code wiki / _hdl_build / nx_stderronly_gate.nx
`nx_stderronly_gate.nx` source

↩ module page · 454 lines · 22971 B
1// nx_stderronly_gate.nx -- END-TO-END gate for nx_stderronly, as an ORGAN. No shell.
2//
3// Inherits nx_gate_verdict (gv_ctr/gv_head/gv_check/gv_bite/gv_verdict) so the EXIT CODE CARRIES THE
4// VERDICT and the declared count equals the executed count by construction. Runtime plumbing (fixture
5// writing, fork/exec, output capture) comes from nx_gatekit_lib.
6//
7// EVERY FIXTURE IS ASSEMBLED AT RUNTIME UNDER /tmp/nx_stderronly_gate/ AND THE QUOTE CHARACTERS ARE
8// COMPOSED FROM A BYTE, NEVER WRITTEN AS LITERALS. The subject is a SOURCE SCANNER, so a fixture
9// spelled out in this file would be found by the subject when it sweeps the corpus -- a detector that
10// scans source will find its own test fixture, and writing the pattern in a COMMENT re-arms the same
11// trap because prose is source bytes too. A gate must also not share its fixture with a production
12// beat, which is why the ratchet teeth pass --baseline into /tmp rather than touching nishi-ops.
13//
14// THE ANTI-VACUITY TOOTH IS FIRST AND IT IS A gv_bite: a trivial always-GREEN implementation fails the
15// fires-on-bad half and a trivial always-RED implementation fails the silent-on-good half, so neither
16// can pass this gate. Every refusal-side tooth is named neg-control-... so the census can SEE it.
17//
18// POSITIVE CONTROLS ON REAL ESTATE CODE, because a detector that flags a known-good guard is worse
19// than none: nx_clockjob.nx (SEVEN real fd-2 refusal guards, every one of them carrying sys_exit) must
20// be EXAMINED and NOT flagged, and nx_logtail_gate.nx must not be flagged. ⚠ THE SECOND CONTROL IS
21// DELIBERATELY WEAK AND IS LABELLED AS SUCH: nx_logtail_gate contains no fd-2 write at all, so it
22// could not be flagged by any implementation, which is why the clockjob control is the load-bearing
23// one -- it has the emissions AND the refusal words AND must still come back clean.
24//
25// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
26import "nx_gatekit_lib.nx"
27import "nx_gate_verdict.nx"
28
29const GS_DIR:   *u8 = "/tmp/nx_stderronly_gate"
30const GS_CAP:   i64 = 262144
31const GS_SRC:   i64 = 65536
32const GS_PATH:  i64 = 4096
33const GS_QUOTE: i64 = 34
34const GS_NLCH:  i64 = 10
35const GS_HASH:  i64 = 35
36const GS_SPACE: i64 = 32
37const GS_D0:    i64 = 48
38const GS_D9:    i64 = 57
39const GS_BASE10: i64 = 10
40const GS_NULRES: i64 = 8      // headroom kept free so a copied source can always be NUL-terminated
41const GS_LENSLOT: i64 = 16    // the out-length cell gk_run_capture writes into, with slack
42
43// append a quoted string, quotes COMPOSED from a byte so this file never contains the fixture's shape
44func gs_qs(b: *u8, o: i64, s: *u8) -> i64 {
  var p: i64 = o
  b[p] = GS_QUOTE as u8; p = p + 1
  p = gk_cat(b, p, s)
  b[p] = GS_QUOTE as u8; p = p + 1
  return p
50}
51
52func gs_nl(b: *u8, o: i64) -> i64 {
  b[o] = GS_NLCH as u8
  return o + 1
55}
56
57// a one-line unconditional stderr helper: writes to fd 2, never branches, returns success
