code wiki / (root) / nx_id_param_gate.nx
`nx_id_param_gate.nx` source

↩ module page · 459 lines · 26059 B
1// nx_id_param_gate.nx -- THE IDENTITY-PARAMETER CORE AND ITS FIRST CONSUMER, GATED.
2// /compare/procgen C36 (id_param_core) and C33 (gn_palette_sample). Subjects: nx_id_param_core,
3// nx_id_palette.
4//
5// WHAT MAKES THIS GATE NON-VACUOUS. A "correlated sampler" is the easiest thing in the world to
6// fake: return the master for every axis and every correlation is perfect. So the teeth here are
7// the properties the WRONG implementations provably cannot all satisfy at once, and BOTH wrong
8// implementations are kept RUNNABLE in the subject rather than described in a comment:
9//   * the INCUMBENT (independent uniform draws, loading 0) -> dies at T3, T6
10//   * a COLLAPSED palette (every axis IS the master)       -> dies at T7, keeps T3/T6 -- which is
11//                                                             exactly why T7 has to exist
12//   * a correlation bought by narrowing the spread         -> dies at T4
13//   * loadings that drifted from their ledger              -> dies at T8
14//
15// T6 IS THE LOAD-BEARING TOOTH AND ITS BAR IS NOT A CONSTANT. A one-factor model predicts every
16// PAIRWISE correlation from the two loadings alone -- corr(a,b) = load_a*load_b/UNIT -- a
17// non-obvious three-way prediction nothing but that structure produces. It is measured with a real
18// Pearson estimator over the whole cast, against a bar DERIVED from the declared loadings.
19//
20// THE TOLERANCE IS DERIVED, NOT PICKED. The standard error of a Pearson r is about (1-r^2)/sqrt(n).
21// At n=512 and the weakest declared pair (r=0.45) that is ~35 permil, so IPG_CORR_TOL=60 leaves
22// under 2x headroom -- enough for sampling noise and integer rounding, not enough to admit a
23// different model. Stated so a later reader can tighten it against a bigger cast rather than guess.
24// license_tier: ORIGINAL  expect_exit: 0   No hw writes (Rule 26).
25import "nx_syscalls.nx"
26import "nx_gate_verdict.nx"
27import "nx_id_param_core.nx"
28import "nx_id_palette.nx"
29
30const IPG_N: i64 = 4096            // cast size. The denominator of every rate printed below.
31const IPG_CORR_TOL: i64 = 60       // permil; derived above from the estimator's own standard error
32// permil of the load-0 spread that the loaded spread may differ. DERIVED SEPARATELY, and the first
33// draft got this wrong in an instructive way: it reused IPG_CORR_TOL, and one constant serving two
34// unrelated estimators can be right for neither. The relative standard error of a sample standard
35// deviation is 1/sqrt(2n); the DIFFERENCE of two independent such estimates carries sqrt(2) times
36// that. At n=4096 that is 16 permil, so a 3-sigma bar is 47 and this is 50. Note the direction:
37// the run that failed used 60 at n=512, where 3 sigma is 133 -- the bar was far too TIGHT for the
38// cast it was measuring. The fix is a bigger cast and a bar derived for the right estimator, which
39// lands STRICTER than the one that failed. Loosening a bar until a measurement passes is the one
40// move this file exists to make impossible.
41const IPG_SPREAD_TOL: i64 = 50
42// permil of all drawn axis values allowed to land exactly on a span endpoint. See the clamp note
43// in nx_id_param_core: the variance-preserving fan can exceed the span, and an unmeasured clamp is
44// a silent cap. Bounded and PRINTED rather than assumed away.
45const IPG_CLAMP_CEIL: i64 = 200
46const IPG_SEED0: i64 = 20260828
47const IPG_BUF: i64 = 256
48const IPG_CONF_A: *u8 = "knowledge/id_palette.conf"
49const IPG_CONF_B: *u8 = "buildroot/knowledge/id_palette.conf"
50const IPG_RGB_PACK: i64 = 256
51
52func ipg_abs(v: i64) -> i64 { if v < 0 { return 0 - v } return v }
53func ipg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
54func ipg_find(hay: *u8, hn: i64, ndl: *u8, nn: i64) -> i64 {
  if nn <= 0 { return 0 - 1 }
  var i: i64 = 0
  while i + nn <= hn {
      var j: i64 = 0
      var ok: i64 = 1
      while j < nn {
          if hay[i + j] != ndl[j] { ok = 0; j = nn } else { j = j + 1 }
      }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
67}
68// 1 = <measured> is not the correlation the model declares. UNDEF counts as wrong: an estimator
69// that could not look must never be read as agreement.
