code wiki / (root) / nx_refusal_shape_gate.nx
`nx_refusal_shape_gate.nx` source

↩ module page · 476 lines · 29599 B
1// nx_refusal_shape_gate.nx -- THE REFEREE FOR FM11 (/compare/failmodes rung: fc_refusal_shape).
2//
3// THE ACCEPT RULE THIS GATE ENFORCES, QUOTED FROM failmodes.plan BEFORE THE WORK BEGAN:
4//   "run it over the estate's EXISTING refusal messages and publish the pass rate; it is accepted
5//    only if it PASSES the three known-correct guards (the nx_fs read truncation envelope, the
6//    build-admission refusal, the capability-denied mint recipe) AND FAILS a crafted refusal that
7//    names no remedy."
8// * A SHAPE CHECKER THAT FLAGS A KNOWN-GOOD GUARD IS WORSE THAN NONE, BECAUSE SOMEONE WILL ACT ON
9//   IT. * The three known-good teeth below read the REAL production sources, not a fixture: a
10//   control drawn from the population under test is not a control, and a control drawn from a
11//   fixture proves only that the fixture was written to pass.
12//
13// FIXTURES ARE ASSEMBLED AT RUNTIME UNDER /tmp AND THEIR REFUSAL TEXT COMES FROM THE CONF.
14// A source-scanning detector finds its own fixture and accuses its author first, so not one
15// refusal marker is written as a literal in this file: the fixtures splice marker[0] and
16// remedy[0] out of the loaded vocabulary. That also makes the fixtures track the conf -- a
17// fixture whose vocabulary has drifted from the detector's is a test of nothing.
18// Scratch lives in /tmp/nx_refusal_shape_gate/ because a gate that shares a fixture with a
19// production path reports on the fixture, and every fixture is rewritten on every run because a
20// gate that is not idempotent reports on its first run and lies about every run after.
21//
22// THE BASELINE IS DELETED AT SETUP so the self-baseline direction is genuinely exercised; the
23// ratchet is bite-proven in THREE directions, because a ratchet that rewrites its baseline on a
24// rise launders itself green and can never fire twice.
25//
26// license_tier: ORIGINAL
27// module: nishi-core.quality.refusal_shape
28// capability: REFUSAL_EMITTER_SHAPE_GATE
29import "nx_gate_verdict.nx"
30import "nx_refusal_shape_lib.nx"
31
32const RSG_DIR:  *u8 = "/tmp/nx_refusal_shape_gate/"
33const RSG_BUF:  i64 = 262144
34const RSG_PATH: i64 = 4096
35const RSG_OUTC: i64 = 262144
36const RSG_MODE_0755: i64 = 493
37
38// Fixture kinds. Each is a MINIMAL NishiLang shape carrying exactly one message, so a tooth binds
39// to one block and never to an aggregate.
40const RSG_GOOD:    i64 = 0      // composed across two literals with a literal-free line between
41const RSG_NOREM:   i64 = 1      // names a particular, names no remedy
42const RSG_BARE:    i64 = 2      // names neither
43const RSG_NOTREF:  i64 = 3      // carries no marker at all: NOT in the population
44const RSG_COMMENT: i64 = 4      // the marker exists ONLY inside a comment: NOT in the population
45const RSG_BRACE:   i64 = 5      // a remedy sits past a closing brace and must NOT be borrowed
46const RSG_SHORT:   i64 = 6      // too short to judge: UNKNOWN, and never an offender
47const RSG_TRAIL:   i64 = 7      // a QUOTED refusal inside a TRAILING comment on a code line
48const RSG_TESTA:   i64 = 8      // states BOTH outcomes at once: a gate tooth, not a refusal
49const RSG_USAGEB:  i64 = 9      // a call-grammar banner: its own remedy
50
51func rsg_join(dst: *u8, name: *u8) -> i64 {
  var o: i64 = gk_cat(dst, 0, RSG_DIR)
  o = gk_cat(dst, o, name)
  dst[o] = 0 as u8
  return o
56}
57
58func rsg_cat_voc(dst: *u8, o: i64, conf: *u8, voc: *i64, base: i64, idx: i64) -> i64 {
  var k: i64 = 0
  var p: i64 = o
  while k < voc[base + idx * 2 + 1] {
      dst[p] = conf[voc[base + idx * 2] + k]
      p = p + 1
      k = k + 1
  }
  return p
67}
68
69// Compose one fixture FROM THE VOCABULARY and write it. Returns 1 on a successful write.
