code wiki / _hdl_build / nx_search_snip_base_20260912.nx
`nx_search_snip_base_20260912.nx` source

↩ module page · 485 lines · 36914 B
1// nx_docportal_search_serve_gate.nx -- GATE for R2 (dss_serve). Writes a test PUBLIC shard, then feeds crafted
2// GET /search requests to dss_serve and asserts the rendered branded page: 200 + Content-Length, result count,
3// the hit's text present, empty-query prompt, no-match=0, and XSS-escaping of the echoed query (defensive at the
4// boundary). All over the REAL sovereign seg_store path, no tsv. license_tier: ORIGINAL
5import "nx_docportal_search_serve.nx"
6import "nx_g_puts_lib.nx"
7// MIGRATED TO THE SHARED VERDICT MACHINERY 2026-08-15, same reason as nx_editdist_gate: this gate
8// hand-rolled pass/total and printed `=== dss_serve gate: 49/49 GREEN`, which nx_swcompare_evidence
9// cannot parse -- once wired it reported [GREEN] pass=0/0, so the verdict travelled on the exit code
10// while the EVIDENCE did not. ★A GATE WHOSE COUNT THE ROLLUP CANNOT READ IS HALF-WIRED, and a partial
11// regression in 49 teeth would have surfaced only as a binary flip. gv_ctr/gv_check make
12// declared-equals-executed BY CONSTRUCTION -- with 49 teeth a hand-maintained denominator is exactly
13// the thing that silently drifts when a tooth stops running.
14import "nx_gate_verdict.nx"
15
16func g_strlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
17func g_num(v: i64) -> i64 {
  let bb: *u8 = sys_mmap(28); var m: i64 = v
  if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
  let t: *u8 = sys_mmap(28); var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(1, bb, k); return 0
25}
26// does hay[0..hn) contain the null-terminated needle?
27func g_contains(hay: *u8, hn: i64, needle: *u8) -> i64 {
  let nl: i64 = g_strlen(needle)
  if nl == 0 { return 1 }
  var i: i64 = 0
  while i + nl <= hn {
      var m: i64 = 1
      var j: i64 = 0
      while j < nl { if hay[i + j] != needle[j] { m = 0 } j = j + 1 }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
39}
40func g_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
45}
46// Thin delegate so all 49 call sites read unchanged while the COUNTING is the shared one.
47func g_check(name: *u8, cond: i64, ctr: *i64) -> i64 { return gv_check(name, cond, ctr) }
48func g_check_unused(name: *u8, cond: i64, pass: *i64, total: *i64) -> i64 {
  total[0] = total[0] + 1
  g_puts(name)
  if cond == 1 { pass[0] = pass[0] + 1; g_puts(" PASS\n") } else { g_puts(" FAIL\n") }
  return 0
53}
54
55func main(argc: i64, argv: *i64) -> i64 {
  g_puts("=== nx_docportal_search_serve gate (R2 /search serve, sovereign) ===\n")
  let d1: *u8 = "Estate Planning wills living trusts probate inheritance executor" as *u8
  // zzqservetest = an INVENTED shard-marker token: T16 proves scope=web switches shards by querying it
  // (present here, absent from any real crawled web page BY CONSTRUCTION -- "probate" stopped working
  // as the isolation probe the moment the real web corpus ingested wikipedia's estate-planning page)
  let d2: *u8 = "Family Law divorce child custody support alimony parenting zzqservetest" as *u8
  let d3: *u8 = "Criminal defense practice page felonies misdemeanors expungement" as *u8
  let w: *i64 = ss_begin()
  ss_add(w, 1, "doc:201" as *u8, d1, g_strlen(d1))
  ss_add(w, 1, "doc:202" as *u8, d2, g_strlen(d2))
  // 203 = an ingested SITE PAGE: carries a url:<cid> row -> its result must link to the PAGE, not /doc
  ss_add(w, 1, "doc:203" as *u8, d3, g_strlen(d3))
  ss_add(w, 1, "url:203" as *u8, "/practice/criminal.html" as *u8, 23)
  // facet fixture (T45): two docs sharing facterm on DIFFERENT hosts -> the SERP offers site: narrowing
  let df1: *u8 = "facterm alpha article body" as *u8
  let df2: *u8 = "facterm beta article body text" as *u8
  ss_add(w, 1, "doc:211" as *u8, df1, g_strlen(df1))
  ss_add(w, 1, "url:211" as *u8, "https://en.wikipedia.org/wiki/Alpha" as *u8, 35)
  ss_add(w, 1, "doc:212" as *u8, df2, g_strlen(df2))
  ss_add(w, 1, "url:212" as *u8, "https://docs.example.org/beta" as *u8, 29)
  let snip_doc0: *u8 = "Wine Reference\nMain menu\nContents\nAccount\nMore navigation and tool links for visitors.\nRed wine carries a distinct aroma, and this sentence explains the color and flavor clearly." as *u8
  ss_add(w, 1, "doc:981" as *u8, snip_doc0, g_strlen(snip_doc0))
  let snip_doc1: *u8 = "Snippet Boundary\nMain menu\nContents\nAccount\nMore navigation and tool links for visitors.\nEscapeterm describes \"quoted\" text with a backslash \\ and caf\xC3\xA9 in a complete useful sentence." as *u8
  ss_add(w, 1, "doc:982" as *u8, snip_doc1, g_strlen(snip_doc1))
  let snip_doc2: *u8 = "Fallbackterm\nTiny body." as *u8
  ss_add(w, 1, "doc:983" as *u8, snip_doc2, g_strlen(snip_doc2))
  let snip_doc3: *u8 = "Caps Reference\nMain menu\nContents\nAccount\nMore navigation and tool links for visitors.\nCapsterm describes bounded output with complete words describes bounded output with complete words describes bounded output with complete words describes bounded output with complete words describes bounded output with complete words describes bounded output with complete words ." as *u8
  ss_add(w, 1, "doc:984" as *u8, snip_doc3, g_strlen(snip_doc3))
  let snip_doc4: *u8 = "Word Reference\nMain menu\nContents\nAccount\nMore navigation and tool links for visitors.\nDogmatic terms appear in this irrelevant sentence with enough prose to qualify.\nA dog needs daily exercise, and this sentence describes that specific animal accurately." as *u8
  ss_add(w, 1, "doc:985" as *u8, snip_doc4, g_strlen(snip_doc4))
  // pager fixture: DSV_MAXR + 2 pgterm docs, DERIVED so it always exceeds the page cap by exactly
  // enough to force a second page.
