code wiki / _hdl_build / nx_organkind_gate.nx
`nx_organkind_gate.nx` source

↩ module page · 427 lines · 24928 B
1// nx_organkind_gate.nx -- proves the role classifier that unblocks seq1492.
2// T5/T6 are load-bearing: they replay the EXACT failure (nx_torrent_get refused by BOTH verbs) and the
3// substring lie that caused it (`nx_torrent` must never match `nx_torrent_get`).
4// license_tier: ORIGINAL   expect_exit: 0   No hw writes (Rule 26).
5import "nx_organkind.nx"
6import "nx_gate_verdict.nx"
7
8const OG_BUF: i64 = 1024
9
10func og_eq(a: i64, b: i64) -> i64 { if a == b { return 1 } return 0 }
11func og_cpy(d: *u8, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { d[i] = s[i]; i = i + 1 }
  d[i] = 0 as u8
  return i
16}
17
18const OG_CONF: i64 = 65536
19const OG_HASH: i64 = 35
20const OG_LF: i64 = 10
21
22// seq1789: THE SAFETY OF THE TERMINAL-SUFFIX RULE, PROVEN AGAINST LIVE DATA RATHER THAN ASSERTED.
23// The rule is only sound if no organ that is actually a DAEMON carries an oracle suffix. That is a
24// property of the declaration file, not of the code, so a comment claiming it is worth nothing -- this
25// walks the real conf every run. Returns -1 when the conf is unreadable (the INSTRUMENT is broken, which
26// must FAIL rather than sail through as `zero conflicts found`), else the number of declared daemons
27// whose name would be captured by the suffix rule. Also reports how many daemon rows it actually saw, so
28// a truncated or empty conf cannot manufacture a vacuous pass.
29func og_daemon_suffix_conflicts(path: *u8, rows: *i64) -> i64 {
  rows[0] = 0
  rows[1] = 0
  // 2026-08-21: THE CAP IS REMOVED, NOT RAISED. This used to read at most OG_CONF-1 = 65535 bytes and
  // never check for truncation, over a file that has grown to ~53 KB / 921 declarations. A silent short
  // read here would fail in the DANGEROUS direction: rows past the cut read as UNDECLARED, and an
  // UNDECLARED *_gate name is promotable by the terminal-suffix rule -- so a truncated read could make a
  // DECLARED DAEMON promotable, the one misfile this entire policy exists to prevent (rule 26).
  // sys_read_file sizes its buffer from the file (lseek END) and drains to EOF, so a short read is not a
  // thing it can do. Not unmapped: this is a one-shot gate and the mapping dies with the process.
  // The SAME capped read still lives in ok_kind_of_path (the promote path's reader) -- T24 below is the
  // announce for it, because that lib is on the deploy path and is not this lane's to rebuild.
  let szp: *i64 = sys_mmap(16) as *i64
  szp[0] = 0
  let b: *u8 = sys_read_file(path, szp)
  if (b as i64) == 0 { return 0 - 1 }
  let tot: i64 = szp[0]
  if tot <= 0 { return 0 - 1 }
  let nmb: *u8 = sys_mmap(256)
  var bad: i64 = 0
  var ls: i64 = 0
  while ls < tot {
      var le: i64 = ls
      var s1: i64 = 1
      while s1 == 1 {
          if le >= tot { s1 = 0 } else {
              if b[le] == (OG_LF as u8) { s1 = 0 } else { le = le + 1 }
          }
      }
      var ne: i64 = ls
      var s2: i64 = 1
      while s2 == 1 {
          if ne >= le { s2 = 0 } else {
              if ok_is_sep(b[ne] as i64) == 1 { s2 = 0 } else { ne = ne + 1 }
          }
      }
      let nl: i64 = ne - ls
      if nl > 0 {
          if b[ls] != (OG_HASH as u8) {
              if nl < 250 {
                  var k: i64 = 0
                  while k < nl { nmb[k] = b[ls + k]; k = k + 1 }
                  nmb[nl] = 0 as u8
                  if ok_kind_of(b, tot, nmb) == OK_DAEMON {
                      rows[0] = rows[0] + 1
                      // 2026-08-19: an ORACLE-SUFFIXED DECLARED DAEMON IS LEGAL BY DESIGN (nx_studio_gate was
                      // declared `daemon` on 2026-08-15; organ_kind.conf itself says renaming it would be
                      // dodging classifiers by luck). The hazard this tooth guards is a daemon that the
                      // suffix rule could PROMOTE, so that is what is measured: declaration must win on the
                      // live row. The suffix collisions are COUNTED (rows[1]) so the reader sees them.