70func rsg_fixture(path: *u8, conf: *u8, voc: *i64, kind: i64) -> i64 {
  let b: *u8 = sys_mmap(RSG_BUF)
  var o: i64 = gk_cat(b, 0, "func f() -> i64 {\n" as *u8)
  // ⚠ THE QUOTES HERE ARE LOAD-BEARING AND WERE ADDED AFTER A MUTATION SURVIVED. The first
  // version of this fixture put the marker in a comment with NO string literal in it -- which no
  // implementation could ever harvest, break rule or not, so the tooth passed for the wrong
  // reason and removing the comment break did not turn the gate red. A fixture the defect cannot
  // fail is not a test. The real hazard is exactly this shape: prose QUOTING the message it
  // describes, which is how every organ in this estate documents its own guards.
  if kind == RSG_COMMENT {
      o = gk_cat(b, o, "    // the guard used to print \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " at path=/tmp/x\" and that prose must never be harvested as an emitted message\n" as *u8)
  }
  if kind == RSG_TRAIL {
      o = gk_cat(b, o, "    o = p(o, \" a plain line with count=3\" as *u8) // \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " at path=/tmp/x\"\n" as *u8)
  }
  if kind == RSG_NOTREF {
      o = gk_cat(b, o, "    o = p(o, \" a plain informational line with count=3 and nothing more\" as *u8)\n" as *u8)
  }
  if kind == RSG_GOOD {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " capture_cap=\" as *u8)\n" as *u8)
      o = gk_cat(b, o, "    o = pn(o, x)\n" as *u8)
      o = gk_cat(b, o, "    o = p(o, \" -- " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_REMBASE, 0)
      o = gk_cat(b, o, " with _async=1]\" as *u8)\n" as *u8)
  }
  if kind == RSG_NOREM {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " the operation on cid=7 did not complete\" as *u8)\n" as *u8)
  }
  if kind == RSG_BARE {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " and there is nothing here at all to act upon\" as *u8)\n" as *u8)
  }
  if kind == RSG_BRACE {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " the widget at id=9 is unavailable\" as *u8)\n" as *u8)
      o = gk_cat(b, o, "}\n" as *u8)
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_REMBASE, 0)
      o = gk_cat(b, o, " with a different widget\" as *u8)\n" as *u8)
  }
  if kind == RSG_TESTA {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " tooth id=3 " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_PASSBASE, 0)
      o = gk_cat(b, o, " or " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_FAILBASE, 0)
      o = gk_cat(b, o, "\" as *u8)\n" as *u8)
  }
  if kind == RSG_USAGEB {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_SRBASE, 0)
      o = gk_cat(b, o, " nx_thing <verb> <arg> and nothing further is said here\" as *u8)\n" as *u8)
  }
  if kind == RSG_SHORT {
      o = gk_cat(b, o, "    o = p(o, \" " as *u8)
      o = rsg_cat_voc(b, o, conf, voc, RS_V_BASE, 0)
      o = gk_cat(b, o, " x\" as *u8)\n" as *u8)
  }
  o = gk_cat(b, o, "}\n" as *u8)
  b[o] = 0 as u8
  let r: i64 = gk_write(path, b)
  sys_munmap(b, RSG_BUF)
  if r < 0 { return 0 }
  return 1
145}
146
147// Scan ONE path with a fresh results vector. `want` may be 0.
148func rsg_scan1(path: *u8, conf: *u8, voc: *i64, want: *u8) -> *i64 {
  let res: *i64 = rs_res_new()
  let out: *u8 = sys_mmap(RSG_OUTC)
  let oo: *i64 = sys_mmap(RS_SMALL) as *i64
  oo[0] = 0
  rs_file_scan(path, conf, voc, res, out, RSG_OUTC, oo, want)
  sys_munmap(out, RSG_OUTC)
  return res
156}
157
158func rsg_show(label: *u8, res: *i64) -> i64 {
  gv_puts("    " as *u8); gv_puts(label)
  gv_puts(" blocks="  as *u8); gv_num(res[RS_R_BLOCKS])
  gv_puts(" population=" as *u8); gv_num(res[RS_R_POP])
  gv_puts(" shaped=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_SHAPED])
  gv_puts(" noremedy=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_NOREMEDY])
  gv_puts(" nosubject=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_NOSUBJECT])
  gv_puts(" bare=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_BARE])
  gv_puts(" unknown=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_UNKNOWN])
  gv_puts(" testassert=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_TEST])
  gv_puts(" usagebanner=" as *u8); gv_num(res[RS_R_BUCKET0 + RS_B_USAGE])
  gv_puts(" offenders=" as *u8); gv_num(res[RS_R_OFFENDERS])
  gv_puts(" want_bucket=" as *u8); gv_num(res[RS_R_WANTBUCKET])
  gv_puts(" want_hits=" as *u8); gv_num(res[RS_R_WANTHITS])
  gv_puts("\n" as *u8)
  return 0
174}
175
176func main(argc: i64, argv: *i64) -> i64 {
  gv_head("nx_refusal_shape_gate -- FM11: does a refusal name its SUBJECT and its REMEDY (EMITTER AXIS ONLY)" as *u8)
  let ctr: *i64 = gv_ctr()
179
  gk_mkdir(RSG_DIR)
181
  // ---- the shipped vocabulary, loaded once ------------------------------------------------
  // Probe BEFORE loading: calling the loader on a path that does not exist prints its own honest
  // refusal to stderr, and a gate that manufactures an error message it then ignores has taught
  // its reader to ignore that message everywhere else too.
