nx_closurehash.nx

nx_closurehash.nx -- PROVENANCE AT PRODUCTION, GENERALISED FROM ONE FILE TO THE WHOLE IMPORT CLOSURE. THE DEFECT THIS RETIRES (measured all day 2026-08-07): the build lane decides "has this tree forked?" by comparing the LIVE NAS tree against `treecanon_laptop_hash.mf` -- a manifest generated from the LAPTOP mirror and pushed across. But edits are made with nx_fs_write, which writes DIRECTLY to the NAS, and builds compile FROM the NAS. So the newest truth is on the NAS and the judge is the stale mirror: *THE CANON GUARD RUNS BACKWARDS RELATIVE TO HOW EDITS ACTUALLY FLOW, AND CALLS THE TRUTH A FORK.* Consequences seen today: builds blocked by my own newer edit · a manifest push losing a file-lock race · four different hashes for one header inside ten minutes · ~3,800 NAS-ahead files nobody can reconcile. Every guard involved was working correctly on a bad premise. nx_mgmt_api already states the right principle, for ONE file: "PROVENANCE, CAPTURED AT THE MOMENT OF PRODUCTION ... A CLOCK CANNOT ESTABLISH PROVENANCE. RECORD IT WHERE IT IS CHEAP: HERE. LATER IT IS UNRECOVERABLE." It emits src_sha256/src_stable for the target's own source. That is the whole idea, one file wide. This widens it to every source the compiler will actually read. *A MANIFEST IS A CLAIM ABOUT A TREE AT A PAST INSTANT; A CLOSURE HASH IS A FACT ABOUT THE BINARY IN YOUR HAND.* With the closure recorded at build time you can answer "was this artifact built from these exact bytes?" with no manifest, no push, no watermark, and nothing to go stale -- and the question a census can never answer, "which of the two trees was I compiled from", becomes trivial. SOURCE RESOLUTION ORDER IS LOAD-BEARING and copied from nx_stalesweep's header rather than guessed: _hdl_build/<t>.nx FIRST, then runtime/<t>.nx -- because buildrun compiles the _hdl_build twin when BOTH exist, so hashing the runtime twin would describe a file the compiler never opened. UNRESOLVED IMPORTS ARE THEIR OWN BUCKET AND ARE COUNTED. An import that resolves nowhere is exactly the kind of thing this must not silently omit -- omitting it would make a BROKEN closure hash the same shape as a healthy one. *A PROVENANCE RECORD THAT DROPS WHAT IT COULD NOT FIND IS A FORGERY.* nx_closurehash <target> [root] root default "." (run from the buildroot) -> one line per source, then: closure_sha=<64hex> files=N unresolved=M bytes=B exit 0 complete | 1 closure has unresolved imports | 2 target source not found | 3 usage license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0