code wiki / (root) / nx_gatelaw_gate.nx
`nx_gatelaw_gate.nx` source

↩ module page · 595 lines · 32921 B
1// nx_gatelaw_gate.nx -- THE SESSION'S LAWS, MADE EXECUTABLE AND POINTED AT EVERY GATE IN THE ESTATE.
2//
3// WHY THIS EXISTS. Every law below was paid for with a real failure, written into a record, and then
4// RE-DERIVED days later because a record is something you have to remember to read. ★★★★★★ A LAW
5// THAT LIVES ONLY IN PROSE IS ADVICE, AND ADVICE IS ADOPTED AT ADVICE RATES; THE SAME LAW PLACED IN
6// THE PATH IS ADOPTED AT 100%. The estate already proved that with nx_memnew (a pre-flight that only
7// INFORMS survives; one that refuses gets disabled).
8//
9// So this is ADVISORY BY CONSTRUCTION: it names offenders, it does not block anyone. Its verdict is
10// bound to ITS OWN subject -- can it read the corpus -- and never to the fleet's condition, because a
11// permanent RED over thousands of legacy gates is noise, not a work order (the same call
12// nx_gatebuilt_gate made about stale_built).
13//
14// THE LAWS, each traceable to a measured failure:
15//   L1 EXIT-CARRIES-VERDICT  -- a gate that prints RED and returns 0 makes /api/gate_run report GREEN.
16//                               MEASURED 2026-08-07 on nx_dwline_roundtrip_gate: "passed 5/11
17//                               verdict=RED" served as exit_code=0 verdict=GREEN.
18//   L2 HAS-NEGATIVE-CONTROL  -- a suite of only positive teeth passes on a subject that does nothing.
19//                               MEASURED: nx_dwline_e2e_gate's no-g control is the only tooth that
20//                               would catch debug info becoming unconditional.
21//   L3 INHERITS-BASE         -- hand-rolled counters drift from the teeth that execute, producing
22//                               red-by-construction (passed 22/20) or silently-skipped teeth.
23//                               gv_check increments both, so declared == executed BY CONSTRUCTION.
24//
25// ★ MEASURED ON CODE, NOT ON PROSE: comments are STRIPPED before matching. A scanner that does not
26// skip comments measures the documentation -- that defect once made the whole estate inherit
27// "writer" from a comment in nx_syscalls.nx.
28//
29// ---------------------------------------------------------------------------------------------
30// 2026-08-07 CORRECTION -- L1 WAS MEASURING AN IDIOM AND CALLING IT A PROPERTY.
31//
32// The old predicate was a substring test for "return gv_verdict(" / "return gv_". A gate ending
33//
34//     let rc: i64 = gv_verdict(name, ctr, note)
35//     sys_exit(rc)
36//
37// carries the verdict to the process exit status MORE strongly than `return` does (sys_exit sets the
38// status unconditionally, and does not depend on what the runtime does with main's return value) --
39// and the old test called it an L1-VIOLATION. Measured: it falsely accused 13 gates written that
40// same day, whose author then read the offender list and believed it.
41//   ★★★★★★ A DETECTOR NAMED FOR A SEMANTIC PROPERTY WHILE TESTING A SPELLING WILL ACCUSE THE
42//   IDIOMS ITS AUTHOR DID NOT HAPPEN TO USE -- AND THOSE ACCUSATIONS READ EXACTLY LIKE FINDINGS.
43// A false accusation is strictly worse here than a miss: this organ's whole output is a worklist,
44// and a worklist with fabricated rows costs a reader the investigation of each one.
45//
46// L1 now resolves the ASSIGNED NAME at each `= gv_verdict(` site (stepping over the `: i64` type
47// annotation) and asks whether that exact name reaches `sys_exit(<name>)`. The two spellings are
48// counted SEPARATELY (l1_via_return / l1_via_sysexit) so the size of the correction is attributable
49// rather than folded silently into an improved-looking total.
50//
51// SECOND CORRECTION -- THE UNMEASURED MAJORITY IS NOW ITS OWN BUCKET. L1/L2 key on the gv_ pattern,
52// so they say NOTHING about gates that never inherit the base class. That was declared in prose here
53// and then misread anyway (as "3,125 gates exit 0 on RED"). It is now a printed counter,
54// hand_rolled_exit_UNMEASURED, with a partition check that it plus l3_ok equals scanned.
55//   ★★★★★ UNKNOWN IS ITS OWN BUCKET -- AN UNMEASURED POPULATION FOLDED INTO A MEASURED ONE BECOMES
56//   THE NUMBER SOMEBODY PLANS AGAINST.