58func gs_helper(b: *u8, o: i64) -> i64 {
  var p: i64 = gk_cat(b, o, "func zz_err(s: *u8) -> i64 { sys_write(2, s, 3); return 0 }" as *u8)
  return gs_nl(b, p)
61}
62
63func gs_dircase(out: *u8, leaf: *u8) -> i64 {
  var o: i64 = gk_cat(out, 0, GS_DIR)
  o = gk_cat(out, o, "/" as *u8)
  o = gk_cat(out, o, leaf)
  out[o] = 0 as u8
  gk_mkdir(out)
  o = gk_cat(out, o, "/" as *u8)
  out[o] = 0 as u8
  return o
72}
73
74// write one fixture source into <GS_DIR>/<leaf>/zz_case.nx and hand back the DIRECTORY (trailing /)
75func gs_put(dirout: *u8, leaf: *u8, body: *u8) -> i64 {
  gs_dircase(dirout, leaf)
  let p: *u8 = sys_mmap(GS_PATH)
  var o: i64 = gk_cat(p, 0, dirout)
  o = gk_cat(p, o, "zz_case.nx" as *u8)
  p[o] = 0 as u8
  // UNLINK BEFORE WRITE -- a gate that is not idempotent reports on its first run and lies after
  gk_rm(p)
  gk_write(p, body)
  return 1
85}
86
87// copy a REAL estate source into a fixture dir so a positive control can be scanned without sweeping
88// the whole corpus. Returns 0 when the source cannot be read, so the caller can gv_need it.
89func gs_copy_real(dirout: *u8, leaf: *u8, srcpath: *u8) -> i64 {
  gs_dircase(dirout, leaf)
  let buf: *u8 = sys_mmap(GS_SRC)
  let n: i64 = gk_read(srcpath, buf, GS_SRC - GS_NULRES)
  if n <= 0 { return 0 }
  buf[n] = 0 as u8
  let p: *u8 = sys_mmap(GS_PATH)
  var o: i64 = gk_cat(p, 0, dirout)
  o = gk_cat(p, o, "zz_real.nx" as *u8)
  p[o] = 0 as u8
  gk_rm(p)
  gk_write(p, buf)
  return 1
102}
103
104// run the subject in dist mode over one fixture dir; returns exit code, output in buf/ln
105func gs_dist(elf: *u8, dir: *u8, buf: *u8, ln: *i64) -> i64 {
  return gk_run_capture(elf, "dist" as *u8, "--dir" as *u8, dir, 0 as *u8, buf, GS_CAP, ln)
107}
108
109// read the integer that follows `key` in the captured output; -1 when the key is absent, so a MISSING
110// field can never be read as a zero -- an axis that cannot see must abstain, not acquit
111func gs_num(buf: *u8, n: i64, key: *u8) -> i64 {
  let at: i64 = gk_out_pos(buf, n, key)
  if at < 0 { return 0 - 1 }
  var i: i64 = at + gk_len(key)
  var f: i64 = 0
  while f == 0 {
      if i >= n { f = 1 } else {
          if buf[i] == (GS_SPACE as u8) { i = i + 1 } else { f = 1 }
      }
  }
  var v: i64 = 0
  var nd: i64 = 0
  var f2: i64 = 0
  while f2 == 0 {
      if i >= n { f2 = 1 } else {
          let c: i64 = buf[i] as i64
          if c >= GS_D0 { if c <= GS_D9 { v = v * GS_BASE10 + (c - GS_D0); nd = nd + 1; i = i + 1 } }
          if c < GS_D0 { f2 = 1 }
          if c > GS_D9 { f2 = 1 }
      }
  }
  if nd == 0 { return 0 - 1 }
  return v
134}
135
136func gs_silent(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[6] SILENT                           =" as *u8) }
137func gs_carries(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[3] guarded-refusal-CARRIES-verdict  =" as *u8) }
138func gs_unknown(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[7] UNKNOWN                          =" as *u8) }
139func gs_helperbody(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[0] in-stderr-helper-body            =" as *u8) }