  let confp: *u8 = sys_mmap(RSG_PATH)
  var cp: i64 = gk_cat(confp, 0, "buildroot/knowledge/refusal_shape.conf" as *u8)
  confp[cp] = 0 as u8
  if gk_exists(confp) == 0 {
      cp = gk_cat(confp, 0, "knowledge/refusal_shape.conf" as *u8)
      confp[cp] = 0 as u8
  }
  let clen: *i64 = sys_mmap(RS_SMALL) as *i64
  let voc: *i64 = sys_mmap(RS_V_LEN * 8) as *i64
  var conf: *u8 = 0 as *u8
  if gk_exists(confp) == 1 { conf = rs_conf_load(confp, clen, voc) }
  gv_puts("    conf=" as *u8); gv_puts(confp); gv_puts("\n" as *u8)
  if gv_need("the shipped vocabulary conf (knowledge/refusal_shape.conf)" as *u8, (conf as i64) != 0, ctr) == 0 {
      return gv_verdict("REFUSAL-SHAPE" as *u8, ctr, "FM11 emitter-shape ruler" as *u8)
  }
  gv_puts("    conf markers=" as *u8); gv_num(voc[RS_V_NMARK])
  gv_puts(" remedies=" as *u8); gv_num(voc[RS_V_NREM])
  gv_puts(" rejected_rows=" as *u8); gv_num(voc[RS_V_REJECT])
  gv_puts(" max_gap_lines=" as *u8); gv_num(voc[RS_V_MAXGAP])
  gv_puts(" min_msg_bytes=" as *u8); gv_num(voc[RS_V_MINMSG])
  gv_puts("\n" as *u8)
207
  // ---- fixtures, written every run ---------------------------------------------------------
  let pGood: *u8 = sys_mmap(RSG_PATH); rsg_join(pGood, "good.nx" as *u8)
  let pNorem: *u8 = sys_mmap(RSG_PATH); rsg_join(pNorem, "noremedy.nx" as *u8)
  let pBare: *u8 = sys_mmap(RSG_PATH); rsg_join(pBare, "bare.nx" as *u8)
  let pNotref: *u8 = sys_mmap(RSG_PATH); rsg_join(pNotref, "notarefusal.nx" as *u8)
  let pComm: *u8 = sys_mmap(RSG_PATH); rsg_join(pComm, "commentonly.nx" as *u8)
  let pBrace: *u8 = sys_mmap(RSG_PATH); rsg_join(pBrace, "bracebreak.nx" as *u8)
  let pShort: *u8 = sys_mmap(RSG_PATH); rsg_join(pShort, "tooshort.nx" as *u8)
  let pTrail: *u8 = sys_mmap(RSG_PATH); rsg_join(pTrail, "trailingcomment.nx" as *u8)
  let pTesta: *u8 = sys_mmap(RSG_PATH); rsg_join(pTesta, "testassertion.nx" as *u8)
  let pUsage: *u8 = sys_mmap(RSG_PATH); rsg_join(pUsage, "usagebanner.nx" as *u8)
  var wrote: i64 = 0
  wrote = wrote + rsg_fixture(pTrail, conf, voc, RSG_TRAIL)
  wrote = wrote + rsg_fixture(pTesta, conf, voc, RSG_TESTA)
  wrote = wrote + rsg_fixture(pUsage, conf, voc, RSG_USAGEB)
  wrote = wrote + rsg_fixture(pGood, conf, voc, RSG_GOOD)
  wrote = wrote + rsg_fixture(pNorem, conf, voc, RSG_NOREM)
  wrote = wrote + rsg_fixture(pBare, conf, voc, RSG_BARE)
  wrote = wrote + rsg_fixture(pNotref, conf, voc, RSG_NOTREF)
  wrote = wrote + rsg_fixture(pComm, conf, voc, RSG_COMMENT)
  wrote = wrote + rsg_fixture(pBrace, conf, voc, RSG_BRACE)
  wrote = wrote + rsg_fixture(pShort, conf, voc, RSG_SHORT)
  if gv_need("all ten runtime fixtures written under /tmp" as *u8, wrote == 10, ctr) == 0 {
      return gv_verdict("REFUSAL-SHAPE" as *u8, ctr, "FM11 emitter-shape ruler" as *u8)
  }
233
  let rGood:   *i64 = rsg_scan1(pGood, conf, voc, 0 as *u8)
  let rNorem:  *i64 = rsg_scan1(pNorem, conf, voc, 0 as *u8)
  let rBare:   *i64 = rsg_scan1(pBare, conf, voc, 0 as *u8)
  let rNotref: *i64 = rsg_scan1(pNotref, conf, voc, 0 as *u8)
  let rComm:   *i64 = rsg_scan1(pComm, conf, voc, 0 as *u8)
  let rBrace:  *i64 = rsg_scan1(pBrace, conf, voc, 0 as *u8)
  let rShort:  *i64 = rsg_scan1(pShort, conf, voc, 0 as *u8)
