code wiki / (root) / nx_organ_ship_gate.nx
`nx_organ_ship_gate.nx` source

↩ module page · 770 lines · 50800 B
1// nx_organ_ship_gate.nx -- THE SHIP LOOP MUST NOT SKIP ITS OWN PROOF STAGE.
2//
3// WHY (measured 2026-08-20): nx_organ_ship's PROVE stage searched exactly ONE name, "<target>_gate",
4// and on a miss announced GATE=NONE and carried on. Shipping nx_gate_roster_run therefore proved
5// NOTHING -- its gate is nx_gate_roster_gate -- while the loop reported SHIPPED. That is the
6// vacuous-test defect living inside the one organ every other ship depends on, so the resolver that
7// replaced it needs teeth of its own.
8//
9// SUBJECT: osl_gate_resolve (nx_organ_ship_lib), driven IN-PROCESS. Deliberately NOT end-to-end:
10// nx_organ_ship's main() BUILDS before it proves, so a gate that drove main() would fork real compiles
11// on a shared host. The resolver takes its artifact roots as (dir, suffix) PARAMETERS for exactly this
12// reason, so every rule is exercised against /tmp/<gate>/ fixtures built at runtime and NOTHING here
13// touches a production surface -- a gate must never share its fixture with a production beat.
14//
15// TEETH
16//   T0 precondition: every fixture artifact this gate asserts against actually exists (gv_need -> SKIP,
17//                    never a false RED, and never an outcome asserted over a fixture that never landed)
18//   T1 ANTI-VACUITY: the MEASURED defect -- osg_roster_run resolves to osg_roster_gate by one-segment
19//                    strip. A resolver that knows only <target>_gate CANNOT pass this tooth.
20//   T2 the plain convention still resolves, and reports itself as the convention
21//   T3 DISCRIMINATION, both signals present at once: a target that has BOTH a conf declaration AND a
22//      conventional <target>_gate artifact resolves to the DECLARED one. Two teeth that each isolate
23//      one signal would not prove precedence between them.
24//   T4 an explicit gate= beats the declaration AND the convention
25//   T5 a target that IS a gate proves itself (shipping a gate used to skip PROVE for the same reason)
26//   T6 the second artifact root (buildroot/_build, .sov.elf) resolves
27//   T7 neg-control-no-gate-is-NAMED-not-silent: a target with no gate anywhere returns 0, reports
28//      OSL_WHY_NONE, and its search transcript NAMES the paths it probed -- the whole point of the fix
29//   T8 neg-control-declared-gate-absent-refuses-without-falling-through: gate=<absent> resolves to 0
30//      even though a derivable gate exists for that target, and the transcript proves it never probed
31//      it. Proving a DIFFERENT gate than the one the caller named would be a false proof.
32//   T9 BITE: the strip rule FIRES on the off-convention name and is SILENT when the stripped name has
33//      no artifact -- a rule that matched everything would resolve gates that do not exist.
34//   T10-T13 several declared gates for ONE target (2026-08-23): count, nth in file order, a commented
35//      row and an empty name never count (neg-control), and osl_conf_gate is exactly nth(0).
36//   T14-T20 WHICH COPY OF THE GATE RUNS (2026-08-25). Every tooth above picks a NAME; these pick the
37//      ARTIFACT, and until today nothing tested that at all. T14 and T15 differ in EXACTLY ONE
38//      argument, with the artifact present at BOTH roots, so they prove a preference between two
39//      real candidates rather than the ability to find one. T16 is the neg-control that freshness is
40//      matched by NAME. T17 keeps the swap a PREFERENCE, so a first promote can never become a false
41//      RED. T18 proves the pre-existing entry point behaves identically. T19 tests provenance under
42//      the SHIPPED roots, where root B is nested inside root A and this gate's own /tmp roots are
43//      structurally unable to expose the defect. T20 bites the swap in both directions.
44//   T21-T34 IS THAT ARTIFACT EVIDENCE ABOUT *THIS* RUN? (2026-08-25 part 2). T14-T20 answer WHICH
45//      artifact runs; these answer whether it was built from the tree being shipped. The residual the
46//      freshness lane NAMED: `ship nx_foo` resolves nx_foo_gate and the loop never rebuilt it, so an
47//      in-process gate -- which statically links its subject -- returned a verdict about the tree as of
48//      its OWN build. T23 is the anti-vacuity tooth and carries the whole bound: rebuild-every-gate
49//      passes T21 and T22 perfectly and doubles every ship's compile cost, so INDEPENDENT-is-not-
50//      rebuilt has to be a tooth. T24/T25 are the two ways a naive matcher spends the rebuild on the
51//      wrong organ (a comment, a prefix name). T26 keeps UNPROVEN out of INDEPENDENT. T28 is the
52//      shadow, where the two source roots can disagree. T32-T34 are the LOUD FALLBACK: a rebuild that
53//      fails does not refuse the ship, so the vintage classifier must never let a stale artifact read
54//      as current, and each failure state must print a name of its own.
55// license_tier: ORIGINAL   Fixtures under /tmp only. No hw writes (Rule 26).   expect_exit: 0
56import "nx_gatekit_lib.nx"
57import "nx_gate_verdict.nx"
58import "nx_organ_ship_lib.nx"
59
60const OSG_DIR:   *u8 = "/tmp/nx_organ_ship_gate/"
61const OSG_DIRA:  *u8 = "/tmp/nx_organ_ship_gate/root/"
62const OSG_DIRB:  *u8 = "/tmp/nx_organ_ship_gate/build/"
63const OSG_SUFA:  *u8 = ".elf"
64const OSG_SUFB:  *u8 = ".sov.elf"
65const OSG_CONF:  *u8 = "/tmp/nx_organ_ship_gate/organ_gate.conf"
66const OSG_BODY:  *u8 = "fixture artifact -- existence is all the resolver reads\n"
67// every fixture path, spelled ONCE and derived into both the writer and the precondition tooth: a
68// hand-repeated path is a second copy that drifts, and a fixture the gate never created is a tooth
69// that passes on a case the resolver never examined.
70const OSG_A_CONV: *u8 = "/tmp/nx_organ_ship_gate/root/osg_conv_gate.elf"
71const OSG_A_ROST: *u8 = "/tmp/nx_organ_ship_gate/root/osg_roster_gate.elf"
72const OSG_A_DECL: *u8 = "/tmp/nx_organ_ship_gate/root/osg_decl_elsewhere.elf"
73const OSG_A_DGAT: *u8 = "/tmp/nx_organ_ship_gate/root/osg_decl_gate.elf"
74const OSG_A_SELF: *u8 = "/tmp/nx_organ_ship_gate/root/osg_self_gate.elf"
75const OSG_B_BLD:  *u8 = "/tmp/nx_organ_ship_gate/build/osg_bld_gate.sov.elf"
76// THE SAME GATE NAME PRESENT AT BOTH ROOTS -- the fixture the freshness rule needs. A rule that only
77// ever sees ONE artifact cannot demonstrate which root it preferred, so every existing fixture above
78// is structurally incapable of testing root order. Two teeth differing in exactly ONE argument then
79// read the two roots apart.
80const OSG_A_BOTH: *u8 = "/tmp/nx_organ_ship_gate/root/osg_both_gate.elf"
81const OSG_B_BOTH: *u8 = "/tmp/nx_organ_ship_gate/build/osg_both_gate.sov.elf"
82// THE PRODUCTION ROOT PAIR, carried here as DATA (osl_root_of is pure string work and opens nothing).
