nx_gatefresh.nx

nx_gatefresh.nx -- "I just ran that gate and it said GREEN. Can I believe it?" ONE target, cheap, now. THE GAP IT FILLS, and why it is not a fourth copy of anything: nx_stale_check <t> REBUILDS and byte-compares _offc/<t>.elf -- authoritative, but O(one build) and a DIFFERENT subject (the _offc build tree, not the deploy root that gate_run executes). nx_rebuild_plan walks the transitive closure for the WHOLE fleet and names the trigger file -- the right instrument for a census, far too heavy to ask about one gate. nx_gatebuilt_gate censuses every authored gate and reports stale_built, but its list is CAPPED at 25, so the gate you actually care about is usually NOT in the output. None of them answer the per-target question in one call, which is the question an agent has RIGHT AFTER reading a verdict. All the arithmetic is nx_srcfresh (live, gated 10/10) -- this organ is only resolution plus an exit code, so it cannot drift from the predicate the gate proved. WHY IT MATTERS (measured 2026-08-07): /api/gate_run served exit 0 verdict=GREEN pass=23/23 for nx_fsops_gate from a 2026-07-29 binary whose source declared 28 checks, and I reported "no regression" on that GREEN. A gate ELF statically links its libs, so a verdict is a claim about the tree AS OF ITS BUILD. Fleet-wide: 715 gates have a binary and only 176 are current with their own source. A GATE VERDICT IS EVIDENCE ABOUT THE SOURCE ONLY IF THE GATE WAS BUILT FROM IT. SCOPE IS DECLARED IN THE OUTPUT, never implied: OWN-SOURCE mtime only. A gate invalidated by a shared dep reads FRESH here, and mtime proves a source MOVED, not that codegen CHANGED (a comment-only edit moves it and leaves the binary byte-identical). So FRESH is a floor, not a guarantee, and the payload says so. nx_gatefresh <name> -> exit 0 FRESH | 1 STALE | 3 UNBUILT (no <name>.elf) | 4 NO-SOURCE | 2 usage license_tier: ORIGINAL Read-only: it stats two paths and writes nothing. (Rule 26)