  let rTrail:  *i64 = rsg_scan1(pTrail, conf, voc, 0 as *u8)
  let rTesta:  *i64 = rsg_scan1(pTesta, conf, voc, 0 as *u8)
  let rUsage:  *i64 = rsg_scan1(pUsage, conf, voc, 0 as *u8)
  rsg_show("trailcomment" as *u8, rTrail)
  rsg_show("testassertion" as *u8, rTesta)
  rsg_show("usagebanner" as *u8, rUsage)
  rsg_show("good      " as *u8, rGood)
  rsg_show("noremedy  " as *u8, rNorem)
  rsg_show("bare      " as *u8, rBare)
  rsg_show("notrefusal" as *u8, rNotref)
  rsg_show("commentonly" as *u8, rComm)
  rsg_show("bracebreak" as *u8, rBrace)
  rsg_show("tooshort  " as *u8, rShort)
254
  // ============================ TOOTH 1: ANTI-VACUITY, FIRST =================================
  // The trivial wrong implementations are "flag everything" and "flag nothing", and BOTH pass a
  // suite that only ever shows the detector one kind of input. This tooth puts the crafted bad
  // message and the known-shaped message in the SAME run and requires the ruler to separate
  // them, so neither trivial implementation can score.
  var badFired: i64 = 0
  if rNorem[RS_R_OFFENDERS] == 1 { badFired = 1 }
  var goodFired: i64 = 1
  if rGood[RS_R_OFFENDERS] == 0 { goodFired = 0 }
  gv_bite("anti-vacuity-crafted-remedyless-refusal-FLAGGED-while-shaped-message-is-NOT-in-one-run" as *u8, badFired, goodFired, ctr)
265
  // Assert the composed call actually EXAMINED something before believing any verdict above:
  // a zero-subject run returning clean is the vacuous-test defect arriving through the front door.
  gv_check("fixture-scan-examined-a-nonzero-population-before-any-bucket-is-believed" as *u8, rGood[RS_R_POP] > 0, ctr)
269
  // ============================ MECHANISM TEETH ==============================================
  // The block, not the literal: the remedy sits in a DIFFERENT literal with a literal-free line
  // between, which is the exact shape of the nx_fs read truncation envelope.
  gv_check("block-spans-a-composed-emission-so-a-remedy-in-a-LATER-literal-still-counts" as *u8,
      rGood[RS_R_BUCKET0 + RS_B_SHAPED] == 1, ctr)
  gv_check("neg-control-a-closing-brace-ENDS-the-block-so-it-cannot-borrow-a-neighbours-remedy" as *u8,
      rBrace[RS_R_BUCKET0 + RS_B_NOREMEDY] == 1, ctr)
  gv_check("neg-control-a-QUOTED-refusal-inside-a-whole-line-comment-is-NEVER-harvested" as *u8,
      rComm[RS_R_POP] == 0, ctr)
  gv_check("neg-control-a-QUOTED-refusal-inside-a-TRAILING-comment-on-a-code-line-is-NEVER-harvested" as *u8,
      rTrail[RS_R_POP] == 0, ctr)
  gv_check("neg-control-a-message-carrying-no-refusal-marker-is-NOT-in-the-population" as *u8,
      rNotref[RS_R_POP] == 0, ctr)
  gv_check("a-refusal-naming-neither-conjunct-is-BARE-not-silently-merged-into-NO-REMEDY" as *u8,
      rBare[RS_R_BUCKET0 + RS_B_BARE] == 1, ctr)
  gv_check("UNKNOWN-is-its-own-bucket-a-block-too-short-to-judge-is-abstained-on-not-acquitted" as *u8,
      rShort[RS_R_BUCKET0 + RS_B_UNKNOWN] == 1, ctr)
  gv_check("neg-control-an-UNKNOWN-block-is-NEVER-counted-as-an-offender" as *u8,
      rShort[RS_R_OFFENDERS] == 0, ctr)
  // The two buckets that exist because the first run's hits were READ instead of suppressed.