                      if ok_suffix_kind(nmb) == OK_ORACLE {
                          rows[1] = rows[1] + 1
                          if ok_may_promote(ok_kind_or_suffix(OK_DAEMON, nmb)) == 1 { bad = bad + 1 }
                      }
                  }
              }
          }
      }
      ls = le + 1
  }
  return bad
90}
91
92// ---- 2026-08-21: ONE KIND PER NAME. A DISAGREEING DUPLICATE IS A COIN FLIP WEARING A SCHEMA. --------
93// MEASURED on the live conf: 921 declarations over 797 distinct names -- 124 duplicate ROWS. Most AGREE
94// and are harmless additive re-declarations, and the file's own comment said exactly that. But FIVE names
95// carried TWO DIFFERENT KINDS (nx_codewiki_gate, nx_gatemap_gate, nx_hostctl_keepbackoff_gate,
96// nx_seedchurn_gate, nx_torrent_backoff_gate), and ok_kind_of RETURNS ON THE FIRST WHOLE-FIELD MATCH, so
97// WHICH kind is live is decided by LINE ORDER -- invisible to every reader of the file and flipped by any
98// re-sort, dedupe or merge. The five were reconciled to `oracle` in the data; this is the mechanism that
99// stops the class coming back silently.
100// WHY NOT THE GENERIC DETECTOR: nx_confdup is STRUCTURALLY BLIND here. Its COLLIDE-ROW pass keys on the
101// KEY ALONE and is shape-filtered to files where >=90 percent of keys are distinct; this file is ~86
102// percent distinct, so it is SKIPPED as a legitimate multi-row-per-key table -- and a value-aware version
103// of that generic rule would be pure noise on the tables the filter exists to protect. ONE KIND PER NAME
104// is a contract of THIS conf, known only to THIS conf's reader, so its enforcement belongs HERE.
105const OG_MAXROWS: i64 = 8192
106const OG_NAMEW:   i64 = 256
107const OG_BOX:     i64 = 64
108const OG_SEEK_END: i64 = 2
109
110func og_name_eq(b: *u8, o1: i64, l1: i64, o2: i64, l2: i64) -> i64 {
  if l1 != l2 { return 0 }
  var i: i64 = 0
  while i < l1 {
      if b[o1 + i] != b[o2 + i] { return 0 }
      i = i + 1
  }
  return 1
118}
119
120func og_kindname(k: i64) -> *u8 {
  if k == OK_DAEMON  { return "daemon" }
  if k == OK_ONESHOT { return "oneshot" }
  if k == OK_ORACLE  { return "oracle" }
  if k == OK_LIB     { return "lib" }
  if k == OK_FIXTURE { return "fixture" }
  return "UNDECLARED-OR-UNPARSEABLE"
127}
128
129func og_pname(b: *u8, off: i64, len: i64) -> i64 {
  let t: *u8 = sys_mmap(OG_NAMEW)
  var m: i64 = len
  if m > OG_NAMEW - 1 { m = OG_NAMEW - 1 }
  var i: i64 = 0
  while i < m { t[i] = b[off + i]; i = i + 1 }
  t[m] = 0 as u8
  gv_puts(t)
  sys_munmap(t, OG_NAMEW)
  return 0
139}
140
141// THE FILE'S OWN SIZE, taken INDEPENDENTLY of the read -- the second instrument for G1 below.
142// -1 means the size could not be established, and the caller must then treat the check as UNOBSERVABLE
143// rather than as a pass: "I could not look" is not "it is fine".
144func og_fsize(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let n: i64 = sys_lseek(fd, 0, OG_SEEK_END)
  sys_close(fd)
  return n
150}
151
152// PURE over a buffer, so a PLANTED conflict can be proven to FIRE without touching the live file.
153//   box[0] declaration rows seen
154//   box[1] AGREEING duplicate rows -- THE ANTI-VACUITY WITNESS. If this is 0 the duplicate path never
155//          executed, and a conflict count of 0 then proves nothing at all.