70func ipg_corr_wrong(measured: i64, declared: i64) -> i64 {
  if measured == IDP_CORR_UNDEF { return 1 }
  if ipg_abs(measured - declared) > IPG_CORR_TOL { return 1 }
  return 0
74}
75// the one-factor model's prediction for a pair, from the two loadings alone.
76func ipg_pair_pred(la: i64, lb: i64) -> i64 { return la * lb / IDP_UNIT }
77// THE BANKED KNOWN-ANSWER VECTOR: three characters, nine numbers, observed on 2026-08-28 after the
78// avalanche finaliser landed. This is what makes the core SHAREABLE rather than merely shared -- a
79// second consumer reproduces these or it is not computing the same identity. Spelled as consts and
80// read through a function because the compiler takes literal const initialisers only.
81const IPG_KAT_0S: i64 = 781
82const IPG_KAT_0H: i64 = 1000
83const IPG_KAT_0E: i64 = 508
84const IPG_KAT_1S: i64 = 642
85const IPG_KAT_1H: i64 = 658
86const IPG_KAT_1E: i64 = 133
87const IPG_KAT_2S: i64 = 730
88const IPG_KAT_2H: i64 = 1000
89const IPG_KAT_2E: i64 = 890
90func ipg_kat(k: i64, ax: i64) -> i64 {
  if k == 0 {
      if ax == 0 { return IPG_KAT_0S }
      if ax == 1 { return IPG_KAT_0H }
      return IPG_KAT_0E
  }
  if k == 1 {
      if ax == 0 { return IPG_KAT_1S }
      if ax == 1 { return IPG_KAT_1H }
      return IPG_KAT_1E
  }
  if ax == 0 { return IPG_KAT_2S }
  if ax == 1 { return IPG_KAT_2H }
  return IPG_KAT_2E
104}
105// 1 = two streams that MUST be independent are not. Used on the raw and finalised streams alike,
106// so the defect and the fix are scored by one detector rather than two.
107func ipg_not_independent(c: i64) -> i64 {
  if c == IDP_CORR_UNDEF { return 1 }
  if ipg_abs(c) > IPG_CORR_TOL { return 1 }
  return 0
111}
112// 1 = this cast has collapsed -- a character's three swatches are one number. A BOOLEAN, because
113// gv_bite scores a detector and not a rate: handing it a permil reads as "did not fire".
114func ipg_collapsed(all_equal: i64) -> i64 {
  if all_equal * IDP_UNIT / IPG_N > 100 { return 1 }
  return 0
117}
118// the spread a loaded axis lost against the uncorrelated control, in permil of that control.
119func ipg_loss_permil(sp: i64, sp0: i64) -> i64 {
  if sp0 <= 0 { return IDP_UNIT }
  return ipg_abs(sp - sp0) * IDP_UNIT / sp0
122}
123// THE BAR FOR T4, DERIVED AT RUNTIME FROM THE ALTERNATIVE THAT WAS NOT TAKEN. Dividing the fan by
124// (w+q) instead of UNIT would remove the endpoint clamp and leave every correlation untouched; its
125// price is a spread scaled by UNIT/(w+q). That price is what the shipped design refused, so it is
126// the honest bar to beat -- an alternative measured at runtime, never a constant.