83// It must be tested in the exact configuration that ships, where root B is NESTED INSIDE root A and a
84// naive first-match-A reports every fresh-build path as a promoted one. This gate's own /tmp roots do
85// NOT nest, so they could never exhibit that defect -- a fixture the defect cannot fail is not a test.
86const OSG_PROD_A: *u8 = "./"
87const OSG_PROD_B: *u8 = "./buildroot/_build/"
88
89// ---- SOURCE fixtures for the CLOSURE scan (2026-08-25 part 2) -------------------------------------
90// The teeth above pick a NAME and then an ARTIFACT. These pick neither: they decide whether the
91// artifact is EVIDENCE ABOUT THIS RUN AT ALL, by reading the gate's own source for an import of the
92// target. Two roots, because the builder prefers _hdl_build and the runtime copy can be a shadow.
93const OSG_SRC_HDL: *u8 = "/tmp/nx_organ_ship_gate/src_hdl/"
94const OSG_SRC_RT:  *u8 = "/tmp/nx_organ_ship_gate/src_rt/"
95const OSG_QT: i64 = 34
96const OSG_FXHDR: *u8 = "// nx_organ_ship_gate fixture source: only its import lines are read\n"
97// A fixture body is one header comment line plus at most three import lines, and every line is a module
98// NAME plus fixed framing -- so the buffer is DERIVED from that shape (line bound = two name caps, which
99// is generous for `import " ... .nx"` around a name), never picked. A hand-chosen buffer beside a
100// literal it is supposed to hold is a second copy of that literal's shape, and the two drift.
101const OSG_FX_LINES: i64 = 4
102func osg_fxcap() -> i64 { return OSG_FX_LINES * (OSL_NAMECAP + OSL_NAMECAP) }
103// the double-quote is CONSTRUCTED as a byte rather than escaped into a literal -- the estate has a
104// banked defect from a literal newline inside a string, and a fixture that does not contain what the
105// author thinks it contains is a test that cannot fail.
106func osg_imp(dst: *u8, o: i64, lead: *u8, module: *u8) -> i64 {
  var k: i64 = gk_cat(dst, o, lead)
  k = gk_cat(dst, k, "import " as *u8)
  dst[k] = OSG_QT as u8
  k = k + 1
  dst[k] = 0 as u8
  k = gk_cat(dst, k, module)
  k = gk_cat(dst, k, OSL_SRC_SUF)
  dst[k] = OSG_QT as u8
  k = k + 1
  dst[k] = 0 as u8
  k = gk_cat(dst, k, "\n" as *u8)
  return k
119}
120func osg_srcpath(dir: *u8, name: *u8, dst: *u8) -> i64 {
  var o: i64 = gk_cat(dst, 0, dir)
  o = gk_cat(dst, o, name)
  o = gk_cat(dst, o, OSL_SRC_SUF)
  return o
125}
126func osg_wsrc(dir: *u8, name: *u8, body: *u8) -> i64 {
  let p: *u8 = sys_mmap(OSL_PATHCAP)
  osg_srcpath(dir, name, p)
  gk_rm(p)
  gk_write(p, body)
  return gk_exists(p)
132}
133// THE ABSENT CASE IS A FIXTURE TOO: the no-source state is CREATED and then asserted, so T26 cannot
134// pass on a path that merely happened to be missing for some other reason.
135func osg_rmsrc(dir: *u8, name: *u8) -> i64 {
  let p: *u8 = sys_mmap(OSL_PATHCAP)
  osg_srcpath(dir, name, p)
  gk_rm(p)
  if gk_exists(p) == 1 { return 0 }
  return 1
141}
142func osg_clo(gate: *u8, target: *u8, tr: *u8, sd: *u8, seenp: *i64) -> i64 {
  return osl_gate_closure(gate, target, OSG_SRC_HDL, OSG_SRC_RT, OSL_SRC_SUF, tr, osl_closure_tried_cap(), sd, seenp)
144}
145
146func osg_run(target: *u8, expl: *u8, tried: *u8, gpath: *u8, why: *i64) -> i64 {
  return osl_gate_resolve(target, expl, OSG_CONF, OSG_DIRA, OSG_SUFA, OSG_DIRB, OSG_SUFB, tried, osl_tried_cap(), gpath, why)
148}
149// the same drive, declaring which name this notional invocation just BUILT
150func osg_run_fresh(target: *u8, expl: *u8, fresh: *u8, tried: *u8, gpath: *u8, why: *i64) -> i64 {
  return osl_gate_resolve_fresh(target, expl, fresh, OSG_CONF, OSG_DIRA, OSG_SUFA, OSG_DIRB, OSG_SUFB, tried, osl_tried_cap(), gpath, why)
152}
153func osg_has(tried: *u8, needle: *u8) -> i64 { return gk_out_has(tried, osl_slen(tried), needle) }
154
155func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_organ_ship_gate -- the ship loop resolves the gate that proves its target, or NAMES the absence" as *u8)
158
  // ---- fixtures, built at runtime under /tmp/<gate>/ (idempotent: rm then write) ----
  gk_mkdir(OSG_DIR)
  gk_mkdir(OSG_DIRA)
  gk_mkdir(OSG_DIRB)
  gk_rm(OSG_A_CONV)
  gk_rm(OSG_A_ROST)
  gk_rm(OSG_A_DECL)
  gk_rm(OSG_A_DGAT)
  gk_rm(OSG_A_SELF)
  gk_rm(OSG_B_BLD)
  gk_rm(OSG_A_BOTH)
  gk_rm(OSG_B_BOTH)
  gk_write(OSG_A_BOTH, OSG_BODY)
  gk_write(OSG_B_BOTH, OSG_BODY)
  gk_write(OSG_A_CONV, OSG_BODY)
  gk_write(OSG_A_ROST, OSG_BODY)
  gk_write(OSG_A_DECL, OSG_BODY)
  gk_write(OSG_A_DGAT, OSG_BODY)
  gk_write(OSG_A_SELF, OSG_BODY)
  gk_write(OSG_B_BLD, OSG_BODY)
  gk_write(OSG_CONF, "; nx_organ_ship_gate fixture: a declaration for a target whose gate name is underivable\nosg_decl\tosg_decl_elsewhere\n; a target proven by SEVERAL declared gates (the compiler shape): two live rows, one commented out, one empty\nosg_multi\tosg_decl_elsewhere\nosg_multi\tosg_self_gate\n; osg_multi\tosg_conv_gate\nosg_multi\t\n" as *u8)
180
  // ---- SOURCE fixtures for the closure scan (T21..T34) ----
  gk_mkdir(OSG_SRC_HDL)
  gk_mkdir(OSG_SRC_RT)
  let fx: *u8 = sys_mmap(osg_fxcap())
  var srcok: i64 = 1
  // 1 the ordinary shape: the gate imports <target>_lib
  var fo: i64 = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_conv_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_conv_gate" as *u8, fx) == 0 { srcok = 0 }
  // 2 the gate imports the TARGET itself
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_conv" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_direct_gate" as *u8, fx) == 0 { srcok = 0 }
  // 3 INDEPENDENT: real live imports, none of them the target -- the BOUND's fixture
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "nx_syscalls" as *u8)
  fo = osg_imp(fx, fo, "" as *u8, "osg_other_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_indep_gate" as *u8, fx) == 0 { srcok = 0 }
  // 3b THE THIRD-LIB CASE, and the whole reason part 3 exists: the gate and the target BOTH import
  // osg_shared_lib and NEITHER imports the other, so a direct-edge scan can only ever answer
  // INDEPENDENT here no matter how correct it is. BOTH sides are written so the fixture genuinely IS
  // the shape its name claims, even though the scan only ever opens the gate side -- a fixture that
  // merely asserts its own name is the vacuous case this file already refuses elsewhere.
