code wiki / (root) / nx_tier_ladder_gate.nx
`nx_tier_ladder_gate.nx` source

↩ module page · 377 lines · 30915 B
1// nx_tier_ladder_gate.nx -- GP3 / GE45 REFEREE: the render-door ladder is DATA, the native walk over that
2// data is pinned by a truth table, and the JS twin the pages carry is pinned to the same ids, limits and
3// reason vocabulary -- so the page, the conf and the ruler cannot disagree.
4//
5// SUBJECTS: (1) the LIVE knowledge/tier_ladder.conf as parsed by nx_tier_ladder_lib (in-process, no fork),
6// including each door's draws word (S0, 2026-09-04: the WebGPU pass declares world -- NO CAST -- as data, so a
7// WebGPU frame missing every character is a fact this gate, the HUD and the referee can all state);
8// (2) runtime-assembled fixture confs that MUST be refused (the neg-controls: a ladder without a fallback,
9// an order that regresses, a field carrying a double quote, an unknown state, a fallback that is not last,
10// an unknown draws word, a door row without the draws field);
11// (3) the emitted JS twin (tl_js over the live table); (4) the world emitter source, which must COMPOSE
12// tl_emit() -- a page emitter that draws a frame without the ladder is the unexplained-frame defect this
13// rung exists to retire.
14//
15// WHY A TRUTH TABLE AND NOT "IT PICKED SOMETHING": the walk has four inputs (WebGPU capability, WebGL2
16// capability, the lever of every door, the force-lever of the fallback) and the defect it must never have is
17// a walk that reads a levered door as default or a capability-absent door as failed. Each row below names the
18// inputs and the ONE door (and reason word) they must produce on the shipping conf.
19//
20//   nx_tier_ladder_gate      (no args; the emitter source is probed at buildroot/runtime then runtime)
21// license_tier: ORIGINAL   No hw writes (Rule 26).
22import "nx_syscalls.nx"
23import "nx_gate_verdict.nx"
24import "nx_tier_ladder_lib.nx"
25
26const TG_E1: *u8 = "buildroot/runtime/nx_game_page_emit.nx"
27const TG_E2: *u8 = "runtime/nx_game_page_emit.nx"
28const TG_FIX_BYTES: i64 = 1024
29const TG_LEVER_BYTES: i64 = 64
30const TG_MIN_DOORS: i64 = 3
31const TG_LP_BYTES: i64 = 16
32
33// fixture variants -- assembled at RUNTIME so a source scanner never mistakes them for a real conf
34const TG_F_GOOD: i64 = 0
35const TG_F_NO_FALLBACK: i64 = 1
36const TG_F_ORDER_REGRESS: i64 = 2
37const TG_F_QUOTE: i64 = 3
38const TG_F_BAD_STATE: i64 = 4
39const TG_F_FALLBACK_NOT_LAST: i64 = 5
40const TG_F_NO_BOOT: i64 = 6
41const TG_F_BOOT_MAX_BELOW_MS: i64 = 7
42// GE30 thread-ladder variants
43const TG_F_THREAD_PARTIAL: i64 = 8      // a floor with no ceiling -- would read as ceiling 0
44const TG_F_THREAD_CEIL_LOW: i64 = 9     // a ceiling below the floor
45const TG_F_THREAD_ZERO: i64 = 10        // a floor of zero -- would pick no workers at all
46const TG_F_THREAD_DUP: i64 = 11         // the same key twice, so which one wins is a coin flip
47const TG_F_NO_THREAD: i64 = 12          // no thread rows: LEGAL, the optional block absent
48// S0 draws-field variants (both planted on the fixture's webgl2 row, its SECOND line)
49const TG_F_BAD_DRAWS: i64 = 13          // a draws word outside the vocabulary -- must REFUSE, never default
50const TG_F_NO_DRAWS: i64 = 14           // the pre-S0 seven-field door row -- must REFUSE BY NAME
51const TG_FIX_WEBGL2_LINE: i64 = 2       // the row both variants corrupt: webgpu row is line 1, webgl2 is line 2
52const TG_CORES_MANY: i64 = 64
53const TG_CORES_ONE: i64 = 1
54const TG_CORES_NONE: i64 = 0
55const TG_LEVER_ASK: i64 = 4
56
57func tg_fixture(buf: *u8, variant: i64) -> i64 {
  var p: i64 = 0
  var st1: *u8 = "levered" as *u8
  if variant == TG_F_BAD_STATE { st1 = "sometimes" as *u8 }
  var id2: *u8 = "webgl2" as *u8
  if variant == TG_F_QUOTE { id2 = "web\"gl2" as *u8 }
  var o2: *u8 = "2" as *u8