57//
58// license_tier: ORIGINAL  expect_exit: 0
59import "syscalls.nx"
60import "nx_gate_verdict.nx"
61
62const GL_SRC_CAP:  i64 = 1048576
63const GL_MAXFILES: i64 = 4096
64const GL_NAMEBUF:  i64 = 1048576
65const GL_MAXNAME:  i64 = 256
66const GL_TMP:      i64 = 4096
67
68func gl_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var tot: i64 = 0
  while tot < cap {
      let n: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot)
      if n <= 0 { break }
      tot = tot + n
  }
  sys_close(fd)
  return tot
79}
80
81// Copy src->dst dropping // line comments. THE LOAD-BEARING STEP: without it this organ would report
82// on what gates SAY about themselves. Kept deliberately simple (no string-literal awareness) and that
83// limit is DECLARED: a "//" inside a string literal ends the line early, which can only ever cause a
84// FALSE MISS (under-reporting), never a false accusation. Failing toward silence is the right
85// direction for an advisory.
86func gl_strip(src: *u8, n: i64, dst: *u8) -> i64 {
  var i: i64 = 0
  var o: i64 = 0
  while i < n {
      if src[i] == (47 as u8) {
          if i + 1 < n {
              if src[i+1] == (47 as u8) {
                  while i < n { if src[i] == (10 as u8) { break } i = i + 1 }
              }
          }
      }
      if i < n { dst[o] = src[i]; o = o + 1; i = i + 1 }
  }
  return o
100}
101
102func gl_slen(p: *u8) -> i64 {
  var m: i64 = 0
  while p[m] != (0 as u8) { m = m + 1 }
  return m
106}
107
108func gl_has(buf: *u8, n: i64, pat: *u8) -> i64 {
  let m: i64 = gl_slen(pat)
  if m == 0 { return 1 }
  var i: i64 = 0
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if buf[i+j] != pat[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
120}
121
122func gl_find(buf: *u8, n: i64, pat: *u8, from: i64) -> i64 {
  let m: i64 = gl_slen(pat)
  if m == 0 { return 0 - 1 }
  var i: i64 = from
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if buf[i+j] != pat[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
134}
135
136// Is `pat` present as CODE rather than as the contents of a string literal? Comment-stripping is not
137// enough: a scanner that searches source for "gv_verdict(" carries that exact text as a quoted
138// pattern, and a substring test then accuses the tool whose whole job is finding the thing.
139// MEASURED: nx_gatebuilt_gate was flagged by the first version of this very fix.
140//   ★★★★★ A DETECTOR THAT SCANS SOURCE WILL FIND ITSELF, AND THEN FIND EVERY OTHER DETECTOR.
141// The test is deliberately one character wide -- a preceding double-quote -- because that is the
142// whole difference between a call and a mention, and a wider test would need a real parser.
143func gl_has_call(buf: *u8, n: i64, pat: *u8) -> i64 {
  var from: i64 = 0
  while from < n {
      let at: i64 = gl_find(buf, n, pat, from)
      if at < 0 { return 0 }
      if at == 0 { return 1 }
      if buf[at-1] != (34 as u8) { return 1 }
      from = at + 1
  }
  return 0
153}
154
155func gl_is_ident(c: u8) -> i64 {
  if c >= (48 as u8) { if c <= (57 as u8)  { return 1 } }
  if c >= (65 as u8) { if c <= (90 as u8)  { return 1 } }
  if c >= (97 as u8) { if c <= (122 as u8) { return 1 } }
  if c == (95 as u8) { return 1 }
  return 0
161}
162
163// Walk backwards over spaces and tabs. Returns the index of the first non-blank at or before k0,
164// or -1 if the scan ran off the front.
165func gl_bskip(code: *u8, k0: i64) -> i64 {
  var k: i64 = k0
  while k >= 0 {
      if code[k] == (32 as u8) { k = k - 1 }
      else { if code[k] == (9 as u8) { k = k - 1 } else { break } }
  }
  return k
172}
173
174// Does the verdict value reach the process exit status?
175//   0 = no
176//   1 = `return gv_verdict(...)`            -- returned directly
177//   2 = `let X = gv_verdict(...)` then `return X` OR `sys_exit(X)`  -- returned via a name
178//   3 = `sys_exit(gv_verdict(...))`         -- nested, never named
179// Resolved by NAME, not by pattern: `sys_exit(0)` sitting beside a discarded gv_verdict() call must
180// NOT be credited, and the neg-control tooth below proves it is not.
181//
182// ⚠ THE FOUR SHAPES ABOVE WERE ENUMERATED FROM THE CORPUS, NOT IMAGINED. The first version of this
183// fix credited only `sys_exit(X)` because that was the idiom its author happened to write that day,
184// and it went on accusing 17 gates using `return X` and 3 using the nested form -- a SECOND round of
185// exactly the defect it was written to repair.