156//   box[2] names carrying two or more DIFFERENT kinds  (also the return value)
157//   box[3] 1 if the row table overflowed. NO SILENT CAP: a table that quietly stopped counting yields a
158//          SMALLER number that reads like BETTER NEWS, so overflow is reported and fails the tooth.
159// Offsets point INTO the caller's buffer -- no copy, so this costs no arena proportional to the file.
160func og_scan_conflicts(b: *u8, n: i64, box: *i64, verbose: i64) -> i64 {
  box[0] = 0
  box[1] = 0
  box[2] = 0
  box[3] = 0
  let noff: *i64 = sys_mmap(OG_MAXROWS * 8) as *i64
  let nlen: *i64 = sys_mmap(OG_MAXROWS * 8) as *i64
  let kind: *i64 = sys_mmap(OG_MAXROWS * 8) as *i64
  let lino: *i64 = sys_mmap(OG_MAXROWS * 8) as *i64
  let took: *i64 = sys_mmap(OG_MAXROWS * 8) as *i64
  var nr: i64 = 0
  var ls: i64 = 0
  var line: i64 = 0
  while ls < n {
      line = line + 1
      var le: i64 = ls
      var s1: i64 = 1
      while s1 == 1 {
          if le >= n { s1 = 0 } else { if b[le] == (OG_LF as u8) { s1 = 0 } else { le = le + 1 } }
      }
      var ne: i64 = ls
      var s2: i64 = 1
      while s2 == 1 {
          if ne >= le { s2 = 0 } else { if ok_is_sep(b[ne] as i64) == 1 { s2 = 0 } else { ne = ne + 1 } }
      }
      let nl: i64 = ne - ls
      var keep: i64 = 1
      if nl <= 0 { keep = 0 }
      if keep == 1 { if b[ls] == (OG_HASH as u8) { keep = 0 } }
      if keep == 1 {
          var ks: i64 = ne
          var s3: i64 = 1
          while s3 == 1 {
              if ks >= le { s3 = 0 } else { if ok_is_sep(b[ks] as i64) == 1 { ks = ks + 1 } else { s3 = 0 } }
          }
          var kend: i64 = ks
          var s4: i64 = 1
          while s4 == 1 {
              if kend >= le { s4 = 0 } else { if ok_is_sep(b[kend] as i64) == 1 { s4 = 0 } else { kend = kend + 1 } }
          }
          if nr < OG_MAXROWS {
              noff[nr] = ls
              nlen[nr] = nl
              kind[nr] = ok_kind_code(b, ks, kend)
              lino[nr] = line
              took[nr] = 0
              nr = nr + 1
              box[0] = box[0] + 1
          } else { box[3] = 1 }
      }
      ls = le + 1
  }
  var a: i64 = 0
  while a < nr {
      if took[a] == 0 {
          var conflict: i64 = 0
          var c2: i64 = a + 1
          while c2 < nr {
              if took[c2] == 0 {
                  if og_name_eq(b, noff[a], nlen[a], noff[c2], nlen[c2]) == 1 {
                      took[c2] = 1
                      if kind[c2] == kind[a] { box[1] = box[1] + 1 } else {
                          conflict = conflict + 1
                          if verbose == 1 {
                              gv_puts("  CONFLICTING-KIND name=" as *u8)
                              og_pname(b, noff[a], nlen[a])
                              gv_puts(" line=" as *u8); gv_num(lino[a])
                              gv_puts(" kind=" as *u8); gv_puts(og_kindname(kind[a]))
                              gv_puts("  VERSUS line=" as *u8); gv_num(lino[c2])
                              gv_puts(" kind=" as *u8); gv_puts(og_kindname(kind[c2]))
                              gv_puts("  <== FIRST MATCH WINS, so line " as *u8); gv_num(lino[a])
                              gv_puts(" is live and the other row is unreachable\n" as *u8)
                          }
                      }
                  }
              }
              c2 = c2 + 1
          }
          if conflict > 0 { box[2] = box[2] + 1 }
          took[a] = 1
      }
      a = a + 1
  }
  sys_munmap(noff as *u8, OG_MAXROWS * 8)
  sys_munmap(nlen as *u8, OG_MAXROWS * 8)
  sys_munmap(kind as *u8, OG_MAXROWS * 8)
  sys_munmap(lino as *u8, OG_MAXROWS * 8)
  sys_munmap(took as *u8, OG_MAXROWS * 8)
  return box[2]
249}
250
251// Slurps the WHOLE file (sys_read_file: sized from the file, cannot short-read) and records the byte
252// count in box[4] so the caller can compare it against an independent lseek and prove it read it all.