140func gs_nostatus(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[4] enclosing-func-not-a-status-func =" as *u8) }
141func gs_elsearm(buf: *u8, n: i64) -> i64 { return gs_num(buf, n, "[8] if-else-selector-arm             =" as *u8) }
142
143func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_stderronly_gate: END-TO-END, organ-driven, fixtures assembled at runtime" as *u8)
146
  // ---- resolve the subject and SAY WHICH ONE, because a green from a stale artifact is
  // indistinguishable from a green from your change ----
  let elf: *u8 = sys_mmap(GS_PATH)
  var have: i64 = 0
  if have == 0 { gk_cat(elf, 0, "/volume1/homes/elderwesto/nishihost/_offc/nx_stderronly.elf" as *u8); elf[gk_len(elf)] = 0 as u8; if gk_exists(elf) == 1 { have = 1 } }
  if have == 0 {
      var o1: i64 = gk_cat(elf, 0, "/volume1/homes/elderwesto/nishihost/nx_stderronly.elf" as *u8)
      elf[o1] = 0 as u8
      if gk_exists(elf) == 1 { have = 1 }
  }
  if have == 0 {
      var o2: i64 = gk_cat(elf, 0, "/mnt/c/Users/elder/nishi-core/nxc2/_offc/nx_stderronly.elf" as *u8)
      elf[o2] = 0 as u8
      if gk_exists(elf) == 1 { have = 1 }
  }
  if have == 0 {
      var o3: i64 = gk_cat(elf, 0, "/mnt/c/Users/elder/nishi-core/nxc2/_build/nx_stderronly.sov.elf" as *u8)
      elf[o3] = 0 as u8
      if gk_exists(elf) == 1 { have = 1 }
  }
  if have == 0 {
      var o4: i64 = gk_cat(elf, 0, "buildroot/_build/nx_stderronly.sov.elf" as *u8)
      elf[o4] = 0 as u8
      if gk_exists(elf) == 1 { have = 1 }
  }
  let m0: *u8 = sys_mmap(GS_PATH)
  var mm: i64 = gk_cat(m0, 0, "  subject=" as *u8)
  if have == 1 { mm = gk_cat(m0, mm, elf) } else { mm = gk_cat(m0, mm, "NONE-FOUND" as *u8) }
  mm = gs_nl(m0, mm)
  gk_say(m0, mm)
  if gv_need("nx_stderronly binary present on this host" as *u8, have, ctr) == 0 {
      return gv_verdict("nx_stderronly_gate" as *u8, ctr, "subject unbuilt on this host" as *u8)
  }
180
  gk_mkdir(GS_DIR)
182
  let src:  *u8 = sys_mmap(GS_SRC)
  let dir:  *u8 = sys_mmap(GS_PATH)
  let dir2: *u8 = sys_mmap(GS_PATH)
  let buf:  *u8 = sys_mmap(GS_CAP)
  let buf2: *u8 = sys_mmap(GS_CAP)
  let ln:   *i64 = sys_mmap(GS_LENSLOT) as *i64
  let ln2:  *i64 = sys_mmap(GS_LENSLOT) as *i64
  let path: *u8 = sys_mmap(GS_PATH)
191
  // ================= FIXTURE A: the planted SILENT guard =================
  var o: i64 = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_do(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { zz_err(" as *u8)
  o = gs_qs(src, o, "REFUSED negative input" as *u8)
  o = gk_cat(src, o, " as *u8) }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x > 99 { return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "bad" as *u8, src)
  let rcA: i64 = gs_dist(elf, dir, buf, ln)
  let silA: i64 = gs_silent(buf, ln[0])
205
  // ================= FIXTURE B: the SAME guard, verdict carried =================
  o = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_do(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { zz_err(" as *u8)
  o = gs_qs(src, o, "REFUSED negative input" as *u8)
