code wiki / _hdl_build / nx_wasm_craft_vm_gate.nx
`nx_wasm_craft_vm_gate.nx` source

↩ module page · 526 lines · 31378 B
1// nx_wasm_craft_vm_gate.nx -- RUN THE SHIPPED CRAFT WASM, IN THE MEMORY THE BROWSER GIVES IT.
2//
3// WHY THIS EXISTS, stated plainly. On 2026-08-14 /craft shipped BROKEN TWICE while nx_wasm_craft_gate
4// reported 59/59 GREEN both times, because that gate is NATIVE: it sys_mmaps CRAFT_TOTAL and therefore
5// never meets the wasm memory bound at all. The WAT backend emits a FIXED 192 pages (12,582,912 bytes)
6// without consulting the module's constants, so when the render ceiling was raised the arena outgrew
7// it by 9.4 MB and every browser frame trapped with "index out of bounds". A page that traps paints
8// NOTHING -- which is also how the characters disappeared, since mob_draw runs inside that render.
9//
10// ★THE LESSON THIS ORGAN ENCODES: A GATE THAT TESTS A DIFFERENT BUILD THAN THE ONE THAT SHIPS IS NOT
11// TESTING THE PRODUCT. The native gate and the wasm are two builds of one source, and only one of them
12// is what a visitor loads. This runs the ACTUAL .wasm the emitter produced, in a linear memory sized
13// to exactly what the module declares, through the estate's own VM -- the same shape six sibling sims
14// already use (nx_pendulum_wasm_vm_gate and friends) and which craft, the biggest of them, lacked.
15//
16// The two teeth are the two ways it broke, in the order it broke them:
17//   FITS   -- the worst-case framebuffer (q=1, one ray per pixel) must lie inside the declared memory
18//   PAINTS -- after init+render the framebuffer must carry more than one colour
19//   PERF   -- (2026-09-04) the long-frame door: perf_frame/perf_n/perf_long through the exports the page calls
20// Neither can be satisfied by a trapping module, and PAINTS cannot be satisfied by a blank frame.
21// license_tier: ORIGINAL   expect_exit: 0
22import "nx_syscalls.nx"
23import "nx_wasm_vm.nx"
24import "nx_wasm_craft.nx"
25import "nx_gate_verdict.nx"
26
27const CV_WASM: *u8 = "buildroot/_build/nx_wasm_craft_emit.wasm"
28const CV_COLCAP: i64 = 4096
29const CV_PERF_SHORT_MS: i64 = 7            // a frame under every bar: budget and the 50 ms long-frame line
30const CV_PERF_LONG_MS: i64 = 60             // one frame past the Long Animation Frame bar (50 ms, ref ge-loaf)
31
32func cv_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
33func cv_n(v: i64) -> i64 {
  var m: i64=v; if m<0 { cv_w("-" as *u8); m=0-m }
  let t: *u8=sys_mmap(24); var k: i64=0
  if m==0 { t[0]=48 as u8; k=1 }
  while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 }
  let o: *u8=sys_mmap(24); var i: i64=0
  while i<k { o[i]=t[k-1-i]; i=i+1 }
  sys_write(1,o,k); return 0
41}
42func cv_rd64(m: *u8, o: i64) -> i64 { var v: i64=0; var i: i64=0; while i<8 { v = v | ((m[o+i] as i64) << (i*8)); i=i+1 } return v }
43func cv_wr64(m: *u8, o: i64, v: i64) -> i64 { var i: i64=0; while i<8 { m[o+i] = ((v >> (i*8)) & 255) as u8; i=i+1 } return 0 }
44
45// ===== E1 (2026-08-25): THE TERRAIN TEETH ================================================
46// FITS and PAINTS prove the module RUNS. Neither can see the LAND, and this gate cannot call
47// init() to look at it -- 786,432 voxels through an interpreter, for the reason stated above.
48// But wheight IS the ground: gencol builds every column from it and gentrees plants from it, and
49// the wat backend exports EVERY top-level function, so the shipped module's own height function
50// can be called one point at a time. A lattice of those calls IS a heightfield, and a heightfield
51// has a dimensionless referee. This is what turns "the terrain is eroded" from a claim about the
52// native twin into a MEASUREMENT TAKEN ON THE WASM A VISITOR LOADS.
53const CV_SEED: i64 = 20260728
54// PAINTS-REAL fixture geometry. A stamped patch mid-world (inside the shader's -8..135 march bounds),
55// with the camera a few blocks above its highest column. Fixture, named as fixture.
