nx_autofix_lib_t138.nx

nx_autofix_lib.nx -- THE SHARED RULERS OF THE AUTONOMOUS FIX LOOP (autodev M0, 2026-08-27). WHY A LIB: nx_autofix_auto (the loop), nx_autofix_intake_gate (the intake) and nx_swebench_local_gate (the judge) each carried their own copy of "find the failing FNRES row", their own ledger path literal (/home/elderwesto/nx_stage/...) and their own idea of what a proposal row means. Three organs that must agree cannot be kept agreeing by discipline; only one copy holds. This is the one copy, and the contract symbols on the /compare/autodev board (af_episode_ledger, af_sandbox_root, af_null_control, af_admit_untrusted, af_intake_board) are thin composers over it in nx_autofix_auto.nx -- the loop's call sites -- while the gates drive these rulers in-process. THE FIVE RULERS AD5 EPISODE LEDGER afl_ledger_* -- one row per episode, appended AS DECIDED to an estate-relative journal (knowledge/status/autofix_ledger.jrnl) so a run interrupted at 95 percent keeps 95 percent, and the page reads the plane and nothing else. The dev-box stage ledger stays the fallback (nx_stage_path), never a literal. AD7 SANDBOX ROOT afl_sandbox_* -- every candidate builds and runs in /tmp/afx_sb_<ts>_<name>/ with its import closure COPIED (not linked: a write through a link would reach the tree), the toolchain linked read-only, a real _build/, RLIMIT_CPU and RLIMIT_AS on the child, a wall deadline that kills the whole process group. The tree copy is never opened for write; afl_bytes_eq is the witness. AD4 NULL CONTROLS afl_null_controls -- the empty patch and a replay of a prior solution are run through the SAME judge; a null that scores GREEN is an oracle defect and the batch is REFUSED, never published. Echo is rejected pre-verify by byte identity (structural) and the revert patch is the empty patch by construction; both are named on the line rather than counted twice. AD6 UNTRUSTED INPUT afl_admit_row -- deny by default: a proposal row is LOCAL (built and run in the sandbox) or EXTERNAL DATA-ONLY (provenance-pinned h<sha> AND maintainer-merged, never executed); an external row missing either is refused BY NAME. AD3 INTAKE PLANE afl_intake_emit -- folds the estate's own boards into one task plane: roster RED gates, the adjudicated drift worklist, the magic ratchet counts, the unwired baseline; every task carries its oracle and a RED-before receipt; the partition prints its sum; debt rows carry no executable oracle and are REFUSED as UNREPRODUCED (counted, never hidden); a source that is absent says ABSENT-SOURCE. CONF (rule 17: env > conf > bootstrap): knowledge/autofix.conf rows sandbox_wall_ms, sandbox_as_bytes, bon_n, bon_temp_pm, bon_topp_pm, bon_topk, null_controls_max_green. The defaults below are the July contract values with the reason each was chosen written beside it. license_tier: ORIGINAL No hw writes (Rule 26).