code wiki / _hdl_build / nx_gate_dry_apply.nx
`nx_gate_dry_apply.nx` source

↩ module page · 707 lines · 32284 B
1// nx_gate_dry_apply.nx -- THE D001 CANDIDATE GENERATOR (2026-07-31, ws=gate-dry-d001).
2//
3// WHAT IT IS: a MECHANICAL REWRITER that emits a MINIMAL-FORM migration candidate for one gate. It is
4// explicitly NOT a correct rewriter and does not need to be -- nx_gate_migrate verify is the safety net,
5// and that net is independently gate-proven to BITE on real files (a check-dropping edit was refused on
6// clause (c) while clauses (a) and (b) both waved it through, and the original was restored byte-intact).
7// So the division of labour is: this organ GUESSES, the verifier DECIDES, and a wrong guess costs nothing
8// because the verifier restores the original itself.
9//
10// THE MINIMAL FORM, and why it is the mechanizable one: leave EVERY check row byte-untouched and replace
11// ONLY the hand-rolled verdict tail. Clause (c) -- the PASS/FAIL vector, which is the hardest clause to
12// satisfy -- then cannot diverge BY CONSTRUCTION rather than by the author having hand-checked it. And the
13// verdict tail is precisely the debt D001 names ("2601 gates roll their own verdict emission"), so the
14// minimal form eats the debt in full. Full gv_check adoption is a separate, optional, later rung.
15//
16// SAFE BY REFUSAL (the nx_map_delegate discipline): every structural landmark must be found EXACTLY, and
17// the counter idiom must match one of the three known shapes. Anything else -> SKIP, emit nothing, exit 1.
18// A SKIP is a fine outcome and must never be dressed up as a migration.
19//
20// SHAPES RECOGNISED (measured over the local buildroot: 950 of 1390 candidates carry a counter idiom):
21//   A  tot[0] / tot[1]         -- an mmap'd pair, pass in [0] and fail in [1]   (nx_brand_snap_gate)
22//   B  var pass / var fail     -- two scalars, pass and fail counted separately
23//   C  var pass / var tot      -- pass counted, total counted
24//
25// usage: nx_gate_dry_apply <gate> <out-candidate-path>
26//   then: nx_gate_migrate verify <gate> <out-candidate-path>
27// exit 0 = candidate written · 1 = SKIP (shape not recognised) · 2 = usage · 4 = harness/root failure
28// license_tier: ORIGINAL   No hw writes (Rule 26).
29import "nx_syscalls.nx"
30import "nx_gate_verdict.nx"
31
32const DA_CAP: i64 = 262144
33const DA_PATH: i64 = 512
34const DA_OUT: i64 = 393216
35const DA_MODE: i64 = 420
36const DA_SKIP: i64 = 1
37const DA_USAGE: i64 = 2
38const DA_HARNESS: i64 = 4
39const DA_NOTE_MAX: i64 = 240
40
41func da_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  sys_close(fd)
  return 1
46}
47
48func da_root_ensure() -> i64 {
  if da_exists("runtime/nx_gate_verdict.nx" as *u8) == 1 { gv_puts("DRY-APPLY root=cwd\n" as *u8); return 1 }
  if sys_chdir("buildroot" as *u8) == 0 {
      if da_exists("runtime/nx_gate_verdict.nx" as *u8) == 1 { gv_puts("DRY-APPLY root=buildroot\n" as *u8); return 1 }
  }
  gv_puts("DRY-APPLY-FAIL no-corpus-root -- refusing to rewrite whatever the cwd happens to be.\n" as *u8)
  return 0
55}
56
57func da_cat(dst: *u8, o: i64, s: *u8) -> i64 {
  var i: i64 = 0
  var p: i64 = o
  while s[i] != (0 as u8) { dst[p] = s[i]; p = p + 1; i = i + 1 }
  dst[p] = 0 as u8
  return p
63}
64
65func da_slurp(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var run: i64 = 1
  while run == 1 {
      if total >= cap { run = 0 } else {