56const CV_PATCH: i64 = 8
57const CV_PATCH_X0: i64 = 60
58const CV_PATCH_Z0: i64 = 60
59const CV_CAM_UP: i64 = 3        // the seed rows 1-3 of world_recipes.conf ship at
60const CV_LAT: i64 = 24               // lattice side -> 576 height queries per scenario
61const CV_STRIDE: i64 = 5             // blocks between lattice points: >= the detail octave's own
                                   // lattice, so a sample is never all one noise cell
63const CV_ERK: i64 = 1                // THE BUDGET CRAFT ACTUALLY SHIPS AT -- kept equal to the
                                   // recipe column on purpose, so this gate's subject is the
                                   // land a visitor gets and not a neighbouring setting.
                                   // CHOSEN FROM THE LADDER BELOW, NOT FROM TASTE: k=1, 2 and 3
                                   // all measure rugosity 75 and moved ~510 of 576, because the
                                   // delivered heights are quantised to whole blocks -- so the
                                   // 2nd and 3rd ticks cost 5x and 25x the raw evaluations per
                                   // column and change nothing the player can stand on.
71const CV_TBASE: i64 = 4              // craft's shipped identity (wc_spec v0), so the subject is
72const CV_TAMP1: i64 = 17             // the land the visitor actually arrives on rather than a
73const CV_TAMP2: i64 = 5              // shape invented for the test
74const CV_TALPROBE: i64 = 384         // 1.5 blocks in WC_ER_Q units -- a representative threshold
75const CV_DSWEEP: i64 = 2048          // +-8 blocks in WC_ER_Q units, wider than craft's relief
76
77func cv_spec(mod: *WasmMod, a1: i64, a2: i64, k: i64) -> i64 {
  cv_wr64(mod.mem, O_SPEC + P_TBASE*8, CV_TBASE)
  cv_wr64(mod.mem, O_SPEC + P_TAMP1*8, a1)
  cv_wr64(mod.mem, O_SPEC + P_TAMP2*8, a2)
  cv_wr64(mod.mem, O_SPEC + P_ERODE*8, k)
  cv_wr64(mod.mem, O_SPEC + P_ERTAL*8, 0)   // re-arm: the threshold must be MEASURED per scenario
  return 0
84}
85func cv_sample(mod: *WasmMod, fn: *u8, out: *i64) -> i64 {
  var i: i64 = 0
  var z: i64 = 0
  while z < CV_LAT {
      var x: i64 = 0
      while x < CV_LAT {
          out[i] = wm_run(mod, fn, 0, x*CV_STRIDE, z*CV_STRIDE, CV_SEED, 0, 4)
          i = i + 1
          x = x + 1
      }
      z = z + 1
  }
  return i
98}
99// Pike & Wilson elevation-relief identity in permil -- THE SAME RULER the native gate's T53 uses,
100// not a second one. Dimensionless ON PURPOSE: adding a constant to every height leaves it exactly
101// unchanged and scaling every height leaves it exactly unchanged, so neither a lifted world nor a
102// louder one can fake an erosion result. -1 = no relief, which is a refusal and not a value.
103func cv_hi(h: *i64, n: i64) -> i64 {
  var mn: i64 = h[0]
  var mx: i64 = h[0]
  var sum: i64 = 0
  var i: i64 = 0
  while i < n {
      if h[i] < mn { mn = h[i] }
      if h[i] > mx { mx = h[i] }
      sum = sum + h[i]
      i = i + 1
  }
  if mx == mn { return 0 - 1 }
  return (sum - n*mn)*1000/(n*(mx - mn))
116}
117func cv_ndiff(a: *i64, b: *i64, n: i64) -> i64 {
  var d: i64 = 0
  var i: i64 = 0
  while i < n { if a[i] != b[i] { d = d + 1 } i = i + 1 }
  return d
122}
123// sample at an ARBITRARY stride. Talus acts between ADJACENT blocks, so the referee below needs a
124// contiguous patch; the broad stride-5 lattice stays for HI, which is a whole-landscape statistic.
125func cv_sample_at(mod: *WasmMod, fn: *u8, st: i64, out: *i64) -> i64 {
  var i: i64 = 0
  var z: i64 = 0
  while z < CV_LAT {
      var x: i64 = 0
      while x < CV_LAT {
          out[i] = wm_run(mod, fn, 0, x*st, z*st, CV_SEED, 0, 4)
          i = i + 1
          x = x + 1
      }
      z = z + 1
  }
  return i
138}
139// RUGOSITY, permil: the field's own MEAN LARGEST-NEIGHBOUR DROP divided by its own RELIEF.
140// Dimensionless, and EXACTLY invariant under h -> a*h + b: a lifted world and a louder world both
141// read identically, so neither an offset nor a gain can fake a result here. It is the SAME
142// quantity wc_er_talus measures, normalised by relief -- one ruler reused, not a second invented.
