docs/GATES.md

The launch gates

launch_check.py asks twelve questions and changes nothing. Every answer is PASS, BLOCKED, or UNKNOWN, and UNKNOWN is never folded into PASS.

Why three states and not two: this project's characteristic failure is a claim that is true, unmeasurable, and quietly wrong later. A two-state check has to guess on the cases it cannot see, and it always guesses green. So a node that cannot be reached is UNKNOWN. A check that needs Windows is UNKNOWN on Linux. A gate that raises is UNKNOWN, never PASS.

Where a gate has a different correct answer per platform, it asserts that answer instead of stepping aside (M34) — a check that stops checking on the platform that runs production has been switched off.

gate	asks	blocked means
G1	does every shipped file hash to MANIFEST.sha256?	either an edit you meant, or a delivery that did not land. Both need to be known before launch
G2	is each companion import beside the file that needs it?	a missing companion reads as a test regression and is not one (M37)
G3	flask, werkzeug, cryptography, requests — and waitress?	without waitress, W1's bounded pool is inert and Flask is served by werkzeug's dev server: one unbounded thread per connection, on the port you expose
G4	one shared canonical genesis?	every node mints its own, they can never converge, supply grows by 1000 per node
G5	is the ethics judge reachable?	the gate fails closed. The node boots, serves /chain, peers, reports healthy — and rejects 100% of transactions. Also blocks on mock + the insecure flag: adversarial transactions are known to pass it
G6	does the judge model fit in RAM?	it loads by paging. P12 measured 3,535 MB free against a ~5,200 MB model on this box
G7	port arithmetic — --port N takes N, N+1, N+11	nodes closer than 20 apart collide, and the victim prints Address already in use after a healthy-looking banner
G8	are the identity keys owner-only?	they are the operator credential and the genesis mint key. On NTFS the mode bit says nothing, so this reads the real ACL — see P9_WINDOWS_OWNER_ONLY.md
G9	do disk and the running process agree?	the file on disk is not what is executing. This is the one that has been wrong for two days at a time
G10	is the watchdog alive?	a monitor that dies silently reports health for ever. Its last line still says everything is fine, and goes on saying it
G11	XRP mainnet gate state	reports; never opens. Four locks, described in LAUNCH.md
G12	when did the suites last run, and where?	always UNKNOWN by design — a result is a claim about the platform it ran on and the source it ran against, and neither is checkable from a filename

Reading the exit code

0   every gate PASS
1   at least one BLOCKED          do not launch
2   no BLOCKED, but some UNKNOWN  this is NOT a pass

AN_LAUNCH.bat stops dead on 1, and on 2 it asks before continuing rather than deciding for you.

G9 and the 48-bit comparison

/health's field is named source_sha256 and contains CORE_SOURCE_SHA12 — twelve hex characters, 48 bits (A25). The contract is correct, intentional, and pinned by test_p11 V6b; only the name lies, and it lied convincingly enough that verify_deploy.py's first draft compared it against a full 64-character digest and reported MISMATCH on a perfectly correct deployment.

So G9 compares twelve, and says so. It is a drift check — "has anybody restarted this node?" — not a tamper check. G1 compares the full 64.