nx_brief_publish.nx

nx_brief_publish.nx -- ONE CALL publishes a research brief: VALIDATE -> WRITE -> VERIFY, or REFUSE. Closes the last leg of the publish arc (task #13). Before this, publishing a brief was four manual steps -- hand-write HTML, write it to the docroot, hand-edit the index, eyeball it -- and step 3 was routinely skipped, so the index silently disagreed with the library it indexed. nx_brief_publish check <src> validate only, exit 0 ok / 3 REFUSED (dry run) nx_brief_publish publish <src> <slug> validate -> write sites/nishifamily/code/<slug>.html -> read back THE CONTRACT IT ENFORCES (the /code/research bar, made mechanical instead of remembered): R1 exactly one <h1> -- one document, one subject R2 a <time datetime= -- machine-readable date, not prose R3 >=3 'http' source links -- claims carry sources R4 an UNVERIFIED section -- a brief with no declared gaps did not look for them R5 a lineage marker -- 'Forks off' or rel='parent' or 'lineage:' (library, not a pile) R6 balanced <main>/</main> -- catches a truncated write BEFORE it reaches the docroot REFUSAL IS THE POINT: a brief that fails any rule is never written, so the docroot cannot hold a page that violates the standard. Verification is a READ-BACK of the bytes actually on disk (never a status string) -- the ecosystem law is verify by artifact bytes. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0