gates: every gate script with a verdict trap fails through it - six sibling gates repaired, 66 pre-empting exits removed, the ratchet widened by shape (the #802 class)

[ryanbreen]

Background

docker/qemu/run-x86-prod-profile-boot-test.sh carries a specific architecture:
set -euo pipefail + set -E (errtrace), a report_gate_failure() function
armed on the ERR trap, and a rule -- tests/teardown_structure.rs's
x86_production_profile_gate_verdict_discipline_holds -- that no exit
statement may appear anywhere in the script other than the trap's own
re-raise (exit "$exit_code"). #801 added two BREENIX_GATE_TMP preflight
checks to that script with a bare exit 1, which reached before the trap
existed and could end the gate with no verdict line at all -- #802. #805
fixed it in that one script and disclosed the open question: whether each
sibling gate's own preflight should print its own FAIL line "is a judgement
about that gate's verdict model, not a red this branch is carrying." This PR
is that judgement, made uniformly, and the repair that follows from it.

Census

Grepped docker/qemu/ and scripts/ for the verdict-line shapes named in
the task ("PASS:, "FAIL:, PASS (, FAIL (, gate: (PASS|FAIL),
gate run, verdict, BREENIX_GATE_TMP): 37 of the tree's 91 .sh files
matched.

That pattern set is itself an undercount: it misses any script phrased as
: PASS", : FAILED (, or RATCHET: FAILED instead of the exact shapes
above. Re-deriving that gap directly (the same phrasings, plus the eight
original patterns, over the 91 scripts, then reading each named file in
full) finds 13 true positives, not 18 as an earlier draft of this
branch's own doc claimed. 5 of that draft's 18 are false positives that
print no PASS/FAIL/verdict-shaped text at all -- zero hits on a
case-insensitive pass|fail|verdict|success sweep of each file's full
body -- 5 of 5 scripts/parallels/ VM-manipulation utilities whose only
exit N statements are argument/prerequisite validation, never a
completion verdict: scripts/parallels/build-efi.sh (0 PASS/FAIL/verdict/success
hits; its one sweep hit is a comment describing newfs_msdos's own
limitation, not this script's verdict), scripts/parallels/collect-breenix-cpu0-traces.sh
and scripts/parallels/collect-hwdump.sh (0 hits each; diagnostic
collectors, no completion verdict), scripts/parallels/collect-linux-cpu0-traces.sh
(0 verdict hits; the sweep's only hit is VM_PASSWORD/VM_SUDO_PASSWORD, a
substring match on "pass" inside "password"), and scripts/parallels/screenshot-vm.sh
(0 hits). 5 excluded scripts total.

The other 13 are genuine (each prints a PASS/FAIL/SUCCESS/FAILURE-shaped
line and has at least one bare exit N): 5 use colored PASS:/FAIL:
("${GREEN}PASS:${NC}", invisible to the literal "PASS: pattern because a
color-code variable sits between the opening quote and the word) --
scripts/check-kernel-no-neon.sh, scripts/check-x86-dispatch-no-alloc.sh,
scripts/check-coreproof-production-clean.sh,
scripts/check-fs-fault-production-clean.sh,
scripts/check-coreproof-seams.sh -- and 8 use a differently-worded banner
(docker/qemu/run-dns-test.sh, docker/qemu/run-keyboard-test.sh,
docker/qemu/run-kthread-test.sh, scripts/ci/ring3_check.sh,
scripts/parallels/inject.sh, scripts/test_fork_mcp.sh,
docker/qemu/run-blocking-recv-test.sh, scripts/run-arm64-keyboard-test.sh).
0 of these 13 (the same null result the wrong 18-count already reported for
its wrong superset) carry the architecture that actually decides repair
scope, so this correction changes the doc's candidate-pool count, not the
repair's scope.