  // ★★★★★★IT WAS THE LITERAL 22 AGAINST A "20/page cap", AND THE CAP MOVED TO 30 ON 2026-07-24
  // (same day dsv_scope's default flipped -- both changes broke this gate together). The fixture then
  // fit on ONE page, no pager rendered, and T35 reported a product bug that did not exist.
  // A FIXTURE SIZED BY A LITERAL AGAINST A CONSTANT THAT CAN MOVE IS A TEST WITH AN EXPIRY DATE
  // NOBODY WROTE DOWN. Derived from DSV_MAXR, it cannot go stale when the cap moves again.
  let pg_docs: i64 = DSV_MAXR + 2
  let dpg: *u8 = "pgterm pagination fixture entry for the serve pager" as *u8
  let pgkey: *u8 = sys_mmap(24)
  var pgi: i64 = 301
  while pgi <= 300 + pg_docs {
      var ko: i64 = 0
      let kp: *u8 = "doc:" as *u8
      while kp[ko] != (0 as u8) { pgkey[ko] = kp[ko]; ko = ko + 1 }
      pgkey[ko] = (48 + (pgi / 100)) as u8
      pgkey[ko + 1] = (48 + ((pgi / 10) % 10)) as u8
      pgkey[ko + 2] = (48 + (pgi % 10)) as u8
      pgkey[ko + 3] = 0 as u8
      ss_add(w, 1, pgkey, dpg, g_strlen(dpg))
      pgi = pgi + 1
  }
  // ⚠FIXTURE MOVED OUT OF knowledge/store/ 2026-08-15 -- IT HAD ACCUMULATED AND CORRUPTED.
  // This gate wrote its fixture into the SHARED production store path and never cleaned it, so every
  // run appended another segment to the same place. MEASURED: buildroot/knowledge/store/
  // dp-ssservetest-pub-manifest.txt read `seg-1 / seg-1 / seg-2` -- a DUPLICATE segment row, which
  // makes ss_open2 mount the same segment twice and the shadow logic treat the older index as
  // superseded by a newer copy of ITSELF. Symptom: every structural tooth passed (headers, XSS
  // escaping, mobile markers, zero-JS, title) while every CONTENT tooth failed (1-result, hit-text,
  // highlight, /doc, pager, facets) -- the shape of a shard that mounts but yields nothing.
  // ★★★★★★A GATE THAT WRITES ITS FIXTURE TO A FIXED SHARED PATH AND NEVER CLEANS IT EVENTUALLY
  // TESTS GARBAGE, AND ITS FAILURES LOOK LIKE PRODUCT BUGS. This is the estate's own recorded rule
  // (gate scratch belongs in /tmp/<gate>/, created by sys_mkdir at SETUP because a teardown does not
  // run when a run crashes) and this gate predates it. Two stale copies of the old fixture remain --
  // knowledge/store/ and buildroot/knowledge/store/ -- and are now unreferenced; adjudicate them with
  // nx_retire_path rather than deleting, since they are evidence of this defect.
  // ⚠DIAGNOSIS OF THE DUPLICATE, stated as a lead not a conclusion: ss_commit re-derives its segid
  // under the plane lock as max_segid+1, so a duplicate seg-1 implies ss_max_segid returned -1 while
  // seg-1 existed. That is worth chasing in ss_max_segid itself -- a manifest reader that reports
  // "no segments" on a readable non-empty store would corrupt ANY store, not just a fixture.
  // The fixture must stay where dss_prefix points -- it builds knowledge/store/dp-<domain>-pub-
  // from the domain the gate serves, so moving the WRITE to /tmp would simply never be read back
  // (checked before building; that would have turned a corrupt fixture into an absent one).
  // Instead: START CLEAN. Unlinking the manifest makes ss_max_segid report an empty store, so
  // ss_commit writes seg-1 and publishes a manifest naming exactly this run's segment -- stale
  // segment FILES are simply overwritten or orphaned, never mounted, because mounting is driven by
  // the manifest. Setup-time, not teardown-time, deliberately: A TEARDOWN DOES NOT RUN WHEN A RUN
  // CRASHES, and this fixture was corrupted by exactly the runs that did not finish tidily.