  if variant == TG_F_ORDER_REGRESS { o2 = "1" as *u8 }
  // S0: every door row carries its draws word; the webgl2 row's is the planted variable
  var dr2: *u8 = "|world+cast|" as *u8
  if variant == TG_F_BAD_DRAWS { dr2 = "|everything|" as *u8 }
  if variant == TG_F_NO_DRAWS { dr2 = "|" as *u8 }
  p = tl_cat(buf, p, "door|webgpu-compute|1|" as *u8); p = tl_cat(buf, p, st1); p = tl_cat(buf, p, "|gpu=1|webgpu|world|WebGPU\n" as *u8)
  if variant == TG_F_FALLBACK_NOT_LAST { p = tl_cat(buf, p, "door|sovereign-cpu|2|fallback|gl=0|always|world+cast|sovereign\n" as *u8) }
  p = tl_cat(buf, p, "door|" as *u8); p = tl_cat(buf, p, id2); p = tl_cat(buf, p, "|" as *u8); p = tl_cat(buf, p, o2); p = tl_cat(buf, p, "|default|-|webgl2" as *u8); p = tl_cat(buf, p, dr2); p = tl_cat(buf, p, "WebGL2\n" as *u8)
  // every variant carries the fallback row EXCEPT the two whose defect IS the fallback -- so a boot-row
  // neg-control fails for the boot reason and not for a missing fallback (the first cut did exactly that)
  if variant != TG_F_NO_FALLBACK { if variant != TG_F_FALLBACK_NOT_LAST { p = tl_cat(buf, p, "door|sovereign-cpu|3|fallback|gl=0|always|world+cast|sovereign\n" as *u8) } }
  if variant == TG_F_FALLBACK_NOT_LAST { p = tl_cat(buf, p, "door|late|9|default|-|always|world|late\n" as *u8) }
  p = tl_cat(buf, p, "limit|maxComputeInvocationsPerWorkgroup|64|kernel workgroup\n" as *u8)
  if variant == TG_F_NO_BOOT { buf[p] = 0 as u8; return p }
  p = tl_cat(buf, p, "boot|gpu_boot_ms|4000|race budget\nboot|gpu_boot_lever|gpuboot|probe lever\n" as *u8)
  if variant == TG_F_BOOT_MAX_BELOW_MS { p = tl_cat(buf, p, "boot|gpu_boot_max_ms|1000|clamp below the budget\n" as *u8) }
  if variant != TG_F_BOOT_MAX_BELOW_MS { p = tl_cat(buf, p, "boot|gpu_boot_max_ms|30000|clamp\n" as *u8) }
  // GE30 thread rows. Every variant carries a WELL-FORMED block except the four whose defect IS the
  // block, and TG_F_NO_THREAD carries none at all -- which must PARSE, because the block is optional.
  if variant == TG_F_NO_THREAD { buf[p] = 0 as u8; return p }
  var tfloor: *u8 = "1" as *u8
  if variant == TG_F_THREAD_ZERO { tfloor = "0" as *u8 }
  var tceil: *u8 = "16" as *u8
  if variant == TG_F_THREAD_CEIL_LOW { tceil = "0" as *u8 }
  p = tl_cat(buf, p, "thread|thread_floor|" as *u8); p = tl_cat(buf, p, tfloor); p = tl_cat(buf, p, "|floor\n" as *u8)
  if variant == TG_F_THREAD_DUP { p = tl_cat(buf, p, "thread|thread_floor|2|a second floor\n" as *u8) }
  if variant != TG_F_THREAD_PARTIAL {
      p = tl_cat(buf, p, "thread|thread_ceiling|" as *u8); p = tl_cat(buf, p, tceil); p = tl_cat(buf, p, "|ceiling\n" as *u8)
      p = tl_cat(buf, p, "thread|thread_lever|threads|lever\n" as *u8)
  }
  buf[p] = 0 as u8
  return p
96}
97func tg_parse_fixture(variant: i64) -> i64 {
  let buf: *u8 = sys_mmap(TG_FIX_BYTES)
  let n: i64 = tg_fixture(buf, variant)
  let tbl: *i64 = sys_mmap(TL_TBL_BYTES) as *i64
  return tl_parse(buf, n, tbl)
102}
103// the 1-based line the parser refused at -- so a refusal tooth can assert WHICH row fired it, not only which code
104func tg_parse_fixture_line(variant: i64) -> i64 {
  let buf: *u8 = sys_mmap(TG_FIX_BYTES)
  let n: i64 = tg_fixture(buf, variant)
  let tbl: *i64 = sys_mmap(TL_TBL_BYTES) as *i64
  tl_parse(buf, n, tbl)
  return tbl[TL_H_LINE]
110}
111// a runtime-assembled needle draws:"<word>" -- assembled, never a literal, so a source scan cannot mistake it
112func tg_draws_needle(word: *u8) -> *u8 {
  let d: *u8 = sys_mmap(TL_FIELD_BYTES)
  var p: i64 = 0
  p = tl_cat(d, p, "draws:\"" as *u8); p = tl_cat(d, p, word); p = tl_cat(d, p, "\"" as *u8)
  d[p] = 0 as u8
  return d
118}
119func tg_levers(a: i64, b: i64, c: i64) -> *i64 {
  let l: *i64 = sys_mmap(TG_LEVER_BYTES) as *i64
  l[0] = a; l[1] = b; l[2] = c
  return l
123}
124// door index carrying a requirement on the live table, or -1