Grepping the 37 candidates for report_gate_failure + an ERR trap that
arms it -- the shape that actually decides scope -- found exactly 7, 7
of 7 under docker/qemu/, 0 of 7 under scripts/:

docker/qemu/run-aarch64-tty-oracle-gate.sh
docker/qemu/run-coreproof-gate.sh
docker/qemu/run-ext2-lock-race-gate.sh
docker/qemu/run-fs-fault-gate.sh
docker/qemu/run-x86-boot-tests.sh
docker/qemu/run-x86-prod-profile-boot-test.sh
docker/qemu/run-x86-tty-oracle-gate.sh

The remaining 30 of 37 are no-verdict-path: they print PASS/FAIL-shaped
text (or a bisect/probe-shaped verdict) through their own ad hoc means, with
no report_gate_failure/ERR-trap backstop, so this idiom does not apply
to them, and 0 of 30 were touched. Two sub-shapes: 23 scripts with an ad hoc
echo-then-exit sequence and no trap backstop (own retry loop or
classify-at-the-end shape), and 7 that are exit-code-primary, own text
diagnostic context rather than a PASS/FAIL banner. Retrofitting a
report_gate_failure architecture onto any of the 30 is a separate, larger
change with its own review.

Per-script disposition

script	pre-repair pre-empting exits	class
run-x86-prod-profile-boot-test.sh	0 (fixed by #805)	has-verdict-path-and-clean
run-x86-boot-tests.sh	1 preflight + 5 in-loop exit 1 (6 sites)	repaired
run-x86-tty-oracle-gate.sh	1 preflight (before its trap existed) + 3 arg-parsing + 1 sun_path + 1 missing-disk + 10 in-loop (16 sites)	repaired
run-aarch64-tty-oracle-gate.sh	3 arg-parsing + 14 in-body/in-loop (17 sites); no BREENIX_GATE_TMP support	repaired
run-fs-fault-gate.sh	1 preflight (before its trap existed) + 2 arg-parsing (exit 2) + 1 build-warning + fail() helper + 2 exit 0 success paths (7 sites)	repaired
run-ext2-lock-race-gate.sh	1 preflight (before its trap existed) + 1 arg-parsing (exit 64) + 1 build-warning + fail() helper + 5-branch --park-only cascade + 1 final exit 0 (10 sites)	repaired
run-coreproof-gate.sh	8 argument/validation exit 2 sites reached before its trap was installed + 1 exit 1 + 1 final exit 0 (10 sites)	repaired

6 + 16 + 17 + 7 + 10 + 10 = 66 pre-empting exit statements removed
across the six repaired scripts, verified directly against origin/main
(git diff origin/main..HEAD -- <script> | grep -c '^-.*exit [0-9]' per
file); the four apparent "added exit N" diff lines are 4 of 4 comment
text explaining the change, not code -- 0 new pre-empting exits were
introduced.

Two repair shapes. Where the trap was already installed before the
pre-empting exit, the bare exit N becomes a bare false in place -- set -e fires the already-armed trap, and report_gate_failure's own exit "$exit_code" re-raise is the one exit statement left. Where the
pre-empting exit ran before the trap existed, the check itself moved
downward to just after the already-installed trap (in
run-coreproof-gate.sh, which had no BREENIX_GATE_TMP check to relocate,
the trap install itself moved earlier instead). A third shape,
redden() { return "$1"; }, called as a plain statement (redden 2),
preserves a script's own non-1 exit code (run-ext2-lock-race-gate.sh's
--park-only 0/1/2 outcomes, run-coreproof-gate.sh's exit 2 usage
errors, run-fs-fault-gate.sh's own exit 2 usage-error contract) through
the trap without a bare exit statement at the call site -- verified
directly: set -eE; trap 'echo TRAP_FIRED status=$?' ERR; f() { return 2; }; f fires the trap with $? = 2, while a bare exit 1 under the same trap
does not fire it at all (the entire premise #802 rests on).

The widened ratchet

tests/teardown_structure.rs gains a generalized version of the original
scan, derived by content rather than a hardcoded file list:
has_report_gate_failure_verdict_trap() (does the script define AND arm
the trap), report_gate_failure_status_variable() (reads each script's own
re-raise variable name rather than hardcoding one), and
verdict_trap_has_no_preempting_exit() -- the rule itself, now
statement-aware: it splits each non-comment line on ;, &&, ||
(quote-aware, so an embedded awk '... { print $2; exit }' isn't
mistaken for a statement boundary) and checks each statement's leading
token, not just the line's, so a case-arm exit 1 or an
||-guarded group's exit 1 reddens the rule exactly like a standalone
exit 1 line.