253func og_conflicts_path(path: *u8, box: *i64) -> i64 {
  let szp: *i64 = sys_mmap(16) as *i64
  szp[0] = 0
  let b: *u8 = sys_read_file(path, szp)
  if (b as i64) == 0 { return 0 - 1 }
  let n: i64 = szp[0]
  if n <= 0 { return 0 - 1 }
  let c: i64 = og_scan_conflicts(b, n, box, 1)
  box[4] = n
  return c
263}
264
265func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_organkind_gate -- classify by ROLE not NAME (seq1492)" as *u8)
268
  let b: *u8 = sys_mmap(OG_BUF)
  let n: i64 = og_cpy(b, "sites.elf daemon\nnx_torrent_get oneshot\nnx_torrent_daemon daemon\nnx_poolgov lib\nnx_procchurn oracle\n" as *u8)
271
  gv_check("T1 a declared daemon classifies as daemon" as *u8,
           og_eq(ok_kind_of(b, n, "sites.elf" as *u8), OK_DAEMON), ctr)
  gv_check("T2 a declared one-shot classifies as oneshot" as *u8,
           og_eq(ok_kind_of(b, n, "nx_torrent_get" as *u8), OK_ONESHOT), ctr)
  gv_check("T3 a declared lib classifies as lib" as *u8,
           og_eq(ok_kind_of(b, n, "nx_poolgov" as *u8), OK_LIB), ctr)
  gv_check("T4 a declared oracle classifies as oracle" as *u8,
           og_eq(ok_kind_of(b, n, "nx_procchurn" as *u8), OK_ORACLE), ctr)
280
  // ---- THE EXACT seq1492 FAILURE, now decided by ROLE ----
  let kget: i64 = ok_kind_of(b, n, "nx_torrent_get" as *u8)
  var t5: i64 = 0
  if ok_may_promote(kget) == 1 { if ok_may_deploy(kget) == 0 { t5 = 1 } }
  gv_check("T5 nx_torrent_get is PROMOTABLE and NOT deployable (it has no port to health-probe)" as *u8, t5, ctr)
  let kdae: i64 = ok_kind_of(b, n, "nx_torrent_daemon" as *u8)
  var t6: i64 = 0
  if ok_may_deploy(kdae) == 1 { if ok_may_promote(kdae) == 0 { t6 = 1 } }
  gv_bite("T6 a DAEMON is deployable and NOT promotable (never swap a binary under a live process)" as *u8,
          t6, og_eq(ok_may_promote(kdae), 1), ctr)
291
  // ---- the substring lie that produced the defect ----
  gv_bite("T7 'nx_torrent' does NOT match 'nx_torrent_get' -- whole-field only" as *u8,
          og_eq(ok_kind_of(b, n, "nx_torrent" as *u8), OK_UNKNOWN),
          og_eq(ok_kind_of(b, n, "nx_torrent_get" as *u8), OK_UNKNOWN), ctr)
296
  // ---- fail-closed: undeclared is refused by BOTH verbs, never name-guessed ----
  let ku: i64 = ok_kind_of(b, n, "nx_never_declared" as *u8)
  var t8: i64 = 0
  if ku == OK_UNKNOWN { if ok_may_deploy(ku) == 0 { if ok_may_promote(ku) == 0 { t8 = 1 } } }
  gv_bite("T8 an UNDECLARED organ is refused by BOTH verbs (no fall-through to a name guess)" as *u8,
          t8, og_eq(ok_is_shippable(ku), 1), ctr)
  gv_check("T9 a LIB is shippable by neither verb (it compiles INTO consumers)" as *u8,
           og_eq(ok_is_shippable(ok_kind_of(b, n, "nx_poolgov" as *u8)), 0), ctr)
  gv_check("T10 ok_is_shippable is TRUE for both a daemon and a one-shot" as *u8,
           og_eq(ok_is_shippable(kdae) + ok_is_shippable(kget), 2), ctr)
  gv_bite("T11 an empty name REFUSES instead of matching the first row" as *u8,
          og_eq(ok_kind_of(b, n, "" as *u8), OK_UNKNOWN),
          og_eq(ok_kind_of(b, n, "sites.elf" as *u8), OK_UNKNOWN), ctr)
310
  // ---- seq1789: THE TERMINAL-SUFFIX RULE, AND THE PROOF IT CANNOT MISFILE A DAEMON ----
  // The defect: md_promote_deny asked `does the name CONTAIN "serve"`, so nx_survey_serve_gate -- an
  // oracle -- was refused as a daemon and could not ship by any route. T12 is the discriminator that
  // was missing: CONTAINS vs ENDS-WITH. Position is meaning.