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_shared_lib" as *u8)
  fo = osg_imp(fx, fo, "" as *u8, "nx_syscalls" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_third_gate" as *u8, fx) == 0 { srcok = 0 }
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_shared_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_conv" as *u8, fx) == 0 { srcok = 0 }
  // 4 a COMMENTED import of the target's lib, beside a live unrelated one
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "// " as *u8, "osg_conv_lib" as *u8)
  fo = osg_imp(fx, fo, "" as *u8, "nx_syscalls" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_cmt_gate" as *u8, fx) == 0 { srcok = 0 }
  // 5 a module the target's lib name is a strict PREFIX of
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_conv_other_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_pfx_gate" as *u8, fx) == 0 { srcok = 0 }
  // 6 an INDENTED import still is one
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "\t" as *u8, "osg_conv_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_indent_gate" as *u8, fx) == 0 { srcok = 0 }
  // 7 THE SHADOW: one basename at BOTH roots, and only the runtime copy names the target
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "nx_syscalls" as *u8)
  if osg_wsrc(OSG_SRC_HDL, "osg_shadow_gate" as *u8, fx) == 0 { srcok = 0 }
  fo = gk_cat(fx, 0, OSG_FXHDR)
  fo = osg_imp(fx, fo, "" as *u8, "osg_conv_lib" as *u8)
  if osg_wsrc(OSG_SRC_RT, "osg_shadow_gate" as *u8, fx) == 0 { srcok = 0 }
  // 8 the ABSENT case, CREATED rather than assumed
  if osg_rmsrc(OSG_SRC_HDL, "osg_nosrc_gate" as *u8) == 0 { srcok = 0 }
  if osg_rmsrc(OSG_SRC_RT, "osg_nosrc_gate" as *u8) == 0 { srcok = 0 }
234
  var pre: i64 = 1
  if srcok == 0 { pre = 0 }
  if gk_exists(OSG_A_CONV) == 0 { pre = 0 }
  if gk_exists(OSG_A_ROST) == 0 { pre = 0 }
  if gk_exists(OSG_A_DECL) == 0 { pre = 0 }
  if gk_exists(OSG_A_DGAT) == 0 { pre = 0 }
  if gk_exists(OSG_A_SELF) == 0 { pre = 0 }
  if gk_exists(OSG_B_BLD) == 0 { pre = 0 }
  if gk_exists(OSG_A_BOTH) == 0 { pre = 0 }
  if gk_exists(OSG_B_BOTH) == 0 { pre = 0 }
  if gk_exists(OSG_CONF) == 0 { pre = 0 }
  if gv_need("T0 precondition: every fixture artifact landed under /tmp" as *u8, pre, ctr) == 0 {
      return gv_verdict("organ_ship" as *u8, ctr, "fixtures could not be written -- UNOBSERVABLE, not a failure of the resolver" as *u8)
  }
249
  let tried: *u8 = sys_mmap(osl_tried_cap())
  let gpath: *u8 = sys_mmap(OSL_PATHCAP)
  let why:   *i64 = sys_mmap(16) as *i64
  let msg:   *u8 = sys_mmap(4096)
254
  // ---- T1 ANTI-VACUITY: the measured defect. nx_gate_roster_run -> nx_gate_roster_gate.
  var t1: i64 = 0
  if osg_run("osg_roster_run" as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_ROST) == 1 { if why[0] == OSL_WHY_STRIP1 { t1 = 1 } }
  }
  var mo: i64 = gk_cat(msg, 0, "  T1 osg_roster_run -> " as *u8)
  mo = gk_cat(msg, mo, gpath)
  mo = gk_cat(msg, mo, " via " as *u8)
  mo = gk_cat(msg, mo, osl_why_name(why[0]))
  mo = gk_cat(msg, mo, "\n" as *u8)
  gk_say(msg, mo)
  gv_check("T1 anti-vacuity: an off-convention gate name STILL resolves (one-segment strip) -- the measured skip" as *u8, t1, ctr)
267
  // ---- T2 the convention
  var t2: i64 = 0
  if osg_run("osg_conv" as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_CONV) == 1 { if why[0] == OSL_WHY_CONVENTION { t2 = 1 } }
  }
  gv_check("T2 the plain <target>_gate convention resolves and reports itself as the convention" as *u8, t2, ctr)
274
  // ---- T3 DISCRIMINATION: declaration beats convention with BOTH artifacts present
  var t3: i64 = 0
  if osg_run("osg_decl" as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_DECL) == 1 { if why[0] == OSL_WHY_CONF { t3 = 1 } }
  }
  gv_check("T3 discrimination: with a conf row AND a conventional gate both present, the DECLARED gate wins" as *u8, t3, ctr)
281
  // ---- T4 explicit beats declaration and convention
  var t4: i64 = 0
  if osg_run("osg_decl" as *u8, "osg_conv_gate" as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_CONV) == 1 { if why[0] == OSL_WHY_EXPLICIT { t4 = 1 } }
  }
  gv_check("T4 an explicit gate= overrides both the declaration and the convention" as *u8, t4, ctr)
288
  // ---- T5 a target that IS a gate proves itself
  var t5: i64 = 0
  if osg_run("osg_self_gate" as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_SELF) == 1 { if why[0] == OSL_WHY_SELF { t5 = 1 } }
  }
  gv_check("T5 shipping a gate PROVES it by running it, instead of hunting a <name>_gate_gate that cannot exist" as *u8, t5, ctr)
295
  // ---- T6 the second artifact root
  var t6: i64 = 0
  if osg_run("osg_bld" as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_B_BLD) == 1 { if why[0] == OSL_WHY_CONVENTION { t6 = 1 } }
  }
  gv_check("T6 a gate that exists only in the build root (.sov.elf) resolves too" as *u8, t6, ctr)
302
  // ---- T7 neg-control: NO gate anywhere is NAMED, never silent
  let miss: i64 = osg_run("osg_missing_run" as *u8, 0 as *u8, tried, gpath, why)
  var t7: i64 = 0
  if miss == 0 {
      if why[0] == OSL_WHY_NONE {
          if gpath[0] == (0 as u8) {
              if osg_has(tried, "osg_missing_run_gate.elf" as *u8) == 1 {
                  if osg_has(tried, "osg_missing_gate.elf" as *u8) == 1 {
                      if osg_has(tried, "osg_missing_run_gate.sov.elf" as *u8) == 1 { t7 = 1 }
                  }
              }
          }
      }
  }
  var m7: i64 = gk_cat(msg, 0, "  T7 transcript:" as *u8)
  m7 = gk_cat(msg, m7, tried)
  m7 = gk_cat(msg, m7, "\n" as *u8)
  gk_say(msg, m7)
  gv_check("T7 neg-control-no-gate-is-NAMED: a target with no gate returns none AND its transcript names every path probed" as *u8, t7, ctr)
322
  // ---- T8 neg-control: a DECLARED gate that is absent refuses and does NOT fall through
  let dmiss: i64 = osg_run("osg_conv" as *u8, "osg_nope_gate" as *u8, tried, gpath, why)
  var t8: i64 = 0
  if dmiss == 0 {
      if why[0] == OSL_WHY_NONE {
          if osg_has(tried, "osg_nope_gate.elf" as *u8) == 1 {
              if osg_has(tried, "osg_conv_gate" as *u8) == 0 { t8 = 1 }
          }
      }
  }
  gv_check("T8 neg-control-declared-absent-refuses: gate=<absent> resolves to none and never falls through to a derivable gate" as *u8, t8, ctr)
334
  // ---- T9 BITE: the strip rule fires on the off-convention name, silent when its target has none
  var bad: i64 = 0
  if osg_run("osg_roster_run" as *u8, 0 as *u8, tried, gpath, why) == 1 { if why[0] == OSL_WHY_STRIP1 { bad = 1 } }
  var good: i64 = 0
  if osg_run("osg_nostrip_run" as *u8, 0 as *u8, tried, gpath, why) == 1 { if why[0] == OSL_WHY_STRIP1 { good = 1 } }
  gv_bite("T9 BITE: the one-segment strip fires on the off-convention target and is SILENT when the stripped name has no artifact" as *u8, bad, good, ctr)
341
  // ---- T10..T13 ONE TARGET, SEVERAL DECLARED GATES (2026-08-23). The compiler is proven by one gate
  // per language rung; a resolver that read only the first row left the rest to a checklist.
