok == 0 { return 0 } 936 if cut + j + GB_NXEXT_LEN != n { return 0 } 937 if path[cut + j] != (GB_ASCII_DOT as u8) { return 0 } 938 if path[cut + j + 1] != (GB_ASCII_N as u8) { return 0 } 939 if path[cut + j + 2] != (GB_ASCII_X as u8) { return 0 } 940 return 1 941} 942 943// Rebuild the MUTATED target, capturing all output. Returns the builder's exit code. 944func gb_build() -> i64 { 945 let pid: i64 = sys_fork() 946 if pid == 0 { 947 let ofd: i64 = sys_openat_wr(gb_outp, 0x1a4) 948 if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } 949 // ★THE BUILDER PATH MUST BE RESOLVED TOO -- THIRD INSTANCE OF THIS CLASS (2026-07-30). 950 // Hardcoded, this reads ./_offc/nx_sov_build_run.elf; on the NAS the builder lives at 951 // buildroot/_offc/. So execve failed, gb_build returned 127, the BASELINE was never green, and 952 // EVERY gate on the NAS reported UNCONTROLLED -> redseen=0 for every domain -> clause 4 953 // (non-vacuity) of the evidence law was STRUCTURALLY UNREACHABLE on the machine that serves the 954 // claims. The whole mechanistic half of the honesty board was pinned at zero by one literal. 955 // ⚠I have now shipped this exact defect three times (pg_run in nx_plane_repair_gate was the 956 // second) INSIDE the tooling built to kill it. A hardcoded artifact path is not a small sin here: 957 // it fails as 127, which every caller reads as "the subject is broken" rather than "I could not 958 // find my own tool" -- an instrument reporting its own blindness as the subject's defect. 959 let elfres: *u8 = sys_mmap(GB_MAGIC_1024) 960 var elf: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 961 if ar_resolve(elf, elfres) == 1 { elf = elfres } 962 // ★AND ITS WORKING DIRECTORY -- the layer under the path. nx_sov_build_run probes runtime/ and 963 // runtime/_hdl_build/ RELATIVE TO CWD. Forked from the serving root it finds no sources and exits 2 964 // (SOURCE-NOT-FOUND), which the baseline reads as "gate not green" -- the SAME misattribution one 965 // layer on, and it kept every NAS gate UNCONTROLLED even after the path was resolved. /api/build 966 // works only because hostctl happens to run the builder from buildroot/. 967 // Derive the root from WHERE THE BUILDER WAS ACTUALLY FOUND (the prefix before "_offc/") rather than 968 // naming buildroot/ here -- naming it would be a second hardcoded path curing the first. On the 969 // laptop ar_resolve yields a bare "_offc/..." so the prefix is empty and nothing changes. 970 let broot: *u8 = sys_mmap(GB_MAGIC_1024) 971 var q: i64 = 0 972 var cut: i64 = 0 - 1 973 while elf[q] != (0 as u8) { 974 if elf[q] == (95 as u8) { if elf[q+1] == (111 as u8) { if elf[q+2] == (102 as u8) { if elf[q+3] == (102 as u8) { if elf[q+4] == (99 as u8) { cut = q } } } } } 975 q = q + 1 976 } 977 if cut > 0 { var bn: i64 = 0; while bn < cut - 1 { broot[bn] = elf[bn]; bn = bn + 1 } broot[bn] = 0 as u8; sys_chdir(broot) } 978 // invoke by the name that is valid in the NEW cwd (the resolved path was relative to the old one) 979 let rel: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 980 // ★★BUILD ONLY -- DO NOT LET THE BUILDER RUN THE GATE. nx_sov_build_run compiles AND runs as its 981 // last step, which forces ONE cwd on TWO steps that need different ones: compiling needs the build 982 // root (it probes runtime/ relative to cwd), the gate needs the SERVING root (it reads fixtures like 983 // nishi_raci.tsv relative to cwd). PROVEN with one binary and two directories: nx_raci_gate.elf is 984 // 5/5 GREEN from ~/nishihost and 4/5 RED from ~/nishihost/buildroot. Bundled, every NAS gate read 985 // UNCONTROLLED and redseen stayed 0 for every domain. 986 // ★This also makes COMPILE-FAIL vs GATE-RED STRUCTURAL rather than a string match on mixed output: 987 // the build's exit and the gate's exit are now two separate observations of two separate things. 988 let argv: *i64 = sys_mmap(32) as *i64 989 argv[0] = rel as i64 990 // **BUILD WHAT WAS MUTATED, NOT ALWAYS THE GATE.** gb_buildwhat is the gate in classic mode and the 991 // SUBJECT in subject mode. The hardcoded gb_target that used to be on this line IS the end-to-end 992 // blindness in full: it rebuilt the TEST and never the SUBJECT, so no mutation of a forked subject 993 // could ever enter the binary under test. 994 var bw: *u8 = gb_buildwhat 995 if (bw as i64) == 0 { bw = gb_target } 996 argv[1] = bw as i64 997 argv[2] = "--build-only\x00" as *u8 as i64 998 argv[3] = 0 999 let envp: *i64 = sys_mmap(16) as *i64 1000 envp[0] = 0 1001 sys_execve(rel, argv, envp) 1002 sys_exit(127) 1003 } 1004 let stp: *i64 = sys_mmap(16) as *i64 1005 sys_wait4(pid, stp, 0) 1006 let sig: i64 = stp[0] & 0x7f 1007 if sig != 0 { return 128 + sig } 1008 return (stp[0] >> 8) & 0xff 1009} 1010 1011func gb_out_has(needle: *u8) -> i64 { 1012 let buf: *u8 = sys_mmap(1 << 20) 1013 let n: i64 = gb_read(gb_outp, buf, (1 << 20) - 1) 1014 if n <= 0 { return 0 } 1015 if gg_last(buf, n, needle) >= 0 { return 1 } 1016 return 0 1017} 1018 1019// ★RUN THE GATE OURSELVES, FROM THE CWD WE WERE STARTED IN -- the other half of the build/run split. 1020// The parent never chdirs (only the build CHILD does), so this fork inherits the serving root and the gate 1021// finds its fixtures. Output OVERWRITES gb_outp on purpose: the COMPILE-FAIL check has already consumed the 1022// build output by the time this runs, so the judge below reads gate output and nothing else. 1023func gb_rungate() -> i64 { 1024 // ⚠★RUN THE FRESHLY BUILT ARTIFACT, NOT THE PROMOTED ONE. Splitting build from run introduced this: 1025 // --build-only leaves the new binary at <buildroot>/_build/<target>.sov.elf, while <target>.elf at the 1026 // serving root is the PROMOTED binary, compiled from UNMUTATED source. Resolving the promoted name made 1027 // every mutant survive BY CONSTRUCTION and reported INCONCLUSIVE -- a false negative that would have 1028 // silently understated coverage forever, and exactly the class this organ exists to catch. Caught by 1029 // asking why a gate known to be killable produced no kill in 12 sites. 