nx_accept_lib.nx

nx_accept_lib.nx -- THE THREE-PARTY ACCEPTANCE LEDGER: the decision core behind every ACCEPTANCE cell on /compare (2026-08-30). Operator standing order, verbatim: "doing it poorly isn't a complete and needs to be shown as that on /compare and your work; it's not complete till you and I and the nishi team agree." A subject is ACCEPTED iff ALL THREE signatures hold, each read from its own sovereign plane: 1. OPERATOR -- knowledge/store/accept- : the LATEST row whose actor is `operator` and whose targets field carries the token ga_accept_<subject> says ACCEPT (REJECT, UNJUDGED, absent do not). 2. REFEREE -- knowledge/store/referee- : the LATEST row for <subject> says composite GOOD AND its percept is at or above floor_percept_<tier> READ FROM knowledge/cjc_panel.conf (never a literal here), its tier is in the panel receipt's tiers_admitted list, and that receipt says admitted=1. The row's own word GOOD is necessary and NOT sufficient: the floor is re-derived so a row cannot lie. 3. SEAT -- knowledge/store/attest- : a row for <subject> naming the shipping seat and its stamp. Anything less is INCOMPLETE, and INCOMPLETE names WHICH signature is missing and WHY. HOW THE BOARD FLIPS. `nx_accept emit` regenerates buildroot/runtime/nx_accept_decl.nx from the planes: one top-level declaration ga_accept_<subject> per ACCEPTED subject and NOTHING for any other. The /compare regen measures that file exactly as it measures every organ (nx_symdecl_lib: a column-0 declaration), so an ACCEPTANCE watch row lands only when the three-party rule holds. A hand-written declaration is a lie: the next emit erases it and nx_accept_gate convicts it (re-derivation must equal the bytes on disk). JOIN RULE, stated once: a plane row GOVERNS subject X iff its targets field carries the token ga_accept_X, bare or domain-qualified (gameengine:ga_accept_X). The subject key IS the suffix of the acceptance symbol, so the board and the ledger cannot name the same thing two ways. Rows with no such token are counted UNMAPPED and printed, never silently dropped. LIB+PROGRAM SPLIT ON PURPOSE: every rule is a function of caller-supplied plane prefixes, conf path and buffers, so nx_accept_gate drives the SAME code over fixture planes under /tmp and never the production planes. COMPOSES, NEVER RE-IMPLEMENTS: nx_seg_store's sequential cursor (plane iteration; ss_get point lookups are the documented quadratic read), nx_comparewatch_lib (tab-field parsing + strict q:<n> keys), nx_lineconf_lib (line-anchored key=value), nx_estate_path (CWD-independent artifact paths). HONEST LIMIT: the actor column is caller-supplied. This ledger buys ATTRIBUTION and TAMPER-EVIDENCE through the plane's own hist- provenance, not cryptographic proof of who the operator is; the signed-row rung (nx_evattest, role=human key) is the named next step, not a claim made here. license_tier: ORIGINAL No hw writes (Rule 26).