  let nm: *u8 = sys_mmap(OSL_NAMECAP)
  let cnt: i64 = osl_conf_gate_count(OSG_CONF, "osg_multi" as *u8)
  var m10: i64 = gk_cat(msg, 0, "  T10 osg_multi declared rows=" as *u8)
  m10 = gk_catn(msg, m10, cnt)
  m10 = gk_cat(msg, m10, " (two live rows; the commented and the empty-name rows must not count)\n" as *u8)
  gk_say(msg, m10)
  var t10: i64 = 0
  if cnt == 2 { t10 = 1 }
  gv_check("T10 count: a target with two live rows, one commented row and one empty-name row declares exactly 2 gates" as *u8, t10, ctr)
  var t11: i64 = 0
  if osl_conf_gate_nth(OSG_CONF, "osg_multi" as *u8, 0, nm) == 1 { if gk_streq(nm, "osg_decl_elsewhere" as *u8) == 1 {
      if osl_conf_gate_nth(OSG_CONF, "osg_multi" as *u8, 1, nm) == 1 { if gk_streq(nm, "osg_self_gate" as *u8) == 1 { t11 = 1 } } } }
  gv_check("T11 nth: row 0 and row 1 come back in file order, each the exact declared name" as *u8, t11, ctr)
  var t12: i64 = 0
  if osl_conf_gate_nth(OSG_CONF, "osg_multi" as *u8, 2, nm) == 0 { if nm[0] == (0 as u8) { t12 = 1 } }
  gv_check("T12 neg-control-past-the-end-is-none: the commented third row is NOT a declaration (nth(2) = none, dst empty)" as *u8, t12, ctr)
  var t13: i64 = 0
  let nm2: *u8 = sys_mmap(OSL_NAMECAP)
  if osl_conf_gate(OSG_CONF, "osg_multi" as *u8, nm2) == 1 { if osl_conf_gate_nth(OSG_CONF, "osg_multi" as *u8, 0, nm) == 1 { if gk_streq(nm, nm2) == 1 { t13 = 1 } } }
  if osl_conf_gate_count(OSG_CONF, "osg_decl" as *u8) != 1 { t13 = 0 }
  if osl_conf_gate_count(OSG_CONF, "osg_nowhere" as *u8) != 0 { t13 = 0 }
  gv_check("T13 first-row equivalence: osl_conf_gate == nth(0), a single-row target counts 1, an undeclared target counts 0" as *u8, t13, ctr)
366
  // ---- T14..T20 WHICH COPY OF THE RESOLVED GATE RUNS (2026-08-25). The rules above pick a NAME;
  // these pick the ARTIFACT. Measured from nx_organ_ship's own journal: one BUILD sha 2d9c5011...
  // produced PROVE RED from ./nx_uvunwrap_gate.elf and PROVE GREEN from the artifact just built, on
  // consecutive rows -- two opposite verdicts about one build, decided only by root order.
371
  // ---- T14 the baseline: both roots hold it, nothing declared fresh -> promoted still wins
  var t14: i64 = 0
  if osg_run_fresh("osg_both_gate" as *u8, 0 as *u8, 0 as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_BOTH) == 1 { if why[0] == OSL_WHY_SELF { t14 = 1 } }
  }
  gv_check("T14 unchanged-by-default: with the artifact at BOTH roots and nothing declared fresh, the PROMOTED root still wins" as *u8, t14, ctr)
378
  // ---- T15 THE FIX. Identical to T14 in every argument but ONE: the candidate is declared fresh.
  // Both signals are present at once (both artifacts exist), so this proves a PREFERENCE between
  // them rather than the mere ability to find one.
  var t15: i64 = 0
  if osg_run_fresh("osg_both_gate" as *u8, 0 as *u8, "osg_both_gate" as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_B_BOTH) == 1 { if why[0] == OSL_WHY_SELF { t15 = 1 } }
  }
  var m15: i64 = gk_cat(msg, 0, "  T15 same target, same two artifacts, fresh declared -> " as *u8)
  m15 = gk_cat(msg, m15, gpath)
  m15 = gk_cat(msg, m15, "\n" as *u8)
  gk_say(msg, m15)
  gv_check("T15 the fix: the candidate the run just built resolves to the FRESH BUILD, not the previous promote sitting beside it" as *u8, t15, ctr)
391
  // ---- T16 neg-control: freshness is matched by NAME, not by being non-empty
  var t16: i64 = 0
  if osg_run_fresh("osg_both_gate" as *u8, 0 as *u8, "osg_other_gate" as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_BOTH) == 1 { t16 = 1 }
  }
  gv_check("T16 neg-control-fresh-must-match-by-name: a fresh name that is not this candidate does NOT move the order" as *u8, t16, ctr)
398
  // ---- T17 anti-vacuity for the fix itself: the swap must be a PREFERENCE, not a requirement.
  // A fix that made the fresh artifact mandatory would turn every first-promote ship into a false RED.
  var t17: i64 = 0
  if osg_run_fresh("osg_self_gate" as *u8, 0 as *u8, "osg_self_gate" as *u8, tried, gpath, why) == 1 {
      if gk_streq(gpath, OSG_A_SELF) == 1 { if why[0] == OSL_WHY_SELF { t17 = 1 } }
  }
  gv_check("T17 preference-not-requirement: a fresh candidate with NO build-root artifact still resolves to the promoted one" as *u8, t17, ctr)
406
  // ---- T18 the pre-existing entry point is EXACTLY the new one with nothing fresh
  let eqn: *i64 = sys_mmap(8 * 8) as *i64
  eqn[0] = "osg_roster_run" as *u8 as i64
  eqn[1] = "osg_conv" as *u8 as i64
  eqn[2] = "osg_decl" as *u8 as i64
  eqn[3] = "osg_self_gate" as *u8 as i64
  eqn[4] = "osg_bld" as *u8 as i64
  eqn[5] = "osg_both_gate" as *u8 as i64
  eqn[6] = "osg_missing_run" as *u8 as i64
  let g2: *u8 = sys_mmap(OSL_PATHCAP)
  let why2: *i64 = sys_mmap(16) as *i64
  let tri2: *u8 = sys_mmap(osl_tried_cap())
  var t18: i64 = 1
  var cmpd: i64 = 0
  var q: i64 = 0
  while q < 7 {
      let nmq: *u8 = eqn[q] as *u8
      let r1: i64 = osg_run(nmq, 0 as *u8, tried, gpath, why)
      let r2: i64 = osg_run_fresh(nmq, 0 as *u8, 0 as *u8, tri2, g2, why2)
      if r1 != r2 { t18 = 0 }
      if why[0] != why2[0] { t18 = 0 }
      if gk_streq(gpath, g2) == 0 { t18 = 0 }
      if gk_streq(tried, tri2) == 0 { t18 = 0 }
      cmpd = cmpd + 1
      q = q + 1
  }
  // BIND THE AGGREGATE TO ITS DENOMINATOR: an equivalence that compared nothing passes trivially.
