nx_buildpath_lib.nx

nx_buildpath_lib.nx -- THE ONE ANSWER TO "WHERE DID THE BUILDER PUT THE ARTIFACT?" WHY IT EXISTS (measured 2026-08-16, coverage_complete=1 / corpus_complete=1 over 23,232 sources): nx_sov_build_run anchors its CWD to buildroot/ and writes _build/<name>.sov.elf. It has not written /tmp since 2026-07-30, when the flock change moved artifacts to a per-target _build/<n>.lock+.s+.sov.elf. Every consumer that wants the freshly-built artifact must know that, and the knowledge had NO CALLABLE HOME -- so each one re-derived it, and they disagree: - nx_stale_check probes /tmp THEN _build. Fixed under seq1554, whose own comment records that probing ONE location "made this guard answer BUILDFAIL for EVERY target, so the instrument that gates a risky promote was DEAD". - nx_drift_watch INLINED nx_stale_check's logic ("the SAME logic as nx_stale_check, INLINED to stay single-nest") and NEVER RECEIVED THAT FIX. It logged BUILDFAIL against all four of its subjects for ~32h while reporting verdict=GREEN. - 13 further organs probe /tmp ONLY, with no fallback at all. *AN INLINED COPY DOES NOT RECEIVE ITS ORIGINAL'S FIXES -- the duplicate-ruler defect with a delay fuse, because the copy looks correct on the day it is written. *A BUG YOU FIX BY REWRITING THE LINE, RATHER THAN BY EXTRACTING THE FIX, IS A BUG YOU WILL WRITE AGAIN. A correction with no callable home fixes exactly one site. WHY THE PROBE ORDER IS WHAT IT IS -- every root is here for a NAMED reason, never for luck: BP_AT_BUILD "_build/" the caller already runs from buildroot/ (nx_drift_watch chdirs there before checking; so does the builder itself). BP_AT_BUILDROOT "buildroot/_build/" the caller runs from the SERVING ROOT -- every gate invoked by /api/gate_run, and the 48 gates repointed on 2026-08-16. BP_AT_TMP "/tmp/" LEGACY, pre-2026-07-30. Kept so an older host still resolves, and reported SEPARATELY so that resolving only via the legacy root is VISIBLE AS DRIFT instead of silent. THE RETURN IS THE ROOT THAT MATCHED, NOT A BOOLEAN. A caller that can say WHICH root answered can distinguish "found where the builder writes" from "found only in the legacy location" -- and one of those is a warning. A two-state answer collapses them, which is how this class stayed invisible. *AN AXIS THAT CANNOT SAY *WHICH* CANNOT REPORT DRIFT, ONLY PRESENCE. `out` ALWAYS holds a path, including on failure, where it holds the PRIMARY probe -- so a caller reports what it LOOKED FOR rather than printing an empty string. A guard whose failure message names no path is the reason this defect took three lanes to find. NO GUESSED CAP: bp_needed(name) derives the exact bytes required from the longest prefix, the caller's name and the suffix, and bp_artifact REFUSES with BP_OUTCAP_TOO_SMALL rather than truncating. A ceiling that has to be guessed is a defect generator in both directions.