1030 // (The path construction that used to be inline here is now gb_resolve_artifact: the SUBJECT needs the 1031 // identical resolution, and two copies of a resolver drift into judging a different file.) 1032 let gelf: *u8 = gb_resolve_artifact(gb_target) 1033 gb_last_elf = gelf 1034 w(" running: "); w(gelf); w("\n") 1035 let ofd: i64 = sys_openat_wr(gb_outp, 0x1a4) 1036 let av: *i64 = sys_mmap(32) as *i64 1037 av[0] = gelf as i64 1038 av[1] = 0 1039 // **SUBJECT MODE: HAND THE GATE THE ARTIFACT WE JUST BUILT.** A substitutable gate resolves its subject 1040 // from argv[1] -- exactly the addressing this organ's NOT-SUBSTITUTABLE message asks gates to provide -- 1041 // so passing the freshly built subject is what carries the mutation into the binary under test. 1042 // gb_last_elf follows the SUBJECT here because it feeds gb_art_same_as_base, and in this mode the gate 1043 // binary is never rebuilt: comparing the GATE would report NOT-REACHED for every mutant forever. 1044 if (gb_subject as i64) != 0 { 1045 let subjelf: *u8 = gb_resolve_artifact(gb_subject) 1046 gb_last_elf = subjelf 1047 av[1] = subjelf as i64 1048 av[2] = 0 1049 w(" subject-under-test: "); w(subjelf); w("\n") 1050 } 1051 let ev: *i64 = sys_mmap(16) as *i64 1052 ev[0] = 0 1053 var gdl: i64 = gb_deadline_ms 1054 if gdl <= 0 { gdl = GB_MUTANT_DEADLINE_MS } 1055 let rc: i64 = nx_guarded_run(gelf, av, ev, gdl, ofd, ofd) 1056 if ofd >= 0 { sys_close(ofd) } 1057 if rc == NX_GR_TIMEOUT { gb_timedout = 1 } 1058 return rc 1059} 1060 1061// Dialect-tolerant verdict: the `verdict=` line if present, else the exit code. 1062func gb_green(rc: i64) -> i64 { 1063 let buf: *u8 = sys_mmap(1 << 20) 1064 let n: i64 = gb_read(gb_outp, buf, (1 << 20) - 1) 1065 gb_judge_kind = 0 1066 if n <= 0 { if rc == 0 { return 1 } return 0 } 1067 if gg_last(buf, n, "verdict=" as *u8) >= 0 { 1068 gb_judge_kind = 1 1069 return gg_line_green(buf, n, "verdict=" as *u8, "GREEN" as *u8) 1070 } 1071 if rc == 0 { return 1 } 1072 return 0 1073} 1074 1075// Read the artifact gb_rungate just executed. CAPLESS -- composes sys_read_file, which sizes its buffer 1076// from the file itself. A guessed ceiling here would compare a PREFIX of two binaries and call a real 1077// mutation "identical", manufacturing the very false negative this check exists to remove. 1078func gb_art_read(lenout: *i64) -> *u8 { 1079 lenout[0] = 0 1080 if (gb_last_elf as i64) == 0 { return 0 as *u8 } 1081 return sys_read_file(gb_last_elf, lenout) 1082} 1083// 1 only if the artifact just judged is byte-identical to the baseline artifact. 1084// ★IT ABSTAINS RATHER THAN ACQUITS: no baseline, or an unreadable artifact, returns 0 -- which falls 1085// through to the pre-existing judgement. A check that cannot observe must never suppress a verdict. 1086func gb_art_same_as_base() -> i64 { 1087 if gb_base_artn <= 0 { return 0 } 1088 let ml: *i64 = sys_mmap(16) as *i64 1089 let m: *u8 = gb_art_read(ml) 1090 if (m as i64) == 0 { return 0 } 1091 if ml[0] != gb_base_artn { return 0 } 1092 var i: i64 = 0 1093 var same: i64 = 1 1094 var go: i64 = 1 1095 while go == 1 { 1096 if i >= ml[0] { go = 0 } else { 1097 if m[i] != gb_base_art[i] { same = 0; go = 0 } else { i = i + 1 } 1098 } 1099 } 1100 return same 1101} 1102 1103// Mutate one byte, rebuild, restore, judge. Returns 1 if this mutant was KILLED. 1104func gb_try(off: i64, newbyte: i64) -> i64 { 1105 // The window opens HERE, so the write-ahead record is armed HERE -- not at startup (aimlist and the 1106 // baseline checks exit without mutating) and not per-mutation (one record covers every site). 1107 if gb_armed == 0 { gb_arm_pristine(); gb_armed = 1 } 1108 var c: i64 = 0 1109 while c < gb_on { gb_work[c] = gb_orig[c]; c = c + 1 } 1110 gb_work[off] = newbyte as u8 1111 gb_write(gb_src, gb_work, gb_on) 1112 let rc: i64 = gb_build() 1113 gb_write(gb_src, gb_orig, gb_on) // mutation window closes before we even look at the result 1114 w(" @off="); wn(off); w(" build_exit="); wn(rc) 1115 if gb_out_has("COMPILE-FAIL" as *u8) == 1 { 1116 gb_invalid = gb_invalid + 1 1117 w(" -> INVALID MUTANT (did not compile; excluded, NOT a kill)\n") 1118 return 0 1119 } 1120 // ★★CLASSIFY BY EXIT CODE, NOT ONLY THE STRING. Caught live on nx_project 2026-08-04: the builder 1121 // exits 4 = SBR_ASM_FAIL (also 6 = ADMIT-REFUSED, 7 = CANON-REFUSED), none of which print COMPILE-FAIL, 1122 // so every such build fell through here as "compiled" -- and gb_rungate then judged the PROMOTED elf, 1123 // compiled from UNMUTATED source. 19 mutants across two runs all read SURVIVED against a binary the 1124 // mutation never entered. The string check above must STAY (the builder is known to exit 0 on some 1125 // compile-fails), but a NONZERO exit means NO FRESH ARTIFACT EXISTS and the judgment is VOID -- a 1126 // third category, distinct from both a killed and an uncompilable mutant. 1127 if rc != 0 { 1128 gb_void = gb_void + 1 1129 w(" -> VOID (build lane exit="); wn(rc); w(": 3=compile 4=asm 6=admit 7=canon -- no fresh artifact; judging would run the PROMOTED elf; excluded, NOT a survivor)\n") 1130 return 0 1131 } 1132 gb_tried = gb_tried + 1 1133 // it compiled -- now RUN the gate from the serving root and judge THAT, not the builder's exit 1134 gb_timedout = 0 1135 let grc: i64 = gb_rungate() 1136 if gb_timedout == 1 { 1137 w(" -> KILLED-BY-TIMEOUT (mutant never terminated; it emitted no verdict, so it did NOT survive)\n") 1138 return 1 1139 } 1140 if gb_green(grc) == 1 { 1141 if gb_art_same_as_base() == 1 { 1142 gb_noreach = gb_noreach + 1 1143 gb_tried = gb_tried - 1 1144 w(" -> NOT-REACHED (artifact byte-identical to baseline -- the mutation never entered the binary\n") 1145 w(" under test. Typically an END-TO-END gate that FORKS its subject instead of importing it, so\n") 1146 w(" rebuilding the GATE cannot carry a mutation into the SUBJECT. Excluded, NOT a survivor.)