127func ipg_alt_loss_permil(w: i64) -> i64 {
  let q: i64 = idp_isqrt(IDP_UNIT * IDP_UNIT - w * w)
  if w + q <= 0 { return 0 }
  return IDP_UNIT - IDP_UNIT * IDP_UNIT / (w + q)
131}
132
133func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_id_param_gate -- the identity core (C36) and the correlated palette (C33)" as *u8)
136
  let nb: i64 = IPG_N * 8
  let mst: *i64 = sys_mmap(nb) as *i64
  let sk: *i64 = sys_mmap(nb) as *i64
  let ha: *i64 = sys_mmap(nb) as *i64
  let ey: *i64 = sys_mmap(nb) as *i64
  let sk0: *i64 = sys_mmap(nb) as *i64
  let ha0: *i64 = sys_mmap(nb) as *i64
  let ey0: *i64 = sys_mmap(nb) as *i64
  let rgb: *i64 = sys_mmap(nb) as *i64
  let p3: *i64 = sys_mmap(32) as *i64
  let c3: *i64 = sys_mmap(32) as *i64
  let mrw: *i64 = sys_mmap(nb) as *i64
  let srw: *i64 = sys_mmap(nb) as *i64
  let mfn: *i64 = sys_mmap(nb) as *i64
  let sfn: *i64 = sys_mmap(nb) as *i64
152
  // ---- draw the cast. THE SHIPPED palette, THE INCUMBENT (loading 0) and THE COLLAPSED one are
  // all produced from the same seeds, so every comparison below is like-for-like.
  var collapsed_all_equal: i64 = 0
  var shipped_all_equal: i64 = 0
  var clamped: i64 = 0
  var i: i64 = 0
  while i < IPG_N {
      let s: i64 = IPG_SEED0 + i
      mst[i] = idp_master(s, IDPAL_FACTOR_MELANIN)
      gn_palette_sample(s, p3)
      sk[i] = p3[IDPAL_AX_SKIN]
      ha[i] = p3[IDPAL_AX_HAIR]
      ey[i] = p3[IDPAL_AX_EYE]
      if p3[0] == p3[1] { if p3[1] == p3[2] { shipped_all_equal = shipped_all_equal + 1 } }
      var ac: i64 = 0
      while ac < IDPAL_N {
          if p3[ac] <= 0 { clamped = clamped + 1 }
          if p3[ac] >= IDPAL_SPAN { clamped = clamped + 1 }
          ac = ac + 1
      }
      gn_palette_sample_uncorrelated(s, p3)
      sk0[i] = p3[IDPAL_AX_SKIN]
      ha0[i] = p3[IDPAL_AX_HAIR]
      ey0[i] = p3[IDPAL_AX_EYE]
      gn_palette_sample_collapsed(s, c3)
      if c3[0] == c3[1] { if c3[1] == c3[2] { collapsed_all_equal = collapsed_all_equal + 1 } }
      // the same two streams BEFORE and AFTER the finaliser. Both must be independent by
      // construction -- a master draw and a residual draw share no input but the seed.
      mrw[i] = idp_centered_raw(s, IDPAL_AX_SKIN, IDP_SALT_MASTER)
      srw[i] = idp_centered_raw(s, IDPAL_AX_SKIN, IDP_SALT_RESID)
      mfn[i] = idp_centered(s, IDPAL_AX_SKIN, IDP_SALT_MASTER)
      sfn[i] = idp_centered(s, IDPAL_AX_SKIN, IDP_SALT_RESID)
      gn_palette_skin_srgb(sk[i], 0, p3)
      rgb[i] = p3[0] * IPG_RGB_PACK * IPG_RGB_PACK + p3[1] * IPG_RGB_PACK + p3[2]
      i = i + 1
  }
189
  let cs: i64 = idp_corr_permil(mst, sk, IPG_N)
  let ch: i64 = idp_corr_permil(mst, ha, IPG_N)
  let ce: i64 = idp_corr_permil(mst, ey, IPG_N)
  let cs0: i64 = idp_corr_permil(mst, sk0, IPG_N)
  let psh: i64 = idp_corr_permil(sk, ha, IPG_N)
  let pse: i64 = idp_corr_permil(sk, ey, IPG_N)
  let phe: i64 = idp_corr_permil(ha, ey, IPG_N)
  let psh0: i64 = idp_corr_permil(sk0, ha0, IPG_N)
198
  gv_puts("  cast n=" as *u8); gv_num(IPG_N)
  gv_puts("  core v=" as *u8); gv_num(id_param_core())
  gv_puts("  palette v=" as *u8); gv_num(gn_palette_version()); gv_puts("\n" as *u8)
  gv_puts("  corr(master,axis) permil: skin=" as *u8); gv_num(cs)