186//   ★★★★★★ A RULER BUILT FROM THE IDIOMS YOU CAN RECALL MEASURES YOUR MEMORY, NOT THE POPULATION.
187//   ENUMERATE WHAT IS ACTUALLY IN THE INPUT FIRST, AND THE SHAPE OF THE PREDICATE FALLS OUT OF IT.
188func gl_carries_verdict(code: *u8, cn: i64, tmp: *u8) -> i64 {
  if gl_has(code, cn, "return gv_verdict(" as *u8) == 1 { return 1 }
  if gl_has(code, cn, "return gv_" as *u8) == 1 { return 1 }
  if gl_has(code, cn, "sys_exit(gv_verdict(" as *u8) == 1 { return 3 }
192
  var pos: i64 = 0
  while pos < cn {
      let at: i64 = gl_find(code, cn, "gv_verdict(" as *u8, pos)
      if at < 0 { break }
      pos = at + 11
198
      var k: i64 = gl_bskip(code, at - 1)
      if k >= 0 {
          if code[k] == (61 as u8) {                 // '='
              k = gl_bskip(code, k - 1)
              var e: i64 = k
              while k >= 0 { if gl_is_ident(code[k]) == 1 { k = k - 1 } else { break } }
              var s: i64 = k + 1
206
              // `let rc: i64 = gv_verdict(...)` -- what we just read is the TYPE, and the name we
              // want sits before the ':'. Without this step every site resolves to "i64" and the
              // whole idiom goes uncredited, which is the original defect in a new costume.
              let b: i64 = gl_bskip(code, k)
              if b >= 0 {
                  if code[b] == (58 as u8) {         // ':'
                      var k2: i64 = gl_bskip(code, b - 1)
                      e = k2
                      while k2 >= 0 { if gl_is_ident(code[k2]) == 1 { k2 = k2 - 1 } else { break } }
                      s = k2 + 1
                  }
              }
219
              if e >= s {
                  if (e - s) < (GL_TMP - 16) {
                      // Both consuming forms, because the corpus uses both: sys_exit(<name>) and
                      // return <name>. Checking only one is what produced the first false wave.
                      var form: i64 = 0
                      while form < 2 {
                          var pre: *u8 = "sys_exit(" as *u8
                          if form == 1 { pre = "return " as *u8 }
                          var o: i64 = 0
                          while pre[o] != (0 as u8) { tmp[o] = pre[o]; o = o + 1 }
                          var c2: i64 = s
                          while c2 <= e { tmp[o] = code[c2]; o = o + 1; c2 = c2 + 1 }
                          if form == 0 { tmp[o] = 41 as u8; o = o + 1 }   // ')'
                          else { tmp[o] = 10 as u8; o = o + 1 }           // newline: `return rc` ends its line
                          tmp[o] = 0 as u8
                          if gl_has(code, cn, tmp) == 1 { return 2 }
                          form = form + 1
                      }
                  }
              }
          }
      }
  }
  return 0
244}
245
246// JOIN TWO FRAGMENTS INTO A NEEDLE THIS SOURCE NEVER SPELLS CONTIGUOUSLY.
247// The L4 axis below hunts for a call to the base class's value emitter. Spelling that needle as a plain
248// literal would make THIS FILE contain it, and the census would count itself -- measured on the day the
249// axis was written: L4 read 2 against a true population of 1. The comment stripper cannot save you, since
250// the needle would sit in code rather than in a comment. Joining two readable halves is deliberately
251// preferred over character codes: a literal spelled as numbers is the same defect in a disguise that no
252// human recognises and no grep finds.
253func gl_join2(dst: *u8, a: *u8, b: *u8) -> *u8 {
  var i: i64 = 0
  var p: i64 = 0
  while a[i] != (0 as u8) { dst[p] = a[i]; p = p + 1; i = i + 1 }
  i = 0
  while b[i] != (0 as u8) { dst[p] = b[i]; p = p + 1; i = i + 1 }
  dst[p] = 0 as u8
  return dst
261}
262
263func gl_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } return p }
264// L5 POOL-EXIT (2026-09-17). A gate that creates a thread pool and ends with the raw thread exit never ends: the leader
265// retires, the workers stay parked in futex wait, the verdict is on disk and the process is a runaway nobody can stop
266// from any surface (two gates sat twenty minutes with fifteen threads each; seven shipping gates carried the shape).
267// The predicate reads the gate's OWN stripped source: pool = any pool-creating call present (nx_pool_submit, nf_pool,
268// mm_pool_i8, nsv_init), runaway = pool AND the raw exit present as a call. A pool created through an imported
269// library is invisible here, so the count is a FLOOR and says so. Returns 0 no pool, 1 pool and clean, 2 runaway.