143// WHY THIS AND NOT HI, MEASURED RATHER THAN ARGUED. HI = (mean-min)/(max-min) reads exactly three
144// numbers, and a weak talus pass is very nearly the affine map h -> mean + a*(h - mean), which HI
145// is blind to BY CONSTRUCTION. On this very build, budget 2 moved 510 of 576 lattice heights while
146// HI read 477 -> 477, and the ladder showed it wandering 477 -> 450 -> 477 -> 477 with no monotone
147// meaning. Talus erosion is NONLINEAR -- material sheds only where the ground is steeper than its
148// own repose threshold -- so it strictly CAPS SLOPES, and rugosity is the statistic that sees
149// exactly that. HI stays printed beside it, because T53 uses it for landscape maturity: reported,
150// never asserted. -1 = no relief, which is a refusal and not a value.
151func cv_rug(h: *i64, side: i64) -> i64 {
  var mn: i64 = h[0]
  var mx: i64 = h[0]
  var i: i64 = 0
  while i < side*side {
      if h[i] < mn { mn = h[i] }
      if h[i] > mx { mx = h[i] }
      i = i + 1
  }
  if mx == mn { return 0 - 1 }
  var sum: i64 = 0
  var n: i64 = 0
  var z: i64 = 1
  while z < side - 1 {
      var x: i64 = 1
      while x < side - 1 {
          let k: i64 = z*side + x
          let c: i64 = h[k]
          var m: i64 = 0
          let a1: i64 = h[k-1] - c
          if a1 > m { m = a1 }
          if 0 - a1 > m { m = 0 - a1 }
          let a2: i64 = h[k+1] - c
          if a2 > m { m = a2 }
          if 0 - a2 > m { m = 0 - a2 }
          let a3: i64 = h[k-side] - c
          if a3 > m { m = a3 }
          if 0 - a3 > m { m = 0 - a3 }
          let a4: i64 = h[k+side] - c
          if a4 > m { m = a4 }
          if 0 - a4 > m { m = 0 - a4 }
          sum = sum + m
          n = n + 1
          x = x + 1
      }
      z = z + 1
  }
  if n == 0 { return 0 - 1 }
  return sum*1000/(n*(mx - mn))
190}
191
192func cv_arg_equal(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while b[i] != (0 as u8) {
      if a[i] != b[i] { return 0 }
      i = i+1
  }
  if a[i] != (0 as u8) { return 0 }
  return 1
200}
201
202func main(argc: i64, argv: *i64) -> i64 {
  var include_ladder: i64 = 1
  if argc > 2 {
      if cv_arg_equal(argv[2] as *u8, "checks" as *u8) == 1 { include_ladder = 0 } else {
          if cv_arg_equal(argv[2] as *u8, "full" as *u8) != 1 {
              cv_w("usage: nx_wasm_craft_vm_gate [artifact.wasm] [checks|full]\n" as *u8)
              return 2
          }
      }
  }
  if include_ladder == 0 {
      cv_w("MODE checks: every correctness assertion enabled; non-voting erosion ladder report excluded. Use full for that report.\n" as *u8)
  }
215
  var wasm_path: *u8 = CV_WASM
  if argc > 1 { wasm_path = argv[1] as *u8 }
  cv_w("WASM input: " as *u8); cv_w(wasm_path); cv_w("\n" as *u8)
  let ctr: *i64 = gv_ctr()
  cv_w("=== NX-CRAFT WASM-VM gate (the SHIPPED wasm, in the memory the browser declares) ===\n" as *u8)
221
  let box: *i64 = sys_mmap(16) as *i64
  let wasm: *u8 = sys_read_file(wasm_path, box)
  gv_check("the emitted craft wasm is readable" as *u8, ((wasm as i64) != 0) as i64, ctr)
  if (wasm as i64) == 0 {
      cv_w("  cannot read " as *u8); cv_w(wasm_path); cv_w(" -- run nx_craft_emit first\n" as *u8)
      return gv_verdict("CRAFT-WASM-VM-GATE" as *u8, ctr, "the shipped wasm was not present to test" as *u8)
  }
  let mod: *WasmMod = wm_new(wasm, box[0])
  let parsed: i64 = wm_parse(mod)
  gv_check("the wasm image parses" as *u8, (parsed==0) as i64, ctr)
  if parsed != 0 { return gv_verdict("CRAFT-WASM-VM-GATE",ctr,"Module parse failed; no execution attempted.") }
233
  // ★THE WHOLE POINT: the VM gets EXACTLY the memory the module declares, so a write past the end is
  // as fatal here as it is in a browser. Sizing this generously would hide the very defect it hunts.