  // ★DOMAIN RENAMED ssservetest -> ssgatesnipbase20260912 2026-08-15. The old name contained the substring
  // `serve`, which is a PROTECTED TOKEN in nx_retire_path -- so every orphaned copy of this fixture
  // was permanently unretirable (RETIRE-REFUSED code=4 token=serve, on all five files). The guard is
  // RIGHT: it stops a live/serving artifact being moved out from under a running service and is
  // deliberately wrong in the direction of doing nothing. THE FIX IS THE NAME, NOT THE GUARD --
  // relaxing a substring match on `serve` to tidy test files would put every genuinely serving
  // artifact one rename away from being retirable. ★★★★★★WHEN A PROTECTION REFUSES SOMETHING
  // HARMLESS, MOVE THE HARMLESS THING OUT OF ITS PATH; DO NOT WIDEN THE PROTECTION.
  // (The five pre-existing orphans keep the old name and stay unretirable-by-design; they are inert
  //  and stand as the evidence for the accumulation defect that produced them.)
  sys_unlinkat("knowledge/store/dp-ssgatesnipbase20260912-pub-manifest.txt\x00" as *u8)
  ss_commit("knowledge/store/dp-ssgatesnipbase20260912-pub-" as *u8, w, 1)
146
  let ctr: *i64 = gv_ctr()
  gv_head("nx_docportal_search_serve -- /search + /doc + /api serve contract over a per-run fixture" as *u8)
  let out: *u8 = sys_mmap(DSV_OUTCAP)
  let dom: *u8 = "ssgatesnipbase20260912" as *u8
151
  // T1: q=probate -> 200 + Content-Length + "1 result" + the estate text
  // ⚠SCOPE MUST BE EXPLICIT (2026-08-15). dsv_scope's DEFAULT flipped site->web on 2026-07-24
  // ("nishifamily.com/search IS a web search engine; the site corpus is an opt-in tab"), so every
  // request in this gate that omits scope= has since been querying the REAL WEB SHARD instead of the
  // fixture committed above. That is why the store is provably correct -- probed directly: bign=27,
  // dcnt1=1 for probate, tf1=1 on cid 201 -- while every CONTENT tooth fails and every STRUCTURAL one
  // passes. ★★★★★★A GATE THAT RELIES ON A DEFAULT TESTS WHATEVER THE DEFAULT LATER BECOMES; the
  // product change was deliberate and correct, and it silently redirected this gate's subject.
  let r1: *u8 = "GET /search?q=probate&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n1: i64 = dss_serve(dom, r1, g_strlen(r1), out)
  g_check("T1 200-header" as *u8, g_contains(out, n1, "HTTP/1.1 200 OK" as *u8), ctr)
  g_check("T1 content-length" as *u8, g_contains(out, n1, "Content-Length: " as *u8), ctr)
  g_check("T1 1-result" as *u8, g_contains(out, n1, "1 result(s)" as *u8), ctr)
  g_check("T1 hit-text(Estate)" as *u8, g_contains(out, n1, "Estate Planning" as *u8), ctr)
166
  // T2: q=divorce -> the family-law doc
  let r2: *u8 = "GET /search?q=divorce&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n2: i64 = dss_serve(dom, r2, g_strlen(r2), out)
  g_check("T2 hit-text(Family)" as *u8, g_contains(out, n2, "Family Law" as *u8), ctr)
171
  // T3: empty query -> prompt, no crash
  let r3: *u8 = "GET /search HTTP/1.1\r\n\r\n" as *u8
  let n3: i64 = dss_serve(dom, r3, g_strlen(r3), out)
  g_check("T3 empty-prompt" as *u8, g_contains(out, n3, "Enter a search term" as *u8), ctr)
176
  // T4 NEG: no match -> "0 result(s)"
  let r4: *u8 = "GET /search?q=zzznotpresent HTTP/1.1\r\n\r\n" as *u8
  let n4: i64 = dss_serve(dom, r4, g_strlen(r4), out)
  g_check("T4 NEG 0-results" as *u8, g_contains(out, n4, "0 result(s)" as *u8), ctr)
181
  // T5 SECURITY: %3Cscript%3E in q -> echoed ESCAPED (&lt;script&gt;), never raw <script>
  let r5: *u8 = "GET /search?q=%3Cscript%3E HTTP/1.1\r\n\r\n" as *u8
  let n5: i64 = dss_serve(dom, r5, g_strlen(r5), out)
  g_check("T5 xss-escaped(&lt;script)" as *u8, g_contains(out, n5, "&lt;script&gt;" as *u8), ctr)
  var raw: i64 = 0
  if g_contains(out, n5, "<script>" as *u8) == 1 { raw = 1 }
  g_check("T5 xss no-raw-script" as *u8, (1 - raw), ctr)
189
  // T6: urldecode '+' -> space (q=child+custody decodes to two terms; both in family-law doc)
  let r6: *u8 = "GET /search?q=child+custody&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n6: i64 = dss_serve(dom, r6, g_strlen(r6), out)
  g_check("T6 urldecode-plus(Family)" as *u8, g_contains(out, n6, "Family Law" as *u8), ctr)
194
  // T10: results are LINKS -> /doc?cid=<cid>&q=<query> (the SERP click-through)
  let na: i64 = dss_serve(dom, r1, g_strlen(r1), out)
  // Links are SCOPE-PRESERVING, so the rendered href carries the scope the request was made in.