  gv_check("a-message-stating-BOTH-outcomes-is-TEST-ASSERTION-a-gate-tooth-is-not-a-refusal" as *u8,
      rTesta[RS_R_BUCKET0 + RS_B_TEST] == 1, ctr)
  gv_check("neg-control-a-TEST-ASSERTION-is-NEVER-counted-as-an-offender" as *u8,
      rTesta[RS_R_OFFENDERS] == 0, ctr)
  gv_check("a-call-grammar-banner-is-USAGE-BANNER-because-the-grammar-IS-the-remedy" as *u8,
      rUsage[RS_R_BUCKET0 + RS_B_USAGE] == 1, ctr)
  gv_check("neg-control-a-USAGE-BANNER-is-NEVER-counted-as-an-offender" as *u8,
      rUsage[RS_R_OFFENDERS] == 0, ctr)
298
  // The partition is a claim: check the parts sum, over the fixtures actually scanned.
  var psum: i64 = 0
  var pb: i64 = 0
  while pb < RS_NBUCKET {
      psum = psum + rGood[RS_R_BUCKET0 + pb] + rNorem[RS_R_BUCKET0 + pb] + rBare[RS_R_BUCKET0 + pb]
      psum = psum + rNotref[RS_R_BUCKET0 + pb] + rComm[RS_R_BUCKET0 + pb] + rBrace[RS_R_BUCKET0 + pb]
      psum = psum + rShort[RS_R_BUCKET0 + pb] + rTrail[RS_R_BUCKET0 + pb]
      psum = psum + rTesta[RS_R_BUCKET0 + pb] + rUsage[RS_R_BUCKET0 + pb]
      pb = pb + 1
  }
  let ppop: i64 = rGood[RS_R_POP] + rNorem[RS_R_POP] + rBare[RS_R_POP] + rNotref[RS_R_POP] + rComm[RS_R_POP] + rBrace[RS_R_POP] + rShort[RS_R_POP] + rTrail[RS_R_POP] + rTesta[RS_R_POP] + rUsage[RS_R_POP]
  gv_puts("    partition_sum=" as *u8); gv_num(psum)
  gv_puts(" population=" as *u8); gv_num(ppop); gv_puts("\n" as *u8)
  gv_check("partition-over-the-population-SUMS-and-the-sum-is-printed" as *u8, psum == ppop, ctr)
313
  // The fixtures are spliced from the vocabulary, so assert the two spliced signals are actually
  // DISTINCT before believing any outcome built on them: a marker that is also a remedy phrase
  // would make every fixture score SHAPED and every tooth above pass for the wrong reason.
  let m0len: i64 = voc[RS_V_BASE + 1]
  let r0len: i64 = voc[RS_V_REMBASE + 1]
  let m0: *u8 = ((conf as i64) + voc[RS_V_BASE]) as *u8
  let r0: *u8 = ((conf as i64) + voc[RS_V_REMBASE]) as *u8
  var distinct: i64 = 1
  if rs_vocab_hit(conf, voc, RS_V_REMBASE, voc[RS_V_NREM], m0, 0, m0len) >= 0 { distinct = 0 }
  if rs_vocab_hit(conf, voc, RS_V_BASE, voc[RS_V_NMARK], r0, 0, r0len) >= 0 { distinct = 0 }
  gv_check("fixture-precondition-the-spliced-marker-and-remedy-are-DISTINCT-signals" as *u8, distinct == 1, ctr)
325
  // ============================ THE RULER, TESTED DIRECTLY ===================================
  // rs_bucket is pure, so these cannot be confounded by I/O, by the walker, or by a formatter.
  gv_check("ruler-SHAPED-requires-BOTH-conjuncts" as *u8, rs_bucket(100, 24, 1, 1, 0, 0) == RS_B_SHAPED, ctr)
  gv_check("ruler-NAMES-the-failing-conjunct-when-only-the-remedy-is-absent" as *u8, rs_bucket(100, 24, 1, 0, 0, 0) == RS_B_NOREMEDY, ctr)
  gv_check("ruler-NAMES-the-failing-conjunct-when-only-the-subject-is-absent" as *u8, rs_bucket(100, 24, 0, 1, 0, 0) == RS_B_NOSUBJECT, ctr)
  gv_check("ruler-BARE-when-neither-conjunct-is-present" as *u8, rs_bucket(100, 24, 0, 0, 0, 0) == RS_B_BARE, ctr)
  gv_check("neg-control-ruler-abstains-BEFORE-judging-so-a-short-block-is-UNKNOWN-not-BARE" as *u8, rs_bucket(10, 24, 0, 0, 0, 0) == RS_B_UNKNOWN, ctr)
  // The declared ORDER: a tooth that also carries a usage word is still a tooth, and neither is
  // ever judged on subject/remedy. An order left implicit is an order the next reader guesses.