          let r: i64 = sys_read(fd, ((buf as i64) + total) as *u8, cap - total)
          if r <= 0 { run = 0 } else { total = total + r }
      }
  }
  sys_close(fd)
  return total
78}
79
80func da_write(path: *u8, buf: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, DA_MODE)
  if fd < 0 { return 0 - 1 }
  var w: i64 = 0
  var run: i64 = 1
  while run == 1 {
      if w >= n { run = 0 } else {
          let r: i64 = sys_write(fd, ((buf as i64) + w) as *u8, n - w)
          if r <= 0 { run = 0 } else { w = w + r }
      }
  }
  sys_close(fd)
  if w == n { return 0 }
  return 0 - 1
94}
95
96func da_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
97
98// offset of the FIRST occurrence of needle at or after `from`, else -1
99func da_find(buf: *u8, n: i64, needle: *u8, from: i64) -> i64 {
  let nl: i64 = da_slen(needle)
  if nl == 0 { return 0 - 1 }
  var i: i64 = from
  while i + nl <= n {
      var m: i64 = 1
      var k: i64 = 0
      while k < nl { if buf[i + k] != needle[k] { m = 0; k = nl } else { k = k + 1 } }
      if m == 1 { return i }
      i = i + 1
  }
  return 0 - 1
111}
112
113// offset of the LAST occurrence, else -1
114func da_find_last(buf: *u8, n: i64, needle: *u8) -> i64 {
  var best: i64 = 0 - 1
  var at: i64 = da_find(buf, n, needle, 0)
  while at >= 0 {
      best = at
      at = da_find(buf, n, needle, at + 1)
  }
  return best
122}
123
124// start-of-line offset containing `off`
125func da_line_start(buf: *u8, off: i64) -> i64 {
  var i: i64 = off
  while i > 0 {
      if buf[i - 1] == (10 as u8) { return i }
      i = i - 1
  }
  return 0
132}
133
134// end-of-line offset (index of the '\n') for the line containing `off`; n if none
135func da_line_end(buf: *u8, n: i64, off: i64) -> i64 {
  var i: i64 = off
  while i < n {
      if buf[i] == (10 as u8) { return i }
      i = i + 1
  }
  return n
142}
143
144// insertion point for the new import = just past the newline of the LAST `import "` line
145func da_import_point(buf: *u8, n: i64) -> i64 {
  let at: i64 = da_find_last(buf, n, "import \"" as *u8)
  if at < 0 { return 0 - 1 }
  let e: i64 = da_line_end(buf, n, at)
  if e >= n { return 0 - 1 }
  return e + 1
151}
152
153// derive the gv_verdict display name: strip a leading "nx_", uppercase, '_' -> '-'
154func da_name(gate: *u8, out: *u8) -> i64 {
  var i: i64 = 0
  if gate[0] == (110 as u8) { if gate[1] == (120 as u8) { if gate[2] == (95 as u8) { i = 3 } } }
  // A large slice of the corpus is named with a leading underscore (_atomic_rewrite_gate, _mmu_gate).
  // Mapping '_' -> '-' unconditionally would emit "NX--ATOMIC-REWRITE-GATE", a double dash that looks
  // like a typo in every report the judge aggregates. Drop leading underscores before converting.
  while gate[i] == (95 as u8) { i = i + 1 }
  var p: i64 = 0
  while gate[i] != (0 as u8) {
      var c: i64 = gate[i] as i64
      if c == 95 { c = 45 }
      if c >= 97 { if c <= 122 { c = c - 32 } }
      out[p] = c as u8
      p = p + 1
      i = i + 1
  }
  out[p] = 0 as u8
  return p
172}
173
174// Recover the ORIGINAL domain note so rule 25 is honoured (rewrite better, never strip): take the text
175// that followed "verdict=GREEN" inside the same string literal, up to the closing quote. Escapes and
176// quotes are dropped rather than re-encoded -- a note is prose, and a mangled note must never be able to
177// break the emitted source. Empty result -> the caller falls back to a fixed honest note.