  if cmpd == 0 { t18 = 0 }
  var m18: i64 = gk_cat(msg, 0, "  T18 targets compared=" as *u8)
  m18 = gk_catn(msg, m18, cmpd)
  m18 = gk_cat(msg, m18, " (path, rule AND full search transcript identical on every one)\n" as *u8)
  gk_say(msg, m18)
  gv_check("T18 the pre-existing entry point is exactly the new one with nothing declared fresh, so no existing caller changes behaviour" as *u8, t18, ctr)
440
  // ---- T19 provenance under the PRODUCTION roots, where root B is nested inside root A
  var t19: i64 = 0
  let ra: i64 = osl_root_of("./nx_uvunwrap_gate.elf" as *u8, OSG_PROD_A, OSG_PROD_B)
  let rb: i64 = osl_root_of("./buildroot/_build/nx_uvunwrap_gate.sov.elf" as *u8, OSG_PROD_A, OSG_PROD_B)
  let rz: i64 = osl_root_of("/tmp/elsewhere/x.elf" as *u8, OSG_PROD_A, OSG_PROD_B)
  if ra == OSL_ROOT_A { if rb == OSL_ROOT_B { if rz == OSL_ROOT_NONE { t19 = 1 } } }
  var m19: i64 = gk_cat(msg, 0, "  T19 production roots: promoted=" as *u8)
  m19 = gk_catn(msg, m19, ra)
  m19 = gk_cat(msg, m19, " freshbuild=" as *u8)
  m19 = gk_catn(msg, m19, rb)
  m19 = gk_cat(msg, m19, " outside=" as *u8)
  m19 = gk_catn(msg, m19, rz)
  m19 = gk_cat(msg, m19, " (expect 1 2 0; a first-match-A reader would say 1 1 0)\n" as *u8)
  gk_say(msg, m19)
  gv_check("T19 provenance under the shipped roots: a fresh-build path reports the FRESH root, never the promoted root it is nested inside" as *u8, t19, ctr)
456
  // ---- T20 BITE: the swap fires exactly on the candidate that was built, and on nothing else
  var swp_bad: i64 = 0
  if osg_run_fresh("osg_both_gate" as *u8, 0 as *u8, "osg_both_gate" as *u8, tried, gpath, why) == 1 { if gk_streq(gpath, OSG_B_BOTH) == 1 { swp_bad = 1 } }
  var swp_good: i64 = 0
  if osg_run_fresh("osg_both_gate" as *u8, 0 as *u8, "osg_other_gate" as *u8, tried, gpath, why) == 1 { if gk_streq(gpath, OSG_B_BOTH) == 1 { swp_good = 1 } }
  gv_bite("T20 BITE: the freshness swap FIRES for the name just built and is SILENT for every other candidate" as *u8, swp_bad, swp_good, ctr)
463
  // ---- T21..T34 IS THE RESOLVED GATE'S BINARY EVIDENCE ABOUT *THIS* RUN? (2026-08-25, part 2)
  // Everything above answers WHICH artifact runs. These answer whether that artifact was built from
  // the tree being shipped -- the residual the freshness lane named: `ship nx_foo` resolves
  // nx_foo_gate and the loop never rebuilt it, so an in-process gate's verdict described the tree as
  // of its OWN build. Fleet scale: 715 gates built, 176 current with their own source.
  let ctr_tr: *u8 = sys_mmap(osl_closure_tried_cap())
  let ctr_sd: *u8 = sys_mmap(OSL_PATHCAP)
  let sn: *i64 = sys_mmap(16) as *i64
472
  // ---- T21 the ordinary shape: the gate imports <target>_lib
  var t21: i64 = 0
  if osg_clo("osg_conv_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS {
      if sn[0] == 1 { t21 = 1 }
  }
  var m21: i64 = gk_cat(msg, 0, "  T21 osg_conv_gate vs osg_conv -> " as *u8)
  m21 = gk_cat(msg, m21, osl_closure_name(OSL_CLO_CONTAINS))
  m21 = gk_cat(msg, m21, " deciding_src=" as *u8)
  m21 = gk_cat(msg, m21, ctr_sd)
  m21 = gk_cat(msg, m21, " sources_read=" as *u8)
  m21 = gk_catn(msg, m21, sn[0])
  m21 = gk_cat(msg, m21, "\n" as *u8)
  gk_say(msg, m21)
  gv_check("T21 a gate whose source imports <target>_lib.nx CONTAINS the target -- the case that makes its binary stale the moment the lib is edited" as *u8, t21, ctr)
487
  // ---- T22 the other real shape: the gate imports the target itself
  var t22: i64 = 0
  if osg_clo("osg_direct_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS { t22 = 1 }
  gv_check("T22 a gate whose source imports <target>.nx CONTAINS it too -- both build-closure shapes, not just the lib one" as *u8, t22, ctr)
492
  // ---- T23 THE BOUND, and the anti-vacuity tooth for the whole fix. Without it, "rebuild every gate
  // on every ship" satisfies T21 and T22 perfectly -- and doubles the compile cost of every lane on a
  // box whose governor already refuses builds under load. sources_read is asserted so this cannot pass
  // by the fixture being unreadable: INDEPENDENT must be a READ answer, never a failed open.
  var t23: i64 = 0
  if osg_clo("osg_indep_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_INDEPENDENT {
      if sn[0] == 1 { t23 = 1 }
  }
  gv_check("T23 anti-vacuity: a gate that imports neither the target nor its lib is INDEPENDENT and is NOT rebuilt, on a source that WAS read -- rebuild-everything cannot pass this" as *u8, t23, ctr)
502
  // ---- T24 neg-control: a commented-out import is not a build edge
  var t24: i64 = 0
  if osg_clo("osg_cmt_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_INDEPENDENT {
      if sn[0] == 1 { t24 = 1 }
  }
  gv_check("T24 neg-control-comments-are-not-code: a commented import of the target's lib is NOT a closure edge, beside a live unrelated import that proves the scanner still parses the file" as *u8, t24, ctr)
509
  // ---- T25 neg-control: exact module names
  var t25: i64 = 0
  if osg_clo("osg_pfx_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_INDEPENDENT {
      if sn[0] == 1 { t25 = 1 }
  }
  gv_check("T25 neg-control-exact-module-name: osg_conv_other_lib.nx does NOT answer for osg_conv -- a substring test would spend the rebuild following a different organ's edit" as *u8, t25, ctr)
516
  // ---- T26 UNPROVEN IS ITS OWN STATE. If "I could not read the source" collapsed into INDEPENDENT,
  // an unreadable gate would report as current and the loud fallback would be silent again.
  var t26: i64 = 0
  if osg_clo("osg_nosrc_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_UNPROVEN {
      if sn[0] == 0 {
          if osg_has(ctr_tr, "src_hdl/osg_nosrc_gate.nx" as *u8) == 1 {
              if osg_has(ctr_tr, "src_rt/osg_nosrc_gate.nx" as *u8) == 1 { t26 = 1 }
          }
      }
  }
  var m26: i64 = gk_cat(msg, 0, "  T26 transcript:" as *u8)
  m26 = gk_cat(msg, m26, ctr_tr)
  m26 = gk_cat(msg, m26, "\n" as *u8)
  gk_say(msg, m26)
  gv_check("T26 no source at either root is UNPROVEN, never INDEPENDENT, and its transcript NAMES both paths it read for -- an abstention that acquits is the flattering failure nobody investigates" as *u8, t26, ctr)
532
  // ---- T27 leading whitespace does not hide an import
  var t27: i64 = 0
  if osg_clo("osg_indent_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS { t27 = 1 }
  gv_check("T27 an INDENTED import is still an import -- a line-start-anchored matcher would miss it and skip the rebuild" as *u8, t27, ctr)
537
  // ---- T28 THE SHADOW: one basename at both roots, only the runtime copy names the target. The
  // builder compiles the _hdl_build copy, so the two can disagree; CONTAINS if EITHER names it is the
  // only direction this decision may be wrong in (one extra compile, never a stale proof).
