nx_page_verify_gate.nx source

1// nx_page_verify_gate.nx -- proves the browser-grade page verifier END-TO-END on the REAL edge: the fixed 2// /render3d page must be GREEN (exit 0), and the PERMANENT negctl fixture (sites/nishifamily/render3d/negctl.html: 3// a .png that answers HTML + a relative ref) must be RED with EXACTLY 2 broken -- the two classes that caused the 4// 2026-07-16 "the pngs are broken" incident. If the negctl leg ever passes, the verifier lost its teeth. 5// D001-MIGRATED 2026-08-18 onto nx_gate_verdict (per-tooth gv_check, exit carries the verdict, census- 6// readable). SUBJECT = the DEPLOYED verifier at its absolute nishihost path (the binary the estate actually 7// runs; the old /tmp subject was volatile and could silently test a stale or absent build). 8// license_tier: ORIGINAL expect_exit: 0 9import "nx_syscalls.nx" 10import "nx_gate_verdict.nx" 11import "nx_tool_run.nx" // tr_run_capture: the proven fork+capture primitive, for the teeth that read OUTPUT 12 13// ---- THE THIRD STATE TEETH (2026-08-22) ------------------------------------------------------------ 14// The verifier used to print VERDICT=RED when it could not CONNECT (status=0 bytes<0). A seat measured 15// that on a healthy page from a CWD where the domain registry did not resolve: two untouched control 16// pages gave byte-identical "RED", while the loopback vantage served 200 with every asset. "I could not 17// reach it" was spelled the same as "it is broken". These teeth pin the cure: no-connection -> exit 3 18// UNOBSERVABLE, vantage + reason named on the LAST line, never RED. The exit code is the fleet's 19// SKIP/UNOBSERVABLE code (nx_gate_verdict returns 3; /api/gate_run maps 3 -> SKIP). 20const PVG_EXIT_GREEN: i64 = 0 21const PVG_EXIT_RED: i64 = 1 22const PVG_EXIT_UNOBSERVABLE: i64 = 3 23const PVG_EXIT_EXEC_MISSING: i64 = 127 24// THE CLOSED-PORT CONTROL. 127.0.0.1:9 (discard) was VERIFIED CLOSED on this host by a SECOND, 25// independent instrument (nx_https_get with the same connect-override -> "connect failed") before it was 26// trusted here -- a probe port you did not verify free is not a control, it is a second instance. 27// If something ever listens on :9, T8 will report 200/RED instead of 3 and this tooth goes RED, which is 28// the correct alarm: the control stopped being a control. 29const PVG_CLOSED_PORT_OVERRIDE: *u8 = "127.0.0.1:9" 30const PVG_CAPTURE_CAP: i64 = 262144 31const PVG_ARGV_SLOTS: i64 = 8 32const PVG_WORD_BYTES: i64 = 8 33 34// ---- 2026-09-05: THE OVERSIZED DECLARED ASSET -- proven by its HEAD, refused by its head (browser BR48) ---- 35// A page can declare (meta name=nishi-<kind>) a rig larger than the verifier's whole-body budget; the live 36// /world/rigview rig is 10,758,232 B against an 8 MB PV_CAP and read UNOBSERVABLE three times before the 37// head-range retry (nx_https_fetch_head over the bounded-prefix reader) landed. These teeth pin BOTH 38// directions permanently: a rig-sized asset whose head carries NXANIM01 is VERIFIED-BY-HEAD and its page 39// is GREEN; the SAME-SIZED twin whose head carries no known magic stays UNOBSERVABLE (a partial read may 40// not convict and may not acquit). The fixtures are written by this gate at setup as SPARSE files (the 41// head at offset 0, one byte at the far end), so they cost the served tree no disk and the edge only what 42// the verifier actually reads; their size is the LIVE RIG'S measured size, not a fresh number, so the 43// fixture is exactly as big as the subject that motivated it. Idempotent: rewritten only when the size on 44// disk is not the declared size (lseek END on a read-only open), so a roster run never churns the tree. 45const PVG_BIGHEAD_BYTES: i64 = 10758232 // sites/nishifamily/world/ref9d.nxa, nx_fs size exact=1, 2026-09-05 46const PVG_BIGHEAD_MAGIC_PATH: *u8 = "sites/nishifamily/render3d/negctl_bighead_magic.nxa" 47const PVG_BIGHEAD_NOMAGIC_PATH: *u8 = "sites/nishifamily/render3d/negctl_bighead_nomagic.nxa" 48const PVG_BIGHEAD_MAGIC_PAGE: *u8 = "sites/nishifamily/render3d/negctl_bighead.html" 49const PVG_BIGHEAD_NOMAGIC_PAGE: *u8 = "sites/nishifamily/render3d/negctl_bighead_nomagic.html" 50const PVG_SEEK_SET: i64 = 0 51const PVG_SEEK_END: i64 = 2 52const PVG_NXA_MAGIC_LEN: i64 = 8 // NXANIM01, owned by nx_nxa.nx 53// THE FIXTURE PATHS ARE JOINED ONTO THE SUBJECT'S DIRECTORY, NEVER ONTO THE RUNNER'S CWD: a roster beat, a 54// behaviour probe and a seat fork this gate from three different directories, and a relative path written 55// from the wrong one lands the fixture where no edge serves it (the T15 tooth then reads a true absence 56// about the wrong tree). main() sets PVG_ROOTP from pvg_dirname(elf) -- the same derivation every leg 57// already uses for the subject's cwd -- and every fixture helper joins through pvg_abs. 58static PVG_ROOTP: i64 59const PVG_PATH_SEP: i64 = 47 // '/' 60const PVG_ABSPATH_CAP: i64 = 4096 // one absolute fixture path 61func pvg_abs(rel: *u8) -> *u8 { 62 let o: *u8 = sys_mmap(PVG_ABSPATH_CAP) 63 var n: i64 = 0 64 if PVG_ROOTP != 0 { 65 let r: *u8 = PVG_ROOTP as *u8 66 var i: i64 = 0 67 while r[i] != (0 as u8) { o[n] = r[i]; n = n + 1; i = i + 1 } 68 o[n] = PVG_PATH_SEP as u8; n = n + 1 69 } 70 var j: i64 = 0 71 while rel[j] != (0 as u8) { o[n] = rel[j]; n = n + 1; j = j + 1 } 72 o[n] = 0 as u8 73 return o 74} 75func pvg_file_size(rel: *u8) -> i64 { 76 let path: *u8 = pvg_abs(rel) 77 let fd: i64 = sys_openat_rd(path) 78 if fd < 0 { return 0 - 1 } 79 let n: i64 = sys_lseek(fd, 0, PVG_SEEK_END) 80 sys_close(fd) 81 return n 82} 83// write a sparse fixture of PVG_BIGHEAD_BYTES with `head` (PVG_NXA_MAGIC_LEN bytes) at offset 0; a null head 84// writes zero bytes there (the no-magic twin). 0 = present at the declared size (written or already there). 85func pvg_write_bighead(rel: *u8, head: *u8) -> i64 { 86 if pvg_file_size(rel) == PVG_BIGHEAD_BYTES { return 0 } 87 let path: *u8 = pvg_abs(rel) 88 let fd: i64 = sys_openat_wr(path, MODE_0644) 89 if fd < 0 { return 0 - 1 } 90 let z: *u8 = sys_mmap(PVG_NXA_MAGIC_LEN) // zero-filled by the kernel: the no-magic head and the far byte 91 var src: *u8 = z 92 if (head as i64) != 0 { src = head } 93 sys_write(fd, src, PVG_NXA_MAGIC_LEN) 94 sys_lseek(fd, PVG_BIGHEAD_BYTES - 1, PVG_SEEK_SET) 95 sys_write(fd, z, 1) 96 sys_close(fd) 97 return 0 98} 99func pvg_write_page(rel: *u8, body: *u8) -> i64 { 100 let path: *u8 = pvg_abs(rel) 101 let fd: i64 = sys_openat_wr(path, MODE_0644) 102 if fd < 0 { return 0 - 1 } 103 var n: i64 = 0 104 while body[n] != (0 as u8) { n = n + 1 } 105 sys_write(fd, body, n) 106 sys_close(fd) 107 return 0 108} 109 110func hw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 111// substring presence over a captured buffer (the gate's own tiny matcher; positional anchoring below) 112// REWRITTEN 2026-09-05 after the promoted gate died at 0x40b09a, an address 154 bytes PAST the mapped end of 113// its own 44,700-byte image: the old inner loop exited by adding 1000 to the cursor and then re-read lit[k] 114// at that cursor -- the CURSOR-SENTINEL idiom nx_srclint hunts -- so every mismatch read up to 1000 bytes past 115// the literal, and it only crashed once new tooth strings moved one literal within 1000 bytes of the image 116// end. The bound is now the literal's measured length, the loop leaves by break, and no byte past either 117// buffer is ever touched. 