\n") 1147 return 0 1148 } 1149 w(" -> SURVIVED (gate still GREEN)\n") 1150 return 0 1151 } 1152 w(" -> KILLED (gate went RED on a mutant that COMPILED)\n") 1153 return 1 1154} 1155 1156func main(argc: i64, argv: *i64) -> i64 { 1157 if argc < 3 { w("usage: nx_gate_bite <gate_target> <source.nx> [max_sites] [subject <subject_target>] [aim <func> <skip> | aimlist <func>]\n"); sys_exit(2); return 2 } 1158 gb_target = argv[1] as *u8 1159 gb_src = argv[2] as *u8 1160 gb_load_deadline(gb_target) 1161 // ★RESOLVE THE SUBJECT THROUGH THE SHARED ROOTS TABLE (seq1398 adoption residual, closed 2026-07-30). 1162 // The GATE source has gone through ar_resolve since round 8, but the SUBJECT was still opened exactly as 1163 // written -- so on the NAS, where promote installs binaries FLAT at the serving root and sources live 1164 // under buildroot/, a .gates 4th field of `runtime/_hdl_build/nx_raci.nx` read ABSENT and every domain 1165 // scored redseen=0. Non-vacuity was structurally unreachable ON THE MACHINE THAT SERVES THE CLAIMS, 1166 // which is the D3 off-host defect one layer down. 1167 // ⚠Resolve ONCE and repoint gb_src, because this path is also used to MUTATE (368), RESTORE (370) and 1168 // BYTE-VERIFY (468). Resolving only the read would read one file and write another -- which would defeat 1169 // the restore guarantee, the one invariant that keeps this organ from damaging the corpus. 1170 // ar_resolve leaves out == input and returns 0 when it cannot resolve (its T5 neg-control), so an 1171 // unresolvable subject still falls through to the honest ABSENT message below, naming what was asked for. 1172 let gb_sres: *u8 = sys_mmap(GB_MAGIC_1024) 1173 if ar_resolve(gb_src, gb_sres) == 1 { gb_src = gb_sres } 1174 gb_outp = "knowledge/status/bite_run.out\x00" as *u8 1175 var maxs: i64 = GB_DEF_SITES 1176 if argc > 3 { 1177 maxs = 0 1178 var badnum: i64 = 0 1179 let a: *u8 = argv[3] as *u8 1180 var i: i64 = 0 1181 while a[i] != (0 as u8) { 1182 let dv: i64 = (a[i] as i64) - 48 1183 if dv < 0 { badnum = 1 } else { if dv > 9 { badnum = 1 } else { maxs = maxs*10 + dv } } 1184 i = i + 1 1185 } 1186 // A NON-NUMERIC 3rd arg must REFUSE, not parse as garbage: `aim` misplaced here would decode to 1187 // maxs=5579 and launch a five-thousand-site sweep. AN APPLIER INVOKED WRONG = ONE THAT DOESN'T EXIST. 1188 if badnum == 1 { 1189 w("usage: nx_gate_bite <gate_target> <source.nx> [max_sites] [subject <subject_target>] [aim <func> <skip> | aimlist <func>]\n") 1190 sys_exit(2); return 2 1191 } 1192 if maxs <= 0 { maxs = GB_DEF_SITES } 1193 } 1194 var aimmode: i64 = 0 1195 var aimskip: i64 = 0 1196 var aimf: *u8 = "-" as *u8 1197 // **KEYWORD ARGUMENTS, SCANNED -- NOT A FIXED SLOT.** The old parser read argv[4] and only argv[4], so 1198 // a second keyword could not be expressed at all. This scan is a STRICT SUPERSET: for every argv the 1199 // slot parser accepted, the first iteration reads the same token, takes the same branch and reaches the 1200 // same state, and an unrecognised token is still ignored exactly as before -- which is what makes 1201 // `subject` additive rather than a grammar change. **A LANE FLAG IS A LOOP, NOT A SLOT**: the build 1202 // runner learned that on 2026-08-15 when a second flag was silently forwarded instead of consumed, and 1203 // this organ never inherited the lesson. 1204 var argi: i64 = 4 1205 var argscan: i64 = 1 1206 while argscan == 1 { 1207 if argi >= argc { argscan = 0 } else { 1208 let am: *u8 = argv[argi] as *u8 1209 var step: i64 = 1 1210 if am[0] == (97 as u8) { if am[1] == (105 as u8) { if am[2] == (109 as u8) { 1211 if am[3] == (0 as u8) { if argc > argi + 2 { 1212 aimmode = 1 1213 aimf = argv[argi + 1] as *u8 1214 let sk: *u8 = argv[argi + 2] as *u8 1215 var si2: i64 = 0 1216 while sk[si2] != (0 as u8) { aimskip = aimskip*10 + ((sk[si2] as i64) - 48); si2 = si2 + 1 } 1217 if aimskip < 0 { aimskip = 0 } 1218 step = 3 1219 } } 1220 if am[3] == (108 as u8) { if argc > argi + 1 { 1221 aimmode = 2 1222 aimf = argv[argi + 1] as *u8 1223 step = 2 1224 } } 1225 } } } 1226 // `subject <target>` -- matched on its first four bytes, so `subj` is an accepted short form. 1227 if am[0] == (115 as u8) { if am[1] == (117 as u8) { if am[2] == (98 as u8) { if am[3] == (106 as u8) { 1228 if argc > argi + 1 { gb_subject = argv[argi + 1] as *u8; step = 2 } 1229 } } } } 1230 argi = argi + step 1231 } 1232 } 1233 1234 w("=== nx_gate_bite -- can this gate ever fail? (2 operators, first-kill-wins) ===\n") 1235 w(" gate="); w(gb_target); w(" subject="); w(gb_src); w(" max_sites_per_operator="); wn(maxs); w("\n") 1236 w(" deadline_ms="); wn(gb_deadline_ms); w("\n") 1237 // gb_buildwhat is THE TARGET THE MUTATION LOOP REBUILDS. Classic mode keeps the historical behaviour 1238 // byte for byte: build the gate. Subject mode builds the SUBJECT, and that one line is the whole fix. 1239 gb_buildwhat = gb_target 1240 if (gb_subject as i64) != 0 { 1241 gb_buildwhat = gb_subject 1242 w(" subject_target="); w(gb_subject) 1243 w(" (END-TO-END mode: the SUBJECT is rebuilt per mutant and handed to the gate as argv[1])\n") 1244 // **THE PAIR IS CHECKED AND ANNOUNCED, NOT REFUSED** -- corrected the same day it was written, after 1245 // reading debt 1785787638. Mutating a file that is not <subject_target>.nx is LEGITIMATE and is in fact 1246 // the HIGHEST-VALUE use of this mode when that file is a LIBRARY INSIDE the subject's build closure: 1247 // that row names exactly it (nx_intlog's BM25 arithmetic inside nx_beir_eval, ZERO mutation coverage 1248 // precisely because a fork boundary hid it). A refusal here would block the case this mode exists for. 1249 // It would also be REDUNDANT: the artifact-identity check is the SOUND general test, because a source 1250 // outside the closure yields a byte-identical artifact EVERY TIME and is excluded as NOT-REACHED with 1251 // its remedy named -- never mistaken for a verdict about the gate. 1252 // **A GUARD THAT REFUSES A LEGITIMATE CASE IS A FALSE-POSITIVE GENERATOR, AND A NARROW DUPLICATE OF A 1253 // SOUND CHECK IS WORSE THAN NO CHECK AT ALL.