  var t28: i64 = 0
  if osg_clo("osg_shadow_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS {
      if sn[0] == 2 { t28 = 1 }
  }
  var m28: i64 = gk_cat(msg, 0, "  T28 shadow sources_read=" as *u8)
  m28 = gk_catn(msg, m28, sn[0])
  m28 = gk_cat(msg, m28, " (expect 2: both roots hold this basename)\n" as *u8)
  gk_say(msg, m28)
  gv_check("T28 a SHADOWED gate name reports both sources read and answers CONTAINS when EITHER copy names the target, so a disagreeing shadow can never silence the rebuild" as *u8, t28, ctr)
550
  // ---- T29 the whole bound in one predicate, all four cases
  var t29: i64 = 1
  if osl_should_rebuild("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_CONTAINS) != 1 { t29 = 0 }
  if osl_should_rebuild("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT) != 0 { t29 = 0 }
  if osl_should_rebuild("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_UNPROVEN) != 0 { t29 = 0 }
  if osl_should_rebuild("osg_self_gate" as *u8, "osg_self_gate" as *u8, OSL_CLO_CONTAINS) != 0 { t29 = 0 }
  gv_check("T29 the bound: a rebuild is spent only for a DIFFERENT gate whose closure CONTAINS the target -- never on INDEPENDENT, never on UNPROVEN, and never on the target's own gate, which stage 1 already built" as *u8, t29, ctr)
558
  // ---- T30 BITE the closure matcher in both directions
  var cb: i64 = 0
  if osg_clo("osg_conv_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS { cb = 1 }
  var cg: i64 = 0
  if osg_clo("osg_pfx_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_CONTAINS { cg = 1 }
  gv_bite("T30 BITE-closure-fires-and-is-silent: CONTAINS on a real import of the target's lib, SILENT on the prefix name beside it" as *u8, cb, cg, ctr)
565
  // ---- T31 the artifact PATH the resolver returns must yield the NAME the source lookup needs,
  // under the PRODUCTION roots where root B nests inside root A.
  let nmo: *u8 = sys_mmap(OSL_NAMECAP)
  var t31: i64 = 1
  if osl_name_of("./nx_uvunwrap_gate.elf" as *u8, OSG_PROD_A, OSG_SUFA, OSG_PROD_B, OSG_SUFB, nmo) == 1 {
      if gk_streq(nmo, "nx_uvunwrap_gate" as *u8) == 0 { t31 = 0 }
  } else { t31 = 0 }
  if osl_name_of("./buildroot/_build/nx_uvunwrap_gate.sov.elf" as *u8, OSG_PROD_A, OSG_SUFA, OSG_PROD_B, OSG_SUFB, nmo) == 1 {
      if gk_streq(nmo, "nx_uvunwrap_gate" as *u8) == 0 { t31 = 0 }
  } else { t31 = 0 }
  if osl_name_of("/tmp/elsewhere/x.elf" as *u8, OSG_PROD_A, OSG_SUFA, OSG_PROD_B, OSG_SUFB, nmo) != 0 { t31 = 0 }
  if osl_name_of("./nx_thing.txt" as *u8, OSG_PROD_A, OSG_SUFA, OSG_PROD_B, OSG_SUFB, nmo) != 0 { t31 = 0 }
  gv_check("T31 both production artifact paths yield the same gate NAME, and a path under neither root or without that root's suffix is REFUSED rather than guessed" as *u8, t31, ctr)
579
  // ---- T32 the vintage classifier. Exactly three states are evidence about this run.
  var t32: i64 = 1
  if osl_vint_current(OSL_VINT_STAGE1) != 1 { t32 = 0 }
  if osl_vint_current(OSL_VINT_REBUILT) != 1 { t32 = 0 }
  if osl_vint_current(OSL_VINT_INDEPENDENT) != 1 { t32 = 0 }
  if osl_vint_current(OSL_VINT_STALE_REFUSED) != 0 { t32 = 0 }
  if osl_vint_current(OSL_VINT_STALE_NOARTIFACT) != 0 { t32 = 0 }
  if osl_vint_current(OSL_VINT_STALE_WRONGSRC) != 0 { t32 = 0 }
  if osl_vint_current(OSL_VINT_UNKNOWN_NOSRC) != 0 { t32 = 0 }
  if osl_vint_current(OSL_VINT_UNKNOWN_NONAME) != 0 { t32 = 0 }
  if osl_vint_current(OSL_VINT_UNKNOWN) != 0 { t32 = 0 }
  gv_check("T32 only stage-1-built, rebuilt-this-run and independent-of-this-build count as CURRENT; every STALE and every UNKNOWN reads as not current" as *u8, t32, ctr)
592
  // ---- T33 BITE the vintage classifier: a version that answered current for everything would make
  // the rebuild-failed fallback silent, which is the defect the fallback exists to avoid.
  var vb: i64 = 0
  if osl_vint_current(OSL_VINT_REBUILT) == 1 { vb = 1 }
  var vg: i64 = 0
  if osl_vint_current(OSL_VINT_STALE_REFUSED) == 1 { vg = 1 }
  gv_bite("T33 BITE-abstain-never-acquits: CURRENT fires for a rebuilt artifact and is SILENT for a refused rebuild" as *u8, vb, vg, ctr)
600
  // ---- T34 A NAMED FALLBACK IS ONLY NAMED IF ITS NAME IS ITS OWN. Two states printing one string
  // would leave the reader unable to tell a load-shed refusal from a wrong-source compile.
  var t34: i64 = 1
  var cmp34: i64 = 0
  var va: i64 = 0
  while va <= osl_vint_max() {
      var vc: i64 = va + 1
      while vc <= osl_vint_max() {
          if gk_streq(osl_vint_name(va), osl_vint_name(vc)) == 1 { t34 = 0 }
          cmp34 = cmp34 + 1
          vc = vc + 1
      }
      va = va + 1
  }
  if cmp34 == 0 { t34 = 0 }
  var m34: i64 = gk_cat(msg, 0, "  T34 vintage name pairs compared=" as *u8)
  m34 = gk_catn(msg, m34, cmp34)
  m34 = gk_cat(msg, m34, " (all distinct)\n" as *u8)
  gk_say(msg, m34)
  gv_check("T34 every vintage code prints a DISTINCT name, bound to the number of pairs actually compared -- an equivalence over nothing passes trivially" as *u8, t34, ctr)
621
  // ---- T35..T43 THE CLOSURE BANK DECIDES (2026-08-26, part 3). T21..T34 answer whether the gate's
  // SOURCE names the target. These answer the question that subsumes it -- whether the gate's
  // ARTIFACT was built from the sources the tree holds now -- and the residual part 2 named in its
  // own header is the shared-third-lib case at T36, which no direct-edge scan can reach by
  // construction rather than by being written badly.