  // Read off the live SERP before rewriting this: /doc?cid=<cid>&q=<q>&scope=site.
  g_check("T10 result-link(href /doc?cid=201&q=probate&scope=site)" as *u8, g_contains(out, na, "href=\"/doc?cid=201&q=probate&scope=site\"" as *u8), ctr)
200
  // T11: the matched query term is <b>-highlighted in the rendered result (index-tokenizer-aligned)
  g_check("T11 highlight(<b>probate</b>)" as *u8, g_contains(out, na, "<b>probate</b>" as *u8), ctr)
203
  // T12: /doc?cid=201&q=probate -> 200 + the FULL doc text + highlight + back-to-results link
  let rd1: *u8 = "GET /doc?cid=201&q=probate&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let nd1: i64 = dsv_doc_serve(dom, rd1, g_strlen(rd1), out)
  var d1ok: i64 = 0
  // "inheritance"/"executor" straddle the title/body split, so assert each side + highlight + back-link
  if g_contains(out, nd1, "HTTP/1.1 200 OK" as *u8) == 1 { if g_contains(out, nd1, "inheritance" as *u8) == 1 { if g_contains(out, nd1, "executor" as *u8) == 1 { if g_contains(out, nd1, "<b>probate</b>" as *u8) == 1 { if g_contains(out, nd1, "href=\"/search?q=probate\"" as *u8) == 1 { d1ok = 1 } } } } }
  g_check("T12 /doc 200 + full text + highlight + back-link" as *u8, d1ok, ctr)
211
  // T13 NEG: absent cid -> branded 404, never a 500/crash
  let rd2: *u8 = "GET /doc?cid=99999 HTTP/1.1\r\n\r\n" as *u8
  let nd2: i64 = dsv_doc_serve(dom, rd2, g_strlen(rd2), out)
  var d2ok: i64 = 0
  if g_contains(out, nd2, "HTTP/1.1 404" as *u8) == 1 { if g_contains(out, nd2, "Document not found" as *u8) == 1 { d2ok = 1 } }
  g_check("T13 NEG /doc absent-cid -> 404" as *u8, d2ok, ctr)
218
  // T14 NEG: malformed cid (digit-guard boundary) -> 404, not a crash / not a store probe with garbage
  let rd3: *u8 = "GET /doc?cid=12abc HTTP/1.1\r\n\r\n" as *u8
  let nd3: i64 = dsv_doc_serve(dom, rd3, g_strlen(rd3), out)
  g_check("T14 NEG /doc malformed-cid -> 404" as *u8, g_contains(out, nd3, "HTTP/1.1 404" as *u8), ctr)
223
  // T15: a doc WITH a url:<cid> row links to the REAL page (href = the url value, no /doc)
  let r15: *u8 = "GET /search?q=expungement&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n15: i64 = dss_serve(dom, r15, g_strlen(r15), out)
  var t15: i64 = 0
  if g_contains(out, n15, "href=\"/practice/criminal.html\"" as *u8) == 1 { if g_contains(out, n15, "/doc?cid=203" as *u8) == 0 { t15 = 1 } }
  g_check("T15 url-row result links to the page" as *u8, t15, ctr)
230
  // T16: scope=web SWITCHES the shard away from the Host domain (a ssservetest-only term must yield 0
  // under web scope -- isolation proves the switch without touching the real web corpus) + Web tab active
  let r16: *u8 = "GET /search?q=zzqservetest&scope=web HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n16: i64 = dss_serve(dom, r16, g_strlen(r16), out)
  // DECOMPOSED 2026-08-25. This was ONE tooth asserting THREE independent facts, so when it went RED it
  // named none of them and the reader is left to guess -- and the guess is always the alarming one here
  // ("the shard switch broke"), never "a hidden input moved". Measured cost of the compound form: it
  // failed, and separating my own change from a pre-existing regression was impossible from the verdict
  // alone. Three named teeth; gv_ctr moves the denominator by itself, which is why the count is not
  // hand-maintained anywhere.
  // T16a NEEDS THE WEB SHARD TO EXIST. PROVEN 2026-08-25: under the buildroot build/run CWD there is no
  // dp-web-pub-manifest at all (nx_shelltool glob over buildroot/knowledge/store: matches=0,
  // corpus_complete=1 across 12,464 files), so dss_open_maybe_cached gets an empty handle, the serve
  // takes its DEGRADED path, and the exact "0 result(s)" prose this tooth greps for is never emitted.
  // The product is behaving correctly -- it cannot search a shard that is not there. The gate simply
  // COULD NOT LOOK, and "I could not look" must never share a word with "it is broken": that is how a
  // false RED trains everyone to ignore a real one. gv_need is the estate's third state for exactly
  // this, so the run reports SKIP -- never a false RED, and never a false pass either.