  gv_bite("T12 the suffix is TERMINAL, not a substring: nx_survey_serve_gate ENDS with _gate; nx_gate_bite merely CONTAINS it" as *u8,
          og_eq(ok_ends_with("nx_survey_serve_gate" as *u8, "_gate" as *u8), 1),
          og_eq(ok_ends_with("nx_gate_bite" as *u8, "_gate" as *u8), 1), ctr)
  gv_check("T13 an oracle suffix classifies an UNDECLARED name as OK_ORACLE" as *u8,
           og_eq(ok_suffix_kind("nx_survey_serve_gate" as *u8), OK_ORACLE), ctr)
  gv_check("T14 _test and _kat carry the same meaning as _gate" as *u8,
           og_eq(ok_suffix_kind("nx_hostctl_syscalls_test" as *u8) + ok_suffix_kind("nx_mlkem_kat" as *u8), OK_ORACLE + OK_ORACLE), ctr)
  gv_bite("T15 THE seq1789 REPLAY: undeclared nx_survey_serve_gate is promotable by suffix; nx_gallery_serve (no oracle suffix) still is not" as *u8,
          og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_survey_serve_gate" as *u8)), 1),
          og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_gallery_serve" as *u8)), 1), ctr)
  // The asymmetry this whole policy exists to protect: misfiling a DAEMON as a one-shot is the only
  // dangerous direction (rule 26). T16 proves a declaration always beats the suffix, and T17 proves the
  // suffix rule is one-directional -- it has no expressible path to OK_DAEMON.
  gv_bite("T16 A DECLARATION STILL WINS: a daemon declared *_gate stays NOT promotable; the same name UNDECLARED is" as *u8,
          og_eq(ok_may_promote(ok_kind_or_suffix(OK_DAEMON, "nx_pretend_gate" as *u8)), 0),
          og_eq(ok_may_promote(ok_kind_or_suffix(OK_UNKNOWN, "nx_pretend_gate" as *u8)), 0), ctr)
  gv_check("T17 ok_suffix_kind is ONE-DIRECTIONAL -- it can never yield OK_DAEMON for any daemon-shaped name" as *u8,
           og_eq(ok_suffix_kind("nx_torrent_daemon" as *u8) + ok_suffix_kind("sites.elf" as *u8) + ok_suffix_kind("nx_gallery_serve" as *u8),
                 OK_UNKNOWN + OK_UNKNOWN + OK_UNKNOWN), ctr)
  // T18 is the one that matters: the rule's safety is a property of the LIVE declaration file, so it is
  // MEASURED here, not promised in a comment. An unreadable conf or a conf with zero daemon rows FAILS
  // -- a check that cannot distinguish `no conflicts` from `nothing examined` proves nothing.
  let ogrows: *i64 = sys_mmap(16)
  // /api/gate_run forks from the serving root and the roster beat from the estate root; the conf is at
  // the root either way, but probe ../ too so a buildroot launch still measures the LIVE file.
  var ogc: i64 = og_daemon_suffix_conflicts("knowledge/status/organ_kind.conf" as *u8, ogrows)
  if ogc < 0 { ogc = og_daemon_suffix_conflicts("../knowledge/status/organ_kind.conf" as *u8, ogrows) }
  var t18: i64 = 0
  if ogc == 0 { if ogrows[0] > 0 { t18 = 1 } }
  gv_puts("  live organ_kind.conf: declared daemons=" as *u8); gv_num(ogrows[0])
  gv_puts(" of which oracle-suffixed=" as *u8); gv_num(ogrows[1]); gv_puts(" promotable-by-suffix=" as *u8); gv_num(ogc); gv_puts("\n" as *u8)
  gv_check("T18 LIVE DATA: no declared daemon is PROMOTABLE by its oracle suffix (declaration wins on the live conf), over a NON-EMPTY daemon set (unreadable or empty conf FAILS, never passes vacuously)" as *u8,
           t18, ctr)
348
  // ---- 2026-08-21: THE DISAGREEING-DUPLICATE CLASS ----------------------------------------------
  // T19 and T20 are a PAIR and the pair IS the finding: the SAME two rows in the OPPOSITE ORDER give
  // the OPPOSITE answer. That is not a curiosity, it is the hazard -- a name declared twice with two
  // kinds resolves by LINE POSITION, which no reader of the conf can see and which any re-sort flips.