627
  // ---- T35 the comparator's exit contract, and every way it can fail to answer at all
  var t35: i64 = 1
  if osl_prov_of_exit(0) != OSL_PROV_CURRENT { t35 = 0 }
  if osl_prov_of_exit(1) != OSL_PROV_DRIFTED { t35 = 0 }
  if osl_prov_of_exit(2) != OSL_PROV_UNPROVEN { t35 = 0 }
  if osl_prov_of_exit(3) != OSL_PROV_UNPROVEN { t35 = 0 }
  if osl_prov_of_exit(127) != OSL_PROV_UNPROVEN { t35 = 0 }
  if osl_prov_of_exit(0 - 5) != OSL_PROV_UNPROVEN { t35 = 0 }
  if osl_prov_of_exit(0 - 2) != OSL_PROV_UNPROVEN { t35 = 0 }
  gv_check("T35 nx_provcheck's exit contract yields exactly two decided answers, and every other exit -- no bank, usage, 127 comparator-absent, -5 deadline fired, harness sentinel -- is UNPROVEN rather than promoted into a verdict" as *u8, t35, ctr)
638
  // ---- T36 THE MOTIVATING CASE, and the one this whole part exists for. The fixture is asserted to
  // REACH the INDEPENDENT classification on a source that WAS read, before any outcome is asserted,
  // so it cannot pass by the fixture being unreadable.
  var t36: i64 = 0
  if osg_clo("osg_third_gate" as *u8, "osg_conv" as *u8, ctr_tr, ctr_sd, sn) == OSL_CLO_INDEPENDENT {
      if sn[0] == 1 {
          if osl_should_rebuild("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT) == 0 {
              if osl_should_rebuild_prov("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_DRIFTED) == 1 { t36 = 1 }
          }
      }
  }
  gv_check("T36 a gate and a target that share a third lib neither imports directly reads INDEPENDENT to the edge scan, which therefore skips the rebuild -- and IS rebuilt once the bank reports DRIFTED, which is exactly the residual part 2 declared out of scope" as *u8, t36, ctr)
651
  // ---- T37 THE NO-REGRESSION PROPERTY, over the WHOLE cross-product rather than a chosen case.
  // This is what makes the change safe for every lane shipping through this loop right now: a
  // rebuild the incumbent demanded is still demanded, whatever the bank happens to say.
  var t37: i64 = 1
  var pairs37: i64 = 0
  var c37: i64 = OSL_CLO_UNPROVEN
  while c37 <= OSL_CLO_CONTAINS {
      var p37: i64 = OSL_PROV_UNPROVEN
      while p37 <= OSL_PROV_DRIFTED {
          let old37: i64 = osl_should_rebuild("osg_conv_gate" as *u8, "osg_conv" as *u8, c37)
          let new37: i64 = osl_should_rebuild_prov("osg_conv_gate" as *u8, "osg_conv" as *u8, c37, p37)
          if old37 == 1 { if new37 != 1 { t37 = 0 } }
          pairs37 = pairs37 + 1
          p37 = p37 + 1
      }
      c37 = c37 + 1
  }
  if pairs37 == 0 { t37 = 0 }
  var m37: i64 = gk_cat(msg, 0, "  T37 closure x bank pairs checked=" as *u8)
  m37 = gk_catn(msg, m37, pairs37)
  m37 = gk_cat(msg, m37, " (expect 9: three closure states by three bank states)\n" as *u8)
  gk_say(msg, m37)
  gv_check("T37 the edge scan may only ever ADD a rebuild: across every closure-by-bank pair, every rebuild the incumbent demanded is still demanded, bound to the number of pairs actually compared" as *u8, t37, ctr)
675
  // ---- T38 neg-control: an UNPROVEN bank must change nothing whatsoever
  var t38: i64 = 1
  var pairs38: i64 = 0
  var c38: i64 = OSL_CLO_UNPROVEN
  while c38 <= OSL_CLO_CONTAINS {
      let u38: i64 = osl_should_rebuild_prov("osg_conv_gate" as *u8, "osg_conv" as *u8, c38, OSL_PROV_UNPROVEN)
      let b38: i64 = osl_should_rebuild("osg_conv_gate" as *u8, "osg_conv" as *u8, c38)
      if u38 != b38 { t38 = 0 }
      pairs38 = pairs38 + 1
      c38 = c38 + 1
  }
  if pairs38 == 0 { t38 = 0 }
  gv_check("T38 neg-control-unproven-bank-is-inert: with no recorded closure to compare, the decision is identical to the incumbent's on every closure state -- an absent bank must never be read as staleness, which is the build lane's own published envelope for its async path" as *u8, t38, ctr)
689
  // ---- T39 neg-control: a CURRENT bank must never VETO a rebuild the edge scan demands. This is the
  // direction that would turn a cheap fast path into a false green, and it is the one a naive
  // "just trust the hash" implementation gets wrong without ever failing a test.
  var t39: i64 = 0
  if osl_should_rebuild_prov("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_CONTAINS, OSL_PROV_CURRENT) == 1 { t39 = 1 }
  gv_check("T39 neg-control-bank-may-not-veto: a bank reading CURRENT does NOT suppress the rebuild an embedded-target closure demands -- the hash decides toward rebuilding and never away from it" as *u8, t39, ctr)
696
  // ---- T40 the target's own gate is never rebuilt twice, whatever the bank says about the artifact
  // it is reading, which for that one candidate is the PREVIOUS promote rather than what stage 1 built
  var t40: i64 = 1
  if osl_should_rebuild_prov("osg_self_gate" as *u8, "osg_self_gate" as *u8, OSL_CLO_CONTAINS, OSL_PROV_DRIFTED) != 0 { t40 = 0 }
  if osl_should_rebuild_prov("osg_self_gate" as *u8, "osg_self_gate" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_DRIFTED) != 0 { t40 = 0 }
  gv_check("T40 the target's own gate is never rebuilt a second time even against a DRIFTED bank, because stage 1 built that artifact in this very run and the resolver already prefers it" as *u8, t40, ctr)
703
  // ---- T41 the no-rebuild vintage picker: which excuse the reader is told
  var t41: i64 = 1
  if osl_vint_norebuild(OSL_PROV_DRIFTED, OSL_CLO_INDEPENDENT) != OSL_VINT_STALE_PROV { t41 = 0 }
  if osl_vint_norebuild(OSL_PROV_CURRENT, OSL_CLO_INDEPENDENT) != OSL_VINT_PROV_CURRENT { t41 = 0 }
  if osl_vint_norebuild(OSL_PROV_CURRENT, OSL_CLO_UNPROVEN) != OSL_VINT_PROV_CURRENT { t41 = 0 }
  if osl_vint_norebuild(OSL_PROV_UNPROVEN, OSL_CLO_UNPROVEN) != OSL_VINT_UNKNOWN_NOSRC { t41 = 0 }
  if osl_vint_norebuild(OSL_PROV_UNPROVEN, OSL_CLO_INDEPENDENT) != OSL_VINT_INDEPENDENT { t41 = 0 }
  gv_check("T41 a gate that was not rebuilt carries the vintage of the strongest evidence that excused it: a CURRENT bank outranks a source lookup that could not resolve, an UNPROVEN bank falls back to the incumbent's own two answers, and a DRIFTED bank reads STALE" as *u8, t41, ctr)
712
  // ---- T42 the three new vintages classify, and STALE_PROV is the one that must not acquit