  var webshard: i64 = 0
  let wfd: i64 = sys_openat_rd("knowledge/store/dp-web-pub-manifest.txt" as *u8)
  if wfd >= 0 { sys_close(wfd); webshard = 1 }
  if gv_need("T16a precondition: web shard present in this CWD" as *u8, webshard, ctr) == 1 {
      g_check("T16a scope=web shard ISOLATION (marker term yields 0 results)" as *u8, g_contains(out, n16, "0 result(s)" as *u8), ctr)
  }
  g_check("T16b scope=web tab is the ACTIVE one" as *u8, g_contains(out, n16, "class=on href=\"/search?scope=web" as *u8), ctr)
  g_check("T16c form CARRIES scope=web forward" as *u8, g_contains(out, n16, "name=scope value=web" as *u8), ctr)
257
  // T17: default scope renders the tabs with This-site active
  let n17: i64 = dss_serve(dom, r1, g_strlen(r1), out)
  var t17: i64 = 0
  if g_contains(out, n17, ">This site</a>" as *u8) == 1 { if g_contains(out, n17, ">Web</a>" as *u8) == 1 { t17 = 1 } }
  g_check("T17 scope tabs render (This site / Web)" as *u8, t17, ctr)
263
  // ---- API-FIRST surface (versioned JSON; enterprise contract) ----
  // T18: /api/search JSON shape -- v1, count, cid AS STRING, escaped title, CORS + content-type headers
  let ra1: *u8 = "GET /api/search?q=probate&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let na1: i64 = dss_api_search(dom, ra1, g_strlen(ra1), out)
  var a1: i64 = 0
  if g_contains(out, na1, "\"v\":1" as *u8) == 1 { if g_contains(out, na1, "\"nresults\":1" as *u8) == 1 { if g_contains(out, na1, "\"cid\":\"201\"" as *u8) == 1 { if g_contains(out, na1, "application/json" as *u8) == 1 { if g_contains(out, na1, "Access-Control-Allow-Origin: *" as *u8) == 1 { a1 = 1 } } } } }
  g_check("T18 /api/search JSON v1 + cid-as-string + CORS" as *u8, a1, ctr)
271
  // T19: self-describing endpoint (no q -> 200 usage document, still structured)
  let ra2: *u8 = "GET /api/search HTTP/1.1\r\n\r\n" as *u8
  let na2: i64 = dss_api_search(dom, ra2, g_strlen(ra2), out)
  var a2: i64 = 0
  if g_contains(out, na2, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, na2, "\"endpoint\":\"/api/search\"" as *u8) == 1 { a2 = 1 } }
  g_check("T19 /api/search self-describes without q" as *u8, a2, ctr)
278
  // T20: /api/doc found -> JSON text; T21: absent -> 404 not_found; T22: malformed -> 400 bad_cid
  let ra3: *u8 = "GET /api/doc?cid=201&scope=site HTTP/1.1\r\n\r\n" as *u8
  let na3: i64 = dss_api_doc(dom, ra3, g_strlen(ra3), out)
  var a3: i64 = 0
  if g_contains(out, na3, "\"found\":true" as *u8) == 1 { if g_contains(out, na3, "Estate Planning" as *u8) == 1 { if g_contains(out, na3, "\"truncated\":false" as *u8) == 1 { a3 = 1 } } }
  g_check("T20 /api/doc found -> JSON text" as *u8, a3, ctr)
  let ra4: *u8 = "GET /api/doc?cid=99999 HTTP/1.1\r\n\r\n" as *u8
  let na4: i64 = dss_api_doc(dom, ra4, g_strlen(ra4), out)
  var a4: i64 = 0
  if g_contains(out, na4, "HTTP/1.1 404" as *u8) == 1 { if g_contains(out, na4, "\"code\":\"not_found\"" as *u8) == 1 { a4 = 1 } }
  g_check("T21 /api/doc absent -> 404 not_found" as *u8, a4, ctr)
  let ra5: *u8 = "GET /api/doc?cid=12abc HTTP/1.1\r\n\r\n" as *u8
  let na5: i64 = dss_api_doc(dom, ra5, g_strlen(ra5), out)
  var a5: i64 = 0
  if g_contains(out, na5, "HTTP/1.1 400" as *u8) == 1 { if g_contains(out, na5, "\"code\":\"bad_cid\"" as *u8) == 1 { a5 = 1 } }
  g_check("T22 /api/doc malformed -> 400 bad_cid" as *u8, a5, ctr)
295
  // T23: url row rides the API too (site pages / web results carry their real location)
  let ra6: *u8 = "GET /api/search?q=expungement&scope=site HTTP/1.1\r\n\r\n" as *u8
  let na6: i64 = dss_api_search(dom, ra6, g_strlen(ra6), out)
  g_check("T23 /api/search carries url for page-backed docs" as *u8, g_contains(out, na6, "\"url\":\"/practice/criminal.html\"" as *u8), ctr)
300
  // ---- MOBILE-FIRST markers (measured mechanically, not vibes) ----
  let nm: i64 = dss_serve(dom, r1, g_strlen(r1), out)
  var mm: i64 = 0
  if g_contains(out, nm, "font-size:16px" as *u8) == 1 { if g_contains(out, nm, "min-height:44px" as *u8) == 1 { if g_contains(out, nm, "prefers-color-scheme" as *u8) == 1 { if g_contains(out, nm, "text-size-adjust" as *u8) == 1 { mm = 1 } } } }
  g_check("T24 mobile-first markers (16px input, 44px targets, dark scheme, size-adjust lock)" as *u8, mm, ctr)
306
  // ---- S-CLASS SERP DISPLAY rows (the beat-Google/Bing result-page bar, measured mechanically) ----
  // T30 the tab title carries the query (multi-tab usability)
  let n30: i64 = dss_serve(dom, r1, g_strlen(r1), out)
  g_check("T30 <title> = query + Nishi Search" as *u8, g_contains(out, n30, "<title>probate &mdash; Nishi Search</title>" as *u8), ctr)
  // T31 ZERO JavaScript on the whole page (Google's SERP won't even render without JS)
  var t31: i64 = 0
  if g_contains(out, n30, "<script" as *u8) == 0 { t31 = 1 }
  g_check("T31 zero-JS page (no <script anywhere)" as *u8, t31, ctr)
  // T32 semantic structure + the measured credo footer
  var t32: i64 = 0
  if g_contains(out, n30, "<article class=r" as *u8) == 1 { if g_contains(out, n30, "<h3 class=t" as *u8) == 1 { if g_contains(out, n30, "<footer class=credo" as *u8) == 1 { if g_contains(out, n30, "0 JavaScript" as *u8) == 1 { if g_contains(out, n30, "<main>" as *u8) == 1 { t32 = 1 } } } } }