178func da_note(buf: *u8, n: i64, gat: i64, out: *u8) -> i64 {
  var i: i64 = gat + 13
  let e: i64 = da_line_end(buf, n, gat)
  var p: i64 = 0
  while i < e {
      let c: i64 = buf[i] as i64
      if c == 34 { i = e }
      else {
          // An escape is TWO characters. Skipping only the backslash leaks the escaped letter into
          // the note -- caught in the wild, where ` verdict=GREEN\n` yielded the note "n". Skip both,
          // so a gate whose verdict line carries no prose falls through to the honest default note
          // instead of a one-character fragment that LOOKS like recovered domain detail.
          if c == 92 { i = i + 2 }
          else {
              if p < DA_NOTE_MAX {
                  if c >= 32 { out[p] = c as u8; p = p + 1 }
              }
              i = i + 1
          }
      }
  }
  // trim leading separators/space so the note reads cleanly inside gv_verdict's parentheses
  var s: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if s >= p { go = 0 }
      else {
          let c2: i64 = out[s] as i64
          if c2 == 32 { s = s + 1 } else { if c2 == 45 { s = s + 1 } else { if c2 == 40 { s = s + 1 } else { go = 0 } } }
      }
  }
  var q: i64 = 0
  while s + q < p { out[q] = out[s + q]; q = q + 1 }
  out[q] = 0 as u8
  // A note made only of punctuation carries NO domain information -- observed in the wild as "===",
  // the leftover of a banner line. Emitting it would dress a FAILED extraction up as recovered detail,
  // which is worse than admitting the default: it looks like rule-25 compliance while delivering none.
  // Require at least one letter; otherwise report empty and let the caller use the honest default.
  var hasalpha: i64 = 0
  var z: i64 = 0
  while z < q {
      let cc: i64 = out[z] as i64
      if cc >= 65 { if cc <= 90 { hasalpha = 1 } }
      if cc >= 97 { if cc <= 122 { hasalpha = 1 } }
      z = z + 1
  }
  if hasalpha == 0 { out[0] = 0 as u8; return 0 }
  return q
226}
227
228func main(argc: i64, argv: *i64) -> i64 {
  if argc < 3 {
      gv_puts("usage: nx_gate_dry_apply <gate> <out-candidate-path>\n" as *u8)
      gv_puts("  emits a MINIMAL-FORM migration candidate; prove it with nx_gate_migrate verify.\n" as *u8)
      return DA_USAGE
  }
  if da_root_ensure() == 0 { return DA_HARNESS }
  let gate: *u8 = argv[1] as *u8
  let outp: *u8 = argv[2] as *u8
237
  let src: *u8 = sys_mmap(DA_PATH)
  var o: i64 = da_cat(src, 0, "runtime/_hdl_build/" as *u8)
  o = da_cat(src, o, gate)
  o = da_cat(src, o, ".nx" as *u8)
  let buf: *u8 = sys_mmap(DA_CAP)
  var n: i64 = da_slurp(src, buf, DA_CAP)
  if n <= 0 {
      o = da_cat(src, 0, "runtime/" as *u8)
      o = da_cat(src, o, gate)
      o = da_cat(src, o, ".nx" as *u8)
      n = da_slurp(src, buf, DA_CAP)
  }
  if n <= 0 { gv_puts("DRY-APPLY NO-SOURCE " as *u8); gv_puts(gate); gv_puts("\n" as *u8); return DA_HARNESS }
251
  if da_find(buf, n, "nx_gate_verdict" as *u8, 0) >= 0 {
      gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate); gv_puts(" -- already inherits the base class\n" as *u8)
      return DA_SKIP
  }
256
  let gat: i64 = da_find_last(buf, n, "verdict=GREEN" as *u8)
  if gat < 0 {
      gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate); gv_puts(" -- no verdict=GREEN tail (anchor rung, not this one)\n" as *u8)
      return DA_SKIP
  }
  let imp: i64 = da_import_point(buf, n)
  if imp < 0 {
      gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate); gv_puts(" -- no import block to extend\n" as *u8)
      return DA_SKIP
  }
  var tail: i64 = da_line_start(buf, gat)
  if tail <= imp {
      gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate); gv_puts(" -- verdict tail precedes the imports (unexpected layout)\n" as *u8)
      return DA_SKIP
  }
272
  // ---- MULTI-LINE GUARD: move the cut UP to the `if` that OPENS the verdict block ----
  // MEASURED, not assumed: of the gates still unmigrated, only 6 carry an `if <a> <op> <b>` ON the
  // verdict=GREEN line, while 196 carry NO `if` there at all. Those are the multi-line shape
  //     if pass == N {
  //         ...verdict=GREEN...; sys_exit(0); return 0
  //     }
  //     ...verdict=RED...; sys_exit(1); return 1
  // Cutting at the GREEN line copies the STILL-OPEN `if` and deletes the RED arm and main's closing
  // brace -- precisely the damage this applier did to nx_swarm_admit_gate before the brace guard
  // existed. Cutting at the `if` LINE instead removes the ENTIRE construct, both arms together,
  // which is correct because gv_verdict emits GREEN and RED itself.