125func tg_door_by_req(tbl: *i64, rq: i64) -> i64 {
  var i: i64 = 0
  while i < tl_doors(tbl) { if tl_door_req(tbl, i) == rq { return i } i = i + 1 }
  return 0 - 1
129}
130
131func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_tier_ladder_gate -- GP3/GE45: the door ladder is data, its walk is pinned, its JS twin carries the same words" as *u8)
134
  // ---- (1) the live conf ----------------------------------------------------------------------
  let tbl: *i64 = sys_mmap(TL_TBL_BYTES) as *i64
  let rc: i64 = tl_load(tbl)
  gv_puts("conf=" as *u8); gv_puts(TL_CONF); gv_puts(" rc=" as *u8); gv_num(rc); gv_puts(" doors=" as *u8); gv_num(tl_doors(tbl)); gv_puts(" limits=" as *u8); gv_num(tl_limits(tbl)); gv_puts("\n" as *u8)
  gv_check("live-conf-parses-rc0" as *u8, rc == TL_OK, ctr)
  let nd: i64 = tl_doors(tbl)
  gv_check("live-conf-carries-at-least-three-doors" as *u8, nd >= TG_MIN_DOORS, ctr)
  var asc: i64 = 1
  var i: i64 = 1
  while i < nd { if tl_door_order(tbl, i) <= tl_door_order(tbl, i - 1) { asc = 0 } i = i + 1 }
  gv_check("live-orders-strictly-ascending" as *u8, asc == 1, ctr)
  var last_fb: i64 = 0
  if nd > 0 { if tl_door_state(tbl, nd - 1) == TL_ST_FALLBACK { if tl_door_req(tbl, nd - 1) == TL_RQ_ALWAYS { last_fb = 1 } } }
  gv_check("live-last-door-is-the-always-satisfiable-fallback" as *u8, last_fb == 1, ctr)
  let dgpu: i64 = tg_door_by_req(tbl, TL_RQ_WEBGPU)
  let dgl: i64 = tg_door_by_req(tbl, TL_RQ_WEBGL2)
  gv_check("live-conf-names-a-webgpu-door-and-a-webgl2-door" as *u8, (dgpu >= 0) * (dgl >= 0) == 1, ctr)
  gv_check("live-webgpu-door-is-the-DEFAULT-since-GE1-flipped-by-conf-edit-2026-09-06-(operator-order)" as *u8, tl_door_state(tbl, 0) == TL_ST_DEFAULT, ctr)
  // ---- (1a) S0: WHAT EACH DOOR DRAWS is data; the WebGPU pass declared NO CAST until S12 step 2 (2026-09-06) ----------------
  // Until 2026-09-04 that fact was prose in the webgpu row's label and the token cast occurred 0 times in
  // the lib, so no instrument could state that a WebGPU frame is missing every character. gv_check_eq so the
  // codes are EMITTED beside each verdict (actual= expected=), never only asserted. The sovereign value was
  // READ off the engine, not guessed: render_overlay_impl -> mob_draw -> wc_mob_mesh draws the resident cast
  // as skinned meshes on the CPU tier (their TEXM surfaces are the open contract wc_mob_tex); the visiting
  // cast of world_npcs.conf is drawn by drawDonors inside glDraw only, and the WebGPU branch calls gpuDraw.
  gv_check_eq("live-webgpu-door-draws-world-plus-cast-since-S12-step-2-2026-09-06-the-resident-cast-rides-the-ported-pipeline" as *u8, tl_door_draws(tbl, dgpu), TL_DR_WORLD_CAST, ctr)
  gv_check_eq("live-webgl2-door-draws-world-plus-cast" as *u8, tl_door_draws(tbl, dgl), TL_DR_WORLD_CAST, ctr)
  gv_check_eq("live-sovereign-cpu-door-draws-world-plus-cast-the-resident-cast-as-wc_mob_mesh-figures" as *u8, tl_door_draws(tbl, nd - 1), TL_DR_WORLD_CAST, ctr)
  gv_check("live-conf-carries-a-limit-row" as *u8, tl_limits(tbl) >= 1, ctr)
  var mins_ok: i64 = 1
  i = 0
  while i < tl_limits(tbl) { if tl_limit_min(tbl, i) <= 0 { mins_ok = 0 } i = i + 1 }
  gv_check("live-every-limit-minimum-is-positive" as *u8, mins_ok == 1, ctr)
  gv_check("live-boot-ceiling-is-data-with-a-positive-budget" as *u8, tl_boot_ms(tbl) > 0, ctr)
  gv_check("live-boot-clamp-is-at-least-the-budget" as *u8, tl_boot_max(tbl) >= tl_boot_ms(tbl), ctr)
  gv_check("live-boot-lever-key-is-named" as *u8, tl_slen(tl_boot_lever(tbl)) > 0, ctr)
171
  // ---- (1b) GE30: the THREAD ladder on the live conf -------------------------------------------
  // The block is optional in the PARSER so a lib and a conf can land independently; it is REQUIRED
  // here, because an optional block nobody checks is one that silently disappears and takes every
  // page back to one core with nothing saying so.