270func gl_l5(code: *u8, cn: i64, np1: *u8, np2: *u8, np3: *u8, np4: *u8, nsx: *u8) -> i64 {
  var pool: i64 = gl_has_call(code, cn, np1)
  if pool == 0 { pool = gl_has_call(code, cn, np2) }
  if pool == 0 { pool = gl_has_call(code, cn, np3) }
  if pool == 0 { pool = gl_has_call(code, cn, np4) }
  if pool == 0 { return 0 }
  if gl_has_call(code, cn, nsx) == 1 { return 2 }
  return 1
278}
279func gl_ends_gate_nx(nm: *u8, nl: i64) -> i64 {
  // "<something>_gate.nx"
  if nl < 12 { return 0 }
  let suf: *u8 = "_gate.nx" as *u8
  var k: i64 = 0
  while k < 8 { if nm[nl-8+k] != suf[k] { return 0 } k = k + 1 }
  return 1
286}
287
288func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("=== NX-GATELAW -- are the estate's gates built the way its own failures taught? ===" as *u8)
291
  sys_chdir("buildroot" as *u8)
293
  var verbose: i64 = 0
  if argc >= 2 { verbose = 1 }
296
  let names: *u8 = sys_mmap(GL_NAMEBUF)
  let noff:  *i64 = sys_mmap(8 * (GL_MAXFILES + 8)) as *i64
  var nfiles: i64 = 0
  var npos: i64 = 0
  var corpus_total: i64 = 0
302
  // Both trees, because the build resolver probes runtime/_hdl_build FIRST and a census of only
  // one of them would report on files the build may never read.
  var dirn: i64 = 0
  while dirn < 2 {
      var dpath: *u8 = "runtime" as *u8
      var pfx: *u8 = "runtime/" as *u8
      var pfxlen: i64 = 8
      if dirn == 1 { dpath = "runtime/_hdl_build" as *u8; pfx = "runtime/_hdl_build/" as *u8; pfxlen = 19 }
      let dfd: i64 = __syscall(257, 0-100, dpath, 0x10000, 0, 0, 0)
      if dfd >= 0 {
          let dbuf: *u8 = sys_mmap(65536)
          var go: i64 = 1
          while go == 1 {
              let nread: i64 = __syscall(217, dfd, dbuf, 65536, 0, 0, 0)
              if nread <= 0 { go = 0 } else {
                  var pos: i64 = 0
                  while pos < nread {
                      let reclen: i64 = (dbuf[pos+16] as i64) | ((dbuf[pos+17] as i64) << 8)
                      var nl: i64 = 0
                      while dbuf[pos+19+nl] != (0 as u8) { nl = nl + 1 }
                      if gl_ends_gate_nx(((dbuf as i64) + pos + 19) as *u8, nl) == 1 {
                          corpus_total = corpus_total + 1
                          if nfiles < GL_MAXFILES {
                              if npos + nl + pfxlen + 4 < GL_NAMEBUF {
                                  noff[nfiles] = npos
                                  var c: i64 = 0
                                  while c < pfxlen { names[npos] = pfx[c]; npos = npos + 1; c = c + 1 }
                                  c = 0
                                  while c < nl { names[npos] = dbuf[pos+19+c]; npos = npos + 1; c = c + 1 }
                                  names[npos] = 0 as u8; npos = npos + 1
                                  nfiles = nfiles + 1
                              }
                          }
                      }
                      if reclen <= 0 { pos = nread } else { pos = pos + reclen }
                  }
              }
          }
          sys_close(dfd)
      }
      dirn = dirn + 1
  }
345
  let raw:  *u8 = sys_mmap(GL_SRC_CAP)
  let code: *u8 = sys_mmap(GL_SRC_CAP)
  let tmp:  *u8 = sys_mmap(GL_TMP)
349
  // The L4 needles, assembled so this source never spells them contiguously (see gl_join2).
  let nkv: *u8 = gl_join2(sys_mmap(64), "gv_" as *u8, "kv(" as *u8)
  let nvh: *u8 = gl_join2(sys_mmap(64), "gv_values" as *u8, "_head(" as *u8)
  // The asserting emitters count too: a tooth written with these publishes the number it tested, which
  // is the whole point of the axis. Counting only the explicit printer would have made the cheapest and
  // most reliable migration path invisible to the very census meant to drive it.
  let nce: *u8 = gl_join2(sys_mmap(64), "gv_check" as *u8, "_eq(" as *u8)
  let ncn: *u8 = gl_join2(sys_mmap(64), "gv_check" as *u8, "_near(" as *u8)
  // The L5 needles, joined at runtime for the same reason: this file must not spell the raw exit or a pool call.
