nx_barcheck.nx

nx_barcheck.nx -- THE CITATION-ROT WATCHER (debt 1785822056). WHY THIS EXISTS, measured not guessed: on 2026-08-04 two comparison pages were caught carrying claims about OTHER people's software that had silently decayed -- ecosysdesign cited a propagation-cost band whose upper bound appears in NO cited source (1785817918) genealogy cited jscpd v5.0.12 and dependency-cruiser v18.0.0; both had moved (5.0.14 / 18.1.1) in 25 days Both were found only because a human-directed evidence run happened to re-read them. ~41 compare matrices carry the same exposure and NOTHING WATCHED THEM. AN EVIDENCE PROGRAM THAT ONLY CHECKS *OUR* CODE IS HALF A PROGRAM: the claims we make about OTHERS decay too, and faster -- their release cadence is not ours to control. WHAT IT DOES: re-reads every declared version bar from the RIVAL PROJECT'S OWN registry over the sovereign TLS lane, diffs against the banked value, and goes RED when a bar has rotted. Data-driven (rule 11): the bars live in knowledge/barcheck.conf, never in this code. row: <domain>|<label>|<kind npm or gh>|<id>|<banked-version> npm -> registry.npmjs.org/<id>/latest key version gh -> api.github.com/repos/<id>/releases/latest key tag_name UNAUTHENTICATED BY DESIGN: this reads public release metadata only. The estate's GitHub PAT is an open sev-9 (1785769931) and must never be spent on a job that does not need it. NON-VACUITY IS STRUCTURAL, NOT ASSERTED: T4/T5 are gv_bite cells. T4 re-checks a REAL row against a deliberately corrupted banked value and REQUIRES the stale detector to fire on it while staying silent on the true value. T5 REQUIRES a fabricated package to come back UNREACHABLE while a real one resolves. A checker that cannot report STALE cannot report FRESH. expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).