  gv_puts("threads declared=" as *u8); gv_num(tl_threads_declared(tbl))
  gv_puts(" floor=" as *u8); gv_num(tl_thread_floor(tbl))
  gv_puts(" ceiling=" as *u8); gv_num(tl_thread_ceiling(tbl))
  gv_puts(" lever=" as *u8); gv_puts(tl_thread_lever(tbl)); gv_puts("\n" as *u8)
  gv_check("live-conf-declares-the-thread-ladder" as *u8, tl_threads_declared(tbl) == 1, ctr)
  gv_check("live-thread-floor-is-one-so-the-scale-down-door-always-draws" as *u8, tl_thread_floor(tbl) == 1, ctr)
  gv_check("live-thread-ceiling-is-at-least-the-floor" as *u8, tl_thread_ceiling(tbl) >= tl_thread_floor(tbl), ctr)
  gv_check("live-thread-lever-key-is-named" as *u8, tl_slen(tl_thread_lever(tbl)) > 0, ctr)
  // the native walk, pinned the same way the door walk is: inputs named, one answer each
  gv_check("threads-one-worker-without-shared-memory-however-many-cores" as *u8, tl_thread_pick(tbl, TG_CORES_MANY, 0, 0) == 1, ctr)
  gv_check("threads-measured-cores-when-sharing-and-inside-the-ceiling" as *u8, tl_thread_pick(tbl, TG_LEVER_ASK, 0, 1) == TG_LEVER_ASK, ctr)
  gv_check("threads-clamped-to-the-ceiling-when-the-host-reports-more" as *u8, tl_thread_pick(tbl, TG_CORES_MANY, 0, 1) == tl_thread_ceiling(tbl), ctr)
  gv_check("threads-clamped-to-the-floor-when-the-host-reports-none" as *u8, tl_thread_pick(tbl, TG_CORES_NONE, 0, 1) == tl_thread_floor(tbl), ctr)
  gv_check("threads-take-the-lever-count-when-a-url-asks-for-one" as *u8, tl_thread_pick(tbl, TG_CORES_ONE, TG_LEVER_ASK, 1) == TG_LEVER_ASK, ctr)
  gv_check("threads-a-lever-past-the-ceiling-is-clamped-not-obeyed" as *u8, tl_thread_pick(tbl, TG_CORES_ONE, TG_CORES_MANY, 1) == tl_thread_ceiling(tbl), ctr)
  gv_check("threads-why-reads-no-shared-memory-when-sharing-is-absent" as *u8, tl_seq(tl_thread_why(tbl, TG_CORES_MANY, 0, 0), TL_T_R_NOSHARE) == 1, ctr)
  gv_check("threads-why-reads-clamped-to-ceiling-on-a-big-host" as *u8, tl_seq(tl_thread_why(tbl, TG_CORES_MANY, 0, 1), TL_T_R_CEIL) == 1, ctr)
  gv_check("threads-why-reads-lever-when-a-url-pinned-the-count" as *u8, tl_seq(tl_thread_why(tbl, TG_CORES_ONE, TG_LEVER_ASK, 1), TL_T_R_LEVER) == 1, ctr)
  gv_check("threads-why-reads-measured-cores-on-an-ordinary-sharing-visitor" as *u8, tl_seq(tl_thread_why(tbl, TG_LEVER_ASK, 0, 1), TL_T_R_MEASURED) == 1, ctr)
195
  // ---- (2) the native walk: a truth table over the shipping conf -------------------------------
  // levers: [webgpu-door lever, webgl2-door lever, fallback force-lever]
  let fbi: i64 = nd - 1
  gv_check("pick-webgpu-when-capable-and-levered" as *u8, tl_pick(tbl, 1, 1, tg_levers(1, 0, 0)) == dgpu, ctr)
  gv_check("pick-webgpu-when-capable-with-lever-off-(the-default-door-needs-no-lever)" as *u8, tl_pick(tbl, 1, 1, tg_levers(0, 0, 0)) == dgpu, ctr)
  gv_check("pick-webgl2-when-lever-on-but-webgpu-absent" as *u8, tl_pick(tbl, 0, 1, tg_levers(1, 0, 0)) == dgl, ctr)
  gv_check("pick-webgpu-even-when-webgl2-absent" as *u8, tl_pick(tbl, 1, 0, tg_levers(1, 0, 0)) == dgpu, ctr)
  gv_check("pick-fallback-when-nothing-is-capable" as *u8, tl_pick(tbl, 0, 0, tg_levers(0, 0, 0)) == fbi, ctr)
  gv_check("pick-fallback-when-its-force-lever-is-on-despite-capability" as *u8, tl_pick(tbl, 1, 1, tg_levers(1, 0, 1)) == fbi, ctr)
  gv_check("pick-webgl2-on-the-ordinary-visitor" as *u8, tl_pick(tbl, 0, 1, tg_levers(0, 0, 0)) == dgl, ctr)