** 1254 if gb_basename_is(gb_src, gb_subject) != 1 { 1255 w(" NOTE subject-source-is-not-the-target's-own-file: src="); w(gb_src) 1256 w(" is not "); w(gb_subject); w(".nx\n") 1257 w(" That is CORRECT for a library inside the subject's build closure and WRONG for an unrelated\n") 1258 w(" file -- and you do not have to guess which: read not_reached below. A source outside the\n") 1259 w(" closure produces a byte-identical artifact every time and is excluded as NOT-REACHED.\n") 1260 } 1261 } 1262 1263 // RECOVER FIRST, TRUST SECOND. If a prior run died mid-window the subject on disk may be a stranded 1264 // mutant; reading it as pristine here would bank the corruption AND make it self-certifying (the 1265 // final byte-verify would compare the mutant against itself and report a clean restore). 1266 gb_recover_pristine() 1267 gb_orig = sys_mmap(GB_MAXSRC) 1268 gb_on = gb_read(gb_src, gb_orig, GB_MAXSRC) 1269 // ★EXIT 4, NOT 2. Exit 2 means UNCONTROLLED = "the gate is not green at its own baseline", i.e. an 1270 // accusation against the GATE. A subject we cannot READ is an accusation against the .gates ROW, and 1271 // the two demand opposite work: fix the gate vs fix one config field. Sharing a code made the sweep 1272 // render a missing file as "UNCONTROLLED (gate not green at baseline)", which is how librarian's 1273 // nx_orchestrate_gate -- a gate that is 13/13 GREEN -- got reported as broken for an entire evening 1274 // while the real fault was a .gates 4th field naming runtime/nx_orchestrate.nx, a file that does not 1275 // exist. ★★★★★★AN INSTRUMENT THAT CANNOT REACH ITS SUBJECT MUST SAY SO, NOT INDICT THE SUBJECT -- 1276 // and an EXIT CODE IS A DIAGNOSIS: two failures sharing one code guarantee a misdiagnosis downstream. 1277 if gb_on <= 0 { 1278 w(" ABSENT: cannot read the subject source (check the .gates 4th field -- this is a CONFIG fault, not a gate fault)\n") 1279 sys_exit(4); return 4 1280 } 1281 // AIMLIST: enumerate the numeric sites of ONE function with context and exit. NO mutation, NO build, 1282 // NO baseline -- this is the READING step that makes an aimed bite a measurement instead of a guess 1283 // (a wrong by-eye site count costs a full 40-minute gate round; this costs milliseconds). 1284 if aimmode == 2 { 1285 let ad: i64 = gb_aim_find(aimf) 1286 if ad < 0 { 1287 w(" AIM-ABSENT: no `func "); w(aimf); w("(` in the subject -- check the function name (an AIM fault, not a gate fault)\n") 1288 sys_exit(4); return 4 1289 } 1290 w(" aimlist: func "); w(aimf); w(" @off="); wn(ad); w(" end="); wn(gb_aim_end); w(" (numeric sites; NO mutation, NO build)\n") 1291 var from2: i64 = ad 1292 var idx: i64 = 0 1293 var listing: i64 = 1 1294 while listing == 1 { 1295 let aoff: i64 = gb_num_at(gb_orig, gb_on, from2) 1296 var stop1: i64 = 0 1297 if aoff < 0 { stop1 = 1 } 1298 if stop1 == 0 { if aoff >= gb_aim_end { stop1 = 1 } } 1299 if stop1 == 1 { listing = 0 } else { 1300 from2 = aoff + 1 1301 let ctx: *u8 = sys_mmap(64) 1302 var ci: i64 = 0 1303 var cs: i64 = aoff - 10 1304 if cs < 0 { cs = 0 } 1305 while cs < aoff + 10 { 1306 if cs < gb_on { 1307 var cc2: i64 = gb_orig[cs] as i64 1308 if cc2 == 10 { cc2 = 32 } 1309 if cc2 == 9 { cc2 = 32 } 1310 ctx[ci] = cc2 as u8 1311 ci = ci + 1 1312 } 1313 cs = cs + 1 1314 } 1315 ctx[ci] = 0 as u8 1316 w(" site "); wn(idx); w(" @off="); wn(aoff); w(" |"); w(ctx); w("|\n") 1317 idx = idx + 1 1318 } 1319 } 1320 w(" total_numeric_sites="); wn(idx); w("\n") 1321 sys_exit(0) 1322 return 0 1323 } 1324 gb_work = sys_mmap(GB_MAXSRC) 1325 gb_tried = 0 1326 gb_invalid = 0 1327 gb_void = 0 1328 gb_noreach = 0 1329 gb_base_artn = 0 1330 1331 // ---- BANK THE DEPLOYED TWINS BEFORE THE FIRST BUILD ------------------------------------------ 1332 // nx_sov_build_run refresh-installs every SUCCESSFUL build into both consumer locations -- 1333 // _offc/<name>.elf and <serving-root>/<name>.elf -- and it does so UNDER --build-only. So each mutant 1334 // build DEPLOYS that mutant where every fork reads it, and the only thing that undoes it is the final 1335 // cleanup build at the end of main, whose exit code this organ used to discard. A failed cleanup build 1336 // therefore left a MUTANT LIVE and said nothing at all. 1337 // **DIGEST FIRST, BEFORE ANY BUILD CAN MOVE THEM** -- taken later, the check would compare a mutant to 1338 // itself and certify the corruption, the same trap gb_recover_pristine already closes for the source. 1339 gb_tw_offc = gb_twin_path("_offc/" as *u8, gb_buildwhat) 1340 gb_tw_root = gb_twin_path("" as *u8, gb_buildwhat) 1341 gb_tw_offc_dig = sys_mmap(GB_DIGEST_BYTES) 1342 gb_tw_root_dig = sys_mmap(GB_DIGEST_BYTES) 1343 let lo: *i64 = sys_mmap(GB_LP_BYTES) as *i64 1344 gb_tw_offc_by = gb_bank_path(gb_tw_offc, gb_tw_offc_dig, lo) 1345 gb_tw_offc_have = 0 1346 if (gb_tw_offc_by as i64) != 0 { gb_tw_offc_have = 1; gb_tw_offc_ln = lo[0] } 1347 let lr: *i64 = sys_mmap(GB_LP_BYTES) as *i64 1348 gb_tw_root_by = gb_bank_path(gb_tw_root, gb_tw_root_dig, lr) 1349 gb_tw_root_have = 0 1350 if (gb_tw_root_by as i64) != 0 { gb_tw_root_have = 1; gb_tw_root_ln = lr[0] } 1351 w(" deployed_twins_banked: offc="); wn(gb_tw_offc_have); w(" root="); wn(gb_tw_root_have) 1352 w(" target="); w(gb_buildwhat); w("\n") 1353 1354 // In subject mode the GATE is never rebuilt by the mutation loop, so build it ONCE here from its own 1355 // unmutated source: a bite measured against a stale gate binary is a claim about a gate we do not have. 1356 if (gb_subject as i64) != 0 { 1357 gb_buildwhat = gb_target 1358 let gbrc: i64 = gb_build() 1359 gb_buildwhat = gb_subject 1360 w(" gate_build_exit="); wn(gbrc); w(" (pristine gate source; the mutation loop rebuilds the SUBJECT only)\n") 1361 if gbrc == GB_BUILD_ADMIT { 1362 w(" BUILD-REFUSED-BY-ADMISSION: the build GOVERNOR declined (exit=6). The box was busy and\n") 1363 w(" NOTHING WAS COMPILED, so this run has no evidence either way about the gate's source.