  g_check("T32 semantic article/h3/main + credo footer" as *u8, t32, ctr)
  // T33 measured query latency in the meta line
  g_check("T33 meta line shows measured ms" as *u8, g_contains(out, n30, " ms</p>" as *u8), ctr)
  // T34 FEATURED ANSWER: a full-coverage sentence gets the answer panel, highlighted
  let r34: *u8 = "GET /search?q=probate+inheritance&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n34: i64 = dss_serve(dom, r34, g_strlen(r34), out)
  var t34: i64 = 0
  if g_contains(out, n34, "class=ans" as *u8) == 1 { if g_contains(out, n34, "<b>probate</b>" as *u8) == 1 { t34 = 1 } }
  g_check("T34 featured-answer panel (full term coverage, highlighted)" as *u8, t34, ctr)
  // T35 pager: 22 matches -> Next on page 0; Prev + page 2 marker on p=1
  let r35a: *u8 = "GET /search?q=pgterm&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n35a: i64 = dss_serve(dom, r35a, g_strlen(r35a), out)
  var t35: i64 = 0
  if g_contains(out, n35a, "Next &rarr;" as *u8) == 1 { if g_contains(out, n35a, "&p=1" as *u8) == 1 {
      let r35b: *u8 = "GET /search?q=pgterm&p=1&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
      let n35b: i64 = dss_serve(dom, r35b, g_strlen(r35b), out)
      // Expected total is DERIVED from the same pg_docs the fixture was seeded with, so the count
      // assertion cannot drift from the fixture the way the literal 22 drifted from DSV_MAXR.
      // ⚠DOCUMENTED BOUND: this formats exactly two digits, which covers any DSV_MAXR from 8 to 97.
      // If the cap ever leaves that range this must grow a real integer formatter -- stated here so
      // the next reader is not surprised by a silently wrong expectation.
      let expm: *u8 = sys_mmap(32)
      var xo: i64 = 0
      let ex1: *u8 = "of " as *u8
      while ex1[xo] != (0 as u8) { expm[xo] = ex1[xo]; xo = xo + 1 }
      expm[xo] = (48 + (pg_docs / 10)) as u8; xo = xo + 1
      expm[xo] = (48 + (pg_docs % 10)) as u8; xo = xo + 1
      let ex2: *u8 = " matched" as *u8
      var xj: i64 = 0
      while ex2[xj] != (0 as u8) { expm[xo] = ex2[xj]; xo = xo + 1; xj = xj + 1 }
      expm[xo] = 0 as u8
      if g_contains(out, n35b, "&larr; Prev" as *u8) == 1 { if g_contains(out, n35b, "page 2" as *u8) == 1 { if g_contains(out, n35b, expm) == 1 { t35 = 1 } } }
  } }
  g_check("T35 pager Next/Prev + page marker + total matched" as *u8, t35, ctr)
352
  // T36 DID-YOU-MEAN: a typo'd query renders the dictionary's correction as a link
  let r36: *u8 = "GET /search?q=probete&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n36: i64 = dss_serve(dom, r36, g_strlen(r36), out)
  var t36: i64 = 0
  // scope-preserving link again -- the correction keeps the user in the scope they searched
  if g_contains(out, n36, "Did you mean" as *u8) == 1 { if g_contains(out, n36, "href=\"/search?q=probate&scope=site\"" as *u8) == 1 { t36 = 1 } }
  g_check("T36 did-you-mean line (probete -> probate link)" as *u8, t36, ctr)
360
  // T37 /api/suggest: dictionary completions as versioned JSON
  let r37: *u8 = "GET /api/suggest?q=prob&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n37: i64 = dss_api_suggest(dom, r37, g_strlen(r37), out)
  var t37: i64 = 0
  if g_contains(out, n37, "\"v\":1" as *u8) == 1 { if g_contains(out, n37, "\"suggestions\":[\"probate\"" as *u8) == 1 { if g_contains(out, n37, "application/json" as *u8) == 1 { t37 = 1 } } }
  g_check("T37 /api/suggest JSON completions" as *u8, t37, ctr)
367
  // T38 /api/search zero-hit carries did_you_mean
  let r38: *u8 = "GET /api/search?q=probete&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n38: i64 = dss_api_search(dom, r38, g_strlen(r38), out)
  var t38: i64 = 0
  if g_contains(out, n38, "\"nresults\":0" as *u8) == 1 { if g_contains(out, n38, "\"did_you_mean\":\"probate\"" as *u8) == 1 { t38 = 1 } }
  g_check("T38 /api/search did_you_mean field" as *u8, t38, ctr)
374
  // T39 +term AND through the serve layer: "probate +custody" -- OR would return BOTH docs; the
  // required term keeps only the custody-bearing one (distinguishing fixture)
  let r39: *u8 = "GET /search?q=probate+%2Bcustody&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n39: i64 = dss_serve(dom, r39, g_strlen(r39), out)
  var t39: i64 = 0
  if g_contains(out, n39, "1 result(s)" as *u8) == 1 { if g_contains(out, n39, "Family Law" as *u8) == 1 { t39 = 1 } }
  g_check("T39 +term AND via serve (OR=2 -> AND=1, custody doc only)" as *u8, t39, ctr)
382
  // T40/T41 PHRASE through the serve layer: quoted adjacency matches; reversed order does not
  let r40: *u8 = "GET /search?q=%22living+trusts%22&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n40: i64 = dss_serve(dom, r40, g_strlen(r40), out)
  g_check("T40 phrase [living trusts] via serve -> 1 result" as *u8, g_contains(out, n40, "1 result(s)" as *u8), ctr)
  // scope=site here too: a NEGATIVE that passes only because it queried the wrong shard is not a
  // negative control at all -- it would report 0 results for a corpus it never searched.