  // reasons for the ordinary visitor with WebGPU present but unlevered
  let lv: *i64 = tg_levers(0, 0, 0)
  let pk: i64 = tl_pick(tbl, 1, 1, lv)
  gv_check("reason-webgpu-door-reads-taken-for-the-capable-ordinary-visitor-(default-door)" as *u8, tl_seq(tl_reason(tbl, dgpu, pk, 1, 1, lv), TL_R_TAKEN) == 1, ctr)
  gv_check("reason-webgl2-door-reads-below-the-taken-webgpu-door" as *u8, tl_seq(tl_reason(tbl, dgl, pk, 1, 1, lv), TL_R_BELOW) == 1, ctr)
  gv_check("reason-fallback-reads-below-taken" as *u8, tl_seq(tl_reason(tbl, fbi, pk, 1, 1, lv), TL_R_BELOW) == 1, ctr)
  let lv2: *i64 = tg_levers(1, 0, 0)
  let pk2: i64 = tl_pick(tbl, 0, 1, lv2)
  gv_check("reason-webgpu-door-reads-capability-absent-when-levered-on-a-host-without-it" as *u8, tl_seq(tl_reason(tbl, dgpu, pk2, 0, 1, lv2), TL_R_NOCAP) == 1, ctr)
  gv_check("reason-webgpu-door-reads-failed-when-capable-and-levered-yet-not-taken" as *u8, tl_seq(tl_reason(tbl, dgpu, dgl, 1, 1, lv2), TL_R_FAILED) == 1, ctr)
216
  // ---- (3) the parser refuses what it must (neg-controls on runtime fixtures) ------------------
  gv_check("control-good-fixture-parses-rc0" as *u8, tg_parse_fixture(TG_F_GOOD) == TL_OK, ctr)
  gv_check("neg-control-ladder-without-a-fallback-is-refused" as *u8, tg_parse_fixture(TG_F_NO_FALLBACK) == TL_E_FALLBACK, ctr)
  gv_check("neg-control-order-regression-is-refused" as *u8, tg_parse_fixture(TG_F_ORDER_REGRESS) == TL_E_ORDER, ctr)
  gv_check("neg-control-double-quote-in-a-field-is-refused" as *u8, tg_parse_fixture(TG_F_QUOTE) == TL_E_QUOTE, ctr)
  gv_check("neg-control-unknown-state-word-is-refused" as *u8, tg_parse_fixture(TG_F_BAD_STATE) == TL_E_STATE, ctr)
  gv_check("neg-control-fallback-that-is-not-last-is-refused" as *u8, tg_parse_fixture(TG_F_FALLBACK_NOT_LAST) == TL_E_FALLBACK, ctr)
  gv_check("neg-control-conf-without-the-three-boot-rows-is-refused" as *u8, tg_parse_fixture(TG_F_NO_BOOT) == TL_E_BOOT, ctr)
  gv_check("neg-control-boot-clamp-below-the-budget-is-refused" as *u8, tg_parse_fixture(TG_F_BOOT_MAX_BELOW_MS) == TL_E_BOOT, ctr)
  // GE30 thread block: optional as a WHOLE, refused when malformed. The control comes first so a
  // refusal below cannot be passing merely because the fixture was broken some other way.
  gv_check("control-a-conf-with-no-thread-rows-still-parses-the-block-is-optional" as *u8, tg_parse_fixture(TG_F_NO_THREAD) == TL_OK, ctr)
  gv_check("neg-control-a-partial-thread-block-is-refused" as *u8, tg_parse_fixture(TG_F_THREAD_PARTIAL) == TL_E_THREAD, ctr)
  gv_check("neg-control-a-thread-ceiling-below-the-floor-is-refused" as *u8, tg_parse_fixture(TG_F_THREAD_CEIL_LOW) == TL_E_THREAD, ctr)
  gv_check("neg-control-a-zero-thread-floor-is-refused" as *u8, tg_parse_fixture(TG_F_THREAD_ZERO) == TL_E_THREAD, ctr)
  gv_check("neg-control-a-repeated-thread-key-is-refused-rather-than-decided-by-order" as *u8, tg_parse_fixture(TG_F_THREAD_DUP) == TL_E_THREAD, ctr)
  // S0 draws field: the POSITIVE control first (every door of the good fixture parses its own draws word --
  // a deny-guard ships with an input that MUST be allowed), then the two refusals, each asserting WHICH
  // verdict fired AND which row: an unknown word must not default to any value (the pr_mode class), and a row
  // without the field must be refused by name, never as a bare field count.