  // wm_parse allocates the memory declared by this artifact. Replacing it with a source constant masks undersized modules and leaks the original mapping.
  gv_check("artifact declares usable linear memory",((mod.mem as i64)>0 && mod.mem_bytes>0) as i64,ctr)
  if (mod.mem as i64)<=0 || mod.mem_bytes<=0 { return gv_verdict("CRAFT-WASM-VM-GATE",ctr,"Declared memory unavailable; no execution attempted.") }
239
  let fi: i64 = wm_find_export(mod, "init" as *u8)
  let fr: i64 = wm_find_export(mod, "render" as *u8)
  let fw: i64 = wm_find_export(mod, "ww" as *u8)
  let fh: i64 = wm_find_export(mod, "hh" as *u8)
  let fo: i64 = wm_find_export(mod, "fb_off" as *u8)
  var ex_ok: i64 = 0
  if fi>=0 { if fr>=0 { if fw>=0 { if fh>=0 { if fo>=0 { ex_ok=1 } } } } }
  gv_check("init/render/ww/hh/fb_off are all exported" as *u8, ex_ok, ctr)
248
  // ⚠NO init() HERE, AND THAT IS DELIBERATE. Measured 2026-08-14: craft's init_impl generates a
  // 128x48x128 world -- 786,432 voxels of integer noise -- and this VM is an INTERPRETER, so the
  // call did not return inside a 120-second gate deadline. The sibling sims get away with it because
  // their init is a handful of assignments.
  // The fit check does not need it: fb_off, ww and hh are trivial accessors, and the quality slot
  // can be set by writing the state word directly. So the tooth that catches the SHIPPED crash runs
  // in milliseconds, and the frame-content tooth is declared UNREACHABLE below rather than faked.
  let off: i64 = wm_run(mod, "fb_off" as *u8, 0,0,0,0,0, 0)
257
  // force the WORST CASE the adaptive controller can reach: q=1, one ray per framebuffer pixel.
  // ww()/hh() then report the CEILING rather than the current coarse resolution.
  cv_wr64(mod.mem, O_ST + S_Q*8, 1)
  let wc: i64 = wm_run(mod, "ww" as *u8, 0,0,0,0,0, 0)
  let hc: i64 = wm_run(mod, "hh" as *u8, 0,0,0,0,0, 0)
  let need: i64 = off + wc*hc*8
  cv_w("  fb_off=" as *u8); cv_n(off); cv_w(" ceiling=" as *u8); cv_n(wc); cv_w("x" as *u8); cv_n(hc)
  cv_w("  needs=" as *u8); cv_n(need); cv_w(" declared=" as *u8); cv_n(mod.mem_bytes)
  cv_w("  headroom=" as *u8); cv_n(mod.mem_bytes - need); cv_w("\n" as *u8)
  gv_check("FITS: the q=1 framebuffer lies inside the declared linear memory -- a browser traps with 'index out of bounds' the instant it does not" as *u8, (need <= mod.mem_bytes) as i64, ctr)
268
  // ★PAINTS -- AND IT DOES RUN, WITHOUT init(). The first cut of this gate declared frame content
  // UNOBSERVABLE because init() generates 786,432 voxels of noise and an interpreter cannot finish
  // that inside any sane deadline (measured: >120s). That was true of init, and FALSE of the thing
  // actually being asked. The question is whether the shipped wasm EXECUTES ITS RENDERER and WRITES
  // A VARIED FRAME inside the memory it declares -- and worldgen is not required for that.
  //
  // An EMPTY world is the cheapest possible subject that still exercises the whole render path:
  // every ray misses, so every pixel comes from the sky gradient, which needs only two spec words.
  // Raising q shrinks the ray count without touching any other behaviour -- at Q_MAX the frame is
  // W/Q_MAX x H/Q_MAX rays instead of 240x150, which an interpreter finishes in milliseconds.
  // What this proves is exactly what was missing when /craft shipped black twice: the module runs,
  // the renderer writes the framebuffer, and it does so without leaving its own linear memory.
  // What it does NOT prove is terrain, characters or lighting -- those are the native gate's teeth
  // (T3/T19/T23/T58/T59), which share this source but cannot see the wasm bound.