  gv_puts(" (declared " as *u8); gv_num(IDPAL_LOAD_SKIN); gv_puts(")  hair=" as *u8); gv_num(ch)
  gv_puts(" (" as *u8); gv_num(IDPAL_LOAD_HAIR); gv_puts(")  eye=" as *u8); gv_num(ce)
  gv_puts(" (" as *u8); gv_num(IDPAL_LOAD_EYE); gv_puts(")\n" as *u8)
  gv_puts("  INCUMBENT control, same seeds, loading 0: corr(master,skin)=" as *u8); gv_num(cs0)
  gv_puts("  corr(skin,hair)=" as *u8); gv_num(psh0); gv_puts("\n" as *u8)
  gv_puts("  pairwise permil: skin-hair=" as *u8); gv_num(psh)
  gv_puts(" (model predicts " as *u8); gv_num(ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_HAIR))
  gv_puts(")  skin-eye=" as *u8); gv_num(pse)
  gv_puts(" (" as *u8); gv_num(ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_EYE))
  gv_puts(")  hair-eye=" as *u8); gv_num(phe)
  gv_puts(" (" as *u8); gv_num(ipg_pair_pred(IDPAL_LOAD_HAIR, IDPAL_LOAD_EYE)); gv_puts(")\n" as *u8)
214
  // ---- T0 THE FIXTURE MUST REACH THE CONDITION. If any column is constant every correlation
  // below is undefined and every tooth is vacuous.
  let spm: i64 = idp_spread(mst, IPG_N)
  let sps: i64 = idp_spread(sk, IPG_N)
  let sph: i64 = idp_spread(ha, IPG_N)
  let spe: i64 = idp_spread(ey, IPG_N)
  var t0: i64 = 1
  if spm <= 0 { t0 = 0 }
  if sps <= 0 { t0 = 0 }
  if sph <= 0 { t0 = 0 }
  if spe <= 0 { t0 = 0 }
  gv_puts("  spreads: master=" as *u8); gv_num(spm); gv_puts(" skin=" as *u8); gv_num(sps)
  gv_puts(" hair=" as *u8); gv_num(sph); gv_puts(" eye=" as *u8); gv_num(spe); gv_puts("\n" as *u8)
  gv_check("T0 fixture-every-column-actually-varies-across-the-cast" as *u8, t0, ctr)
229
  // ---- T1 DETERMINISM. The whole promise of a shared core is that the NAS and the engine get the
  // same character from the same seed. Re-drawing the cast must reproduce it bit for bit.
  var t1: i64 = 1
  var i1: i64 = 0
  while i1 < IPG_N {
      gn_palette_sample(IPG_SEED0 + i1, p3)
      if p3[IDPAL_AX_SKIN] != sk[i1] { t1 = 0 }
      if p3[IDPAL_AX_HAIR] != ha[i1] { t1 = 0 }
      if p3[IDPAL_AX_EYE] != ey[i1] { t1 = 0 }
      i1 = i1 + 1
  }
  gv_check("T1 same-seed-reproduces-the-character-bit-for-bit" as *u8, t1, ctr)
242
  // ---- T2 THE AXES ARE SPLIT STREAMS AND NOT TWINS. Two axis ids must give DIFFERENT residuals
  // for the same seed (or every tissue would be the same draw wearing three names), while one
  // axis id reproduces. Asserting only the reproducibility half would pass for a constant.
  var difftwin: i64 = 0
  var samerep: i64 = 1
  var i2: i64 = 0
  while i2 < IPG_N {
      let s: i64 = IPG_SEED0 + i2
      if idp_centered(s, 0, IDP_SALT_RESID) != idp_centered(s, 1, IDP_SALT_RESID) { difftwin = difftwin + 1 }
      if idp_centered(s, 0, IDP_SALT_RESID) != idp_centered(s, 0, IDP_SALT_RESID) { samerep = 0 }
      i2 = i2 + 1
  }
  var t2: i64 = 1
  if difftwin < IPG_N * 9 / 10 { t2 = 0 }
  if samerep != 1 { t2 = 0 }
  gv_puts("  distinct-residual seeds: " as *u8); gv_num(difftwin); gv_puts(" of " as *u8)
  gv_num(IPG_N); gv_puts("\n" as *u8)
  gv_check("T2 different-axis-ids-are-different-streams-and-one-id-reproduces" as *u8, t2, ctr)
261
  // ---- T3 THE CORRELATION IS THE ONE DECLARED, measured with a real estimator against the
  // loading in the ledger. Not "greater than zero" -- the actual number.
