nx_envelope_audit.nx

nx_envelope_audit.nx -- F227 THE SCALE-ENVELOPE SWEEP (operator scale-law: "every tool DECLARES its envelope IN ITS OUTPUT -- silent capping is forbidden BY CONSTRUCTION"; editcover row 3 silent-truncation). A bounded read that never says it was bounded is how a seat (any model) silently believes a partial answer is the whole answer -- the ark v1 lesson and the nx_debt 64KB blind spot were both this class. This organ MEASURES the law across the fleet a seat can actually CALL (the registered tool_allowlist rows -- not all ~15k .nx, that is the honest scope: an unregistered organ cannot mislead an agent). PER ROW: resolve the source from the elf basename -> probe buildroot/runtime/_hdl_build/<base>.nx then buildroot/runtime/<base>.nx -> classify: DECLARING = source carries an envelope-declaration marker (envelope | caps: | window_bytes) SILENT-CAP-CAND = has bounded-read consts (_CAP / _MAX) but NO declaration <- the actionable set UNBOUNDED-OR-NA = no bounded-read consts found (nothing to declare, or reads are unbounded) NAME-PROBE-MISS = no <elfbase>.nx in either probe dir. NOT proof of missing source: a tool's elf and source names can DIVERGE (verified 07-20: nx_fs_write.elf builds from nx_fsops_write.nx). Treat as 'not found BY NAME PROBE' and verify by content before ever claiming a source is lost. LIAR-KILLED: this is a CANDIDATE detector over source text, never an absolute verdict -- the output says so, and it reports counts + the candidate list so a human/referee adjudicates. Measurement first; a ratchet floor comes only AFTER a measured baseline (never a gate on an unmeasured fleet). 2026-08-20 (lane K, failure-detector census) -- THE SILENT-CAP DETECTOR HAD A SILENT CAP. A row-cap gate wrapped the whole per-row body and the row counter only incremented INSIDE it, so every allowlist row past the cap was dropped with no counter, no flag and no marker -- and the dogfood line then printed the cap as a HAND-TYPED literal, which read as a population. MEASURED: the served binary reported rows=512 against a tool_allowlist.conf of 81243 bytes whose line 906 exists, i.e. it published a distribution over the HEAD of a sorted file and called it the fleet. ***THE ENFORCER COMMITTED THE DEFECT IT ENFORCES, AND ITS OWN OUTPUT WAS THE ALIBI.*** FIXED HERE: (1) the row gate is REMOVED -- nothing was indexed by the row counter, so the cap bounded only wall time and bought nothing; (2) every remaining bound is now DERIVED from its own const and printed, never re-typed in prose (a hand-typed copy of a cap is a second copy of that cap's shape and the two drift silently); (3) each capped LIST says it is a prefix of its own count; (4) the partition is printed and reconciled; (5) an incomplete audit exits EA_EXIT_PARTIAL instead of publishing a confident distribution -- the nx_undefscan rule that a zero from an incomplete scan must still exit non-zero. DOGFOOD: declares its OWN envelope in its own output, every field derived from the constant it bounds. nx_envelope_audit [allowlist] [outpath] license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0