  let r41: *u8 = "GET /search?q=%22trusts+living%22&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n41: i64 = dss_serve(dom, r41, g_strlen(r41), out)
  g_check("T41 NEG reversed phrase -> 0 results" as *u8, g_contains(out, n41, "0 result(s)" as *u8), ctr)
  // T42 API carries the exactness contract for quoted queries
  let r42: *u8 = "GET /api/search?q=%22living+trusts%22&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n42: i64 = dss_api_search(dom, r42, g_strlen(r42), out)
  var t42: i64 = 0
  if g_contains(out, n42, "\"phrase_exact\":true" as *u8) == 1 { if g_contains(out, n42, "\"nresults\":1" as *u8) == 1 { t42 = 1 } }
  g_check("T42 /api/search phrase_exact:true for a quoted query" as *u8, t42, ctr)
398
  // T43 OpenAPI 3.1 contract: valid structure, all 3 paths, servers names the Host, cid-as-string note
  let n43: i64 = dss_api_openapi("andelinwest.com" as *u8, out)
  var t43: i64 = 0
  if g_contains(out, n43, "\"openapi\":\"3.1.0\"" as *u8) == 1 { if g_contains(out, n43, "\"/api/search\":" as *u8) == 1 { if g_contains(out, n43, "\"/api/doc\":" as *u8) == 1 { if g_contains(out, n43, "\"/api/suggest\":" as *u8) == 1 { if g_contains(out, n43, "https://andelinwest.com" as *u8) == 1 { if g_contains(out, n43, "SearchResponse" as *u8) == 1 { if g_contains(out, n43, "application/json" as *u8) == 1 { t43 = 1 } } } } } } }
  g_check("T43 /api/openapi.json valid 3.1 spec (paths+schemas+server+CORS)" as *u8, t43, ctr)
  // T44 the SERP footer links the API spec (discoverability)
  let r44: *u8 = "GET /search?q=probate HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n44: i64 = dss_serve(dom, r44, g_strlen(r44), out)
  g_check("T44 SERP footer links /api/openapi.json" as *u8, g_contains(out, n44, "href=\"/api/openapi.json\"" as *u8), ctr)
408
  // T48-T50 THREE SCOPES (operator's 2026-07-04 model): the SERP shows This site / Trusted / Web tabs,
  // each scope-preserving; the API scope name resolves web/trusted/site.
  let r48: *u8 = "GET /search?q=probate HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n48: i64 = dss_serve(dom, r48, g_strlen(r48), out)
  var t48: i64 = 0
  if g_contains(out, n48, ">This site</a>" as *u8) == 1 { if g_contains(out, n48, ">Trusted</a>" as *u8) == 1 { if g_contains(out, n48, ">Web</a>" as *u8) == 1 { t48 = 1 } } }
  g_check("T48 three scope tabs (This site / Trusted / Web)" as *u8, t48, ctr)
  let r49: *u8 = "GET /api/search?q=probate&scope=trusted HTTP/1.1\r\n\r\n" as *u8
  let n49: i64 = dss_api_search(dom, r49, g_strlen(r49), out)
  g_check("T49 /api/search scope=trusted -> \"scope\":\"trusted\"" as *u8, g_contains(out, n49, "\"scope\":\"trusted\"" as *u8), ctr)
  let r50: *u8 = "GET /api/search?q=probate&scope=web HTTP/1.1\r\n\r\n" as *u8
  let n50: i64 = dss_api_search(dom, r50, g_strlen(r50), out)
  g_check("T50 /api/search scope=web -> \"scope\":\"web\"" as *u8, g_contains(out, n50, "\"scope\":\"web\"" as *u8), ctr)
422
  // T45 host FACETS: facterm spans 2 hosts -> the SERP offers one-click site: narrowing
  let r45: *u8 = "GET /search?q=facterm&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n45: i64 = dss_serve(dom, r45, g_strlen(r45), out)
  var t45: i64 = 0
  if g_contains(out, n45, "Sites: " as *u8) == 1 { if g_contains(out, n45, "site%3Aen.wikipedia.org" as *u8) == 1 { if g_contains(out, n45, "site%3Adocs.example.org" as *u8) == 1 { t45 = 1 } } }
  g_check("T45 SERP host facets (Sites: line + site: links)" as *u8, t45, ctr)
  // T46 the site: OPERATOR through the serve layer narrows to one host + facet line suppressed
  let r46: *u8 = "GET /search?q=facterm+site%3Adocs.example.org&scope=site HTTP/1.1\r\nHost: x\r\n\r\n" as *u8
  let n46: i64 = dss_serve(dom, r46, g_strlen(r46), out)
  var t46: i64 = 0
  if g_contains(out, n46, "1 result(s)" as *u8) == 1 { if g_contains(out, n46, "Sites: " as *u8) == 0 { t46 = 1 } }
  g_check("T46 site: operator via serve (1 result, facets suppressed)" as *u8, t46, ctr)
  // T47 API carries the host field
  let r47: *u8 = "GET /api/search?q=facterm&scope=site HTTP/1.1\r\n\r\n" as *u8
  let n47: i64 = dss_api_search(dom, r47, g_strlen(r47), out)