  var t3: i64 = 1
  if ipg_corr_wrong(cs, IDPAL_LOAD_SKIN) == 1 { t3 = 0 }
  if ipg_corr_wrong(ch, IDPAL_LOAD_HAIR) == 1 { t3 = 0 }
  if ipg_corr_wrong(ce, IDPAL_LOAD_EYE) == 1 { t3 = 0 }
  gv_check("T3 measured-correlation-matches-the-declared-loading-on-every-axis" as *u8, t3, ctr)
269
  // ---- T4 THE CORRELATION WAS NOT BOUGHT WITH VARIETY. Each axis's spread at its shipped
  // loading must match its spread at loading 0. An implementation that pulls every character
  // toward the mean would score T3 and fail here, and that is the trade this rung must not make.
  let sps0: i64 = idp_spread(sk0, IPG_N)
  let sph0: i64 = idp_spread(ha0, IPG_N)
  let spe0: i64 = idp_spread(ey0, IPG_N)
  // The loss is NOT zero and pretending otherwise would be the wrong tooth: the endpoint clamp
  // measured at T11 costs a little spread, most on the axis whose weights overshoot furthest.
  // What the design actually claims is that this cost is SMALLER than the alternative's, so the
  // bar is the alternative's own price, recomputed here rather than remembered.
  let lsk: i64 = ipg_loss_permil(sps, sps0)
  let lha: i64 = ipg_loss_permil(sph, sph0)
  let ley: i64 = ipg_loss_permil(spe, spe0)
  var t4: i64 = 1
  if sps0 <= 0 { t4 = 0 }
  if lsk >= ipg_alt_loss_permil(IDPAL_LOAD_SKIN) { t4 = 0 }
  if lha >= ipg_alt_loss_permil(IDPAL_LOAD_HAIR) { t4 = 0 }
  if ley >= ipg_alt_loss_permil(IDPAL_LOAD_EYE) { t4 = 0 }
  gv_puts("  spread vs the uncorrelated control: skin " as *u8); gv_num(sps); gv_puts(" vs " as *u8)
  gv_num(sps0); gv_puts(", hair " as *u8); gv_num(sph); gv_puts(" vs " as *u8); gv_num(sph0)
  gv_puts(", eye " as *u8); gv_num(spe); gv_puts(" vs " as *u8); gv_num(spe0); gv_puts("\n" as *u8)
  gv_puts("  spread lost permil: skin " as *u8); gv_num(lsk); gv_puts("/" as *u8)
  gv_num(ipg_alt_loss_permil(IDPAL_LOAD_SKIN)); gv_puts("  hair " as *u8); gv_num(lha)
  gv_puts("/" as *u8); gv_num(ipg_alt_loss_permil(IDPAL_LOAD_HAIR)); gv_puts("  eye " as *u8)
  gv_num(ley); gv_puts("/" as *u8); gv_num(ipg_alt_loss_permil(IDPAL_LOAD_EYE))
  gv_puts("   (measured / what the range-preserving alternative would cost)\n" as *u8)
  gv_check("T4 the-shipped-fan-loses-less-variety-than-the-alternative-it-refused" as *u8, t4, ctr)
297
  // ---- T5 THE ORDERING IS THE FALSIFIABLE CLAIM: skin most determined by the shared factor,
  // then hair, then eye. Asserted on the MEASURED correlations and on the declared loadings, so
  // a ledger edit that inverted the model would be caught even if the arithmetic still agreed.