  let d1: *u8 = sys_mmap(OG_BUF)
  let dn1: i64 = og_cpy(d1, "nx_dup_probe oracle\nnx_dup_probe oneshot\n" as *u8)
  gv_check("T19 FIRST MATCH WINS (read out of ok_kind_of, not assumed): with oracle ABOVE oneshot the live kind is ORACLE" as *u8,
           og_eq(ok_kind_of(d1, dn1, "nx_dup_probe" as *u8), OK_ORACLE), ctr)
  let d2: *u8 = sys_mmap(OG_BUF)
  let dn2: i64 = og_cpy(d2, "nx_dup_probe oneshot\nnx_dup_probe oracle\n" as *u8)
  gv_check("neg-control-T20 THE ORDER IS THE ANSWER: the SAME two rows swapped resolve to ONESHOT instead, so a disagreeing duplicate is decided by line position and not by evidence (an order-independent reader would fail this)" as *u8,
           og_eq(ok_kind_of(d2, dn2, "nx_dup_probe" as *u8), OK_ONESHOT), ctr)
361
  // T21 PLANTS THE KNOWN-BAD IN MEMORY. A detector that has only ever seen clean data has not been
  // shown to fire, and the live conf is (now) clean -- so the firing proof cannot come from the live
  // file. The fixture also carries an AGREEING duplicate that must NOT be reported, because a detector
  // that flags all 124 benign duplicates is a permanently-red one everybody learns to ignore.
  let cbox: *i64 = sys_mmap(OG_BOX) as *i64
  let pb: *u8 = sys_mmap(OG_BUF)
  let pn: i64 = og_cpy(pb, "nx_a oracle\nnx_b oneshot\nnx_a oracle\nnx_c oneshot\nnx_c daemon\n" as *u8)
  let pc: i64 = og_scan_conflicts(pb, pn, cbox, 0)
  var t21: i64 = 0
  if pc == 1 { if cbox[0] == 5 { if cbox[1] == 1 { if cbox[3] == 0 { t21 = 1 } } } }
  gv_puts("  planted fixture: rows=" as *u8); gv_num(cbox[0])
  gv_puts(" agreeing_dups=" as *u8); gv_num(cbox[1])
  gv_puts(" conflicting_names=" as *u8); gv_num(pc)
  gv_puts(" overflow=" as *u8); gv_num(cbox[3]); gv_puts("\n" as *u8)
  gv_bite("T21 THE DETECTOR FIRES ON A PLANTED CONFLICT and stays quiet on a benign one: 5 rows, the AGREEING duplicate nx_a ignored, the DISAGREEING name nx_c (oneshot vs daemon) reported exactly once" as *u8,
          t21, og_eq(pc, 0), ctr)
378
  // T22/T23/T24 are about the LIVE declaration file. T22 is the class this lane closed; T23 is G1 (two
  // instruments, one fact) so a clean verdict cannot be a statement about a prefix; T24 is the announce
  // for the ONE capped reader this lane could not fix, because it lives on the deploy path.