  //
  // The heuristic is deliberately loose (a line containing both `if ` and `{`) because it does not
  // have to be sound on its own: the brace-DELTA guard re-checks the finished candidate and REFUSES
  // anything unbalanced, and nx_gate_migrate verify then re-checks behaviour. A loose proposal behind
  // two fail-closed checks is safe; a clever proposal with no check is not.
  var vle: i64 = tail
  var vg: i64 = 1
  while vg == 1 {
      if vle >= n { vg = 0 }
      else {
          if buf[vle] as i64 == 10 { vg = 0 }
          else { vle = vle + 1 }
      }
  }
  if da_find(buf, vle, "if " as *u8, tail) < 0 {
      var up: i64 = tail
      var steps: i64 = 0
      var hunting: i64 = 1
      while hunting == 1 {
          if steps >= 6 { hunting = 0 }
          else {
              if up <= (imp + 2) { hunting = 0 }
              else {
                  let ps0: i64 = da_line_start(buf, up - 2)
                  var pe0: i64 = ps0
                  var g2: i64 = 1
                  while g2 == 1 {
                      if pe0 >= n { g2 = 0 }
                      else {
                          if buf[pe0] as i64 == 10 { g2 = 0 }
                          else { pe0 = pe0 + 1 }
                      }
                  }
                  let hasif0: i64 = da_find(buf, pe0, "if " as *u8, ps0)
                  if hasif0 >= 0 {
                      let hasbr0: i64 = da_find(buf, pe0, "{" as *u8, ps0)
                      if hasbr0 >= 0 {
                          if ps0 > imp { tail = ps0 }
                          hunting = 0
                      }
                  }
                  up = ps0
                  steps = steps + 1
              }
          }
      }
  }
331
  // ---- EVIDENCE-SIDE-EFFECT GUARD --------------------------------------------------------------
  // This applier works by DELETING everything from the verdict line to end-of-main and re-emitting a
  // gv_verdict tail. That is safe for pure printing, but some gates also write an append-only evidence
  // log in exactly that region (observed on _eoe_gate: g_fp(lfd,...) followed by sys_close(lfd)).
  // Deleting those writes destroys the gate's evidence trail.
  // WHY THE ORACLE CANNOT BE RELIED ON TO CATCH IT: clause (d) is the evidence clause, and it reports
  // UNCHECKED unless the CALLER names an evidence file -- which the batch driver does not. So an
  // evidence-destroying rewrite can pass (a), (b) and (c) and be ACCEPTED. The safety net has a hole
  // exactly here, so the generator must not walk into it. REFUSE rather than rely on a clause that is
  // switched off by default.
  var apmode: i64 = 0
  if da_find(buf, n, "sys_close(" as *u8, tail) >= 0 {
      apmode = 1
      // ---- APPEND MODE (2026-08-01): DO NOT DELETE THE EVIDENCE, CUT ONLY THE FINAL RETURN ----
      // The refusal above was RIGHT about the danger and WRONG to stop. 129 gates -- the largest
      // actionable family in the R4 backlog -- were unmigratable purely because their verdict tail
      // also writes a durable log, and this applier's only mode was DELETE-FROM-HERE.
      //
      // The safe move is not to classify which statements are evidence and which are verdict; that
      // needs a heuristic ("gw(1,..) is console, gw(lf,..) is log") that WILL be wrong somewhere, and
      // a wrong transform here silently destroys an audit trail. Instead: KEEP EVERY BYTE of the tail
      // and move the cut to the FINAL return statement. The gate's own console line and its log write
      // both survive untouched; only the bare return is replaced by the gv_verdict emission.
      //
      // Cost: the gate prints its verdict twice -- its own wording, then the contract line. That is
      // redundant, not wrong, and it is INFORMATION-PRESERVING. A duplicated line is a far cheaper
      // defect than a deleted evidence trail.
      // Gain: it now inherits the base class, so nx_gate_green can read it and a harness.jrnl frame
      // exists -- which is the whole point of D001.