  var t5: i64 = 1
  if IDPAL_LOAD_SKIN <= IDPAL_LOAD_HAIR { t5 = 0 }
  if IDPAL_LOAD_HAIR <= IDPAL_LOAD_EYE { t5 = 0 }
  if cs <= ch { t5 = 0 }
  if ch <= ce { t5 = 0 }
  gv_check("T5 skin-hair-eye-ordering-holds-in-both-the-ledger-and-the-measurement" as *u8, t5, ctr)
307
  // ---- T6 THE LOAD-BEARING TOOTH: THE ONE-FACTOR SIGNATURE. All three pairwise correlations
  // must match load_a*load_b/UNIT -- a three-way prediction from two numbers each, which neither
  // an uncorrelated draw (all zero) nor a collapsed one (all 1000) can satisfy.
  var t6: i64 = 1
  if ipg_corr_wrong(psh, ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_HAIR)) == 1 { t6 = 0 }
  if ipg_corr_wrong(pse, ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_EYE)) == 1 { t6 = 0 }
  if ipg_corr_wrong(phe, ipg_pair_pred(IDPAL_LOAD_HAIR, IDPAL_LOAD_EYE)) == 1 { t6 = 0 }
  gv_check("T6 all-three-pairwise-correlations-match-the-one-factor-prediction" as *u8, t6, ctr)
316
  // ---- T7 THREE TISSUES, NOT ONE NUMBER. This is the tooth the COLLAPSED implementation dies
  // on while passing T3 and T6, which is exactly why a correlation tooth alone is not enough.
  var t7: i64 = 1
  if shipped_all_equal * IDP_UNIT / IPG_N > 100 { t7 = 0 }
  if collapsed_all_equal != IPG_N { t7 = 0 }
  gv_puts("  seeds whose three swatches are one number: shipped=" as *u8); gv_num(shipped_all_equal)
  gv_puts(" of " as *u8); gv_num(IPG_N); gv_puts(", collapsed control=" as *u8)
  gv_num(collapsed_all_equal); gv_puts(" of " as *u8); gv_num(IPG_N); gv_puts("\n" as *u8)
  gv_check("T7 the-three-swatches-stay-distinct-while-the-collapsed-control-does-not" as *u8, t7, ctr)
326
  // ---- T8 THE PALETTE ACTUALLY REACHES COLOUR. The skin swatch is pushed through the published
  // ITA locus and the distinct sRGB albedos are COUNTED, with the cast size in the condition --
  // a gamut claim asserted over an unstated denominator is not a claim.
  var distinct: i64 = 0
  var i8: i64 = 0
  while i8 < IPG_N {
      var seen: i64 = 0
      var j8: i64 = 0
      while j8 < i8 {
          if rgb[j8] == rgb[i8] { seen = 1; j8 = i8 } else { j8 = j8 + 1 }
      }
      if seen == 0 { distinct = distinct + 1 }
      i8 = i8 + 1
  }
  // THE BAR IS THE LOCUS'S OWN CARDINALITY, NOT THE CAST SIZE -- and getting that wrong the first
  // time WAS the finding. Sweeping the gene end to end counts every albedo nx_skin_ita's locus
  // can express at all; the cast can never exceed it, so scaling a bar with N asserts something
  // the colour model makes impossible. What is worth asserting is that the palette REACHES
  // essentially the whole gamut available to it.
  var reach: i64 = 0
  var g8: i64 = 0
  while g8 <= IDPAL_SPAN {
      gn_palette_skin_srgb(g8, 0, p3)
      let k: i64 = p3[0] * IPG_RGB_PACK * IPG_RGB_PACK + p3[1] * IPG_RGB_PACK + p3[2]
      var seen2: i64 = 0
      var h8: i64 = 0
      while h8 < g8 {
          gn_palette_skin_srgb(h8, 0, c3)
          if c3[0] * IPG_RGB_PACK * IPG_RGB_PACK + c3[1] * IPG_RGB_PACK + c3[2] == k { seen2 = 1; h8 = g8 } else { h8 = h8 + 1 }
      }
      if seen2 == 0 { reach = reach + 1 }
      g8 = g8 + 1
  }
  var t8: i64 = 1
  if reach <= 0 { t8 = 0 }
  if distinct * 10 < reach * 9 { t8 = 0 }
  gv_puts("  distinct skin albedos: cast reaches " as *u8); gv_num(distinct)
  gv_puts(" of the " as *u8); gv_num(reach)
  gv_puts(" this locus can express at all (cast n=" as *u8); gv_num(IPG_N); gv_puts(")\n" as *u8)
  gv_puts("  NOTE the ceiling is the COLOUR MODEL, not the palette: nx_skin_ita holds a* and b*\n" as *u8)
  gv_puts("  fixed, so every skin in the estate lies on ONE line in Lab. Widening that is B13.\n" as *u8)
  gv_check("T8 the-cast-reaches-nine-tenths-of-the-gamut-this-locus-can-express" as *u8, t8, ctr)
369
  // ---- T10 THE FINALISER EARNS ITS PLACE. Two streams that share no input but the seed must be
  // uncorrelated. Measured on the RAW gn_hash3 output and on the avalanched one, same seeds, same
  // estimator: the raw pair must FAIL independence and the finalised pair must PASS it. Without
  // the second half this tooth would pass for a core that avalanched nothing; without the first
  // it would pass for a hash that never needed fixing.
