nx_confdup.nx

nx_confdup.nx -- find CONFIG FILES THAT DECLARE THE SAME CONCERN TWICE. WHY THIS EXISTS (measured 2026-07-30, media-vault lane): /api/promote reads `knowledge/organ_kinds.conf` (PLURAL, values hyphenated `one-shot`) while nx_organkind reads `knowledge/status/organ_kind.conf` (SINGULAR, values unhyphenated `oneshot`). I added a row to the singular file, promote kept working, and I concluded the row was the fix -- it was INERT. Undeclared names fall through to a name-substring heuristic, so the wrong file "worked" by luck until a name that failed the heuristic (nx_mvault_walk) became unshippable by any sanctioned route. ★★★LAW: A SILENTLY-INERT CONFIG ROW IS WORSE THAN A MISSING ONE -- it manufactures false confidence. The failure is invisible precisely because the other source of truth keeps answering. This is a RECURRING class in this ecosystem, not a one-off: * organ_kind.conf vs organ_kinds.conf (this session) * nx_fs root=nishihost vs /api/build buildroot/runtime -- TWO ROOTS ONE NAME * the ruler reading the wrong evidence root (rollup saw 181 of 1164 logs) So it gets a DETECTOR rather than another banked warning. WHAT IT FLAGS -- two independent signals, reported separately because they have different remedies: COLLIDE-STEM two config files whose names normalize to the SAME stem (plural/singular, hyphen/underscore, trailing digits). Remedy: one file, or make one provably derived. COLLIDE-BASE the SAME basename living under two different directories. Remedy: name the roots apart, or collapse them. Normalization is deliberately AGGRESSIVE (drop ext, lowercase, '-'->'_', strip trailing digits/underscores, strip ONE trailing plural 's') because a false positive costs a glance while a false negative costs a session. nx_confdup scan [root] (default root: knowledge) Read-only. license_tier: ORIGINAL No hw writes (Rule 26).