nx_forkfresh_lib.nx

nx_forkfresh_lib.nx -- FORK FRESHNESS: is the binary an organ is ABOUT TO FORK the same bytes as the artifact that was PROMOTED? The decision core, split into a lib so a gate can drive it IN-PROCESS (nothing can import a main(), and a gate that fork/execs a deployed elf reports NOT-REACHED for every mutant -- organ_gate.conf records that lesson five times over). WHY THIS EXISTS, MEASURED 2026-08-31 AND REGENERATED THE SAME DAY. nx_compare_regen chdirs into buildroot and forks the BARE paths _offc/nx_swcompare_{matrix,sota,hub}.elf, so the PUBLISHER of every /compare page executes buildroot/_offc/. But /api/promote writes the SERVING ROOT (and nishihost/_offc); buildroot/_offc updates ONLY via a manual nx_restage. A regen therefore returned published=201 fails=0 verdict=GREEN and CHANGED NOTHING -- every publish line read prev= EQUAL to the new byte count -- because all three generators were a generation behind. FOUR AGENTS EACH VERIFIED THEIR PROMOTE AGAINST THE SERVING ROOT AND/OR nishihost/_offc AND ALL FOUR MISSED THE COPY THE PUBLISHER ACTUALLY RUNS. nx_catalog CANNOT see buildroot/_offc, so every row read BUILT==PROMOTED, with_gaps=0, VERDICT LIVE -- the clean-looking reading that hid it. (STAR)A CATALOGUE THAT CANNOT SEE THE COPY THAT EXECUTES WILL REPORT A STALE FLEET AS LIVE. The remedy so far was "remember to nx_restage", which is O(seats) forever. The estate standing law is that a law which must be RECALLED at the moment of temptation is not a control -- only a mechanism in the path is, and writing another rule is the weakest available fix. This lib is that mechanism. WHY THE PROMOTED SERVING-ROOT ARTIFACT IS THE REFERENCE, AND NOT THE OTHER TWO CANDIDATES: * NOT _build/<t>.sov.elf -- that is a BUILD FOSSIL. It is whatever the last build anybody ran left behind, it can predate the source, and a REFUSED build DELETES it. A BEHIND row whose reference is a fossil points at exactly the wrong action, and re-baselining against an absence reports a live subject as never-built. * NOT a fresh rebuild from source -- that is what nx_stale_check does, and it answers a DIFFERENT question (is this behind SOURCE). Three compiles inside the publisher hot path, on a box whose build admission already refuses under load, would make the publish surface hostage to the compiler. * THE PROMOTED ARTIFACT IS THE AUTHORITY because /api/promote is what installs it, nx_catalog calls that path PROMOTED, and -- decisively -- nx_compare_regen ALREADY forks its gapmap generator from ../nx_swcompare_gapmap.elf with the comment "promoted-elf path (nishihost root, CWD is buildroot): /api/build + /api/promote place it". The convention is the organ own, established, not invented here. That is also why the gapmap fork needs no check: it already reads the authority directly. COMPARE BY HASH, NEVER BY SIZE. Measured on the day this shipped: buildroot/_offc/nx_maturity_board.elf and its promoted twin differ by TWENTY-SIX BYTES with different digests, and the buildroot copy is the LARGER of the two -- so both a size-equality test and an is-the-fork-smaller heuristic acquit it. The full-width digest is the only ruler that convicts. FAIL DIRECTION, ESTABLISHED BEFORE SHIPPING: every unreadable input degrades to a NAMED third state (FF_UNPROVEN / FF_NOFORK), never to FRESH and never to STALE. An axis that cannot see must abstain, not