  let craw: i64 = idp_corr_permil(mrw, srw, IPG_N)
  let cfin: i64 = idp_corr_permil(mfn, sfn, IPG_N)
  var t10: i64 = 1
  if ipg_not_independent(craw) != 1 { t10 = 0 }
  if ipg_not_independent(cfin) != 0 { t10 = 0 }
  gv_puts("  independence of two same-seed streams: RAW gn_hash3=" as *u8); gv_num(craw)
  gv_puts(" permil, AVALANCHED=" as *u8); gv_num(cfin)
  gv_puts(" permil (bar " as *u8); gv_num(IPG_CORR_TOL); gv_puts(")\n" as *u8)
  gv_check("T10 the-finaliser-turns-a-correlated-raw-stream-into-an-independent-one" as *u8, t10, ctr)
384
  // ---- T11 THE CLAMP IS MEASURED, NOT ASSUMED AWAY. The variance-preserving fan can exceed the
  // span (see the note in nx_id_param_core), so some values land on an endpoint. An unmeasured
  // clamp is a silent cap, and a silent cap in a palette means a cast quietly piling up at
  // maximum-light and maximum-dark. Counted over every axis of every character, denominator in
  // the condition, and PRINTED whether it passes or not.
  var t11: i64 = 1
  let clamp_permil: i64 = clamped * IDP_UNIT / (IPG_N * IDPAL_N)
  if clamp_permil > IPG_CLAMP_CEIL { t11 = 0 }
  gv_puts("  axis values pinned to a span endpoint: " as *u8); gv_num(clamped)
  gv_puts(" of " as *u8); gv_num(IPG_N * IDPAL_N); gv_puts(" = " as *u8); gv_num(clamp_permil)
  gv_puts(" permil (ceiling " as *u8); gv_num(IPG_CLAMP_CEIL); gv_puts(")\n" as *u8)
  gv_check("T11 endpoint-clamping-measured-and-inside-its-declared-ceiling" as *u8, t11, ctr)
397
  // ---- T12 THE BANKED KAT. This is what makes the core SHAREABLE rather than merely shared: a
  // second consumer -- the engine -- proves it computes the same identity by reproducing these
  // exact triples. Banked from the 2026-08-28 run after the avalanche finaliser landed; a change
  // to the stream, the fan or the loadings moves them, which is the point.
  var t12: i64 = 1
  gv_puts("  KAT gn_palette_sample:" as *u8)
  var ik: i64 = 0
  while ik < 3 {
      gn_palette_sample(IPG_SEED0 + ik, p3)
      gv_puts(" seed+" as *u8); gv_num(ik); gv_puts("=[" as *u8); gv_num(p3[0])
      gv_puts("," as *u8); gv_num(p3[1]); gv_puts("," as *u8); gv_num(p3[2]); gv_puts("]" as *u8)
      if p3[0] != ipg_kat(ik, 0) { t12 = 0 }
      if p3[1] != ipg_kat(ik, 1) { t12 = 0 }
      if p3[2] != ipg_kat(ik, 2) { t12 = 0 }
      ik = ik + 1
  }
  gv_puts("\n" as *u8)
  gv_check("T12 the-cast-reproduces-its-banked-known-answer-vector" as *u8, t12, ctr)
416
  // ---- T9 THE LOADINGS AGREE WITH THEIR LEDGER. Each expected row is COMPOSED FROM THE CONSTS,
  // so this is a real coupling. If the ledger cannot be read the gate ABSTAINS, never acquits.