  let tgood: *i64 = sys_mmap(TL_TBL_BYTES) as *i64
  let bgood: *u8 = sys_mmap(TG_FIX_BYTES)
  gv_check_eq("control-good-fixture-still-parses-rc0-with-draws-on-every-door" as *u8, tl_parse(bgood, tg_fixture(bgood, TG_F_GOOD), tgood), TL_OK, ctr)
  gv_check_eq("control-good-fixture-webgpu-door-parses-draws-world" as *u8, tl_door_draws(tgood, 0), TL_DR_WORLD, ctr)
  gv_check_eq("control-good-fixture-webgl2-door-parses-draws-world-plus-cast" as *u8, tl_door_draws(tgood, 1), TL_DR_WORLD_CAST, ctr)
  gv_check_eq("control-good-fixture-fallback-door-parses-draws-world-plus-cast" as *u8, tl_door_draws(tgood, 2), TL_DR_WORLD_CAST, ctr)
  gv_check_eq("neg-control-unknown-draws-token-is-refused-not-defaulted" as *u8, tg_parse_fixture(TG_F_BAD_DRAWS), TL_E_DRAWS, ctr)
  gv_check_eq("neg-control-unknown-draws-refusal-names-the-webgl2-row-it-fired-on" as *u8, tg_parse_fixture_line(TG_F_BAD_DRAWS), TG_FIX_WEBGL2_LINE, ctr)
  gv_check_eq("neg-control-door-row-without-a-draws-field-is-refused-by-name" as *u8, tg_parse_fixture(TG_F_NO_DRAWS), TL_E_DRAWS_ABSENT, ctr)
  gv_check_eq("neg-control-missing-draws-refusal-names-the-webgl2-row-it-fired-on" as *u8, tg_parse_fixture_line(TG_F_NO_DRAWS), TG_FIX_WEBGL2_LINE, ctr)
  // and the absent block picks ONE, never zero -- the scale-down door, not a starved page
  let tnone: *i64 = sys_mmap(TL_TBL_BYTES) as *i64
  let bnone: *u8 = sys_mmap(TG_FIX_BYTES)
  tl_parse(bnone, tg_fixture(bnone, TG_F_NO_THREAD), tnone)
  gv_check("a-conf-without-thread-rows-picks-one-worker-not-zero" as *u8, tl_thread_pick(tnone, TG_CORES_MANY, 0, 1) == 1, ctr)
  gv_check("a-conf-without-thread-rows-says-why-it-picked-one" as *u8, tl_seq(tl_thread_why(tnone, TG_CORES_MANY, 0, 1), TL_T_R_ABSENT) == 1, ctr)
253
  // ---- (4) the emitted twin carries the same table and the same words --------------------------
  let js: *u8 = tl_js(tbl)
  let jn: i64 = tl_slen(js)
  var ids_in_order: i64 = 1
  var at: i64 = 0
  i = 0
  while i < nd {
      let f: i64 = tl_find(js, jn, at, tl_door_id(tbl, i))
      if f < 0 { ids_in_order = 0 }
      if f >= 0 { at = f }
      i = i + 1
  }
  gv_check("js-carries-every-door-id-in-conf-order" as *u8, ids_in_order == 1, ctr)
  var keys_ok: i64 = 1
  i = 0
  while i < tl_limits(tbl) { if tl_find(js, jn, 0, tl_limit_key(tbl, i)) < 0 { keys_ok = 0 } i = i + 1 }
  gv_check("js-carries-every-limit-key" as *u8, keys_ok == 1, ctr)
  var vocab: i64 = 1
  if tl_find(js, jn, 0, TL_R_TAKEN) < 0 { vocab = 0 }
  if tl_find(js, jn, 0, TL_R_BELOW) < 0 { vocab = 0 }
  if tl_find(js, jn, 0, TL_R_LEVER_OFF) < 0 { vocab = 0 }
  if tl_find(js, jn, 0, TL_R_NOCAP) < 0 { vocab = 0 }
  if tl_find(js, jn, 0, TL_R_FAILED) < 0 { vocab = 0 }
  if tl_find(js, jn, 0, TL_R_UNEXPLAINED) < 0 { vocab = 0 }
  gv_check("js-carries-the-whole-reason-vocabulary-of-tl_reason" as *u8, vocab == 1, ctr)
  gv_check("js-defines-nxDoorId-and-nxDoorReport" as *u8, (tl_find(js, jn, 0, "function nxDoorId(" as *u8) >= 0) * (tl_find(js, jn, 0, "function nxDoorReport(" as *u8) >= 0) == 1, ctr)
  // the HUD's door field calls nxDoor(); a twin that defines the report but not the door prints ladder-absent
  // for every visitor while every other tooth stays green -- caught by reading nx_contentdiff, not by this gate,
  // on 2026-09-02, which is why both twins are pinned here
  gv_check("js-defines-nxDoor-the-function-the-HUD-door-field-calls" as *u8, tl_find(js, jn, 0, "function nxDoor(" as *u8) >= 0, ctr)
  gv_check("js-nxDoor-falls-back-to-the-undecided-word" as *u8, tl_find(js, jn, 0, TL_R_UNDECIDED) >= 0, ctr)
  gv_check("js-defines-nxGpuBootMs-the-ceiling-the-page-races-against" as *u8, tl_find(js, jn, 0, "function nxGpuBootMs(" as *u8) >= 0, ctr)
  gv_check("js-boot-object-carries-the-conf-lever-key" as *u8, tl_find(js, jn, 0, tl_boot_lever(tbl)) >= 0, ctr)
  gv_check("js-boot-lever-is-clamped-by-max-not-trusted" as *u8, tl_find(js, jn, 0, "v>b.max?b.max:v" as *u8) >= 0, ctr)
  gv_check("js-window-ladder-and-limits-objects-present" as *u8, (tl_find(js, jn, 0, "window.__nx_ladder=[" as *u8) >= 0) * (tl_find(js, jn, 0, "window.__nx_gpu_limits={" as *u8) >= 0) == 1, ctr)
  // ---- S0: the twin carries every door's draws word and a reader for the active door's, on window ----