Two legs: gate_scripts_with_verdict_trap_have_no_preempting_exits (the
ratchet -- census the two directories, filter to the verdict-trap shape,
assert the rule on each, >= 7 anti-vacuity floor, free to grow) and
verdict_trap_no_preempting_exit_rule_is_not_vacuous (mutation proof --
planting a standalone exit 1 preflight, mirroring #802's own shape, on a
scratch copy reddens the rule and names the planted line; deleting the
local exit_code=$? opener also reddens rather than silently passing).
verdict_trap_no_preempting_exit_rule_catches_inline_exit_shapes extends
the mutation proof to the two inline shapes the statement-splitting fix
added: reverting two real repaired sites to their pre-repair bare exit 1
(one in a case arm, one in an || guard) confirms the rule reddens both,
by name.

Run proofs, with provenance

Each of the 6 repaired scripts got one default-env run and one simulated
preflight failure at the repair commit (5a5c1ce4); aarch64 on this Mac,
x86 on beast (breenix-x86 Incus container, clone
/root/breenix-verdict). 12 of 12 raw outputs are saved under
docs/planning/green-program/gates/serials/verdict-widened-2026-09-05/.
A review round (r157) found and this branch fixed: a stale-serial
concern that turned out to be a genuine bash version difference (macOS
system /bin/bash vs. a newer $PATH-resolved bash report different
BASH_LINENO[0] for a case inside a loop -- reproduced directly, not
dismissed), a run-fs-fault-gate.sh usage-error regression where the
initial widening silently collapsed exit 2 onto the generic exit 1
gate-FAIL code (fixed with its own redden()), and several count/line
corrections to the doc's own prose, each disclosed with a strike-through
and a correction paragraph rather than silently edited.

Landing re-smoke, at the merged head (git merge --no-ff origin/main,
merge commit 8c87639a7069300c6498931d325a3cf0dad96f5b; git diff --stat origin/main..HEAD lists only this branch's own files -- the 7 gate
scripts, the doc, its serials, and tests/teardown_structure.rs -- 0
conflicts):

• Full tests/*_structure.rs sweep: 30 of 30 suites green, 565 cases, 0
  failed.
• scripts/test_claim_lint.py: 72 tests, OK, exit 0.
• aarch64 (this Mac): built via the mandated build-std invocation (clean,
  0 warnings), scripts/check-kernel-no-neon.sh PASS,
  run-aarch64-tty-oracle-gate.sh PASS on a default-env run and exit-1
  FAIL on a simulated bad-argument preflight.
• x86 (beast, /root/breenix-verdict at 8c87639a): clean build first
  (cargo build --release --features boot_tests,testing,external_test_bins --bin qemu-uefi, 0 of 3 output lines matched ^(warning|error)), then
  run-x86-boot-tests.sh 1 PASS on a default-env run and FAIL (exit 1) on
  a simulated relative-path BREENIX_GATE_TMP preflight.
• Host-load rule (pgrep -f qemu-system-<arch> <= 2, one boot at a time)
  checked before each of the 4 gate invocations across both arches.
• 0 of 6 re-smoke checks produced an unattributed red.

4 of 4 landing-round serials are saved under
docs/planning/green-program/gates/serials/verdict-widened-landing-2026-09-05/.

What is NOT claimed

• Not a rebuild demonstration for userspace or kernel source. 0 files
  under kernel/, userspace/, or libs/ changed on this branch. The
  aarch64 default-env runs (both rounds) used a prebuilt ext2 disk and
  userspace ELF set copied in from the main checkout rather than rebuilt in
  the worktree (both gitignored build products, not repository content, and
  no userspace/kernel source changed on this branch); the x86 runs on beast
  built the kernel, userspace, and ext2 disk from source both times.
• Not a claim that the 30 no-verdict-path scripts are correct, complete,
  or free of their own defects. They were read only far enough to
  classify them out of scope for this repair; 0 of the 30 were modified.
• Not a claim that redden()'s exit-code preservation is exercised by
  the widened Rust ratchet. verdict_trap_has_no_preempting_exit checks
  the absence of a pre-empting exit statement; it does not itself execute
  any script or assert what code a redden N call produces at runtime.
  That is checked separately, at runtime, by the
  run-coreproof-gate.sh --component Z simulated-preflight run (exit 2,
  not the false-only fallback of exit 1) and by the direct bash
  reproduction of the redden N / TRAP status=2 behavior.
• Not a claim this wires into any gate or CI. This repository has no
  GitHub Actions CI; scripts/run-structure-tests.sh is the only way these
  Rust tests run today, same as the other 29 of 30 tests/*_structure.rs files.

Plain references, not closing keywords: #802, #797, #805.