  let np1: *u8 = gl_join2(sys_mmap(64), "nx_pool_" as *u8, "submit(" as *u8)
  let np2: *u8 = gl_join2(sys_mmap(64), "nf_" as *u8, "pool(" as *u8)
  let np3: *u8 = gl_join2(sys_mmap(64), "mm_pool_" as *u8, "i8(" as *u8)
  let np4: *u8 = gl_join2(sys_mmap(64), "nsv_" as *u8, "init" as *u8)
  let nsx: *u8 = gl_join2(sys_mmap(64), "sys_" as *u8, "exit(" as *u8)
364
  var scanned: i64 = 0
  var l1_ok:       i64 = 0
  var l1_ret:      i64 = 0
  var l1_via_name: i64 = 0
  var l1_nested:   i64 = 0
  var discarded:   i64 = 0
  var l2_ok:   i64 = 0
  var l3_ok:   i64 = 0
  var all3:    i64 = 0
  var hand_rolled: i64 = 0
  // L4 IS A SEPARATE AXIS AND IS DELIBERATELY NOT FOLDED INTO all3. A gate can satisfy all three older
  // laws and still emit no number, so widening that conjunction would silently redefine a figure other
  // lanes already act on. A new bucket that overlaps an existing partition gets declared separately.
  var l4_ok: i64 = 0
  var base_no_values: i64 = 0
  // L5 IS A SEPARATE AXIS TOO: pool-creating gates, and those among them still ending with the raw thread exit.
  var l5_pool: i64 = 0
  var l5_runaway: i64 = 0
383
  var fi: i64 = 0
  while fi < nfiles {
      let path: *u8 = ((names as i64) + noff[fi]) as *u8
      let n: i64 = gl_read(path, raw, GL_SRC_CAP)
      if n > 0 {
          scanned = scanned + 1
          let cn: i64 = gl_strip(raw, n, code)
391
          // L3 first: it is the precondition for the other two being meaningful.
          let base: i64 = gl_has(code, cn, "gv_check(" as *u8)
          if base == 1 { l3_ok = l3_ok + 1 } else { hand_rolled = hand_rolled + 1 }
395
          // L1: the verdict must REACH THE EXIT STATUS -- by return, by name, or nested in sys_exit.
          let carry: i64 = gl_carries_verdict(code, cn, tmp)
          var e1: i64 = 0
          if carry > 0 { e1 = 1; l1_ok = l1_ok + 1 }
          if carry == 1 { l1_ret  = l1_ret + 1 }
          if carry == 2 { l1_via_name = l1_via_name + 1 }
          if carry == 3 { l1_nested  = l1_nested + 1 }
403
          // THE ACTIONABLE CLASS, and the only one worth a worklist row: the gate CALLS gv_verdict
          // -- so it computed a verdict and printed it -- and then throws the value away. A gate
          // with no gv_verdict call at all is simply outside L1's declared scope and must not be
          // accused of anything; a scanner whose own source contains the literal "gv_verdict(" as a
          // SEARCH PATTERN is the reason this is a call-shape test and not a substring test.
          let calls_gv: i64 = gl_has_call(code, cn, "gv_verdict(" as *u8)
          var discards: i64 = 0
          if calls_gv == 1 { if carry == 0 { discards = 1; discarded = discarded + 1 } }
412
          // L2: at least one tooth NAMED as a negative control. Naming is the honest proxy -- a
          // machine cannot tell an assertion's polarity, but a gate author who wrote the word
          // decided the tooth exists. REPORTED AS A NAMING CHECK, never as proof of coverage.
          var e2: i64 = gl_has(code, cn, "neg-control" as *u8)
          if e2 == 0 { e2 = gl_has(code, cn, "neg_control" as *u8) }
          if e2 == 0 { e2 = gl_has(code, cn, "negative-control" as *u8) }
          if e2 == 1 { l2_ok = l2_ok + 1 }
420
          if base == 1 { if e1 == 1 { if e2 == 1 { all3 = all3 + 1 } } }
422
          // L4: does this gate EMIT any measured value, or does it only assert PASS?
          // A GATE THAT PRINTS ONLY PASS IS UNFALSIFIABLE FROM THE OUTSIDE. An arithmetic that cannot
          // see a number can never contradict one, so a pass-only gate makes an independent SECOND
          // METHOD CLASS structurally impossible -- and PROVEN requires two independent method classes.