\n") 1364 w(" Re-run when load clears; admission re-measures on every call.\n") 1365 w("VERDICT: verdict=UNPROVEN (BUILD-REFUSED-BY-ADMISSION -- could not look, so nothing is claimed)\n") 1366 sys_exit(GB_EXIT_BUILD_REFUSED); return GB_EXIT_BUILD_REFUSED 1367 } 1368 if gbrc != 0 { 1369 w(" BASELINE-UNBUILDABLE: the GATE's own source failed the build lane (exit="); wn(gbrc) 1370 w(", 3=compile 4=asm 7=canon). Every judgment below would run a binary this source did not produce.\n") 1371 w("VERDICT: verdict=RED (BASELINE-UNBUILDABLE -- the gate is not reproducible from its own source)\n") 1372 sys_exit(5); return 5 1373 } 1374 } 1375 1376 // Baseline: the gate must be GREEN before we break anything, or no observation is attributable. 1377 let brc: i64 = gb_build() 1378 // build and run are now SEPARATE observations: a non-zero build exit means the code did not compile, 1379 // a non-green gate means the gate failed. Reporting both stops the baseline blaming the gate for a 1380 // build problem -- the misattribution that kept every NAS gate reading UNCONTROLLED. 1381 let grc: i64 = gb_rungate() 1382 let base: i64 = gb_green(grc) 1383 w(" baseline: build_exit="); wn(brc); w(" gate_exit="); wn(grc); w(" green="); wn(base) 1384 if gb_judge_kind == 1 { w(" judge=verdict-line\n") } else { w(" judge=exit-code (gate emits no verdict= anchor)\n") } 1385 // ★★A GREEN BASELINE OVER A FAILED BUILD IS NOT A BASELINE. If the PRISTINE source does not build 1386 // (any nonzero exit), the green just observed came from the PROMOTED elf -- so every mutant would be 1387 // judged against a binary the mutation cannot enter, and killed=0 is guaranteed BY CONSTRUCTION. 1388 // nx_project read exactly this way twice before the hole was found: baseline build_exit=4 (ASM-FAIL) 1389 // printed in plain sight, and nothing refused. A bite whose subject cannot build must say SO, loudly, 1390 // as its verdict -- that the live tool is NOT REPRODUCIBLE FROM SOURCE is itself a sev-worthy finding. 1391 if brc == GB_BUILD_ADMIT { 1392 w(" BUILD-REFUSED-BY-ADMISSION: the build GOVERNOR declined (exit=6). The box was busy and\n") 1393 w(" NOTHING WAS COMPILED. The green above came from the PROMOTED elf, so a bite is not available --\n") 1394 w(" but that is a fact about THIS RUN, not about whether the tool builds from its source.\n") 1395 w(" Re-run when load clears; admission re-measures on every call.\n") 1396 w("VERDICT: verdict=UNPROVEN (BUILD-REFUSED-BY-ADMISSION -- could not look, so nothing is claimed)\n") 1397 sys_exit(GB_EXIT_BUILD_REFUSED); return GB_EXIT_BUILD_REFUSED 1398 } 1399 if brc != 0 { 1400 w(" BASELINE-UNBUILDABLE: pristine source failed the build lane (exit="); wn(brc) 1401 w(", 3=compile 4=asm 7=canon) -- the green above is the PROMOTED elf, not this source.\n") 1402 w(" Every mutant judgment would be VOID. Fix the build (or the lane) first; this is a real finding, not noise.\n") 1403 w("VERDICT: verdict=RED (BASELINE-UNBUILDABLE -- the registered tool is not reproducible from its own source)\n") 1404 sys_exit(5); return 5 1405 } 1406 if base != 1 { 1407 w(" UNCONTROLLED: the gate is not GREEN before mutation -- fix that first\n") 1408 sys_exit(2); return 2 1409 } 1410 // ★BANK THE BASELINE ARTIFACT NOW. The binary that produced the GREEN above is the reference every 1411 // mutant is compared against, and it is captured AFTER the baseline is proven green so a broken 1412 // baseline can never become the yardstick. Printing its size makes the reference VISIBLE: a zero here 1413 // says the identity check is abstaining, rather than leaving the reader to assume it ran. 1414 let bal: *i64 = sys_mmap(16) as *i64 1415 gb_base_art = gb_art_read(bal) 1416 if (gb_base_art as i64) != 0 { gb_base_artn = bal[0] } 1417 w(" baseline_artifact_bytes="); wn(gb_base_artn) 1418 if gb_base_artn <= 0 { w(" (UNREADABLE -- artifact-identity check will ABSTAIN, not acquit)") } 1419 w("\n") 1420 1421 var killed: i64 = 0 1422 // AIMED MODE: mutate numeric sites inside the ONE function the expert named, skipping the first 1423 // <skip> sites (the leading guard block). Runs INSTEAD of the positional sweep: maxs is zeroed after, 1424 // so every operator below enumerates nothing -- their headers print, their budgets are spent here. 1425 // The verdict record and restore guarantee are UNCHANGED: a kill still requires a compiling mutant 1426 // and a RED gate, so aiming changes which mutants are TRIED, never what counts as proof. 1427 if aimmode == 1 { 1428 w(" -- AIMED: operator-3 numeric mutation inside one named function (sweep budget zeroed) --\n") 1429 let ad2: i64 = gb_aim_find(aimf) 1430 if ad2 < 0 { 1431 w(" AIM-ABSENT: no `func "); w(aimf); w("(` in the subject -- check the function name (an AIM fault, not a gate fault)\n") 1432 sys_exit(4); return 4 1433 } 1434 w(" aim: func "); w(aimf); w(" @off="); wn(ad2); w(" end="); wn(gb_aim_end); w(" skip="); wn(aimskip); w("\n") 1435 var ak: i64 = 0 1436 var from3: i64 = ad2 1437 var idx2: i64 = 0 1438 while ak < maxs { 1439 let aoff2: i64 = gb_num_at(gb_orig, gb_on, from3) 1440 var stop2: i64 = 0 1441 if aoff2 < 0 { stop2 = 1 } 1442 if stop2 == 0 { if aoff2 >= gb_aim_end { stop2 = 1 } } 1443 if stop2 == 1 { 1444 w(" aim: numeric sites exhausted at idx="); wn(idx2); w("\n") 1445 ak = maxs 1446 } else { 1447 from3 = aoff2 + 1 1448 if idx2 >= aimskip { 1449 var nda: i64 = (gb_orig[aoff2] as i64) + 1 1450 if nda > 57 { nda = 56 } 1451 w(" aim num site "); wn(idx2) 1452 if gb_try(aoff2, nda) == 1 { killed = 1; ak = maxs } else { ak = ak + 1 } 1453 } 1454 idx2 = idx2 + 1 1455 } 1456 } 1457 maxs = 0 1458 } 1459 w(" -- operator 1: COMPARISON (reaches logic) --\n") 1460 var k: i64 = 0 1461 while k < maxs { 1462 let off: i64 = gb_site_cmp(gb_orig, gb_on, k) 1463 if off < 0 { k = maxs } else { 1464 w(" cmp site "); wn(k) 1465 if gb_try(off, gb_cmp_flip(gb_orig, off)) == 1 { killed = 1; k = maxs } 1466 k = k + 1 1467 } 1468 } 1469 1470 if killed == 0 { 1471 // 2a: aim at the phrases the gate's own source names, before any linear scan. 1472 gb_load_gate_src(gb_target) 1473 if gb_gn > 0 { 1474 w(" -- operator 2a: NEEDLE-GUIDED (aimed at phrases the gate itself asserts on) --\n") 1475 gb_needle_audit(gb_orig, gb_on) 1476 k = 0 1477 while k < maxs { 1478 let noff: i64 = gb_site_needle(gb_orig, gb_on, k) 1479 if noff < 0 { k = maxs } else { 1480 var nb2: i64 = (gb_orig[noff] as i64) + 1 1481 if nb2 == 123 { nb2 = 97 } 1482 if nb2 == 91 { nb2 = 65 } 1483 w(" needle site "); wn(k) 1484 if gb_try(noff, nb2) == 1 { killed = 1; k = maxs } 1485 k = k + 1 1486 } 1487 } 1488 } else { w(" (gate source not found -- skipping needle-guided phase)\n") } 1489 } 1490 1491 if killed == 0 { 1492 w(" -- operator 2b: LITERAL linear scan (reaches rendered output) --\n") 1493 k = 0 1494 while k < maxs { 1495 let off: i64 = gb_site_lit(gb_orig, gb_on, k) 1496 if off < 0 { k = maxs } else { 1497 var nb: i64 = (gb_orig[off] as i64) + 1 1498 if nb == 123 { nb = 97 } 1499 if nb == 91 { nb = 65 } 1500 w(" lit site "); wn(k) 1501 if gb_try(off, nb) == 1 { killed = 1; k = maxs } 1502 k = k + 1 1503 } 1504 } 1505 } 1506 1507 // OPERATOR 3 runs LAST but is the only one that reaches branchless code. Kept as a distinct phase 1508 // rather than folded into 2b because a changed CONSTANT and a changed STRING falsify different things: 1509 // 2b perturbs rendered output, this perturbs ARITHMETIC. For a KAT the arithmetic is the claim. 1510 if killed == 0 { 1511 w(" -- operator 3: NUMERIC CONSTANT (reaches branchless/constant-time code) --\n") 1512 k = 0 1513 while k < maxs { 1514 let noff2: i64 = gb_site_num(gb_orig, gb_on, k) 1515 if noff2 < 0 { k = maxs } else { 1516 // 9 -> 8, everything else +1: never creates a leading zero, never overflows the run 1517 var nd: i64 = (gb_orig[noff2] as i64) + 1 1518 if nd > 57 { nd = 56 } 1519 w(" num site "); wn(k) 1520 if gb_try(noff2, nd) == 1 { killed = 1; k = maxs } 1521 k = k + 1 1522 } 1523 } 1524 } 1525 1526 // ---- OPERATOR 4: SYMBOL-TARGETED. Aim where the GATE actually reaches. ---- 1527 // Operators 1/3 pick sites by FILE POSITION, so a bounded run on a large subject only ever mutates the 1528 // first kilobyte. MEASURED 2026-08-01: sites 864/936 in a 150261B subject -> killed=0, while the SAME 1529 // gate killed at off=4421 in a 10915B subject. Uniform striding was implemented, MEASURED and REVERTED 1530 // (debt 1785637001): at a fixed budget it MOVES the blind spot instead of shrinking it, and it lost a 1531 // kill that dense sampling had already found. Targeting is what position-based sampling cannot give. 1532 // Operator 2a tried this with string LITERALS and reported present_in_subject=0, because a gate's 1533 // literals are mostly its own chk() LABELS -- prose that was never a claim about the subject. An 1534 // IDENTIFIER is not prose: if the gate CALLS sym and the subject DEFINES func sym(, that is a site the 1535 // gate demonstrably reaches, established by parsing rather than by guessing. 1536 // ADDITIVE BY CONSTRUCTION: runs only when 1/2b/3 found no kill, so it can never remove an existing one. 1537 if killed == 0 { 1538 w(" -- operator 4: SYMBOL-TARGETED (mutate inside functions the GATE CALLS) --\n") 1539 let sym: *u8 = sys_mmap(200) 1540 let pat: *u8 = sys_mmap(240) 1541 var si: i64 = 0 1542 var used: i64 = 0 1543 let tried: *i64 = sys_mmap(8 * 64) as *i64 1544 var ntried: i64 = 0 1545 var scanning: i64 = 1 1546 while scanning == 1 { 1547 if used >= maxs { scanning = 0 } else { 1548 let L: i64 = gb_gate_call(si, sym, 200) 1549 if L < 0 { scanning = 0 } else { 1550 si = si + 1 1551 var po: i64 = 0 1552 let fw: *u8 = "func " as *u8 1553 var z: i64 = 0 1554 while z < 5 { pat[po] = fw[z]; po = po + 1; z = z + 1 } 1555 z = 0 1556 while z < L { pat[po] = sym[z]; po = po + 1; z = z + 1 } 1557 pat[po] = 40 as u8 1558 po = po + 1 1559 let d: i64 = gb_find(gb_orig, gb_on, pat, po) 1560 if d >= 0 { 1561 let off4: i64 = gb_cmp_at(gb_orig, gb_on, d) 1562 // DEDUP: many functions share the next downstream ==, so without this the budget is 1563 // burned re-mutating ONE site. MEASURED on nx_vcodec_band_gate: 26 valid mutants and 1564 // exactly ONE distinct offset (39064), because vv_enc_band and vv_dec_band both 1565 // resolved forward to the same comparison. Requiring a strictly LATER offset makes 1566 // every attempt a genuinely new site and turns max_sites into a real budget. 1567 if off4 >= 0 { 1568 // A MONOTONIC dedup was tried first and was WRONG: symbols are not ordered by 1569 // definition offset, so requiring a strictly later site discarded every candidate 1570 // defined earlier in the file and left exactly ONE distinct offset again. A tried-SET 1571 // is the correct shape -- order-independent, and it is what makes max_sites a budget 1572 // over DISTINCT sites rather than over attempts. 1573 var dup: i64 = 0 1574 var q2: i64 = 0 1575 while q2 < ntried { if tried[q2] == off4 { dup = 1 } q2 = q2 + 1 } 1576 if dup == 0 { 1577 if ntried < 64 { tried[ntried] = off4; ntried = ntried + 1 } 1578 w(" sym site "); w(sym) 1579 used = used + 1 1580 if gb_try(off4, gb_cmp_flip(gb_orig, off4)) == 1 { killed = 1; scanning = 0 } 1581 } 1582 } 1583 // AIM + BRANCHLESS REACH. Operator 4 aimed well but reused operator 1s == predicate, 1584 // so it inherited its blindness: constant-time and table-driven code is written NOT to 1585 // branch, and that is exactly the code most worth proving. Same aim, operator 3s 1586 // mutation -- perturb a NUMERIC constant inside the function the gate calls. 