  var t42: i64 = 1
  if osl_vint_current(OSL_VINT_PROV_CURRENT) != 1 { t42 = 0 }
  if osl_vint_current(OSL_VINT_REBUILT_PROV) != 1 { t42 = 0 }
  if osl_vint_current(OSL_VINT_STALE_PROV) != 0 { t42 = 0 }
  if osl_vint_rebuilt(OSL_PROV_DRIFTED) != OSL_VINT_REBUILT_PROV { t42 = 0 }
  if osl_vint_rebuilt(OSL_PROV_UNPROVEN) != OSL_VINT_REBUILT { t42 = 0 }
  if osl_vint_rebuilt(OSL_PROV_CURRENT) != OSL_VINT_REBUILT { t42 = 0 }
  gv_check("T42 a bank-proven artifact and a bank-driven rebuild both count as current while a PROVEN-stale one does not, and a successful rebuild records which instrument demanded it" as *u8, t42, ctr)
722
  // ---- T43 BITE the part-3 decision in both directions, holding the closure state FIXED so that
  // the bank is demonstrably what moved the answer and not the closure argument beside it
  var pb: i64 = 0
  if osl_should_rebuild_prov("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_DRIFTED) == 1 { pb = 1 }
  var pg: i64 = 0
  if osl_should_rebuild_prov("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_CURRENT) == 1 { pg = 1 }
  gv_bite("T43 BITE-bank-fires-and-is-silent: one INDEPENDENT gate is rebuilt on a DRIFTED bank and left alone on a CURRENT one, with every other argument held fixed" as *u8, pb, pg, ctr)
730
  // ---- T44/T45 AD2: the harness disclosure manifest (hermetic /tmp fixtures) ----
  gk_mkdir("/tmp/nx_organ_ship_gate/hm" as *u8)
  let hm_fx: *u8 = "/tmp/nx_organ_ship_gate/hm/extra.txt" as *u8
  gk_write(hm_fx, "alpha\n" as *u8)
  let hm_m: *u8 = "/tmp/nx_organ_ship_gate/hm/m.manifest" as *u8
  let hm_t1: *u8 = sys_mmap(24)
  let hm_r1: i64 = osl_harness_manifest(hm_m, "sha-fixture" as *u8, hm_fx, 1000, 0, hm_fx, hm_t1)
  let hm_t2: *u8 = sys_mmap(24)
  let hm_r2: i64 = osl_harness_manifest(hm_m, "sha-fixture" as *u8, hm_fx, 1000, 0, hm_fx, hm_t2)
  var t44: i64 = 0
  if hm_r1 > 0 { if hm_r1 == hm_r2 { if osl_streq(hm_t1, hm_t2) == 1 { t44 = 1 } } }
  gv_check("T44 AD2 the harness manifest is DETERMINISTIC: the same component set writes the same rows and the same token twice" as *u8, t44, ctr)
  gk_write(hm_fx, "beta-\n" as *u8)
  let hm_t3: *u8 = sys_mmap(24)
  osl_harness_manifest(hm_m, "sha-fixture" as *u8, hm_fx, 1000, 0, hm_fx, hm_t3)
  var hm_fires: i64 = 0
  if osl_streq(hm_t1, hm_t3) == 0 { hm_fires = 1 }
  gv_bite("T45 AD2 BITE-manifest-token: changing ONE component file changes the token, an unchanged set does not -- two results under different tokens are not comparable" as *u8, hm_fires, 1 - t44, ctr)
749
  // ---- T46-T50 THE BANK DESCRIBES ROOT B; PROVE MUST RUN WHAT THE BANK DESCRIBES (2026-09-05). Measured on
  // nx_janitor_caps_gate: a CURRENT bank, and PROVE ran the 20,695 B promoted fossil while the banked artifact was
  // 30,649 B. osl_pick_banked is the pure decision os_gate_freshen now takes on a CURRENT bank.
  gv_check_eq("T46 the resolver picked root B: KEEP whatever the digests say (nothing to switch to)" as *u8, osl_pick_banked(OSL_ROOT_B, "aa" as *u8, "bb" as *u8, 1), OSL_PICK_KEEP, ctr)
  gv_check_eq("T47 root A byte-identical to the banked root B: KEEP (the promoted binary IS the banked artifact)" as *u8, osl_pick_banked(OSL_ROOT_A, "s1" as *u8, "s1" as *u8, 1), OSL_PICK_KEEP, ctr)
  gv_check_eq("T48 root A differs from the banked root B: SWITCH to root B (the measured nx_janitor_caps_gate case)" as *u8, osl_pick_banked(OSL_ROOT_A, "s1" as *u8, "s2" as *u8, 1), OSL_PICK_SWITCH_B, ctr)
  gv_check_eq("neg-control-T49 root B ABSENT under a CURRENT bank is UNPROVEN, never KEEP (a refused build eats the fossil and leaves the sidecar)" as *u8, osl_pick_banked(OSL_ROOT_A, "s1" as *u8, "" as *u8, 0), OSL_PICK_UNPROVEN, ctr)
  gv_check_eq("neg-control-T50 an unreadable digest on either side is UNPROVEN, never a match" as *u8, osl_pick_banked(OSL_ROOT_A, "" as *u8, "s2" as *u8, 1), OSL_PICK_UNPROVEN, ctr)
758
  // ---- T51-T56 THE BANK VETOES A REBUILD ONLY WITH THE ARTIFACT IN HAND (2026-09-05). T39 stays true of
  // osl_should_rebuild_prov (a bank alone vetoes nothing); osl_should_rebuild_pick adds the artifact identity.
  gv_check_eq("T51 CONTAINS + CURRENT bank + KEEP (the resolved binary IS the banked artifact): no rebuild, the compile could only reproduce bytes on disk" as *u8, osl_should_rebuild_pick("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_CONTAINS, OSL_PROV_CURRENT, OSL_PICK_KEEP), 0, ctr)
  gv_check_eq("T52 CONTAINS + CURRENT bank + SWITCH_B (PROVE will run the banked artifact): no rebuild" as *u8, osl_should_rebuild_pick("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_CONTAINS, OSL_PROV_CURRENT, OSL_PICK_SWITCH_B), 0, ctr)
  gv_check_eq("neg-control-T53 CONTAINS + CURRENT bank + UNPROVEN pick (the banked artifact is GONE): the bank vetoes nothing, the incumbent rebuild stands" as *u8, osl_should_rebuild_pick("osg_conv_gate" as *u8, "osg_conv" as *u8, OSL_CLO_CONTAINS, OSL_PROV_CURRENT, OSL_PICK_UNPROVEN), 1, ctr)
  gv_check_eq("T54 DRIFTED bank rebuilds whatever the pick says (the hash decides toward rebuilding)" as *u8, osl_should_rebuild_pick("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_DRIFTED, OSL_PICK_KEEP), 1, ctr)
  gv_check_eq("T55 UNPROVEN bank + KEEP is the incumbent's answer on an INDEPENDENT closure (no rebuild)" as *u8, osl_should_rebuild_pick("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT, OSL_PROV_UNPROVEN, OSL_PICK_KEEP), osl_should_rebuild("osg_third_gate" as *u8, "osg_conv" as *u8, OSL_CLO_INDEPENDENT), ctr)
  gv_check_eq("T56 the target's own gate is never rebuilt twice, pick or no pick" as *u8, osl_should_rebuild_pick("osg_self_gate" as *u8, "osg_self_gate" as *u8, OSL_CLO_CONTAINS, OSL_PROV_DRIFTED, OSL_PICK_UNPROVEN), 0, ctr)
767
  return gv_verdict("organ_ship" as *u8, ctr, "declaration beats derivation, the run proves the artifact it just built rather than the previous promote, a gate is rebuilt whenever its banked closure no longer matches the tree and additionally whenever its own source imports what this run built, and every answer names the rule, the artifact and the vintage behind it" as *u8)
769}
770
nx_organ_ship_gate.nx source

`nx_organ_ship_gate.nx` source