          // This axis measures the estate's exposure to that, which is how the whole fleet can read
          // green while the estate-wide PROVEN ratio sits at zero.
          var e4: i64 = gl_has(code, cn, nkv)
          if e4 == 0 { e4 = gl_has(code, cn, nvh) }
          if e4 == 0 { e4 = gl_has(code, cn, nce) }
          if e4 == 0 { e4 = gl_has(code, cn, ncn) }
          if e4 == 1 { l4_ok = l4_ok + 1 }
          if base == 1 { if e4 == 0 { base_no_values = base_no_values + 1 } }
          // L5: a gate that creates a pool must exit_group (gv_exit); the raw exit leaves its workers alive forever.
          let e5: i64 = gl_l5(code, cn, np1, np2, np3, np4, nsx)
          if e5 >= 1 { l5_pool = l5_pool + 1 }
          if e5 == 2 {
              l5_runaway = l5_runaway + 1
              if verbose == 1 { gv_puts("  L5-VIOLATION pool-gate-ends-with-the-raw-thread-exit (gv_exit fixes it): " as *u8); gv_puts(path); gv_puts("\n" as *u8) }
          }
442
          if verbose == 1 {
              // A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE. These gates are already on the base
              // class, so one gv_kv call each is the whole remedy -- the cheap half of the exposure.
              if base == 1 { if e4 == 0 {
                  gv_puts("  L4-VIOLATION emits-no-measured-value: " as *u8)
                  gv_puts(path); gv_puts("\n" as *u8)
              } }
              if discards == 1 {
                  gv_puts("  DISCARDS-VERDICT calls gv_verdict then returns a literal: " as *u8)
                  gv_puts(path); gv_puts("\n" as *u8)
              }
          }
      }
      fi = fi + 1
  }
458
  gv_puts("\n  --- GATE-LAW CENSUS (whole corpus, both trees) ---\n" as *u8)
  gv_puts("  gate_sources_found=" as *u8); gv_num(corpus_total)
  gv_puts("  scanned=" as *u8);            gv_num(scanned)
  gv_puts("  declared_cap=" as *u8);       gv_num(GL_MAXFILES); gv_puts("\n" as *u8)
  gv_puts("  L3 inherits nx_gate_verdict (declared==executed by construction): " as *u8)
  gv_num(l3_ok); gv_puts("\n" as *u8)
  gv_puts("  L1 exit carries verdict:                                         " as *u8)
  gv_num(l1_ok); gv_puts("   [return gv_verdict " as *u8); gv_num(l1_ret)
  gv_puts(" | via a name " as *u8); gv_num(l1_via_name)
  gv_puts(" | nested in sys_exit " as *u8); gv_num(l1_nested); gv_puts("]\n" as *u8)
  gv_puts("  DISCARDS-VERDICT (calls gv_verdict, throws the value away) -- THE WORKLIST: " as *u8)
  gv_num(discarded); gv_puts("\n" as *u8)
  gv_puts("  L2 names at least one negative control:                          " as *u8)
  gv_num(l2_ok); gv_puts("\n" as *u8)
  gv_puts("  ALL THREE:                                                       " as *u8)
  gv_num(all3); gv_puts("\n" as *u8)
  gv_puts("  hand_rolled_exit_UNMEASURED (no base class -- L1/L2 say NOTHING about these): " as *u8)
  gv_num(hand_rolled); gv_puts("\n" as *u8)
  gv_puts("  L4 emits at least one MEASURED VALUE (separate axis, NOT part of ALL THREE): " as *u8)
  gv_num(l4_ok); gv_puts("\n" as *u8)
  gv_puts("  L4 worklist -- on the base class and emitting nothing, one gv_kv call each (-v NAMES them): " as *u8)
  gv_num(base_no_values); gv_puts("\n" as *u8)
  gv_puts("  L5 creates a thread pool in its own source (a FLOOR: a pool made through an import is not seen): " as *u8)
  gv_num(l5_pool); gv_puts("\n" as *u8)
  gv_puts("  L5 worklist -- pool gates ending with the raw thread exit, runaways (-v NAMES them): " as *u8)
  gv_num(l5_runaway); gv_puts("\n\n" as *u8)
485
  // ---- BITE FIXTURES, assembled at runtime so this organ's own source cannot trip its scanner ----
  // A green that never had a corresponding red is unverified, and the neg-control is the one that
  // matters: crediting sys_exit(0) would make the fix worse than the defect it replaces.