118func pvg_has(b: *u8, n: i64, lit: *u8) -> i64 { 119 var ll: i64 = 0 120 while lit[ll] != (0 as u8) { ll = ll + 1 } 121 if ll == 0 { return 1 } 122 var i: i64 = 0 123 while i + ll <= n { 124 var k: i64 = 0 125 var ok: i64 = 1 126 while ok == 1 { if k >= ll { break } if b[i+k] != lit[k] { ok = 0 } k = k + 1 } 127 if ok == 1 { return 1 } 128 i = i + 1 129 } 130 return 0 131} 132// does the LAST non-empty line of the capture start with `lit`? Positional, like gv_last_line -- 133// textual matching anywhere in the output would let an explanatory echo of the verdict word pass. 134func pvg_last_line_starts(b: *u8, n: i64, lit: *u8) -> i64 { 135 var e: i64 = n 136 while e > 0 { if b[e-1] == (10 as u8) { e = e - 1 } else { break } } // strip trailing newlines 137 var s: i64 = e 138 while s > 0 { if b[s-1] == (10 as u8) { break } s = s - 1 } 139 var k: i64 = 0 140 while lit[k] != (0 as u8) { if s + k >= e { return 0 } if b[s+k] != lit[k] { return 0 } k = k + 1 } 141 return 1 142} 143// ---- THE SUBJECT'S CWD IS DERIVED FROM THE SUBJECT, NEVER DECLARED (2026-08-22) ------------------- 144// The verifier opens data/mozilla_certdata.txt and knowledge/registry/our_domains.conf RELATIVE TO 145// ITS CWD. Run from anywhere else it prints "cannot load trust store" and exits 3 on EVERY leg -- and 146// this gate, forked by nx_sov_build_run (which anchors CWD to buildroot/), then reported 4/13 RED 147// against a correct subject. The gate was judging the runner's working directory in the subject's 148// name. So every leg now forks the subject IN THE DIRECTORY THE SUBJECT LIVES IN -- dirname of the 149// absolute elf path, which IS the nishihost root for both the promoted binary and its staged twin. 150// Not a hardcoded root: move the subject, the cwd moves with it. tr_run_capture_cwd is the proven 151// primitive; a cwd that cannot be entered returns TR_ERR_CHDIR (-6), a named harness failure. 152const PVG_CWD_CAP: i64 = 4096 153const PVG_NO_TIMEOUT: i64 = 0 // tr_run_capture_cwd: <=0 delegates to the unbounded capture (explicit opt-out contract) 154const PVG_SLASH: i64 = 47 155func pvg_dirname(path: *u8, out: *u8) -> i64 { 156 var last: i64 = 0 - 1 157 var i: i64 = 0 158 while path[i] != (0 as u8) { if path[i] == (PVG_SLASH as u8) { last = i } i = i + 1 } 159 if last <= 0 { out[0] = PVG_SLASH as u8; out[1] = 0 as u8; return 1 } 160 var k: i64 = 0 161 while k < last { if k < PVG_CWD_CAP - 1 { out[k] = path[k] } k = k + 1 } 162 out[last] = 0 as u8 163 return last 164} 165// fork the subject with two args IN ITS OWN DIRECTORY and CAPTURE stdout; returns the exit code, 166// *olen = bytes captured. a2 may be 0 for a one-arg run. 167func run2cap(elf: *u8, a1: *u8, a2: *u8, out: *u8, olen: *i64) -> i64 { 168 let av: *i64 = sys_mmap(PVG_WORD_BYTES*PVG_ARGV_SLOTS) as *i64 169 av[0] = elf as i64; av[1] = a1 as i64 170 if (a2 as i64) != 0 { av[2] = a2 as i64; av[3] = 0 } else { av[2] = 0 } 171 let cwd: *u8 = sys_mmap(PVG_CWD_CAP) 172 pvg_dirname(elf, cwd) 173 return tr_run_capture_cwd(elf, av, out, PVG_CAPTURE_CAP, olen, PVG_NO_TIMEOUT, cwd) 174} 175func pn(v: i64) -> i64 { let t: *u8=sys_mmap(24); var m: i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(24); var j: i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(1,b,k); return 0 } 176 177// run1/run2: exit-code-only legs, now routed through the cwd-aware capture so EVERY leg forks the 178// subject in its own directory (the hand-rolled fork+execve below them inherited the RUNNER's cwd, which 179// is how 7 correct teeth read as RED under nx_sov_build_run). Output is captured and discarded; the 180// gate judges exit codes on these legs, and the CLI's own runs remain the verbose surface. 