  g_check("T47 /api/search result carries host" as *u8, g_contains(out, n47, "\"host\":\"en.wikipedia.org\"" as *u8), ctr)
439
  // T7-T9: dsv_host (Host-header -> domain; the daemon's /search route feeds this to dss_serve)
  let hbuf: *u8 = sys_mmap(256)
  let rh1: *u8 = "GET /search?q=x HTTP/1.1\r\nHost: andelinwest.com:443\r\n\r\n" as *u8
  dsv_host(rh1, g_strlen(rh1), hbuf, 255)
  g_check("T7 host(andelinwest.com,port-stripped)" as *u8, g_streq(hbuf, "andelinwest.com" as *u8), ctr)
  let rh2: *u8 = "GET / HTTP/1.1\r\nhost: bradrwest.com\r\n\r\n" as *u8
  dsv_host(rh2, g_strlen(rh2), hbuf, 255)
  g_check("T8 host(lowercase)" as *u8, g_streq(hbuf, "bradrwest.com" as *u8), ctr)
  let rh3: *u8 = "GET / HTTP/1.1\r\n\r\n" as *u8
  dsv_host(rh3, g_strlen(rh3), hbuf, 255)
  var t9ok: i64 = 0
  if hbuf[0] == (0 as u8) { t9ok = 1 }
  g_check("T9 host-absent-empty" as *u8, t9ok, ctr)
453
  let snip_req0: *u8 = "GET /api/search?q=red+wine&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_n0: i64 = dss_api_search(dom, snip_req0, g_strlen(snip_req0), out)
  g_check("API selects relevant prose after navigation" as *u8, g_contains(out, snip_n0, "\"snippet\":\"Red wine carries a distinct aroma, and this sentence explains the color and flavor clearly\"" as *u8), ctr)
  g_puts("SNIP-API-0 BEGIN\n"); sys_write(1, out, snip_n0); g_puts("\nSNIP-API-0 END\n")
  let snip_req1: *u8 = "GET /api/search?q=escapeterm&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_n1: i64 = dss_api_search(dom, snip_req1, g_strlen(snip_req1), out)
  g_check("API escapes JSON without HTML entities or highlighting" as *u8, g_contains(out, snip_n1, "\"snippet\":\"Escapeterm describes \\\"quoted\\\" text with a backslash \\\\ and caf\xC3\xA9 in a complete useful sentence\"" as *u8), ctr)
  g_puts("SNIP-API-1 BEGIN\n"); sys_write(1, out, snip_n1); g_puts("\nSNIP-API-1 END\n")
  let snip_req2: *u8 = "GET /api/search?q=fallbackterm&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_n2: i64 = dss_api_search(dom, snip_req2, g_strlen(snip_req2), out)
  g_check("API fallback unchanged without qualifying prose" as *u8, g_contains(out, snip_n2, "\"snippet\":\"Tiny body.\"" as *u8), ctr)
  g_puts("SNIP-API-2 BEGIN\n"); sys_write(1, out, snip_n2); g_puts("\nSNIP-API-2 END\n")
  let snip_req3: *u8 = "GET /api/search?q=dog&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_n3: i64 = dss_api_search(dom, snip_req3, g_strlen(snip_req3), out)
  g_check("API chooses whole-word match over dogmatic decoy" as *u8, g_contains(out, snip_n3, "\"snippet\":\"A dog needs daily exercise, and this sentence describes that specific animal accurately\"" as *u8), ctr)
  g_puts("SNIP-API-3 BEGIN\n"); sys_write(1, out, snip_n3); g_puts("\nSNIP-API-3 END\n")
  let snip_html_req: *u8 = "GET /search?q=red+wine&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_html_n: i64 = dss_serve(dom, snip_html_req, g_strlen(snip_html_req), out)
  g_check("HTML keeps same selected prose and highlighting" as *u8, g_contains(out, snip_html_n, "<div class=s><b>Red</b> <b>wine</b> carries a distinct aroma, and this sentence explains the color and flavor clearly</div>" as *u8), ctr)
  let snip_cap_req: *u8 = "GET /api/search?q=capsterm&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_cap_n: i64 = dss_api_search(dom, snip_cap_req, g_strlen(snip_cap_req), out)
  g_puts("SNIP-CAP BEGIN\n"); sys_write(1, out, snip_cap_n); g_puts("\nSNIP-CAP END\n")
476
  let snip_multi_req: *u8 = "GET /api/search?q=wine+escapeterm+dog&scope=site HTTP/1.1\r\n\r\n" as *u8
  let snip_multi_n: i64 = dss_api_search(dom, snip_multi_req, g_strlen(snip_multi_req), out)
  g_puts("SNIP-API-4 BEGIN\n"); sys_write(1, out, snip_multi_n); g_puts("\nSNIP-API-4 END\n")
  // Exit code comes FROM the verdict: /api/gate_run and nx_swcompare_evidence both derive GREEN/RED
  // from the exit status, so printing a verdict beside a bare `return 0` blesses every failure found.
  let rc: i64 = gv_verdict("DSSSERVE" as *u8, ctr, "/search + /doc + /api serve contract" as *u8)
  sys_exit(rc)
  return rc
485}
nx_search_snip_base_20260912.nx source

`nx_search_snip_base_20260912.nx` source