  o = gk_cat(src, o, " as *u8); return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x > 99 { return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir2, "good" as *u8, src)
  let rcB: i64 = gs_dist(elf, dir2, buf2, ln2)
  let silB: i64 = gs_silent(buf2, ln2[0])
  let carB: i64 = gs_carries(buf2, ln2[0])
220
  // ---- T1 ANTI-VACUITY, FIRST. The two fixtures differ by ONE clause, so neither an
  // always-GREEN nor an always-RED implementation can pass this. ----
  var fired: i64 = 0
  if silA == 1 { fired = 1 }
  var quiet: i64 = 1
  if silB == 0 { quiet = 0 }
  gv_bite("T1 anti-vacuity-fires-on-planted-silent-guard-and-not-on-its-carrying-twin" as *u8, fired, quiet, ctr)
228
  // ---- T2 the fixture REACHED THE CONDITION: the worklist NAMES the function, not just a count ----
  gv_check("T2 bad-fixture-worklist-NAMES-the-planted-function-not-only-a-count" as *u8, gk_out_has(buf, ln[0], "func=zz_do" as *u8), ctr)
231
  // ---- T3 the good fixture was EXAMINED, not skipped: it must report the site as CARRIES ----
  var t3: i64 = 0
  if carB >= 1 { t3 = 1 }
  gv_check("T3 neg-control-carrying-guard-is-EXAMINED-and-classified-CARRIES-not-skipped" as *u8, t3, ctr)
236
  // ---- T4 an unconditional stderr helper's own body is a PRINTER, never a guard ----
  var t4h: i64 = gs_helperbody(buf, ln[0])
  var t4: i64 = 0
  if t4h >= 1 { t4 = 1 }
  gv_check("T4 neg-control-stderr-helper-body-classified-as-printer-not-guard" as *u8, t4, ctr)
242
  // ================= FIXTURE C: a REASON-PRINTER (caller already holds the code) =================
  o = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_reason(rc: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if rc == 0 - 1 { zz_err(" as *u8)
  o = gs_qs(src, o, "REFUSED bad thing" as *u8)
  o = gk_cat(src, o, " as *u8) }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "reason" as *u8, src)
  gs_dist(elf, dir, buf, ln)
  var t5: i64 = 0
  if gs_silent(buf, ln[0]) == 0 { if gs_nostatus(buf, ln[0]) >= 1 { t5 = 1 } }
  gv_check("T5 neg-control-reason-printer-not-flagged-and-named-not-a-status-func" as *u8, t5, ctr)
257
  // ================= FIXTURE D: an if/else message SELECTOR =================
  o = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_pick(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { zz_err(" as *u8)
  o = gs_qs(src, o, "REFUSED left" as *u8)
  o = gk_cat(src, o, " as *u8) } else { zz_err(" as *u8)
  o = gs_qs(src, o, "REFUSED right" as *u8)
  o = gk_cat(src, o, " as *u8) }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x > 99 { return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "selector" as *u8, src)
  gs_dist(elf, dir, buf, ln)
  var t6: i64 = 0
  if gs_silent(buf, ln[0]) == 0 { if gs_elsearm(buf, ln[0]) >= 1 { t6 = 1 } }
  gv_check("T6 neg-control-if-else-selector-arm-not-flagged-and-named-as-a-selector" as *u8, t6, ctr)
275
  // ================= FIXTURE E: fd 2 spelled as a NAMED CONSTANT =================
  // THE SAME CONSTANT IN TWO BASES IS TWO CONSTANTS TO EVERY SCANNER, and the estate writes both.