  let lbox: *i64 = sys_mmap(OG_BOX) as *i64
  var lpath: *u8 = "knowledge/status/organ_kind.conf" as *u8
  var lc: i64 = og_conflicts_path(lpath, lbox)
  if lc < 0 { lpath = "../knowledge/status/organ_kind.conf" as *u8; lc = og_conflicts_path(lpath, lbox) }
  let lsz: i64 = og_fsize(lpath)
  gv_puts("  live organ_kind.conf: rows=" as *u8); gv_num(lbox[0])
  gv_puts(" agreeing_dups=" as *u8); gv_num(lbox[1])
  gv_puts(" CONFLICTING_NAMES=" as *u8); gv_num(lc)
  gv_puts(" parsed_bytes=" as *u8); gv_num(lbox[4])
  gv_puts(" file_bytes=" as *u8); gv_num(lsz)
  gv_puts(" lib_reader_cap=" as *u8); gv_num(OK_CONFBUF - 1)
  gv_puts(" headroom=" as *u8); gv_num(OK_CONFBUF - 1 - lsz)
  gv_puts(" row_table_overflow=" as *u8); gv_num(lbox[3]); gv_puts("\n" as *u8)
  var t22: i64 = 0
  if lc == 0 { if lbox[0] > 0 { if lbox[3] == 0 { t22 = 1 } } }
  gv_check("T22 LIVE DATA: ZERO names declare two DIFFERENT kinds, over a NON-EMPTY row set that did NOT overflow its row table -- an unreadable, empty or truncated-table conf FAILS rather than passing vacuously. CORRECTED 2026-08-29: the duplicate-path-executed evidence is the PLANTED fixture above (T21 parses agreeing_dups=1), never the live file. Requiring LIVE duplicates made this tooth forbid draining the very class it watches -- nx_kinddedupe took 125 agreeing dups to 0 and the gate went RED on the fix. A tooth that needs the defect to persist in production is a fixture error wearing a safeguard's name" as *u8,
           t22, ctr)
  var t23: i64 = 0
  if lsz > 0 { if lbox[4] == lsz { t23 = 1 } }
  gv_check("T23 G1 TWO INSTRUMENTS ONE FACT: the bytes this gate PARSED equal the file's own lseek size, so the zero above is a statement about the WHOLE file and not about a prefix of it" as *u8,
           t23, ctr)
  var t24: i64 = 0
  if lsz > 0 { if lsz < OK_CONFBUF - 1 { t24 = 1 } }
  gv_check("T24 LIB READER HEADROOM: organ_kind.conf still fits inside ok_kind_of_path's FIXED OK_CONFBUF read, which has no truncation check -- past that cap a DECLARED DAEMON reads as UNDECLARED and the terminal-suffix rule makes a *_gate name PROMOTABLE, the one misfile rule 26 forbids. The bound is the lib's own constant, not a number picked here" as *u8,
           t24, ctr)
407
  // ---- 2026-09-02: FIXTURE, the kind the adoption ladder lacked (five DONE rungs on /compare/lang read
  // SOURCE-ONLY because their runnable witnesses had no declared kind). Parsed like every other kind,
  // refused by both ship verbs like a lib, and proven on the LIVE file so a declaration cannot rot silently.
  let fb: *u8 = sys_mmap(OG_BUF)
  let fbn: i64 = og_cpy(fb, "nx_checked_arith fixture\nnx_torrent_get oneshot\n" as *u8)
  gv_check("T25 a declared fixture classifies as fixture (a runnable witness its gate compiles per run)" as *u8,
           og_eq(ok_kind_of(fb, fbn, "nx_checked_arith" as *u8), OK_FIXTURE), ctr)
  gv_check("T26 a FIXTURE is shippable by neither verb (nothing to promote, no port to probe)" as *u8,
           og_eq(ok_is_shippable(OK_FIXTURE), 0), ctr)
  gv_bite("T27 fixture is a WHOLE-WORD kind: the same table's oneshot row still reads oneshot, never fixture (a reader keyed on length alone would fail here, both are 7 letters)" as *u8,
          og_eq(ok_kind_of(fb, fbn, "nx_torrent_get" as *u8), OK_ONESHOT),
          og_eq(ok_kind_of(fb, fbn, "nx_torrent_get" as *u8), OK_FIXTURE), ctr)
  gv_check("T28 LIVE DATA: nx_checked_arith is DECLARED fixture in the live organ_kind.conf and reads back as OK_FIXTURE through the deploy-path reader (an absent or undeclared row FAILS, never passes vacuously)" as *u8,
           og_eq(ok_kind_of_path(lpath, "nx_checked_arith" as *u8), OK_FIXTURE), ctr)
422
  let rc: i64 = gv_verdict("ORGANKIND-GATE" as *u8, ctr, "role-based ship policy proven; undeclared refused by both verbs; fixture declared, parsed, unshippable and live" as *u8)
  sys_exit(rc)
  return rc
426}
427
nx_organkind_gate.nx source

`nx_organkind_gate.nx` source