  cv_wr64(mod.mem, O_ST + S_Q*8, Q_MAX)
  cv_wr64(mod.mem, O_SPEC + P_SKYTOP*8, 0x201060)
  cv_wr64(mod.mem, O_SPEC + P_SKYHOR*8, 0xC0A070)
  wm_run(mod, "render" as *u8, 0,0,0,0,0, 0)
  let rw: i64 = wm_run(mod, "ww" as *u8, 0,0,0,0,0, 0)
  let rh: i64 = wm_run(mod, "hh" as *u8, 0,0,0,0,0, 0)
  let seen: *i64 = sys_mmap(CV_COLCAP*8) as *i64
  var distinct: i64 = 0
  var p: i64 = 0
  while p < rw*rh {
      let c: i64 = cv_rd64(mod.mem, off + p*8)
      var j: i64 = 0
      var dup: i64 = 0
      while j < distinct { if seen[j]==c { dup=1; j=distinct } else { j=j+1 } }
      if dup==0 { if distinct < CV_COLCAP { seen[distinct]=c; distinct=distinct+1 } else { p = rw*rh } }
      p = p + 1
  }
  cv_w("  rendered " as *u8); cv_n(rw); cv_w("x" as *u8); cv_n(rh)
  cv_w(" rays=" as *u8); cv_n(rw*rh); cv_w(" distinct colours=" as *u8); cv_n(distinct); cv_w("\n" as *u8)
  gv_check("PAINTS: the shipped wasm runs its renderer and writes a VARIED frame inside its declared memory -- a module that traps, or one that writes nothing, cannot" as *u8, (distinct > 1) as i64, ctr)
303
  // ===== PAINTS-REAL: THE SAME RENDERER, ON THE IDENTITY THE PAGE SHIPS ====================
  // The PAINTS tooth above is a CONTROL, not a proof: it renders an all-zero world under two sky
  // words the gate itself supplied, so every one of its "distinct colours" is a gradient band
  // between constants of its own choosing. Measured 2026-08-25: /craft shipped BLACK with that tooth
  // GREEN -- a renderer drawing sky over nothing says nothing about a renderer drawing terrain over
  // something. This block gives it a subject: the SHIPPED palette (wc_spec v0, the identity craft
  // boots), REAL heights from the exported wheight at the SHIPPED erosion budget, a voxel patch
  // stamped from them, the camera above it -- and then it demands a pixel colour the empty-world
  // control frame did NOT contain, which is terrain by construction. The control's two sky words
  // are re-applied over the identity's, so sky pixels are IDENTICAL between the two frames and
  // cannot masquerade as "new". gencol is NOT called (six args, past wm_run's five) and NOT
  // re-implemented: the patch uses a declared SUBSET of its rule (grass on top, stone below). This
  // proves the renderer paints the shipped palette over real heights; block-kind fidelity stays the
  // native gate's tooth.
  let fsp: i64 = wm_find_export(mod, "wc_spec" as *u8)
  let fvs: i64 = wm_find_export(mod, "vset" as *u8)
  let fwm: i64 = wm_find_export(mod, "wc_wmax" as *u8)
  let fwh0: i64 = wm_find_export(mod, "wheight" as *u8)
  var pr_ok: i64 = 0
  if fsp >= 0 { if fvs >= 0 { if fwm >= 0 { if fwh0 >= 0 { pr_ok = 1 } } } }
  gv_check("PAINTS-REAL precondition: wc_spec, vset, wc_wmax and wheight are all exported" as *u8, pr_ok, ctr)
  if pr_ok == 1 {
      wm_run(mod, "wc_spec" as *u8, 0, 0, 0,0,0, 2)
      cv_spec(mod, CV_TAMP1, CV_TAMP2, CV_ERK)
      cv_wr64(mod.mem, O_SPEC + P_SKYTOP*8, 0x201060)
      cv_wr64(mod.mem, O_SPEC + P_SKYHOR*8, 0xC0A070)
      var hmax: i64 = 0
      var stamped: i64 = 0
      var pz: i64 = 0
      while pz < CV_PATCH {
          var px: i64 = 0
          while px < CV_PATCH {
              let wx: i64 = CV_PATCH_X0 + px
              let wz: i64 = CV_PATCH_Z0 + pz
              let hh: i64 = wm_run(mod, "wheight" as *u8, 0, wx, wz, CV_SEED, 0, 4)
              if hh > hmax { hmax = hh }
              var py: i64 = 0
              while py <= hh {
                  var bk: i64 = 3
                  if py == hh { bk = 1 }
                  wm_run(mod, "vset" as *u8, 0, wx, py, wz, bk, 5)
                  stamped = stamped + 1
                  py = py + 1
              }
              px = px + 1
          }
          pz = pz + 1
      }
      wm_run(mod, "wc_wmax" as *u8, 0, 0,0,0,0, 1)
      cv_wr64(mod.mem, O_ST + S_CX*8, (CV_PATCH_X0 + CV_PATCH/2) * 256)
      cv_wr64(mod.mem, O_ST + S_CY*8, (hmax + CV_CAM_UP) * 256)
      cv_wr64(mod.mem, O_ST + S_CZ*8, (CV_PATCH_Z0 + CV_PATCH/2) * 256)
      cv_wr64(mod.mem, O_ST + S_YAW*8, 0)
      cv_wr64(mod.mem, O_ST + S_PITCH*8, 0)
      cv_wr64(mod.mem, O_ST + S_Q*8, Q_MAX)
      wm_run(mod, "render" as *u8, 0,0,0,0,0, 0)