      //
      // Exit code: gv_verdict derives rc from ctr[0] vs ctr[1], so a gate that used to `return 0`
      // unconditionally now returns the TRUTH. On a passing gate the two agree, which is what
      // nx_gate_migrate verify compares; on a failing one the new code is strictly more honest.
      // The brace-delta guard below still protects this path: if the final return sits inside a
      // guard block, the cut unbalances the braces and the whole candidate is REFUSED.
      let rp: i64 = da_find_last(buf, n, "\n    return " as *u8)
      if rp < 0 {
          gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate)
          gv_puts(" -- verdict tail writes a durable log AND has no top-level final return to cut,\n" as *u8)
          gv_puts("     so there is no way to append the contract without deleting evidence. REFUSED.\n" as *u8)
          return DA_SKIP
      }
      if (rp + 1) <= imp {
          gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate)
          gv_puts(" -- final return precedes the import block (unexpected layout)\n" as *u8)
          return DA_SKIP
      }
      tail = rp + 1
380
      // ---- walk the cut UP over one-line early-return guards ----
      // CAUGHT BY READING THE FIRST CANDIDATE, not by review: cutting at the FINAL return leaves a
      // preceding one-liner like
      //     if passed == BG_ROWS { return 0 }
      // in place, so a PASSING gate returns BEFORE reaching gv_verdict and the contract is emitted
      // only on FAILURE -- exactly backwards, and BRACE-BALANCED, so the delta guard cannot see it.
      // That guard line IS part of the hand-rolled verdict emission, so it must be cut with it; the
      // evidence-log statements sit ABOVE it and are still preserved untouched.
      var moved: i64 = 1
      while moved == 1 {
          moved = 0
          if tail > (imp + 2) {
              let ps: i64 = da_line_start(buf, tail - 2)
              if ps > imp {
                  let hasif: i64 = da_find(buf, tail, "if " as *u8, ps)
                  if hasif >= 0 {
                      let hasret: i64 = da_find(buf, tail, "return" as *u8, ps)
                      if hasret >= 0 { tail = ps; moved = 1 }
                  }
              }
          }
      }
  }
404
  // ---- counter idiom detection. Ordered most-specific first; unknown shape = SKIP, never a guess. ----
  var pexpr: *u8 = 0 as *u8
  var texpr: *u8 = 0 as *u8
  if da_find(buf, n, "tot[0]" as *u8, 0) >= 0 {
      if da_find(buf, n, "tot[1]" as *u8, 0) >= 0 {
          pexpr = "tot[0]" as *u8
          texpr = "tot[0] + tot[1]" as *u8
      }
  }
  if (pexpr as i64) == 0 {
      if da_find(buf, n, "var pass: i64" as *u8, 0) >= 0 {
          if da_find(buf, n, "var fail: i64" as *u8, 0) >= 0 {
              pexpr = "pass" as *u8
              texpr = "pass + fail" as *u8
          }
      }
  }
  // Shape D was found by MEASURING the skips rather than guessing at them: of the gates that carry
  // "var pass: i64" but were declined, the dominant partner is "var total: i64", and it is the LARGEST
  // family in the whole corpus -- 499 gates, against 137 for pass/fail, 109 for pass/tot and 30 for
  // tot[0]/tot[1]. Omitting it was most of the applier's missing recall.
  // NOTE on ordering: "var total: i64" cannot be confused with "var tot: i64" by substring search
  // (the literal includes the colon), so these three branches are mutually exclusive by construction.
  if (pexpr as i64) == 0 {
      if da_find(buf, n, "var pass: i64" as *u8, 0) >= 0 {
          if da_find(buf, n, "var total: i64" as *u8, 0) >= 0 {
              pexpr = "pass" as *u8
              texpr = "total" as *u8
          }
      }
  }
  if (pexpr as i64) == 0 {
      if da_find(buf, n, "var pass: i64" as *u8, 0) >= 0 {
          if da_find(buf, n, "var tot: i64" as *u8, 0) >= 0 {
              pexpr = "pass" as *u8
              texpr = "tot" as *u8
          }
      }
  }
  // Shape E: the total is a LITERAL, not a variable -- "var pass: i64" counted up and then compared
  // against a hard number, e.g. `if pass == 4 { ... }`. Measured at 296 gates with no total/fail/tot
  // variable at all, 222 of them carrying a verdict tail, so it is the second-largest family and it
  // looks like "no counter idiom" to any check that only hunts for a second variable.