  gv_check("ruler-order-TEST-ASSERTION-outranks-USAGE-BANNER-and-both-outrank-the-subject-remedy-ruler" as *u8, rs_bucket(100, 24, 1, 1, 1, 1) == RS_B_TEST, ctr)
  gv_check("ruler-order-USAGE-BANNER-outranks-the-subject-remedy-ruler" as *u8, rs_bucket(100, 24, 1, 0, 0, 1) == RS_B_USAGE, ctr)
  gv_check("neg-control-a-SHORT-block-that-is-a-tooth-is-TEST-ASSERTION-not-UNKNOWN" as *u8, rs_bucket(10, 24, 0, 0, 1, 0) == RS_B_TEST, ctr)
338
  // SUBJECT is witnessed structurally; the negative control is the case that would make the
  // witness fire on ordinary arithmetic prose and quietly acquit every bare refusal in the tree.
  let s1: *u8 = "the read cap=163840 was reached" as *u8
  gv_check("subject-witness-fires-on-a-key-equals-pair" as *u8, rs_has_particular(s1, 0, gk_len(s1)) == 1, ctr)
  let s2: *u8 = "mint one with POST api/cap/mint and retry" as *u8
  gv_check("subject-witness-fires-on-a-path-segment" as *u8, rs_has_particular(s2, 0, gk_len(s2)) == 1, ctr)
  let s3: *u8 = "declare a kind for <target> in the conf" as *u8
  gv_check("subject-witness-fires-on-a-placeholder" as *u8, rs_has_particular(s3, 0, gk_len(s3)) == 1, ctr)
  let s4: *u8 = "a >= b and c <= d and e == f and nothing else" as *u8
  gv_check("neg-control-comparison-operators-are-NOT-a-key-equals-pair" as *u8, rs_has_particular(s4, 0, gk_len(s4)) == 0, ctr)
  let s5: *u8 = "the operation did not complete and there is no more to say" as *u8
  gv_check("neg-control-ordinary-prose-witnesses-NO-particular" as *u8, rs_has_particular(s5, 0, gk_len(s5)) == 0, ctr)
351
  // ============================ THE THREE KNOWN-CORRECT GUARDS ===============================
  // Real production sources. These are the load-bearing control of the whole rung: if any of the
  // three is flagged, the detector is worse than absent and must not ship.
  let rt: *u8 = sys_mmap(RSG_PATH)
  let hd: *u8 = sys_mmap(RSG_PATH)
  let haveRoot: i64 = gk_corpus_root(rt)
  let haveHdl: i64 = gk_corpus_hdl(hd)
  let pApi: *u8 = sys_mmap(RSG_PATH)
  let pAdm: *u8 = sys_mmap(RSG_PATH)
  var ao: i64 = gk_cat(pApi, 0, rt); ao = gk_cat(pApi, ao, "nx_tools_api.nx" as *u8); pApi[ao] = 0 as u8
  var bo2: i64 = gk_cat(pAdm, 0, hd); bo2 = gk_cat(pAdm, bo2, "nx_build_admit.nx" as *u8); pAdm[bo2] = 0 as u8
363
  var okApi: i64 = 0
  if haveRoot == 1 { okApi = gk_exists(pApi) }
  var okAdm: i64 = 0
  if haveHdl == 1 { okAdm = gk_exists(pAdm) }
368
  if gv_need("the real source of the truncation and capability guards (nx_tools_api.nx)" as *u8, okApi == 1, ctr) == 1 {
      let g1: *i64 = rsg_scan1(pApi, conf, voc, "nx-truncated output-is-partial" as *u8)
      rsg_show("guard1-truncation-envelope" as *u8, g1)
      gv_check("known-good-guard-1-nx_fs-read-truncation-envelope-is-SHAPED-not-flagged" as *u8,
          g1[RS_R_WANTBUCKET] == RS_B_SHAPED, ctr)
      gv_check("guard-1-was-actually-FOUND-in-the-real-source-so-the-tooth-above-judged-something" as *u8,
          g1[RS_R_WANTHITS] > 0, ctr)
      let g3: *i64 = rsg_scan1(pApi, conf, voc, "capability denied for tool" as *u8)
      rsg_show("guard3-capability-denied " as *u8, g3)
      gv_check("known-good-guard-3-capability-denied-mint-recipe-is-SHAPED-not-flagged" as *u8,
          g3[RS_R_WANTBUCKET] == RS_B_SHAPED, ctr)
      gv_check("guard-3-was-actually-FOUND-in-the-real-source-so-the-tooth-above-judged-something" as *u8,
          g3[RS_R_WANTHITS] > 0, ctr)
  }
  if gv_need("the real source of the build-admission guard (nx_build_admit.nx)" as *u8, okAdm == 1, ctr) == 1 {
      let g2: *i64 = rsg_scan1(pAdm, conf, voc, "verdict=queue" as *u8)
      rsg_show("guard2-build-admission     " as *u8, g2)
      gv_check("known-good-guard-2-build-admission-refusal-is-SHAPED-not-flagged" as *u8,
          g2[RS_R_WANTBUCKET] == RS_B_SHAPED, ctr)
      gv_check("guard-2-was-actually-FOUND-in-the-real-source-so-the-tooth-above-judged-something" as *u8,
          g2[RS_R_WANTHITS] > 0, ctr)
  }
391
  // ============================ THE INSTRUMENT REFUSES ON A BLIND CONF =======================
  let pNoMark: *u8 = sys_mmap(RSG_PATH); rsg_join(pNoMark, "nomarkers.conf" as *u8)
  // COMPLETE IN EVERY OTHER RESPECT, so the refusal it must produce is the MARKER one and not a
  // different conjunct: a red for the wrong reason is not evidence, and it is the easiest false
  // proof to accept because the verdict vector looks exactly right.
