nx_artifact_root.nx

nx_artifact_root.nx -- ARTIFACT ROOT RESOLUTION, shared. One resolver, one roots table, for every organ that has to turn a by-convention path into a file that actually exists on THIS host. WHY THIS IS A SHARED LIB AND NOT A LOCAL HELPER: two independent lanes paid for the same defect within a day of each other, which is the signal that it is a CLASS, not a bug. * evidence lane (2026-07-30): a `.gates` row names `_offc/nx_X_gate.elf` and a matrix row names `runtime/nx_X.nx`. BOTH resolve on the laptop and NEITHER on the NAS -- /api/promote installs binaries FLAT at the serving root, and sources live under `buildroot/`. MEASURED: 9 of 9 real warden axes read UNGROUNDED on the NAS while every symbol was present in the tree the whole time. * seq1339 (sibling): the maturity rollup reads evidence logs at one root while gates emit 1164 of them at another, leaving ~85% of real evidence invisible and whole lanes reading UNMEASURED. Same shape both times: an organ decided "not here" when the honest answer was "look somewhere else". ★THE LAW THIS ENCODES: a path convention that differs per host is a DATA fact, not a code constant. The roots live in a conf (rule 11/17) so a new deployment layout is a config edit, not a recompile of every consumer. RESOLUTION ORDER, and why all three steps are needed: 1. the path EXACTLY as written -- so nothing that works today changes behaviour 2. each root + the FULL relative path -- sources keep their directory part (`buildroot/` + `runtime/x.nx`) 3. each root + the BASENAME -- binaries lose theirs (`` + `x.elf`, because promote installs flat) First hit wins. A miss returns 0 and leaves `out` equal to the input, so the caller's error message stays truthful about what it was actually looking for. license_tier: ORIGINAL