nx_deploy_ready_scope_gate.nx

nx_deploy_ready_scope_gate.nx -- proves the pre-deploy gate SCOPES its evidence-honesty block to the deploy target's blast radius (own domain + shared-fate domains) and NEVER to an unrelated domain's RED. THE DEFECT THIS GATE EXISTS FOR (measured 2026-09-02): nx_deploy_ready's evidence-honesty row was a GLOBAL conjunction over knowledge/status/evidence_honesty.log, so two content domains (autodev, performersearch) reading RED blocked the UNRELATED fleet-supervisor memory-leak deploy (daemonsup -> loadgov), and the deploy shipped only through an audited override. Operator: "a supervisor deploy has no business being blocked by a search domain's RED ... estate wide loose coupling small sharp intelligent pieces microservice type architecture not single monolithic coding." A gate that blocks too broadly is overridden in practice and protects nothing. HOW IT PROVES IT: it builds an ISOLATED fixture tree under /tmp/nx_deploy_ready_scope_gate/ (its own knowledge/registry/{deploy_checks.tsv,deploy_domain.conf,deploy_sharedfate.conf} + evidence logs), CHDIRs into it, and forks the REAL subject binary (absolute path) so the subject reads the fixture confs at the exact relative paths production uses -- zero contact with the live registry (the fixture-ratchet law). Every scenario is a different evidence log or target; the teeth assert the JSON and the EXIT CODE both. The fixture-reached-condition tooth runs FIRST (a fixture the defect cannot fail is not a test), and gv_bite pairs the decoupling case with its own-domain-RED control so the gate cannot pass vacuously. nx_deploy_ready_scope_gate [subject-elf-ABSOLUTE] (default: the promoted nishihost binary) license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0