  gk_write(pNoMark, "remedy|re-run\npasstoken|pass\nfailtoken|fail\nselfremedy|usage\nparam|max_gap_lines|2\nparam|min_msg_bytes|24\n" as *u8)
  let clen2: *i64 = sys_mmap(RS_SMALL) as *i64
  let voc2: *i64 = sys_mmap(RS_V_LEN * 8) as *i64
  let confBad: *u8 = rs_conf_load(pNoMark, clen2, voc2)
  gv_check("neg-control-a-vocabulary-with-no-markers-is-REFUSED-not-published-as-an-empty-population" as *u8,
      (confBad as i64) == 0, ctr)
  gv_check("the-shipped-vocabulary-parses-with-ZERO-rejected-rows" as *u8, voc[RS_V_REJECT] == 0, ctr)
404
  // ============================ THE RATCHET, THREE DIRECTIONS ================================
  let pBase: *u8 = sys_mmap(RSG_PATH); rsg_join(pBase, "ratchet.baseline" as *u8)
  let pW1: *u8 = sys_mmap(RSG_PATH); rsg_join(pW1, "wl1.tsv" as *u8)
  let pW2: *u8 = sys_mmap(RSG_PATH); rsg_join(pW2, "wl2.tsv" as *u8)
  let pW3: *u8 = sys_mmap(RSG_PATH); rsg_join(pW3, "wl3.tsv" as *u8)
  let pWmiss: *u8 = sys_mmap(RSG_PATH); rsg_join(pWmiss, "no_such_worklist.tsv" as *u8)
  gk_rm(pBase)
  gk_rm(pWmiss)
  // Rows are BUCKET TAB name TAB marker TAB preview. SHAPED and UNKNOWN rows are present on
  // purpose: a ratchet that counted them would move on a message it has no complaint about.
  // The marker column is a neutral placeholder rather than a real vocabulary word: this file is
  // already excluded from the census by declaration, and a fixture that would ALSO be a finding
  // if that declaration were ever removed is a trap set for the next reader.
  // ⚠ ONE ROW OF EVERY BUCKET, AND THAT IS NOT DECORATION. The first version of this fixture
  // carried only NO-REMEDY, BARE, SHAPED and UNKNOWN, so it could not fail when the ratchet kept
  // counting TEST-ASSERTION and USAGE-BANNER rows as offenders -- and it did, silently, until the
  // census and the ratchet were run over the same file and disagreed 9,039 against 13,286.
  // A fixture that omits a bucket cannot test the bucket.