  // A subject that matched only the digit would report zero here and look clean.
  o = gk_cat(src, 0, "const ZZ_ERRFD: i64 = 2" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "func zz_do(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { sys_write(ZZ_ERRFD, " as *u8)
  o = gs_qs(src, o, "REFUSED via a named fd constant" as *u8)
  o = gk_cat(src, o, " as *u8, 31) }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x > 99 { return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "fdconst" as *u8, src)
  gs_dist(elf, dir, buf, ln)
  var t7: i64 = 0
  if gs_silent(buf, ln[0]) == 1 { t7 = 1 }
  gv_check("T7 fd2-spelled-as-a-named-const-is-resolved-by-VALUE-not-by-the-digit" as *u8, t7, ctr)
293
  // ================= FIXTURE F: an UNTERMINATED literal =================
  // From the open quote onward the code view is fiction. The subject must ABSTAIN (UNKNOWN), never
  // acquit and never accuse -- an axis that cannot see must abstain, not acquit.
  o = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_do(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { zz_err(" as *u8)
  src[o] = GS_QUOTE as u8; o = o + 1
  o = gk_cat(src, o, "REFUSED and never closed" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "unterm" as *u8, src)
  gs_dist(elf, dir, buf, ln)
  var t8: i64 = 0
  if gs_unknown(buf, ln[0]) >= 1 { if gs_silent(buf, ln[0]) == 0 { t8 = 1 } }
  gv_check("T8 neg-control-unterminated-literal-ABSTAINS-as-UNKNOWN-rather-than-acquitting" as *u8, t8, ctr)
308
  // ================= FIXTURE G: a LITERAL NEWLINE inside a string =================
  // This dialect allows it, so a newline must NOT close a literal. The first version of the subject
  // assumed it did, and the closing quote on the next line then read as an OPENING quote.
  o = gs_helper(src, 0)
  o = gk_cat(src, o, "func zz_do(x: i64) -> i64 {" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x < 0 { zz_err(" as *u8)
  src[o] = GS_QUOTE as u8; o = o + 1
  o = gk_cat(src, o, "REFUSED with a real newline" as *u8); o = gs_nl(src, o)
  src[o] = GS_QUOTE as u8; o = o + 1
  o = gk_cat(src, o, " as *u8) }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    if x > 99 { return 1 }" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "    return 0" as *u8); o = gs_nl(src, o)
  o = gk_cat(src, o, "}" as *u8); o = gs_nl(src, o)
  src[o] = 0 as u8
  gs_put(dir, "nlstr" as *u8, src)
  gs_dist(elf, dir, buf, ln)
  var t9: i64 = 0
  if gs_silent(buf, ln[0]) == 1 { if gs_unknown(buf, ln[0]) == 0 { t9 = 1 } }
  gv_check("T9 literal-newline-inside-a-string-does-not-close-it-and-does-not-shift-the-mask" as *u8, t9, ctr)
328
  // ---- T10 THE BAR IS PRINTED IN EVERY VERDICT -- a bar nobody can see was never published ----
  var t10: i64 = 0
  if gk_out_has(buf, ln[0], "BAR vocab=" as *u8) == 1 { if gk_out_has(buf, ln[0], "tokens=" as *u8) == 1 { t10 = 1 } }
  gv_check("T10 the-vocabulary-bar-and-its-token-count-are-printed-on-every-run" as *u8, t10, ctr)
333
  // ---- T11 THE PARTITION IS A CLAIM: CHECK THE PARTS SUM, and check the subject says so ----
  gv_check("T11 the-published-partition-RECONCILES-with-its-own-site-total" as *u8, gk_out_has(buf, ln[0], "RECONCILES" as *u8), ctr)
336
  // ================= THE RATCHET, BOTH DIRECTIONS =================
  // --baseline points into /tmp: A GATE MUST NOT SHARE ITS FIXTURE WITH A PRODUCTION BEAT.