  let f_exit: *u8 = "let rc: i64 = gv_verdict(nm, ctr, note)\n    sys_exit(rc)\n    return rc\n" as *u8
  let f_zero: *u8 = "let rc: i64 = gv_verdict(nm, ctr, note)\n    sys_exit(0)\n    return 0\n" as *u8
  let f_ret:  *u8 = "    return gv_verdict(nm, ctr, note)\n" as *u8
  let f_none: *u8 = "    gv_num(passed)\n    return 0\n" as *u8
  let f_name: *u8 = "let rc: i64 = gv_verdict(nm, ctr, note)\n    return rc\n" as *u8
  let f_nest: *u8 = "    sys_exit(gv_verdict(nm, ctr, note))\n    return 0\n" as *u8
  let f_disc: *u8 = "    gv_verdict(nm, ctr, note)\n    return 0\n" as *u8
496
  let c_exit: i64 = gl_carries_verdict(f_exit, gl_slen(f_exit), tmp)
  let c_zero: i64 = gl_carries_verdict(f_zero, gl_slen(f_zero), tmp)
  let c_ret:  i64 = gl_carries_verdict(f_ret,  gl_slen(f_ret),  tmp)
  let c_none: i64 = gl_carries_verdict(f_none, gl_slen(f_none), tmp)
  let c_name: i64 = gl_carries_verdict(f_name, gl_slen(f_name), tmp)
  let c_nest: i64 = gl_carries_verdict(f_nest, gl_slen(f_nest), tmp)
  let c_disc: i64 = gl_carries_verdict(f_disc, gl_slen(f_disc), tmp)
  gv_puts("  fixtures: sys_exit(rc)=" as *u8);  gv_num(c_exit)
  gv_puts("  sys_exit(0)=" as *u8);             gv_num(c_zero)
  gv_puts("  return gv_verdict=" as *u8);       gv_num(c_ret)
  gv_puts("  neither=" as *u8);                 gv_num(c_none); gv_puts("\n" as *u8)
508
  gv_check("sysexit-idiom-credited (this was a FALSE ACCUSATION before 2026-08-07)" as *u8,
           (c_exit == 2) as i64, ctr)
  gv_check("neg-control-sys_exit(0)-NOT-credited (the fix must not over-credit)" as *u8,
           (c_zero == 0) as i64, ctr)
  gv_check("incumbent-return-idiom-still-credited (no regression against the known good)" as *u8,
           (c_ret == 1) as i64, ctr)
  gv_check("neg-control-gate-with-neither-idiom-scores-zero" as *u8,
           (c_none == 0) as i64, ctr)
  gv_check("return-via-a-NAME credited (17 gates were falsely accused of exactly this)" as *u8,
           (c_name == 2) as i64, ctr)
  gv_check("nested sys_exit(gv_verdict(..)) credited (3 more falsely accused)" as *u8,
           (c_nest == 3) as i64, ctr)
  gv_check("neg-control-DISCARDED-verdict-STILL-caught (a fix that credits everything is worse)" as *u8,
           (c_disc == 0) as i64, ctr)
523
  // A quoted MENTION is not a CALL. Both directions, because this predicate decides whether a gate
  // lands on the worklist, and the scanner-shaped gates are exactly the ones most likely to mention it.
  let f_quoted: *u8 = "    if gb_call_site(sbuf, sn, \"gv_verdict(\" as *u8) == 1 {\n" as *u8
  let f_real:   *u8 = "    gv_verdict(nm, ctr, note)\n" as *u8
  gv_check("neg-control-a-QUOTED-mention-of-gv_verdict-is-not-a-call" as *u8,
           (gl_has_call(f_quoted, gl_slen(f_quoted), "gv_verdict(" as *u8) == 0) as i64, ctr)
  gv_check("a real unquoted call IS still seen (the quote guard did not blind the check)" as *u8,
           (gl_has_call(f_real, gl_slen(f_real), "gv_verdict(" as *u8) == 1) as i64, ctr)
532
  // THE VERDICT IS ABOUT THIS ORGAN'S OWN SUBJECT, NOT THE FLEET'S CONDITION.
  // A fleet-wide RED over legacy gates would be noise nobody can action; the CENSUS is the
  // deliverable and the numbers above are the work order.
  gv_check("corpus-enumerated-non-vacuously" as *u8, (scanned > 100) as i64, ctr)
  gv_check("comment-stripper-shrinks-source" as *u8, (scanned > 0) as i64, ctr)
  gv_check("neg-control-cap-not-silently-binding" as *u8, (corpus_total <= GL_MAXFILES) as i64, ctr)
  gv_check("partition-sums: base-class + hand-rolled == scanned" as *u8,
           ((l3_ok + hand_rolled) == scanned) as i64, ctr)
541
  // ---- L4 FIXTURES, joined at runtime for the same reason the L1 fixtures are quoted ----
  // The property that matters is that the needle matches a CONTIGUOUS occurrence only, so a file that
  // merely mentions the two halves is never counted and a match can only come from a real call.
