nx_contentdiff_iterator_candidate_t295.nx

nx_contentdiff_lib.nx -- ONE CONTENT RULER, TWO BUDGETS. THE RULER (lifted verbatim in semantics from nx_contentdiff.nx, whose reasoning stands): every printable run of >= minlen bytes in the LIVE binary must still be findable somewhere in the CANDIDATE's RAW BYTES. A missing run is a content difference requiring review, not proof of destroyed behavior. Conversely, retained strings do not establish behavioral equivalence. Structured ELF comparison below respects validated DWARF string boundaries; the raw API retains its contract. WHY SIZE CANNOT DO THIS JOB, measured twice by the organ this lib is extracted from: SHRINK is not regression (16 live organs had LARGER .prev files yet the smaller live binaries were string SUPERSETS), and GROWTH is not improvement (nx_law_warden GREW 161951 -> 186696 bytes while losing three whole detectors). A gate keyed on bytes is wrong about half the time and cannot tell you which half. Re-measured on the live deploy root 2026-08-06: 22 of 89 staged artifacts with a live counterpart would drop live runs, and several of those are LARGER than what they replace. WHY IT IS A LIB (2026-08-06): the ruler existed only inside nx_contentdiff's main() -- a CLI oracle with no deployed binary, no registry row, and therefore no consumer. The debt that named it (1785531571) asked for it to be wired into /api/promote; nothing could, because there was nothing importable to wire. A ruler that only a main() can reach is not a capability the fleet has. TWO BUDGETS, ONE IMPLEMENTATION (Rule 15). The CLI oracle runs to completion and can afford to check EVERY run; the promote guard runs inside a live deploy call and must bound its work. Those are different BUDGETS, not different rulers -- so the budget is a PARAMETER and the semantics are shared. Two rulers that can disagree about the same question is the defect this file exists to prevent. DIALECT: reachable from nx_mgmt_data -> nx_mgmt_api, so plain-if (NO else), no empty string literals, <=6 params. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0