      var newpx: i64 = 0
      var distinct2: i64 = 0
      let seen2: *i64 = sys_mmap(CV_COLCAP*8) as *i64
      var p2: i64 = 0
      while p2 < rw*rh {
          let c2: i64 = cv_rd64(mod.mem, off + p2*8)
          var known: i64 = 0
          var jk: i64 = 0
          while jk < distinct { if seen[jk]==c2 { known=1; jk=distinct } else { jk=jk+1 } }
          if known == 0 { newpx = newpx + 1 }
          var dup2: i64 = 0
          var j2: i64 = 0
          while j2 < distinct2 { if seen2[j2]==c2 { dup2=1; j2=distinct2 } else { j2=j2+1 } }
          if dup2==0 { if distinct2 < CV_COLCAP { seen2[distinct2]=c2; distinct2=distinct2+1 } }
          p2 = p2 + 1
      }
      cv_w("  PAINTS-REAL: patch=" as *u8); cv_n(CV_PATCH); cv_w("x" as *u8); cv_n(CV_PATCH)
      cv_w(" stamped=" as *u8); cv_n(stamped); cv_w(" hmax=" as *u8); cv_n(hmax)
      cv_w(" erode_k=" as *u8); cv_n(CV_ERK)
      cv_w(" distinct=" as *u8); cv_n(distinct2); cv_w(" (control " as *u8); cv_n(distinct)
      cv_w(") non-sky pixels=" as *u8); cv_n(newpx); cv_w(" of " as *u8); cv_n(rw*rh); cv_w("\n" as *u8)
      var t_real: i64 = 0
      if newpx > 0 { if stamped > 0 { t_real = 1 } }
      gv_check("PAINTS-REAL: with the SHIPPED palette, real heights at the SHIPPED erosion budget and a stamped patch under the camera, the frame carries colours the empty-world control never produced -- terrain painted, not just sky" as *u8, t_real, ctr)
  }
385
  // ===== E1: DOES THE GROUND THE PLAYER WALKS ON ACTUALLY CHANGE? =========================
  let fq: i64 = wm_find_export(mod, "wheight" as *u8)
  let fqr: i64 = wm_find_export(mod, "wheight_raw" as *u8)
  var q_ok: i64 = 0
  if fq >= 0 { if fqr >= 0 { q_ok = 1 } }
  gv_check("the shipped module exports wheight AND wheight_raw -- the ground gencol builds every column from, and its un-eroded control, both callable a point at a time so the LAND can be measured without running worldgen" as *u8, q_ok, ctr)
  if q_ok == 0 {
      cv_w("  E1 UNMEASURABLE: the height door is absent from this build\n" as *u8)
      return gv_verdict("CRAFT-WASM-VM-GATE" as *u8, ctr, "the wasm a visitor actually loads was run in the memory it actually gets" as *u8)
  }
396
  let n53: i64 = CV_LAT*CV_LAT
  let hraw: *i64 = sys_mmap(n53*8) as *i64
  let hoff: *i64 = sys_mmap(n53*8) as *i64
  let hero: *i64 = sys_mmap(n53*8) as *i64
  let hflt: *i64 = sys_mmap(n53*8) as *i64
  let hfltr: *i64 = sys_mmap(n53*8) as *i64
403
  // (1) OPT-OUT IS EXACT. This is the tooth that says what happens to every world that did not
  // ask for erosion: budget 0 must reproduce wheight_raw at every single point, not approximately.
  cv_spec(mod, CV_TAMP1, CV_TAMP2, 0)
  cv_sample(mod, "wheight_raw" as *u8, hraw)
  cv_sample(mod, "wheight" as *u8, hoff)
  let noff: i64 = cv_ndiff(hoff, hraw, n53)
  cv_w("  E1 opt-out: budget=0 differs from raw at " as *u8); cv_n(noff); cv_w(" of " as *u8); cv_n(n53); cv_w(" points\n" as *u8)
  gv_check("neg-control-budget-zero-is-the-legacy-terrain-EXACTLY: with P_ERODE=0 every lattice height equals wheight_raw, so a world that did not opt in generates the ground it generated before erosion existed" as *u8, (noff == 0) as i64, ctr)
412
  // (2) THE GROUND MOVES, and the referee that says so is dimensionless.
  cv_spec(mod, CV_TAMP1, CV_TAMP2, CV_ERK)
  cv_sample(mod, "wheight" as *u8, hero)
  let moved: i64 = cv_ndiff(hero, hraw, n53)
  let tal: i64 = cv_rd64(mod.mem, O_SPEC + P_ERTAL*8)
  let hi0: i64 = cv_hi(hraw, n53)
  let hi1: i64 = cv_hi(hero, n53)
  cv_w("  E1 eroded: budget=" as *u8); cv_n(CV_ERK)
  cv_w(" talus MEASURED=" as *u8); cv_n(tal); cv_w("/" as *u8); cv_n(WC_ER_Q)
  cv_w(" moved=" as *u8); cv_n(moved); cv_w(" of " as *u8); cv_n(n53)
  cv_w(" | HI " as *u8); cv_n(hi0); cv_w(" -> " as *u8); cv_n(hi1); cv_w(" permil\n" as *u8)
  gv_check("EROSION MOVES THE GROUND: at the shipped budget the shipped wasm returns a DIFFERENT height at one or more lattice points than the un-eroded surface does" as *u8, (moved > 0) as i64, ctr)
  // THE REFEREE, on a CONTIGUOUS patch: talus acts between ADJACENT blocks, so a stride-5
  // lattice would be asking about a scale the operator does not work at.
