nx_envelope_audit_gate.nx

nx_envelope_audit_gate.nx -- TEETH FOR THE SILENT-CAP DETECTOR, because on 2026-08-20 it HAD ONE. WHY THIS GATE EXISTS. nx_envelope_audit is the estate's enforcer of the scale-law ("every tool DECLARES its envelope IN ITS OUTPUT -- silent capping is forbidden BY CONSTRUCTION"). It shipped for weeks with a row-cap gate wrapping its whole per-row body and a row counter that only incremented INSIDE that gate, so every allowlist row past the cap was dropped with no counter and no marker -- and its dogfood line then printed the cap as a HAND-TYPED literal, which reads as a population. Measured: it reported rows=512 against a tool_allowlist.conf whose true data-row count is over a thousand. ***THE ENFORCER COMMITTED THE DEFECT IT ENFORCES, AND ITS OWN OUTPUT WAS THE ALIBI.*** A green that never had a corresponding red is unverified, so every tooth below is paired with the input that must make it fail. HERMETIC BY CONSTRUCTION. The subject resolves its probe dirs (buildroot/runtime/_hdl_build, then buildroot/runtime) RELATIVE TO CWD, so this gate builds a complete throwaway probe tree under /tmp/nx_envelope_audit_gate/ and chdirs into it. Nothing here touches a production path, nothing shares a fixture with a beat, and the fixtures are rebuilt every run so the gate is idempotent -- a gate that is not idempotent reports on its first run and lies about every run after. The fixture SOURCES are assembled at RUNTIME, never stored as files in the tree, because a detector that scans source will otherwise find its own test fixture -- and writing the pattern in a comment re-arms that trap, since prose is source bytes too. SUBJECT: the DEPLOYED nx_envelope_audit elf (serving root, then _offc, then a local _build). If none resolves the gate SKIPs via gv_need -- "I could not look" is not "it is broken". license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0