  var draws_ok: i64 = 1
  i = 0
  while i < nd { if tl_find(js, jn, 0, tg_draws_needle(tl_draws_name(tl_door_draws(tbl, i)))) < 0 { draws_ok = 0 } i = i + 1 }
  gv_check("js-carries-every-doors-draws-word-in-the-ladder-rows" as *u8, draws_ok * (nd > 0) == 1, ctr)
  // the requires and draws fields sit side by side in the emitted row, so ONE substring pins the claim that
  // the door requiring webgpu draws world -- a probe reading window.__nx_ladder gets the same pair
  gv_check("js-webgpu-row-reads-requires-webgpu-draws-world-plus-cast-so-a-probe-can-state-the-frame-carries-the-resident-cast" as *u8, tl_find(js, jn, 0, "requires:\"webgpu\",draws:\"world+cast\"" as *u8) >= 0, ctr)
  gv_check("js-defines-nxDoorDraws-and-publishes-it-on-window" as *u8, (tl_find(js, jn, 0, "function nxDoorDraws(" as *u8) >= 0) * (tl_find(js, jn, 0, "window.nxDoorDraws=nxDoorDraws" as *u8) >= 0) == 1, ctr)
  // anchored INSIDE nxDoorDraws (the undecided word also appears in nxDoor and nxDoorReport, so a whole-file
  // find would pass on a mutant that dropped it from the reader under test)
  let jdd: i64 = tl_find(js, jn, 0, "function nxDoorDraws(" as *u8)
  let jdr: i64 = tl_find(js, jn, 0, "function nxDoorReport(" as *u8)
  var undecided_in: i64 = 0
  if jdd >= 0 { if jdr > jdd { let ju: i64 = tl_find(js, jn, jdd, TL_R_UNDECIDED); if ju >= 0 { if ju < jdr { undecided_in = 1 } } } }
  gv_check("js-nxDoorDraws-reads-undecided-before-the-ladder-resolves-anchored-inside-itself" as *u8, undecided_in == 1, ctr)
  let jabs: *u8 = tl_js_absent(TL_E_UNREADABLE, 0)
  gv_check("neg-control-absent-twin-names-the-absence-and-still-defines-both-functions" as *u8, (tl_find(jabs, tl_slen(jabs), 0, "__nx_ladder_absent" as *u8) >= 0) * (tl_find(jabs, tl_slen(jabs), 0, "function nxDoorReport(" as *u8) >= 0) == 1, ctr)
  gv_check("neg-control-absent-twin-also-defines-nxDoor" as *u8, tl_find(jabs, tl_slen(jabs), 0, "function nxDoor(" as *u8) >= 0, ctr)
  gv_check("neg-control-absent-twin-still-defines-nxGpuBootMs-so-the-page-boots" as *u8, tl_find(jabs, tl_slen(jabs), 0, "function nxGpuBootMs(" as *u8) >= 0, ctr)
  // S0: a broken conf must still define nxDoorDraws (the badge calls it unconditionally) and it must NAME the
  // absence rather than claim a draws word -- needle assembled at runtime from the lib's own vocabulary
  let jda: *u8 = sys_mmap(TL_FIELD_BYTES)
  var jdp: i64 = 0
  jdp = tl_cat(jda, jdp, "function nxDoorDraws(){return \"" as *u8); jdp = tl_cat(jda, jdp, TL_R_ABSENT); jdp = tl_cat(jda, jdp, "\";}" as *u8); jda[jdp] = 0 as u8
  gv_check("neg-control-absent-twin-nxDoorDraws-names-the-ladder-absence-and-is-published" as *u8, (tl_find(jabs, tl_slen(jabs), 0, jda) >= 0) * (tl_find(jabs, tl_slen(jabs), 0, "window.nxDoorDraws=nxDoorDraws" as *u8) >= 0) == 1, ctr)
  // ---- GE30: the thread twin carries the same numbers and the same reason words -----------------
  gv_check("js-carries-the-thread-floor-ceiling-and-lever-from-the-conf" as *u8, (tl_find(js, jn, 0, "window.__nx_threads={floor:" as *u8) >= 0) * (tl_find(js, jn, 0, tl_thread_lever(tbl)) >= 0), ctr)
  gv_check("js-defines-nxThreads-the-count-the-page-cuts-its-bands-by" as *u8, tl_find(js, jn, 0, "function nxThreads(" as *u8) >= 0, ctr)
  gv_check("js-defines-nxThreadsWhy-so-a-one-worker-frame-is-never-unexplained" as *u8, tl_find(js, jn, 0, "function nxThreadsWhy(" as *u8) >= 0, ctr)
  gv_check("js-measures-sharing-rather-than-assuming-it-from-a-header" as *u8, (tl_find(js, jn, 0, "crossOriginIsolated" as *u8) >= 0) * (tl_find(js, jn, 0, "SharedArrayBuffer" as *u8) >= 0), ctr)
  gv_check("js-reads-the-hosts-core-count-rather-than-a-device-class" as *u8, tl_find(js, jn, 0, "navigator.hardwareConcurrency" as *u8) >= 0, ctr)
  // ⚠ANCHORED INSIDE nxThreads, not merely present in the file. The first cut searched the whole
  // emitted string for the clamp and a planted mutant that DELETED the clamp from nxThreads
  // survived it -- because nxThreadsWhy legitimately contains the same two comparisons to decide
  // which reason word to print. A substring found anywhere is not the same claim as a clamp on the
  // path that returns the count, so the search starts at nxThreads and must land before nxThreadsWhy.