  let fx: *u8 = sys_mmap(256)
  let l4_joined: i64 = gl_has(gl_join2(fx, "xx " as *u8, "gv_kv( yy" as *u8), 12, nkv)
  let l4_split:  i64 = gl_has(gl_join2(fx, "xx gv_ " as *u8, "kv( yy" as *u8), 13, nkv)
  gv_check("l4-needle-matches-a-contiguous-occurrence" as *u8, l4_joined, ctr)
  gv_check("neg-control-l4-needle-is-SILENT-on-a-buffer-holding-only-the-split-halves" as *u8,
           (l4_split == 0) as i64, ctr)
  gv_check("neg-control-l4-detector-finds-a-real-emitter-so-a-zero-here-would-indict-the-scanner" as *u8,
           (l4_ok >= 1) as i64, ctr)
  gv_check("l4-worklist-is-a-subset-of-the-base-class-population" as *u8,
           (base_no_values <= l3_ok) as i64, ctr)
555
  // ---- L5 FIXTURES, joined at runtime: the predicate fires on a pool gate with the raw exit, stays silent on the
  // exit_group form and on a raw exit with no pool, and a quoted mention of the raw exit is not a call ----
  let f5: *u8 = sys_mmap(512)
  var o5: i64 = 0
  o5 = gl_cat(f5, o5, "let p = nf_" as *u8); o5 = gl_cat(f5, o5, "pool()\n    let rc: i64 = gv_verdict(nm, ctr, note)\n    sys_" as *u8); o5 = gl_cat(f5, o5, "exit(rc)\n" as *u8)
  let l5_bad: i64 = gl_l5(f5, o5, np1, np2, np3, np4, nsx)
  o5 = 0
  o5 = gl_cat(f5, o5, "let p = nf_" as *u8); o5 = gl_cat(f5, o5, "pool()\n    let rc: i64 = gv_verdict(nm, ctr, note)\n    sys_" as *u8); o5 = gl_cat(f5, o5, "exit_group(rc)\n" as *u8)
  let l5_good: i64 = gl_l5(f5, o5, np1, np2, np3, np4, nsx)
  o5 = 0
  o5 = gl_cat(f5, o5, "let rc: i64 = gv_verdict(nm, ctr, note)\n    sys_" as *u8); o5 = gl_cat(f5, o5, "exit(rc)\n" as *u8)
  let l5_nopool: i64 = gl_l5(f5, o5, np1, np2, np3, np4, nsx)
  o5 = 0
  o5 = gl_cat(f5, o5, "let p = nf_" as *u8); o5 = gl_cat(f5, o5, "pool()\n    if gl_has(buf, n, \"sys_" as *u8); o5 = gl_cat(f5, o5, "exit(\" as *u8) == 1 { x = 1 }\n    sys_" as *u8); o5 = gl_cat(f5, o5, "exit_group(rc)\n" as *u8)
  let l5_quoted: i64 = gl_l5(f5, o5, np1, np2, np3, np4, nsx)
  gv_check("l5-pool-gate-with-the-raw-exit-is-a-runaway" as *u8, (l5_bad == 2) as i64, ctr)
  gv_check("neg-control-l5-pool-gate-with-exit_group-is-clean" as *u8, (l5_good == 1) as i64, ctr)
  gv_check("neg-control-l5-raw-exit-without-a-pool-is-outside-the-axis" as *u8, (l5_nopool == 0) as i64, ctr)
  gv_check("neg-control-l5-a-QUOTED-mention-of-the-raw-exit-is-not-a-call" as *u8, (l5_quoted == 1) as i64, ctr)
  gv_check("l5-worklist-is-a-subset-of-the-pool-gates" as *u8, (l5_runaway <= l5_pool) as i64, ctr)
  gv_check("neg-control-l5-detector-finds-a-real-pool-gate-so-a-zero-here-would-indict-the-scanner" as *u8, (l5_pool >= 1) as i64, ctr)
577
  // EMIT THE CENSUS, because a census that only asserts PASS is exactly the defect L4 measures.
  // Dogfooding is the point: this organ is the first consumer of the primitive it exists to count.
  gv_values_head()
  gv_kv("gate_sources_found" as *u8, corpus_total)
  gv_kv("scanned" as *u8, scanned)
  gv_kv("l3_inherits_base_class" as *u8, l3_ok)
  gv_kv("l1_exit_carries_verdict" as *u8, l1_ok)
  gv_kv("l2_names_a_negative_control" as *u8, l2_ok)
  gv_kv("all_three" as *u8, all3)
  gv_kv("hand_rolled_unmeasured" as *u8, hand_rolled)
  gv_kv("l4_emits_a_measured_value" as *u8, l4_ok)
  gv_kv("l4_worklist_base_class_but_silent" as *u8, base_no_values)
  gv_kv("l5_pool_gates_floor" as *u8, l5_pool)
  gv_kv("l5_runaway_exit_worklist" as *u8, l5_runaway)
592
  return gv_verdict("nx_gatelaw_gate" as *u8, ctr,
      "census only -- offenders are NAMED with -v and never blocked; a pre-flight that can refuse gets disabled, one that informs survives" as *u8)
595}
nx_gatelaw_gate.nx source

`nx_gatelaw_gate.nx` source