  // The literal is read from the gate's OWN comparison, so the total can never disagree with the
  // gate's own definition of complete -- and if it somehow did, clause (a) would refuse the migration.
  let litbuf: *u8 = sys_mmap(64)
  if (pexpr as i64) == 0 {
      if da_find(buf, n, "var pass: i64" as *u8, 0) >= 0 {
          var lat: i64 = da_find(buf, n, "if pass == " as *u8, 0)
          var adv: i64 = 11
          if lat < 0 {
              lat = da_find(buf, n, "if pass==" as *u8, 0)
              adv = 9
          }
          if lat >= 0 {
              var d: i64 = lat + adv
              var q2: i64 = 0
              var go2: i64 = 1
              while go2 == 1 {
                  if d >= n { go2 = 0 }
                  else {
                      if q2 >= 32 { go2 = 0 }
                      else {
                          let ch: i64 = buf[d] as i64
                          if ch >= 48 {
                              if ch <= 57 { litbuf[q2] = buf[d]; q2 = q2 + 1; d = d + 1 }
                              else { go2 = 0 }
                          } else { go2 = 0 }
                      }
                  }
              }
              litbuf[q2] = 0 as u8
              if q2 > 0 {
                  pexpr = "pass" as *u8
                  texpr = litbuf
              }
          }
      }
  }
484
  // In APPEND MODE the cut point IS the verdict guard, so that guard's operands are AUTHORITATIVE and
  // shapes A-E must not win. PROVEN NECESSARY, not defensive: on nx_browser_gate shape D matched the
  // names pass/total from somewhere else in the file while the real guard was `if passed == BG_ROWS`,
  // so the candidate referenced two variables that do not exist at that point and DID NOT BUILD.
  // nx_gate_migrate verify caught it and restored the original -- the safety net held -- but the
  // generator should not have emitted it. Discard the earlier guess and let shape F read the truth.
  if apmode == 1 { pexpr = 0 as *u8 }
  if (pexpr as i64) == 0 {
      // ---- Shape F (2026-08-01): READ THE OPERANDS FROM THE GATE'S OWN GUARD ----
      // MEASURED over the 322 unmigrated gates that carry a verdict=GREEN tail, not guessed:
      //   ok == 1 -> 87 · fails == 0 -> 36 · pass == ttl -> 20 · green == 1 -> 3 · long tail after.
      // Shapes A-E hardcode the NAMES (pass/tot/total/fail), so a gate that merely SPELLS its
      // counter differently reads as "no counter idiom" while its comparison sits right there on
      // the line. Rather than bolt on five more names, take both operands from the gate's OWN
      // comparison -- the same principle shape E already uses for its literal, so the total can
      // never disagree with the gate's own definition of complete.
      //
      // REFUSED BY CONSTRUCTION: a right-hand side of literal 0 (the `fails == 0` family, 36
      // gates). gv_verdict scores ctr[1]==0 as RED by design -- zero teeth is never GREEN -- so
      // mapping fails/0 straight onto it would INVERT every one of those gates from GREEN to RED.
      // They need a DERIVED boolean, which is a separate rung, not a wider regex here.
      //
      // Only the ONE-LINER guard is reachable: for a multi-line guard the `if` is not on this
      // line, so no match is found -- and those are refused by the brace-delta guard anyway.