  let cn: *i64 = sys_mmap(8) as *i64
  cn[0] = 0
  var cbuf: *u8 = sys_read_file(IPG_CONF_A, cn)
  var csrc: i64 = 1
  if cn[0] <= 0 { cbuf = sys_read_file(IPG_CONF_B, cn); csrc = 2 }
  var present: i64 = 0
  if cn[0] > 0 { present = 1 }
  gv_puts("  loading ledger: " as *u8)
  if csrc == 1 { gv_puts(IPG_CONF_A) } else { gv_puts(IPG_CONF_B) }
  gv_puts(" bytes=" as *u8); gv_num(cn[0]); gv_puts("\n" as *u8)
  if gv_need("id_palette.conf readable from this working directory" as *u8, present, ctr) == 1 {
      let row: *u8 = sys_mmap(IPG_BUF) as *u8
      var t9: i64 = 1
      var q: i64 = gv_cat(row, 0, "load|0|skin|" as *u8)
      q = gv_catn(row, q, IDPAL_LOAD_SKIN); q = gv_cat(row, q, "|" as *u8); row[q] = 0 as u8
      if ipg_find(cbuf, cn[0], row, ipg_slen(row)) < 0 { t9 = 0 }
      q = gv_cat(row, 0, "load|1|hair|" as *u8)
      q = gv_catn(row, q, IDPAL_LOAD_HAIR); q = gv_cat(row, q, "|" as *u8); row[q] = 0 as u8
      if ipg_find(cbuf, cn[0], row, ipg_slen(row)) < 0 { t9 = 0 }
      q = gv_cat(row, 0, "load|2|eye|" as *u8)
      q = gv_catn(row, q, IDPAL_LOAD_EYE); q = gv_cat(row, q, "|" as *u8); row[q] = 0 as u8
      if ipg_find(cbuf, cn[0], row, ipg_slen(row)) < 0 { t9 = 0 }
      if ipg_find(cbuf, cn[0], "|UNPINNED" as *u8, 9) < 0 { t9 = 0 }
      gv_check("T9 every-loading-has-a-matching-ledger-row-with-a-source-field" as *u8, t9, ctr)
  }
444
  // ---- NEGATIVE CONTROLS. Each is measured on a REAL implementation kept runnable in the
  // subject, never on a described one.
  gv_bite("neg-control-the-uncorrelated-incumbent-cannot-show-the-declared-correlation" as *u8,
          ipg_corr_wrong(cs0, IDPAL_LOAD_SKIN), ipg_corr_wrong(cs, IDPAL_LOAD_SKIN), ctr)
  gv_bite("neg-control-the-uncorrelated-incumbent-has-no-pairwise-structure" as *u8,
          ipg_corr_wrong(psh0, ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_HAIR)),
          ipg_corr_wrong(psh, ipg_pair_pred(IDPAL_LOAD_SKIN, IDPAL_LOAD_HAIR)), ctr)
  gv_bite("neg-control-a-collapsed-palette-cannot-keep-three-distinct-swatches" as *u8,
          ipg_collapsed(collapsed_all_equal), ipg_collapsed(shipped_all_equal), ctr)
  gv_bite("neg-control-the-unavalanched-hash-cannot-produce-independent-streams" as *u8,
          ipg_not_independent(craw), ipg_not_independent(cfin), ctr)
456
  return gv_verdict("nx_id_param_gate" as *u8, ctr,
      "identity axes are drawn from one shared factor with per-tissue loadings. Every bar above is DERIVED AT RUNTIME rather than written here -- the declared loading, the one-factor pairwise prediction, the refused alternative's own price, the locus's own gamut -- and the uncorrelated incumbent and a collapsed palette are both kept RUNNABLE in the subject, each failing teeth the shipped one passes. This note deliberately recites no counts and no findings: the per-tooth lines above are the summary, and a note that restated them would silently go stale the next time a tooth is added." as *u8)
459}
nx_id_param_gate.nx source

`nx_id_param_gate.nx` source