181func run1(elf: *u8, a1: *u8) -> i64 { 182 let out: *u8 = sys_mmap(PVG_CAPTURE_CAP) 183 let olen: *i64 = sys_mmap(PVG_WORD_BYTES*2) as *i64 184 return run2cap(elf, a1, 0 as *u8, out, olen) 185} 186func run2(elf: *u8, a1: *u8, a2: *u8) -> i64 { 187 let out: *u8 = sys_mmap(PVG_CAPTURE_CAP) 188 let olen: *i64 = sys_mmap(PVG_WORD_BYTES*2) as *i64 189 return run2cap(elf, a1, a2, out, olen) 190} 191 192func main() -> i64 { 193 let ctr: *i64 = gv_ctr() 194 gv_head("nx_page_verify_gate -- the verifier's teeth, proven on the live edge against the DEPLOYED binary" as *u8) 195 // ABSOLUTE subject path (the 08-14 nx_manga_bubble_gate lesson): a relative path resolves against 196 // the RUNNER's CWD, and exit=127 (exec-not-found) then reads as six failing teeth. Measured here 197 // 2026-08-18 on first run: 0/6 with every leg exit=127 -- the gate was judging an absent binary. 198 let elf: *u8 = "/volume1/homes/elderwesto/nishihost/nx_page_verify.elf" as *u8 199 200 let rc1: i64 = run1(elf, "https://nishifamily.com/render3d" as *u8) 201 hw(" /render3d exit=" as *u8); pn(rc1); hw("\n" as *u8) 202 gv_check("T1 POSITIVE CONTROL: the fixed /render3d page is GREEN -- every asset fetches and decodes, so the deny-teeth below cannot be a verifier that refuses everything" as *u8, (rc1 == 0) as i64, ctr) 203 204 let rc2: i64 = run1(elf, "https://nishifamily.com/render3d/negctl.html" as *u8) 205 hw(" negctl exit=" as *u8); pn(rc2); hw("\n" as *u8) 206 gv_check("T2 neg-control-brokenpair: the permanent negctl fixture reports EXACTLY 2 broken (a png answering HTML + a double-quoted relative ref) -- the 2026-07-16 incident classes stay caught" as *u8, (rc2 == 2) as i64, ctr) 207 208 // ---- seq911: THE ROOT-FALLBACK BLIND SPOT, now a permanent neg-control ---------------- 209 // The edge answers 200 with the site ROOT for any unknown path. Every asset on it fetches 210 // and decodes, so the asset-only verdict said GREEN while the page you published had 211 // landed nowhere. Measured 2026-07-25 on /research/rt004.html (835-byte root served, a 212 // 10201-byte page published nowhere). These three legs pin the fix permanently. 213 let ghost: *u8 = "https://nishifamily.com/definitely-not-a-page-seq911.html" as *u8 214 let want: *u8 = "expect=Five Rejected Hypotheses" as *u8 215 216 let rc3: i64 = run1(elf, ghost) 217 hw(" ghost-path (no assertion) exit=" as *u8); pn(rc3); hw("\n" as *u8) 218 // RE-DERIVED 2026-08-18: the seq911 premise (edge serves the site ROOT for unknown paths, so a 219 // ghost path was GREEN) is GONE -- measured live via this very gate: the ghost now returns 220 // status=0/RED with no assertion at all. The blindness this tooth reproduced was closed elsewhere, 221 // so the tooth now asserts what is TRUE and load-bearing: a nonexistent page can NEVER be GREEN, 222 // assertion or not (rc3 != 0). T4 keeps the assertion contract on top. If the edge ever regrows a 223 // root fallback, rc3 returns to 0, this tooth goes RED, and the seq911 fixture is live again. 