nx_envelope_audit.nx

nx_envelope_audit.nx -- F227 THE SCALE-ENVELOPE SWEEP (operator scale-law: "every tool DECLARES its envelope IN ITS OUTPUT -- silent capping is forbidden BY CONSTRUCTION"; editcover row 3 silent-truncation). A bounded read that never says it was bounded is how a seat (any model) silently believes a partial answer is the whole answer -- the ark v1 lesson and the nx_debt 64KB blind spot were both this class. This organ MEASURES the law across the fleet a seat can actually CALL (the registered tool_allowlist rows -- not all ~15k .nx, that is the honest scope: an unregistered organ cannot mislead an agent). PER ROW: resolve the source from the elf basename -> probe buildroot/runtime/_hdl_build/<base>.nx then buildroot/runtime/<base>.nx -> classify: DECLARING = source carries an envelope-declaration marker (envelope | caps: | window_bytes) SILENT-CAP-CAND = has bounded-read consts (_CAP / _MAX) but NO declaration <- the actionable set UNBOUNDED-OR-NA = no bounded-read consts found (nothing to declare, or reads are unbounded) NAME-PROBE-MISS = no <elfbase>.nx in either probe dir. NOT proof of missing source: a tool's elf and source names can DIVERGE (verified 07-20: nx_fs_write.elf builds from nx_fsops_write.nx). Treat as 'not found BY NAME PROBE' and verify by content before ever claiming a source is lost. LIAR-KILLED: this is a CANDIDATE detector over source text, never an absolute verdict -- the output says so, and it reports counts + the candidate list so a human/referee adjudicates. Measurement first; a ratchet floor comes only AFTER a measured baseline (never a gate on an unmeasured fleet). DOGFOOD: declares its OWN envelope in its own output (512 rows, 256KB per source, 64 candidates listed). nx_envelope_audit [allowlist] [outpath] license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0