1587 if killed == 0 { 1588 let noff4: i64 = gb_num_at(gb_orig, gb_on, d) 1589 if noff4 >= 0 { 1590 var dupn: i64 = 0 1591 var q3: i64 = 0 1592 while q3 < ntried { if tried[q3] == noff4 { dupn = 1 } q3 = q3 + 1 } 1593 if dupn == 0 { 1594 if ntried < 64 { tried[ntried] = noff4; ntried = ntried + 1 } 1595 var nd4: i64 = (gb_orig[noff4] as i64) + 1 1596 if nd4 > 57 { nd4 = 56 } 1597 w(" sym num "); w(sym) 1598 used = used + 1 1599 if gb_try(noff4, nd4) == 1 { killed = 1; scanning = 0 } 1600 } 1601 } 1602 } 1603 } 1604 } 1605 } 1606 } 1607 } 1608 1609 // VERIFY THE RESTORE against the pristine copy. The organ refuses to report success over a damaged tree. 1610 let back: *u8 = sys_mmap(GB_MAXSRC) 1611 let bn: i64 = gb_read(gb_src, back, GB_MAXSRC) 1612 var same: i64 = 1 1613 if bn != gb_on { same = 0 } else { 1614 var j: i64 = 0 1615 while j < gb_on { if back[j] != gb_orig[j] { same = 0; j = gb_on } else { j = j + 1 } } 1616 } 1617 if same != 1 { 1618 w(" RESTORE-FAILED: subject does NOT match its pristine bytes -- CORPUS AT RISK\n") 1619 sys_exit(3); return 3 1620 } 1621 w(" restore verified: "); wn(bn); w(" bytes byte-identical to pristine\n") 1622 // The window is now provably shut, so and ONLY so may the write-ahead record be dropped. On the 1623 // RESTORE-FAILED path above we exit(3) WITHOUT disarming, on purpose: the sidecar is the repair kit. 1624 gb_disarm_pristine() 1625 // **READ THE EXIT CODE OF THE CLEANUP BUILD.** This call was made and its result DISCARDED: when it 1626 // fails, the last artifact installed into both consumer locations is THE LAST MUTANT, and nothing said so. 1627 let finrc: i64 = gb_build() // leave a clean binary: the last build was from mutated source 1628 w(" cleanup_build_exit="); wn(finrc); w("\n") 1629 // ---- ARTIFACT CUSTODY: is the DEPLOYED binary back to the bytes we found? --------------------- 1630 // Three NAMED outcomes, because they demand different work and one merged counter would hide the 1631 // dangerous one -- the same split this organ already made for void vs not-reached: 1632 // RESTORED final == the pre-run bytes: this harness left the estate exactly as it found it. 1633 // REFRESHED final != pre-run but == the PRISTINE BASELINE BUILD: no mutant is deployed, and the 1634 // delta is PRE-EXISTING DRIFT -- the twin was not a faithful build of its own source 1635 // before we started. A finding about the estate, not a failure of this run. 1636 // MUTANT-LIVE neither: a mutated or failed build is installed where consumers fork it. 1637 var custody_bad: i64 = 0 1638 var custody_checked: i64 = 0 1639 var custody_refreshed: i64 = 0 1640 // HEALED is its own bucket, never folded into RESTORED: "I put it back myself" and "it was never 1641 // disturbed" are different facts about this run, and merging them would hide how often the cleanup 1642 // build is being refused -- the very signal that motivated the repair. 1643 var custody_healed: i64 = 0 1644 let basedig: *u8 = sys_mmap(GB_DIGEST_BYTES) 1645 var have_base: i64 = 0 1646 if gb_base_artn > 0 { sha256_digest(gb_base_art, gb_base_artn, basedig); have_base = 1 } 1647 if gb_tw_offc_have == 1 { 1648 custody_checked = custody_checked + 1 1649 let tv: i64 = gb_twin_check(gb_tw_offc, gb_tw_offc_dig, basedig, have_base) 1650 if tv == 1 { custody_refreshed = custody_refreshed + 1 } 1651 if tv == 2 { 1652 // SELF-HEAL, THEN RE-CHECK. Writing the bytes back and ASSERTING the result is what makes 1653 // this a repair instead of a hopeful write -- the same discipline the source restore above 1654 // already uses (restore, then byte-verify, then and only then disarm). 1655 if gb_twin_restore(gb_tw_offc, gb_tw_offc_by, gb_tw_offc_ln) == 1 { 1656 w(" twin HEAL ATTEMPTED from banked bytes (no build, no governor): "); w(gb_tw_offc); w("\n") 1657 let tvh: i64 = gb_twin_check(gb_tw_offc, gb_tw_offc_dig, basedig, have_base) 1658 if tvh == 0 { custody_healed = custody_healed + 1 } else { custody_bad = custody_bad + 1 } 1659 } else { custody_bad = custody_bad + 1 } 1660 } 1661 } 1662 if gb_tw_root_have == 1 { 1663 custody_checked = custody_checked + 1 1664 let tv2: i64 = gb_twin_check(gb_tw_root, gb_tw_root_dig, basedig, have_base) 1665 if tv2 == 1 { custody_refreshed = custody_refreshed + 1 } 1666 if tv2 == 2 { 1667 if gb_twin_restore(gb_tw_root, gb_tw_root_by, gb_tw_root_ln) == 1 { 1668 w(" twin HEAL ATTEMPTED from banked bytes (no build, no governor): "); w(gb_tw_root); w("\n") 1669 let tvh2: i64 = gb_twin_check(gb_tw_root, gb_tw_root_dig, basedig, have_base) 1670 if tvh2 == 0 { custody_healed = custody_healed + 1 } else { custody_bad = custody_bad + 1 } 1671 } else { custody_bad = custody_bad + 1 } 1672 } 1673 } 1674 w(" artifact_custody: twins_checked="); wn(custody_checked) 1675 w(" restored="); wn(custody_checked - custody_refreshed - custody_bad - custody_healed) 1676 w(" refreshed="); wn(custody_refreshed); w(" healed="); wn(custody_healed) 1677 w(" mutant_live="); wn(custody_bad); w("\n") 1678 if custody_healed > 0 { 1679 w(" NOTE "); wn(custody_healed) 1680 w(" twin(s) were PUT BACK BY THIS HARNESS from bytes banked before the first build. That is a\n") 1681 w(" repair, not a clean run: something left a mutant installed -- almost always a cleanup build\n") 1682 w(" the governor REFUSED (cleanup_build_exit=6) because this harness's own builds loaded the box.\n") 1683 w(" The estate is consistent again, and the count is kept so the refusal rate stays visible.\n") 1684 } 1685 if custody_checked == 0 { 1686 w(" artifact_custody: NO DEPLOYED TWIN for "); w(gb_buildwhat) 1687 w(" -- nothing was installed, so this check is VACUOUS for this target and SAYS SO rather than passing quietly.