224 gv_check("T3 neg-control-ghostpage: a nonexistent path is NEVER GREEN even without a content assertion (the edge no longer serves a root fallback -- measured 2026-08-18; a return to GREEN here means the seq911 root-fallback blindness is back)" as *u8, (rc3 != 0) as i64, ctr) 225 226 let rc4: i64 = run2(elf, ghost, want) 227 hw(" ghost-path (expect=) exit=" as *u8); pn(rc4); hw("\n" as *u8) 228 gv_check("T4 neg-control-rootfallback: the SAME 200 is RED once a content assertion is given -- a 200 is not your page" as *u8, (rc4 == 1) as i64, ctr) 229 230 let rc5: i64 = run2(elf, "https://nishifamily.com/rt004.html" as *u8, want) 231 hw(" real page (expect=) exit=" as *u8); pn(rc5); hw("\n" as *u8) 232 gv_check("T5 ANTI-VACUITY: the REAL page passes the SAME content assertion, so expect= is a discriminator and not a blanket refusal" as *u8, (rc5 == 0) as i64, ctr) 233 234 // ---- 2026-08-18: THE SINGLE-QUOTE BLIND SPOT, now a permanent neg-control ----------------- 235 // The extractor recognised only src=" -- a page whose generator emitted src='...' had every 236 // image ref INVISIBLE to the verdict (neither checked nor law-red), and 15 relative gallery 237 // refs that 404'd in every browser shipped under GREEN. negctl_sq.html carries ONE such ref; 238 // the verifier must report exactly ONE broken. If this leg ever passes GREEN, the blindness is back. 239 let rc6: i64 = run1(elf, "https://nishifamily.com/render3d/negctl_sq.html" as *u8) 240 hw(" negctl_sq exit=" as *u8); pn(rc6); hw("\n" as *u8) 241 gv_check("T6 neg-control-singlequote: a single-quoted relative img ref is SEEN and law-red (exactly 1 broken) -- the extractor reads both quote styles; if this ever goes GREEN the blindness is back" as *u8, (rc6 == 1) as i64, ctr) 242 243 // ---- 2026-08-18: THE DOT-SEGMENT FALSE-RED, now a permanent POSITIVE control (debt 1787072049) ---- 244 // pv_normpath collapses /a/../b before fetch. Without it the verifier fetched the literal URL, got the 245 // client's own bad-url body (status=0, 82 bytes) and reported BROKEN x5 / VERDICT=RED on a page whose 246 // every asset served 200 -- a false red on the ruler, the kind everyone learns to ignore. negctl_dot.html 247 // carries ONE existing asset behind a ../ path and MUST be GREEN. Bite-proven at fixture birth via 248 // nx_behaveprobe prev: live rc=0, pre-normpath .prev rc=1 on this exact URL (2026-08-18). 249 let rc7: i64 = run1(elf, "https://nishifamily.com/render3d/negctl_dot.html" as *u8) 250 hw(" negctl_dot exit=" as *u8); pn(rc7); hw("\n" as *u8) 251 gv_check("T7 POSITIVE CONTROL dot-segment: a /a/../b ref to an EXISTING asset is normalized before fetch and GREEN -- a red here means the ruler refuses URLs every browser resolves" as *u8, (rc7 == 0) as i64, ctr) 252 253 // ---- 2026-08-22: THE THIRD STATE -- no-connection is UNOBSERVABLE, never RED ----------------- 254 let cap: *u8 = sys_mmap(PVG_CAPTURE_CAP) 255 let olen: *i64 = sys_mmap(PVG_WORD_BYTES*2) as *i64 256 let rc8: i64 = run2cap(elf, "https://nishifamily.com/compare/charsim" as *u8, PVG_CLOSED_PORT_OVERRIDE, cap, olen) 257 hw(" closed-port vantage exit=" as *u8); pn(rc8); hw(" captured=" as *u8); pn(olen[0]); hw("\n" as *u8) 258 gv_check("T8 no-connection-is-UNOBSERVABLE: a vantage that cannot connect (verified-closed 127.0.0.1:9) exits 3, not RED -- the page was never observed, so it cannot be convicted" as *u8, (rc8 == PVG_EXIT_UNOBSERVABLE) as i64, ctr) 259 // ANTI-VACUITY: the fixture must have reached the condition the tooth names. A subject that exited 3 260 // for some OTHER reason (no trust store, usage) would