      var le: i64 = tail
      var g3: i64 = 1
      while g3 == 1 {
          if le >= n { g3 = 0 }
          else {
              if buf[le] as i64 == 10 { g3 = 0 }
              else { le = le + 1 }
          }
      }
      let ifp: i64 = da_find(buf, le, "if " as *u8, tail)
      if ifp >= 0 {
          let abuf: *u8 = sys_mmap(64)
          let bbuf: *u8 = sys_mmap(64)
          var d3: i64 = ifp + 3
          var s1: i64 = 1
          while s1 == 1 {
              if d3 >= le { s1 = 0 }
              else {
                  if buf[d3] as i64 == 32 { d3 = d3 + 1 }
                  else { s1 = 0 }
              }
          }
          var qa: i64 = 0
          var s2: i64 = 1
          while s2 == 1 {
              if d3 >= le { s2 = 0 }
              else {
                  if qa >= 60 { s2 = 0 }
                  else {
                      let ca: i64 = buf[d3] as i64
                      var isa: i64 = 0
                      if ca >= 97 { if ca <= 122 { isa = 1 } }
                      if ca >= 65 { if ca <= 90 { isa = 1 } }   // UPPERCASE: totals are often CONSTANTS (BG_ROWS)
                      if ca == 95 { isa = 1 }
                      if ca >= 48 { if ca <= 57 { isa = 1 } }
                      if isa == 1 { abuf[qa] = buf[d3]; qa = qa + 1; d3 = d3 + 1 }
                      else { s2 = 0 }
                  }
              }
          }
          abuf[qa] = 0 as u8
          var s3: i64 = 1
          while s3 == 1 {
              if d3 >= le { s3 = 0 }
              else {
                  if buf[d3] as i64 == 32 { d3 = d3 + 1 }
                  else { s3 = 0 }
              }
          }
          var okeq: i64 = 0
          if d3 + 1 < le {
              if buf[d3] as i64 == 61 {
                  if buf[d3 + 1] as i64 == 61 { okeq = 1; d3 = d3 + 2 }
              }
          }
          if okeq == 1 {
              var s4: i64 = 1
              while s4 == 1 {
                  if d3 >= le { s4 = 0 }
                  else {
                      if buf[d3] as i64 == 32 { d3 = d3 + 1 }
                      else { s4 = 0 }
                  }
              }
              var qb: i64 = 0
              var s5: i64 = 1
              while s5 == 1 {
                  if d3 >= le { s5 = 0 }
                  else {
                      if qb >= 60 { s5 = 0 }
                      else {
                          let cb: i64 = buf[d3] as i64
                          var isb: i64 = 0
                          if cb >= 97 { if cb <= 122 { isb = 1 } }
                          if cb >= 65 { if cb <= 90 { isb = 1 } }   // UPPERCASE: `if passed == BG_ROWS`
                          if cb == 95 { isb = 1 }
                          if cb >= 48 { if cb <= 57 { isb = 1 } }
                          if isb == 1 { bbuf[qb] = buf[d3]; qb = qb + 1; d3 = d3 + 1 }
                          else { s5 = 0 }
                      }
                  }
              }
              bbuf[qb] = 0 as u8
              var zrhs: i64 = 0
              if qb == 1 {
                  if bbuf[0] as i64 == 48 { zrhs = 1 }
              }
              if zrhs == 1 {
                  gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate)
                  gv_puts(" -- guard is <x> == 0 (the fails==0 family, 36 gates). gv_verdict scores\n" as *u8)
                  gv_puts("  ctr[1]==0 as RED by design, so a direct operand map would INVERT this gate\n" as *u8)
                  gv_puts("  from GREEN to RED. Needs a derived boolean -- a separate rung.\n" as *u8)
                  return DA_SKIP
              }
              if qa > 0 {
                  if qb > 0 {
                      pexpr = abuf
                      texpr = bbuf
                  }
              }
          }
      }
  }
  if (pexpr as i64) == 0 {
      gv_puts("DRY-APPLY SKIP " as *u8); gv_puts(gate); gv_puts(" -- counter idiom not recognised (A tot[0]/tot[1], B pass/fail, C pass/tot, D pass/total, E pass/literal, F own-guard operands)\n" as *u8)
      return DA_SKIP
  }
616
  let nm: *u8 = sys_mmap(DA_PATH)
  da_name(gate, nm)