  gk_write(pW1, "NO-REMEDY\ta.nx:10\tmk1\tprev one\nBARE\tb.nx:20\tmk2\tprev two\nSHAPED\tc.nx:30\tmk3\tprev three\nUNKNOWN\td.nx:40\tmk4\tprev four\nTEST-ASSERTION\tf.nx:60\tmk5\tprev six\nUSAGE-BANNER\tg.nx:70\tmk6\tprev seven\nNO-SUBJECT\th.nx:80\tmk7\tprev eight\nWAT\ti.nx:90\tmk8\tprev nine\n" as *u8)
  gk_write(pW2, "NO-REMEDY\ta.nx:10\tmk1\tprev one\nBARE\tb.nx:20\tmk2\tprev two\nBARE\te.nx:50\tmk2\tprev five\n" as *u8)
  gk_write(pW3, "NO-REMEDY\ta.nx:10\tmk1\tprev one\n" as *u8)
426
  let rc0: i64 = rs_ratchet(pWmiss, pBase)
  gv_check("neg-control-ratchet-reports-UNMEASURED-when-there-is-no-worklist-rather-than-ALLOW" as *u8, rc0 == RS_RATCHET_UNMEAS, ctr)
429
  let rc1: i64 = rs_ratchet(pW1, pBase)
  let base1: i64 = gk_size(pBase)
  gv_puts("    ratchet self-baseline rc=" as *u8); gv_num(rc1)
  gv_puts(" baseline_bytes=" as *u8); gv_num(base1); gv_puts("\n" as *u8)
  gv_check("ratchet-SELF-BASELINES-on-first-sight-so-adopting-it-cannot-turn-the-fleet-red" as *u8, rc1 == RS_RATCHET_ALLOW, ctr)
  // Asserted by CONTENT, never by a hand-counted byte total: a number counted beside a string
  // literal is a second copy of that literal's shape and the two drift silently.
  var onlyOffenders: i64 = 1
  if gk_contains(pBase, "a.nx:10" as *u8) == 0 { onlyOffenders = 0 }
  if gk_contains(pBase, "b.nx:20" as *u8) == 0 { onlyOffenders = 0 }
  if gk_contains(pBase, "h.nx:80" as *u8) == 0 { onlyOffenders = 0 }
  if gk_contains(pBase, "c.nx:30" as *u8) == 1 { onlyOffenders = 0 }
  if gk_contains(pBase, "d.nx:40" as *u8) == 1 { onlyOffenders = 0 }
  gv_check("ratchet-self-baseline-recorded-only-the-OFFENDER-names-not-the-SHAPED-or-UNKNOWN-rows" as *u8, onlyOffenders == 1, ctr)
  // ONE RULER: the ratchet's offender set must be exactly what rs_is_offender says, for EVERY
  // bucket -- not for the two the first author happened to hand-code.
  var sameRuler: i64 = 1
  if gk_contains(pBase, "f.nx:60" as *u8) == 1 { sameRuler = 0 }
  if gk_contains(pBase, "g.nx:70" as *u8) == 1 { sameRuler = 0 }
  gv_check("neg-control-the-ratchet-uses-THE-SAME-offender-ruler-as-the-census-for-every-bucket" as *u8, sameRuler == 1, ctr)
  gv_check("neg-control-an-UNRECOGNISED-bucket-label-is-NOT-silently-adopted-as-an-offender" as *u8,
      gk_contains(pBase, "i.nx:90" as *u8) == 0, ctr)
452
  let rc2: i64 = rs_ratchet(pW2, pBase)
  let base2: i64 = gk_size(pBase)
  gv_puts("    ratchet rise rc=" as *u8); gv_num(rc2)
  gv_puts(" baseline_bytes=" as *u8); gv_num(base2); gv_puts("\n" as *u8)
  gv_check("ratchet-FIRES-on-a-rise-and-names-the-new-offender" as *u8, rc2 == RS_RATCHET_REFUSE, ctr)
  // ⚠ BY CONTENT AS WELL AS BY SIZE. A byte count is the same weak compare-and-swap token the
  // estate already learned not to trust: measured here, the rise fixture's offender set happens
  // to be the SAME LENGTH as the baseline, so a mutant that rewrote the baseline on a rise sailed
  // straight through a size-only assertion. The name that must NOT have arrived is the evidence.
  var notLaundered: i64 = 0
  if base2 == base1 {
      if gk_contains(pBase, "e.nx:50" as *u8) == 0 { notLaundered = 1 }
  }
  gv_check("neg-control-ratchet-must-NOT-rewrite-its-baseline-on-a-rise-or-it-launders-itself-green" as *u8, notLaundered == 1, ctr)
467
  let rc3: i64 = rs_ratchet(pW3, pBase)
  let base3: i64 = gk_size(pBase)
  gv_puts("    ratchet fall rc=" as *u8); gv_num(rc3)
  gv_puts(" baseline_bytes=" as *u8); gv_num(base3); gv_puts("\n" as *u8)
  gv_check("ratchet-TIGHTENS-on-a-fall-so-it-is-a-ratchet-and-not-merely-a-threshold" as *u8, rc3 == RS_RATCHET_ALLOW, ctr)
  gv_check("ratchet-tightened-baseline-is-strictly-smaller-than-the-one-it-replaced" as *u8, base3 < base1, ctr)
474
  return gv_verdict("REFUSAL-SHAPE" as *u8, ctr, "FM11 emitter-shape ruler" as *u8)
476}
nx_refusal_shape_gate.nx source

`nx_refusal_shape_gate.nx` source