pass T8 by coincidence. The output must name 261 // the vantage it tried and the no-connection reason, and it must do so on the LAST line. 262 var t9: i64 = 0 263 if pvg_has(cap, olen[0], "reason=no-connection" as *u8) == 1 { if pvg_has(cap, olen[0], "vantage=pinned:127.0.0.1:9" as *u8) == 1 { t9 = 1 } } 264 gv_check("T9 anti-vacuity: the UNOBSERVABLE run NAMED its vantage (pinned:127.0.0.1:9) and its reason (no-connection) -- the fixture reached the condition T8 asserts" as *u8, t9, ctr) 265 gv_check("T10 verdict-line-is-LAST-and-positional: the final line starts with VERDICT=UNOBSERVABLE (gv_last_line anchors by position; an explanatory echo elsewhere must not count)" as *u8, pvg_last_line_starts(cap, olen[0], "VERDICT=UNOBSERVABLE" as *u8), ctr) 266 // NEVER RED ON NO-CONNECTION, stated as its own tooth so a regression to the old behaviour is named. 267 gv_check("T11 neg-control-never-red-on-no-connection: the captured output contains no VERDICT=RED -- the defect this lane fixed was exactly that word on exactly this input" as *u8, (pvg_has(cap, olen[0], "VERDICT=RED" as *u8) == 0) as i64, ctr) 268 // THE BITE PAIR: T1 is the allow case (a reachable page is GREEN). A subject that said UNOBSERVABLE 269 // for EVERYTHING would pass T8-T11 and look correct; pairing it with T1 catches that. 270 var bad8: i64 = 0 271 if rc8 == PVG_EXIT_UNOBSERVABLE { bad8 = 1 } 272 var good1: i64 = 1 273 if rc1 == PVG_EXIT_GREEN { good1 = 0 } 274 gv_bite("T12 neg-control-unreachable-abstains-AND-reachable-is-green: abstains on the closed port, green on the live edge -- a verifier that abstained on everything cannot score this" as *u8, bad8, good1, ctr) 275 // the subject must actually have RUN for any of the above to mean anything 276 gv_check("T13 neg-control-subject-executed: the closed-port leg was not exec-not-found (127) nor a harness sentinel -- the exit codes above came from the verifier, not from the fork" as *u8, ((rc8 != PVG_EXIT_EXEC_MISSING) as i64) * ((rc8 >= 0) as i64), ctr) 277 278 // ---- 2026-08-25: THE UNQUOTED-ATTRIBUTE BLIND SPOT, now a permanent neg-control ------------ 279 // The 2026-08-18 fix (T6) taught the extractor BOTH QUOTE STYLES and STOPPED AT TWO FORMS. The 280 // unquoted attribute is legal HTML and our own world/foundation page emitted FIFTEEN of them: 281 // sixteen image tags resolved to ONE ref, so the run could only declare a coverage gap it was 282 // unable to convict, and fifteen images were broken in every browser under that GREEN-PARTIAL. 283 // negctl_bare.html carries ONE such ref; the verifier must report exactly ONE broken, forever. 284 // T6 STRUCTURALLY CANNOT COVER THIS -- its fixture is single-quoted, so it stays GREEN while the 285 // bare form is invisible. That is why this is a separate tooth and not a widened T6. 286 let rc9: i64 = run1(elf, "https://nishifamily.com/render3d/negctl_bare.html" as *u8) 287 hw(" negctl_bare exit=" as *u8); pn(rc9); hw("\n" as *u8) 288 gv_check("T14 neg-control-unquoted: an UNQUOTED relative img ref is SEEN and law-red (exactly 1 broken) -- the extractor reads quoted AND bare attributes; if this ever goes GREEN the blindness is back" as *u8, (rc9 == 1) as i64, ctr) 289 290 // ---- 2026-09-05: THE OVERSIZED DECLARED ASSET (browser BR48) -- see PVG_BIGHEAD_* above ---------- 291 let root: *u8 = sys_mmap(PVG_CWD_CAP) 292 pvg_dirname(elf, root) 293 PVG_ROOTP = root as i64 294 pvg_write_bighead(PVG_BIGHEAD_MAGIC_PATH, "NXANIM01" as *u8) 295 pvg_write_bighead(PVG_BIGHEAD_NOMAGIC_PATH, 0 as *u8) 296 