  let hrc: *i64 = sys_mmap(n53*8) as *i64
  let hec: *i64 = sys_mmap(n53*8) as *i64
  cv_spec(mod, CV_TAMP1, CV_TAMP2, 0)
  cv_sample_at(mod, "wheight_raw" as *u8, 1, hrc)
  cv_spec(mod, CV_TAMP1, CV_TAMP2, CV_ERK)
  cv_sample_at(mod, "wheight" as *u8, 1, hec)
  let rug0: i64 = cv_rug(hrc, CV_LAT)
  let rug1: i64 = cv_rug(hec, CV_LAT)
  cv_w("  E1 referee: rugosity (mean neighbour drop / relief) " as *u8); cv_n(rug0)
  cv_w(" -> " as *u8); cv_n(rug1)
  cv_w(" permil | HI " as *u8); cv_n(hi0); cv_w(" -> " as *u8); cv_n(hi1)
  cv_w(" permil (HI REPORTED, NOT ASSERTED -- see cv_rug)\n" as *u8)
  var rug_ok: i64 = 0
  if rug0 > 0 { if rug1 > 0 { if rug1 < rug0 { rug_ok = 1 } } }
  gv_check("THE DIMENSIONLESS REFEREE FALLS: rugosity -- the ground's own mean largest-neighbour drop divided by its own relief -- is STRICTLY LOWER after weathering. The ratio is exactly invariant under h -> a*h + b, so a lifted world and a louder world read identically and neither an offset nor a gain can produce this; only capping slopes can" as *u8, rug_ok, ctr)
  gv_check("the talus threshold was MEASURED FROM THE TERRAIN, never authored: P_ERTAL is positive after the first query, having been re-armed to zero immediately before it" as *u8, (tal > 0) as i64, ctr)
443
  // THE BUDGET LADDER -- PRINTED, NEVER ASSERTED. One run answers "how much weathering does a
  // tick actually buy on this land", so the recipe column is chosen from a measurement instead
  // of from taste, and a later reader can see whether the shipped budget sits on a plateau or a
  // cliff. No tooth keys on it: a ladder that voted would be a second ruler beside the two above.
  if include_ladder == 1 {
  var kk: i64 = 1
  while kk <= WC_ER_MAXK {
      cv_spec(mod, CV_TAMP1, CV_TAMP2, kk)
      cv_sample(mod, "wheight" as *u8, hero)
      cv_w("  E1 ladder k=" as *u8); cv_n(kk)
      cv_w(" talus=" as *u8); cv_n(cv_rd64(mod.mem, O_SPEC + P_ERTAL*8))
      cv_w(" moved=" as *u8); cv_n(cv_ndiff(hero, hraw, n53))
      cv_w(" of " as *u8); cv_n(n53)
      cv_w(" HI=" as *u8); cv_n(cv_hi(hero, n53))
      cv_sample_at(mod, "wheight" as *u8, 1, hec)
      cv_w(" rugosity=" as *u8); cv_n(cv_rug(hec, CV_LAT))
      cv_w(" permil (raw HI " as *u8); cv_n(hi0)
      cv_w(" rugosity " as *u8); cv_n(rug0); cv_w(")\n" as *u8)
      kk = kk + 1
  }
  }
465
  // (3) NEG-CONTROL: a world with NO RELIEF must come out untouched. An operator that added
  // noise, or lifted the ground, or blurred it, would move this one too.
  cv_spec(mod, 0, 0, CV_ERK)
  cv_sample(mod, "wheight" as *u8, hflt)
  cv_spec(mod, 0, 0, 0)
  cv_sample(mod, "wheight_raw" as *u8, hfltr)
  let nflt: i64 = cv_ndiff(hflt, hfltr, n53)
  cv_w("  E1 flat control: amp1=0 amp2=0 budget=" as *u8); cv_n(CV_ERK)
  cv_w(" differs at " as *u8); cv_n(nflt); cv_w(" points (must be 0)\n" as *u8)
  gv_check("neg-control-a-flat-world-is-not-eroded: with no relief the measured talus is zero, erosion turns itself off, and every height is identical -- so this operator cannot be adding noise, an offset, or a blur" as *u8, (nflt == 0) as i64, ctr)
476
  // (4) NEG-CONTROL: mass. Each edge transfer must be exactly equal and opposite, which is what
  // separates erosion (material MOVES downhill) from smoothing (material is destroyed).