  gs_dircase(dir, "bad" as *u8)
  var bp: i64 = gk_cat(path, 0, GS_DIR)
  bp = gk_cat(path, bp, "/base_empty.txt" as *u8)
  path[bp] = 0 as u8
  gk_rm(path)
  gk_write(path, "# nx_stderronly baseline fixture, deliberately holding no keys\n" as *u8)
  let rcRed: i64 = gk_run_capture(elf, "--dir" as *u8, dir, "--baseline" as *u8, path, buf, GS_CAP, ln)
  var t12: i64 = 0
  if rcRed == 1 { if gk_out_has(buf, ln[0], "NEW-SILENT-STDERR-GUARD" as *u8) == 1 { if gk_out_has(buf, ln[0], "zz_do" as *u8) == 1 { t12 = 1 } } }
  gv_check("T12 ratchet-goes-RED-with-exit-1-and-NAMES-the-new-key-not-just-a-count" as *u8, t12, ctr)
349
  // now baseline that exact key and the SAME tree must go GREEN with exit 0
  var kp: i64 = gk_cat(path, 0, GS_DIR)
  kp = gk_cat(path, kp, "/base_full.txt" as *u8)
  path[kp] = 0 as u8
  gk_rm(path)
  let keyb: *u8 = sys_mmap(GS_PATH)
  var ko: i64 = gk_cat(keyb, 0, "# nx_stderronly baseline fixture holding the planted key\n" as *u8)
  ko = gk_cat(keyb, ko, dir)
  ko = gk_cat(keyb, ko, "zz_case.nx" as *u8)
  keyb[ko] = GS_HASH as u8; ko = ko + 1
  ko = gk_cat(keyb, ko, "zz_do" as *u8)
  ko = gs_nl(keyb, ko)
  keyb[ko] = 0 as u8
  gk_write(path, keyb)
  let rcGreen: i64 = gk_run_capture(elf, "--dir" as *u8, dir, "--baseline" as *u8, path, buf2, GS_CAP, ln2)
  var t13: i64 = 0
  if rcGreen == 0 { if gk_out_has(buf2, ln2[0], "GREEN no new silent guard" as *u8) == 1 { t13 = 1 } }
  gv_check("T13 ratchet-goes-GREEN-with-exit-0-once-the-same-key-is-baselined" as *u8, t13, ctr)
368
  // ---- T14 IDEMPOTENT: the same inputs twice give byte-identical output ----
  let rcAgain: i64 = gk_run_capture(elf, "--dir" as *u8, dir, "--baseline" as *u8, path, buf, GS_CAP, ln)
  var t14: i64 = 0
  if rcAgain == rcGreen { if ln[0] == ln2[0] {
      var same: i64 = 1
      var z: i64 = 0
      while z < ln[0] { if buf[z] != buf2[z] { same = 0; z = ln[0] } else { z = z + 1 } }
      t14 = same
  } }
  gv_check("T14 idempotent-second-run-over-the-same-fixture-is-byte-identical" as *u8, t14, ctr)
379
  // ---- T19 A TEST-SCOPED RATCHET MUST NOT WRITE THE PRODUCTION JOURNAL. `path` still holds the
  // baseline used by T13/T14, and those runs passed NO --journal, so the record must have landed
  // BESIDE THE BASELINE. This tooth exists because the earlier gate did the opposite and put three
  // fixture rows (corpus=1) into knowledge/status/stderronly.log, where a trend reader would have
  // consumed them as real censuses. ----
  let jside: *u8 = sys_mmap(GS_PATH)
  var jso: i64 = gk_cat(jside, 0, path)
  jso = gk_cat(jside, jso, ".journal" as *u8)
  jside[jso] = 0 as u8
  let jsn: i64 = gk_read(jside, buf, GS_CAP - GS_NULRES)
  var t19: i64 = 0
  if jsn > 0 { if gk_out_has(buf, jsn, "verdict=" as *u8) == 1 { t19 = 1 } }
  gv_check("T19 a-test-scoped-baseline-sends-the-run-record-beside-it-not-into-the-production-journal" as *u8, t19, ctr)
393
  // ================= POSITIVE CONTROLS ON REAL ESTATE CODE =================
  // nx_clockjob carries SEVEN real fd-2 refusal guards, every one of them followed by a non-zero
  // exit. It must be EXAMINED (CARRIES > 0) and NOT flagged. This is the load-bearing control:
  // A DETECTOR THAT FLAGS A KNOWN-GOOD GUARD IS WORSE THAN NONE.