pvg_write_page(PVG_BIGHEAD_MAGIC_PAGE, "<html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width'><title>bighead magic fixture</title><meta name='nishi-model' content='/render3d/negctl_bighead_magic.nxa'></head><body><main><h1>bighead magic fixture</h1><p>permanent fixture written by nx_page_verify_gate: a rig-sized declared asset whose head carries NXANIM01, so the verifier must prove it by its head</p></main></body></html>\n" as *u8) 297 pvg_write_page(PVG_BIGHEAD_NOMAGIC_PAGE, "<html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width'><title>bighead nomagic fixture</title><meta name='nishi-model' content='/render3d/negctl_bighead_nomagic.nxa'></head><body><main><h1>bighead nomagic fixture</h1><p>permanent fixture written by nx_page_verify_gate: a rig-sized declared asset whose head carries no known magic, so the verifier must abstain, never convict</p></main></body></html>\n" as *u8) 298 gv_check("T15 fixture-reached-the-condition: both bighead fixtures are on disk at the live rig's measured size (10,758,232 B), larger than the verifier's whole-body budget, so the head-range path is the only door" as *u8, ((pvg_file_size(PVG_BIGHEAD_MAGIC_PATH) == PVG_BIGHEAD_BYTES) as i64) * ((pvg_file_size(PVG_BIGHEAD_NOMAGIC_PATH) == PVG_BIGHEAD_BYTES) as i64), ctr) 299 let capm: *u8 = sys_mmap(PVG_CAPTURE_CAP) 300 let olm: *i64 = sys_mmap(PVG_WORD_BYTES*2) as *i64 301 let rcm: i64 = run2cap(elf, "https://nishifamily.com/render3d/negctl_bighead.html" as *u8, 0 as *u8, capm, olm) 302 hw(" bighead-magic exit=" as *u8); pn(rcm); hw("\n" as *u8) 303 var t16: i64 = 0 304 if rcm == PVG_EXIT_GREEN { if pvg_has(capm, olm[0], "VERIFIED-BY-HEAD" as *u8) == 1 { if pvg_has(capm, olm[0], "verified-by-head=1" as *u8) == 1 { t16 = 1 } } } 305 gv_check("T16 POSITIVE CONTROL bighead-magic: a declared rig larger than the whole-body budget whose head carries NXANIM01 reads NXA MAGIC-OK VERIFIED-BY-HEAD, verified-by-head=1, and the page is GREEN -- the head is the proof a rig needs" as *u8, t16, ctr) 306 let capn: *u8 = sys_mmap(PVG_CAPTURE_CAP) 307 let oln: *i64 = sys_mmap(PVG_WORD_BYTES*2) as *i64 308 let rcn: i64 = run2cap(elf, "https://nishifamily.com/render3d/negctl_bighead_nomagic.html" as *u8, 0 as *u8, capn, oln) 309 hw(" bighead-nomagic exit=" as *u8); pn(rcn); hw("\n" as *u8) 310 var t17: i64 = 0 311 if rcn == PVG_EXIT_UNOBSERVABLE { if pvg_has(capn, oln[0], "carries no known magic" as *u8) == 1 { if pvg_has(capn, oln[0], "verified-by-head=0" as *u8) == 1 { t17 = 1 } } } 312 gv_check("T17 neg-control-bighead-nomagic: the SAME-SIZED twin whose head carries no known magic stays UNOBSERVABLE (exit 3, verified-by-head=0, the no-known-magic line named) -- a partial read may not convict and may not acquit" as *u8, t17, ctr) 313 gv_check("T18 neg-control-never-red-on-nomagic-head: the no-magic run contains no VERDICT=RED -- an oversized asset that cannot be proven is not a broken one" as *u8, (pvg_has(capn, oln[0], "VERDICT=RED" as *u8) == 0) as i64, ctr) 314 var badn: i64 = 0 315 if rcn == PVG_EXIT_UNOBSERVABLE { badn = 1 } 316 var goodm: i64 = 1 317 if rcm == PVG_EXIT_GREEN { goodm = 0 } 318 gv_bite("T19 neg-control-bighead-pair: the no-magic twin abstains AND the magic twin is green -- a verifier that abstained on every oversized asset, or blessed every one, cannot score this" as *u8, badn, goodm, ctr) 319 320 let rc: i64 = gv_verdict("PAGE-VERIFY-GATE", ctr, "live edge, deployed subject, permanent published fixtures; every tooth states its own strength" as *u8) 321 sys_exit(rc) 322 return rc 323}