  var asym: i64 = 0
  var dd: i64 = 0 - CV_DSWEEP
  while dd <= CV_DSWEEP {
      let fp: i64 = wm_run(mod, "wc_er_flux" as *u8, dd, CV_TALPROBE, 0, 0, 0, 2)
      let fm: i64 = wm_run(mod, "wc_er_flux" as *u8, 0 - dd, CV_TALPROBE, 0, 0, 0, 2)
      if fp != 0 - fm { asym = asym + 1 }
      dd = dd + 1
  }
  cv_w("  E1 mass: antisymmetry breaks at " as *u8); cv_n(asym)
  cv_w(" of " as *u8); cv_n(CV_DSWEEP*2 + 1); cv_w(" sampled drops (must be 0)\n" as *u8)
  gv_check("neg-control-mass-is-conserved-edge-by-edge: wc_er_flux is EXACTLY antisymmetric across the whole sweep, so both ends of every edge move by equal and opposite amounts and material is transported rather than destroyed -- a smoothing filter fails this tooth" as *u8, (asym == 0) as i64, ctr)
490
  // ===== PERF: THE LONG-FRAME DOOR ANSWERS ON THE WASM A VISITOR LOADS (2026-09-04) =============
  // MEASURED on the served /world/beach the hour this was written: the page telemetry read long=-1,
  // the UNOBSERVED sentinel, while n=256 and over=19 came from the SAME perf region through the same
  // exports -- pf_long answering "nothing observed" on a populated window. The native ruler cannot see
  // it (nx_perf_pct_gate 36/36 runs the lib natively), the module DOES export perf_long (parsed from the
  // served bytes), so the question belongs here: push frames through perf_frame exactly as the engine
  // does, then read perf_n and perf_long back through the exports the page calls. A frame at or over
  // the 50 ms Long Animation Frame bar (ref ge-loaf) must count as one; three below it must count as
  // zero; and the sentinel on a populated window is the defect, named as the neg-control.
  let fpf: i64 = wm_find_export(mod, "perf_frame" as *u8)
  let fpn: i64 = wm_find_export(mod, "perf_n" as *u8)
  let fpl: i64 = wm_find_export(mod, "perf_long" as *u8)
  var pf_ok: i64 = 0
  if fpf >= 0 { if fpn >= 0 { if fpl >= 0 { pf_ok = 1 } } }
  gv_check("PERF precondition: perf_frame, perf_n and perf_long are all exported by the shipped module" as *u8, pf_ok, ctr)
  if pf_ok == 1 {
      wm_run(mod, "perf_frame" as *u8, CV_PERF_SHORT_MS, 0,0,0,0, 1)
      wm_run(mod, "perf_frame" as *u8, CV_PERF_SHORT_MS, 0,0,0,0, 1)
      wm_run(mod, "perf_frame" as *u8, CV_PERF_SHORT_MS, 0,0,0,0, 1)
      let long_before: i64 = wm_run(mod, "perf_long" as *u8, 0,0,0,0,0, 0)
      wm_run(mod, "perf_frame" as *u8, CV_PERF_LONG_MS, 0,0,0,0, 1)
      let pn: i64 = wm_run(mod, "perf_n" as *u8, 0,0,0,0,0, 0)
      let plong: i64 = wm_run(mod, "perf_long" as *u8, 0,0,0,0,0, 0)
      let pworst: i64 = wm_run(mod, "perf_worst_ever" as *u8, 0,0,0,0,0, 0)
      cv_w("  PERF: pushed 3x" as *u8); cv_n(CV_PERF_SHORT_MS); cv_w("ms + 1x" as *u8); cv_n(CV_PERF_LONG_MS)
      cv_w("ms -> perf_n=" as *u8); cv_n(pn); cv_w(" perf_long_before=" as *u8); cv_n(long_before)
      cv_w(" perf_long=" as *u8); cv_n(plong); cv_w(" perf_worst_ever=" as *u8); cv_n(pworst); cv_w("
518" as *u8)
      gv_check_eq("PERF: perf_n counts the four frames pushed through the export the engine uses" as *u8, pn, 4, ctr)
      gv_check_eq("PERF: perf_long is ZERO, not the sentinel, on a populated window with no frame at the 50 ms bar" as *u8, long_before, 0, ctr)
      gv_check_eq("PERF: perf_long counts exactly the one frame at or over 50 ms -- the value the page publishes as long=" as *u8, plong, 1, ctr)
      gv_check("neg-control-perf_long-never-answers-UNOBSERVED-on-a-populated-window (the served-page defect this tooth was written against)" as *u8, (plong >= 0) as i64, ctr)
  }
524
  return gv_verdict("CRAFT-WASM-VM-GATE" as *u8, ctr, "the wasm a visitor actually loads was run in the memory it actually gets, and the ground it generates was measured through its own height function" as *u8)
526}
nx_wasm_craft_vm_gate.nx source

`nx_wasm_craft_vm_gate.nx` source