  let root: *u8 = sys_mmap(GS_PATH)
  var haveroot: i64 = gk_corpus_root(root)
  var cj: i64 = 0
  if haveroot == 1 {
      var rp: i64 = gk_len(root)
      rp = gk_cat(root, rp, "nx_clockjob.nx" as *u8)
      root[rp] = 0 as u8
      cj = gs_copy_real(dir, "pc_clockjob" as *u8, root)
  }
  if gv_need("nx_clockjob.nx readable for the positive control" as *u8, cj, ctr) == 1 {
      gs_dist(elf, dir, buf, ln)
      var t15: i64 = 0
      if gs_silent(buf, ln[0]) == 0 { if gs_carries(buf, ln[0]) >= 1 { t15 = 1 } }
      gv_check("T15 positive-control-nx_clockjob-real-refusal-guards-EXAMINED-and-NOT-flagged" as *u8, t15, ctr)
  }
413
  // nx_logtail_gate is the census's model detector. ⚠ WEAK BY CONSTRUCTION AND SAID SO IN THE NAME:
  // it holds no fd-2 write at all, so no implementation could flag it. Kept because the census named
  // it, but it is the clockjob control above that actually constrains anything.
  let hdl: *u8 = sys_mmap(GS_PATH)
  var havehdl: i64 = gk_corpus_hdl(hdl)
  var lg: i64 = 0
  if havehdl == 1 {
      var hp: i64 = gk_len(hdl)
      hp = gk_cat(hdl, hp, "nx_logtail_gate.nx" as *u8)
      hdl[hp] = 0 as u8
      lg = gs_copy_real(dir, "pc_logtail" as *u8, hdl)
  }
  if gv_need("nx_logtail_gate.nx readable for the weak positive control" as *u8, lg, ctr) == 1 {
      gs_dist(elf, dir, buf, ln)
      var t16: i64 = 0
      if gs_silent(buf, ln[0]) == 0 { t16 = 1 }
      gv_check("T16 positive-control-WEAK-nx_logtail_gate-not-flagged-it-holds-no-fd2-write-at-all" as *u8, t16, ctr)
  }
432
  // ---- T18 THE DURABLE RUN RECORD. A beat discards stdout, so without this line a RED run on the
  // clock would announce its finding to nobody -- which is the very defect the subject detects. The
  // tooth asserts the record EXISTS and CARRIES THE VERDICT, and it writes into /tmp, never into the
  // production log, because a gate must not share its fixture with a production beat. ----
  var jp: i64 = gk_cat(path, 0, GS_DIR)
  jp = gk_cat(path, jp, "/run_journal.log" as *u8)
  path[jp] = 0 as u8
  gk_rm(path)
  gs_dircase(dir, "good" as *u8)
  gk_run_capture(elf, "--dir" as *u8, dir, "--journal" as *u8, path, buf, GS_CAP, ln)
  let jn: i64 = gk_read(path, buf2, GS_CAP - GS_NULRES)
  var t18: i64 = 0
  if jn > 0 { if gk_out_has(buf2, jn, "verdict=" as *u8) == 1 { if gk_out_has(buf2, jn, "sites=" as *u8) == 1 { t18 = 1 } } }
  gv_check("T18 a-durable-run-record-is-appended-and-carries-the-verdict-so-a-beat-is-not-silent" as *u8, t18, ctr)
447
  // ---- T17 the subject's own exit codes are its verdict, not decoration ----
  var t17: i64 = 0
  if rcA == 0 { if rcB == 0 { t17 = 1 } }
  gv_check("T17 dist-mode-exits-0-so-a-census-run-is-never-mistaken-for-a-ratchet-verdict" as *u8, t17, ctr)
452
  return gv_verdict("nx_stderronly_gate" as *u8, ctr, "source-shape detector for refusals that reach the caller as silence" as *u8)
454}
nx_stderronly_gate.nx source

`nx_stderronly_gate.nx` source