  let jt: i64 = tl_find(js, jn, 0, "function nxThreads(" as *u8)
  let jtw: i64 = tl_find(js, jn, 0, "function nxThreadsWhy(" as *u8)
  var clamped: i64 = 0
  if jt >= 0 { if jtw > jt {
      let cfl: i64 = tl_find(js, jn, jt, "n<t.floor" as *u8)
      let ccl: i64 = tl_find(js, jn, jt, "n>t.ceiling" as *u8)
      if cfl >= 0 { if cfl < jtw { if ccl >= 0 { if ccl < jtw { clamped = 1 } } } }
  } }
  gv_check("js-clamps-the-thread-lever-into-floor-and-ceiling-inside-nxThreads-itself" as *u8, clamped == 1, ctr)
  var tvocab: i64 = 1
  if tl_find(js, jn, 0, TL_T_R_NOSHARE) < 0 { tvocab = 0 }
  if tl_find(js, jn, 0, TL_T_R_CEIL) < 0 { tvocab = 0 }
  if tl_find(js, jn, 0, TL_T_R_FLOOR) < 0 { tvocab = 0 }
  if tl_find(js, jn, 0, TL_T_R_LEVER) < 0 { tvocab = 0 }
  if tl_find(js, jn, 0, TL_T_R_MEASURED) < 0 { tvocab = 0 }
  gv_check("js-carries-the-whole-thread-reason-vocabulary-of-tl_thread_why" as *u8, tvocab == 1, ctr)
  // the ladder JS is appended INSIDE the page's instantiate callback, so a bare `function nxThreads(){}`
  // is closure-scoped and invisible to every external instrument -- MEASURED on the live /world/beach,
  // where window.__nx_threads read back fine while nxThreads, nxThreadsWhy and nxDoor all read NOFN.
  // Both twins must therefore PUBLISH the doors on window, or the ruler cannot referee the page.
  gv_check("js-publishes-the-thread-doors-on-window-so-an-external-probe-can-call-them" as *u8, (tl_find(js, jn, 0, "window.nxThreads=nxThreads" as *u8) >= 0) * (tl_find(js, jn, 0, "window.nxThreadsWhy=nxThreadsWhy" as *u8) >= 0) * (tl_find(js, jn, 0, "window.nxThreadShared=nxThreadShared" as *u8) >= 0), ctr)
  gv_check("neg-control-absent-twin-also-publishes-them-so-a-broken-conf-stays-measurable" as *u8, tl_find(jabs, tl_slen(jabs), 0, "window.nxThreads=nxThreads" as *u8) >= 0, ctr)
  gv_check("neg-control-absent-twin-still-defines-nxThreads-so-the-frame-loop-lives" as *u8, (tl_find(jabs, tl_slen(jabs), 0, "function nxThreads(" as *u8) >= 0) * (tl_find(jabs, tl_slen(jabs), 0, "function nxThreadsWhy(" as *u8) >= 0), ctr)
349
  // ---- (5) the world emitter composes tl_emit() ------------------------------------------------
  let lp: *i64 = sys_mmap(TG_LP_BYTES) as *i64
  var src: *u8 = sys_read_file(TG_E1, lp)
  var readable: i64 = 0
  if (src as i64) != 0 { if lp[0] > 0 { readable = 1 } }
  if readable == 0 {
      src = sys_read_file(TG_E2, lp)
      if (src as i64) != 0 { if lp[0] > 0 { readable = 1 } }
  }
  if gv_need("emitter-source-nx_game_page_emit.nx-readable-at-buildroot/runtime-or-runtime" as *u8, readable, ctr) == 1 {
      gv_check("emitter-composes-tl_emit" as *u8, tl_composes(src, lp[0]) == 1, ctr)
      gv_check("emitter-races-WebGPU-init-against-nxGpuBootMs-not-a-constant" as *u8, tl_find(src, lp[0], 0, "GPU_BOOT_MS=nxGpuBootMs()" as *u8) >= 0, ctr)
      // S0: the tier badge NAMES what the frame draws -- the needle is the CODE shape (a const assignment),
      // not the function name, so a comment in the emitter that mentions the reader cannot satisfy it
      gv_check("emitter-tier-badge-appends-nxDoorDraws-so-the-badge-names-what-the-frame-draws" as *u8, tl_find(src, lp[0], 0, "const dw9=nxDoorDraws();" as *u8) >= 0, ctr)
      gv_check("emitter-mirrors-the-draws-word-as-window.__sov_draws-for-instruments" as *u8, tl_find(src, lp[0], 0, "window.__sov_draws=dw9;" as *u8) >= 0, ctr)
  }
  // S0: the VALUES the draws teeth rest on, emitted for independent adjudication (one line per door)
  gv_values_head()
  gv_kv("doors" as *u8, nd)
  i = 0
  while i < nd {
      gv_puts("  door_" as *u8); gv_puts(tl_door_id(tbl, i)); gv_puts("_draws=" as *u8); gv_puts(tl_draws_name(tl_door_draws(tbl, i)))
      gv_puts(" code=" as *u8); gv_num(tl_door_draws(tbl, i)); gv_puts("\n" as *u8)
      i = i + 1
  }
  return gv_verdict("nx_tier_ladder_gate" as *u8, ctr, "the door ladder is data; page, conf and ruler share one table" as *u8)
377}
nx_tier_ladder_gate.nx source

`nx_tier_ladder_gate.nx` source
