nx_compare_gw_lib.nx

nx_compare_gw_lib.nx -- THE PURE DECISION CORE of the /compare gateway: who may see which board. WHY A GATEWAY AT ALL (operator 2026-08-27: "/compare against the login walls so its behind the same thing as opaque and has the same access structure -- i can see them as the owner but then others see different levels of /compare so i can provide a client a /compare"). Today /compare is plain static docroot bytes: no route row, no session, every domain public. This lib decides, per request, from THREE inputs -- the viewer's LEVEL (resolved by the estate's one access spine, nx_hr_access: OPAQUE session -> HR level, deny-by-default), the DOMAIN the path names, and the ACCESS the domain declares as DATA in knowledge/compare/access.conf -- whether the bytes are served, and what an index at that level lists. ACCESS IS DATA, NEVER CODE (rule 11). access.conf rows: default|<access> the access every domain gets unless a row names it (ABSENT = operator: fail-closed) domain|<dom>|<access> one domain's access access vocabulary, identical to nx_maturity_registry's mr_level_of so the hub and the compare wall cannot disagree on a word: public=0 viewer=1 member=2 operator=3 ; an UNKNOWN word reads operator (fail-closed: a typo locks a board to the owner, it never exposes one). HR enrols owner=3 and family/client=1, so a client handed a /compare sees the public boards plus every board declared viewer; the owner sees all. NO-LEAK AT THE RENDER LAYER: a viewer's index bytes never contain the name of a board above their level (absent from the bytes, not hidden by style), and a request for such a board answers exactly like a request for a board that does not exist. Not-even-listed is the property, and it is measured by the gate. license_tier: ORIGINAL No hw writes (Rule 26).