  let note: *u8 = sys_mmap(DA_PATH)
  let nl: i64 = da_note(buf, n, gat, note)
621
  let out: *u8 = sys_mmap(DA_OUT)
  var p: i64 = 0
  var i: i64 = 0
  while i < imp { out[p] = buf[i]; p = p + 1; i = i + 1 }
  p = da_cat(out, p, "import \"nx_gate_verdict.nx\"\n" as *u8)
  i = imp
  while i < tail { out[p] = buf[i]; p = p + 1; i = i + 1 }
  p = da_cat(out, p, "    // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check\n" as *u8)
  p = da_cat(out, p, "    // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled\n" as *u8)
  p = da_cat(out, p, "    // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.\n" as *u8)
  p = da_cat(out, p, "    let ctr__dry: *i64 = gv_ctr()\n" as *u8)
  p = da_cat(out, p, "    ctr__dry[0] = " as *u8)
  p = da_cat(out, p, pexpr)
  p = da_cat(out, p, "\n    ctr__dry[1] = " as *u8)
  p = da_cat(out, p, texpr)
  p = da_cat(out, p, "\n    let rc__dry: i64 = gv_verdict(\"" as *u8)
  p = da_cat(out, p, nm)
  p = da_cat(out, p, "\" as *u8, ctr__dry, \"" as *u8)
  if nl > 0 { p = da_cat(out, p, note) }
  else { p = da_cat(out, p, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) }
  p = da_cat(out, p, "\" as *u8)\n" as *u8)
  p = da_cat(out, p, "    sys_exit(rc__dry)\n" as *u8)
  p = da_cat(out, p, "    return rc__dry\n}\n" as *u8)
645
  // ---- FAIL-CLOSED STRUCTURAL GUARD (added 2026-08-01 after this applier DAMAGED a real gate) ----
  // The cut point is the line holding "verdict=GREEN". When that emission is NESTED inside a guard --
  //     if pass == 3 { GREEN; exit 0 }   RED; exit 1
  // -- cutting at the GREEN line copies the still-OPEN `if`, then deletes BOTH the RED path and main's
  // closing brace. The result compiled anyway (nx_cc fails open on an unclosed body at EOF) and
  // nx_gate_migrate verify called it GREEN, because a gate that PASSES today never exercises its RED
  // path -- so the deleted branch was never compared. That is a gate which goes SILENT exactly when it
  // should fail: the worst possible direction for an instrument to break.
  //
  // Comparing DELTAS, not absolute balance: the original is a file that compiles, so it is the
  // reference. Only a tail is replaced, so the brace delta MUST be preserved exactly. A naive count is
  // sound here precisely because it is applied identically to both sides -- any skew from braces inside
  // strings or comments cancels. REFUSE, never emit-and-hope: an unbalanced candidate is not a
  // migration, it is damage with a plausible shape.
  var ob: i64 = 0
  var cb: i64 = 0
  var k: i64 = 0
  while k < n {
      let c: i64 = buf[k] as i64
      if c == 123 { ob = ob + 1 }
      if c == 125 { cb = cb + 1 }
      k = k + 1
  }
  var ob2: i64 = 0
  var cb2: i64 = 0
  k = 0
  while k < p {
      let c2: i64 = out[k] as i64
      if c2 == 123 { ob2 = ob2 + 1 }
      if c2 == 125 { cb2 = cb2 + 1 }
      k = k + 1
  }
  if (ob - cb) != (ob2 - cb2) {
      gv_puts("DRY-APPLY REFUSE " as *u8); gv_puts(gate)
      gv_puts(" -- candidate brace delta differs from the original (orig " as *u8)
      gv_num(ob); gv_puts("/" as *u8); gv_num(cb)
      gv_puts(", candidate " as *u8); gv_num(ob2); gv_puts("/" as *u8); gv_num(cb2)
      gv_puts(").\n  The verdict tail is NESTED inside a guard, so the cut deleted a branch and/or a\n" as *u8)
      gv_puts("  closing brace. NOTHING WRITTEN -- the gate source is untouched. This layout needs the\n" as *u8)
      gv_puts("  cut point moved to the enclosing `if` line, which this applier does not yet do.\n" as *u8)
      return DA_SKIP
  }
688
  if da_write(outp, out, p) != 0 {
      gv_puts("DRY-APPLY-FAIL cannot write candidate\n" as *u8)
      return DA_HARNESS
  }
  gv_puts("DRY-APPLY CANDIDATE " as *u8)
  gv_puts(gate)
  gv_puts(" shape=" as *u8)
  gv_puts(pexpr)
  gv_puts(" bytes=" as *u8)
  gv_num(p)
  gv_puts(" -> " as *u8)
  gv_puts(outp)
  gv_puts("\n  NOT A MIGRATION YET. Prove it: nx_gate_migrate verify " as *u8)
  gv_puts(gate)
  gv_puts(" " as *u8)
  gv_puts(outp)
  gv_puts("\n" as *u8)
  return 0
707}
nx_gate_dry_apply.nx source

`nx_gate_dry_apply.nx` source