\n") 1688 } 1689 if custody_bad > 0 { 1690 w("VERDICT: verdict=RED (ARTIFACT-RESTORE-FAILED -- "); wn(custody_bad) 1691 w(" deployed twin(s) of "); w(gb_buildwhat) 1692 w(" are NEITHER the bytes we found NOR the pristine baseline build, so a build this harness made is LIVE where consumers fork it. Rebuild and reinstall before trusting anything that forks it.)\n") 1693 sys_exit(3); return 3 1694 } 1695 1696 // Record the observation, bound to WHAT was measured and WHERE (a bite record is only true of the 1697 // gate-and-subject pair it was measured on; the same gate built on two hosts has different digests). 1698 let sd: *u8 = sys_mmap(32) 1699 sha256_digest(gb_orig, gb_on, sd) 1700 let vb: *u8 = sys_mmap(GB_MAGIC_1024) 1701 var o: i64 = 0 1702 let k1: *u8 = "killed=" 1703 var q: i64 = 0 1704 while k1[q] != (0 as u8) { vb[o] = k1[q]; o = o + 1; q = q + 1 } 1705 vb[o] = (48 + killed) as u8; o = o + 1 1706 let tb: *u8 = sys_mmap(28) 1707 let k2: *u8 = " valid_mutants=" 1708 q = 0 1709 while k2[q] != (0 as u8) { vb[o] = k2[q]; o = o + 1; q = q + 1 } 1710 var m: i64 = gb_tried 1711 var kk: i64 = 0 1712 if m == 0 { tb[0] = 48 as u8; kk = 1 } 1713 while m > 0 { tb[kk] = (48 + (m % 10)) as u8; m = m / 10; kk = kk + 1 } 1714 var z: i64 = kk - 1 1715 while z >= 0 { vb[o] = tb[z]; o = o + 1; z = z - 1 } 1716 let k2b: *u8 = " invalid=" 1717 q = 0 1718 while k2b[q] != (0 as u8) { vb[o] = k2b[q]; o = o + 1; q = q + 1 } 1719 m = gb_invalid 1720 kk = 0 1721 if m == 0 { tb[0] = 48 as u8; kk = 1 } 1722 while m > 0 { tb[kk] = (48 + (m % 10)) as u8; m = m / 10; kk = kk + 1 } 1723 z = kk - 1 1724 while z >= 0 { vb[o] = tb[z]; o = o + 1; z = z - 1 } 1725 let k3: *u8 = " epoch=" 1726 q = 0 1727 while k3[q] != (0 as u8) { vb[o] = k3[q]; o = o + 1; q = q + 1 } 1728 m = sys_now_realtime_sec() 1729 kk = 0 1730 if m == 0 { tb[0] = 48 as u8; kk = 1 } 1731 while m > 0 { tb[kk] = (48 + (m % 10)) as u8; m = m / 10; kk = kk + 1 } 1732 z = kk - 1 1733 while z >= 0 { vb[o] = tb[z]; o = o + 1; z = z - 1 } 1734 let k4: *u8 = " subjectdig=" 1735 q = 0 1736 while k4[q] != (0 as u8) { vb[o] = k4[q]; o = o + 1; q = q + 1 } 1737 let hexd: *u8 = "0123456789abcdef" 1738 var hj: i64 = 0 1739 while hj < 32 { 1740 let hb: i64 = sd[hj] as i64 1741 vb[o] = hexd[(hb >> 4) & 15]; o = o + 1 1742 vb[o] = hexd[hb & 15]; o = o + 1 1743 hj = hj + 1 1744 } 1745 let k5: *u8 = " host=" 1746 q = 0 1747 while k5[q] != (0 as u8) { vb[o] = k5[q]; o = o + 1; q = q + 1 } 1748 let hb2: *u8 = sys_mmap(256) 1749 let hn: i64 = gb_read("/etc/hostname\x00" as *u8, hb2, 255) 1750 if hn <= 0 { vb[o] = 63 as u8; o = o + 1 } else { 1751 var hk: i64 = 0 1752 while hk < hn { if hb2[hk] == (10 as u8) { break } vb[o] = hb2[hk]; o = o + 1; hk = hk + 1 } 1753 } 1754 vb[o] = 10 as u8; o = o + 1 1755 let vp: *u8 = sys_mmap(256) 1756 var vo: i64 = 0 1757 let vpre: *u8 = "knowledge/status/bite_" 1758 q = 0 1759 while vpre[q] != (0 as u8) { vp[vo] = vpre[q]; vo = vo + 1; q = q + 1 } 1760 q = 0 1761 while gb_target[q] != (0 as u8) { vp[vo] = gb_target[q]; vo = vo + 1; q = q + 1 } 1762 let vsfx: *u8 = ".verdict" 1763 q = 0 1764 while vsfx[q] != (0 as u8) { vp[vo] = vsfx[q]; vo = vo + 1; q = q + 1 } 1765 vp[vo] = 0 as u8 1766 gb_write(vp, vb, o) 1767 1768 w(" valid_mutants="); wn(gb_tried); w(" invalid_uncompilable="); wn(gb_invalid); w(" void_build_lane="); wn(gb_void); w(" not_reached="); wn(gb_noreach); w(" killed="); wn(killed); w("\n") 1769 // ★NAME THE REMEDY, NOT JUST THE COUNT. A run whose mutants ALL failed to enter the binary is not a 1770 // weak gate and must not be read as one -- it is a gate whose subject this harness cannot substitute, 1771 // and the fix is in the gate's addressing, not its teeth. A count without a remedy is not actionable. 1772 if gb_noreach > 0 { if gb_tried == 0 { 1773 w(" NOT-SUBSTITUTABLE: every mutant produced a byte-identical artifact, so NONE of them reached the\n") 1774 w(" code under test. This gate does not import the mutated source -- it almost certainly FORKS its\n") 1775 w(" subject as a separate binary, which rebuilding the GATE cannot affect. This is NOT evidence about\n") 1776 w(" its teeth. Remedy: make the gate take its subject path as an argument so a harness can aim it at\n") 1777 w(" the artifact it just built (see nx_gateaddr for the estate-wide census of this class).\n") 1778 w(" THEN RE-RUN WITH `subject <subject_target>`: the harness rebuilds the SUBJECT per mutant and hands\n") 1779 w(" the gate the artifact it just built, which is the only thing that carries a mutation into an\n") 1780 w(" end-to-end gate. Without that argument this run measured the GATE's own build closure, not yours.\n") 1781 } } 1782 if killed == 1 { w("VERDICT: verdict=GREEN (gate BITES -- a compiling mutant was killed, non-vacuity proven)\n"); sys_exit(0); return 0 } 1783 // ★THE ONE-LINE SUMMARY MUST NAME THE ACTUAL CONDITION. A sweep that buckets on this line would file 1784 // a NOT-SUBSTITUTABLE gate under INCONCLUSIVE -- the reader inheriting the emitter's ambiguity, which 1785 // is the exact merge this organ already fixed once for UNCONTROLLED-vs-SUBJECT-UNREADABLE. 1786 // The `verdict=RED` token is UNCHANGED, so gv_last_line and every existing consumer keep working: 1787 // this widens the DIAGNOSIS, never the contract. 1788 if gb_noreach > 0 { if gb_tried == 0 { 1789 w("VERDICT: verdict=RED (NOT-SUBSTITUTABLE -- all "); wn(gb_noreach) 1790 w(" mutant(s) produced a byte-identical artifact, so NONE reached the code under test; this says NOTHING about the gate's teeth. Fix the gate's subject ADDRESSING, not its assertions)\n") 1791 sys_exit(1) 1792 return 1 1793 } } 1794 w("VERDICT: verdict=RED (INCONCLUSIVE -- no kill across BOTH operators in "); wn(gb_tried) 1795 w(" valid mutant(s); NOT proof of vacuity, only that these perturbations did not reach its assertions)\n") 1796 sys_exit(1) 1797 return 1 1798}