nx_law_warden.nx

============================================================================================ STOP -- DO NOT BUILD OR PROMOTE THIS ORGAN. FREEZE 2026-07-31, debt 1785516173 (sev9). The DEPLOYED binary exposes {scan | file | countfile | selftest} and runs a 20/20 gate including T15 segamp, T16 gatedry, T17 helperdup, T18 scancap, T20 debt-id-parse. THIS SOURCE HAS NONE OF countfile / scancap / gatedry / helperdup / T20 -- countfile appears in ZERO of 20016 .nx files NAS-wide (only nx_magicratchet CALLS it). Meanwhile this source ALONE has valuenamed (seq1348), which the deployed binary lacks. NEITHER SIDE IS A SUPERSET; THERE IS NO SAFE DIRECTION. WHY IT MATTERS: nx_magicratchet is wired into /api/build and gates every build on `nx_law_warden countfile`. Rebuild -> the verb is gone -> mr_parse_magic returns -1 -> the ratchet FAILS OPEN BY DESIGN -> magic-number enforcement is permanently disarmed AND the hourly autofiler stops, silently, WITH EVERY GATE STILL GREEN. One routine rebuild turns off both enforcement and detection at once. Restore the four missing capabilities into this file FIRST, then build. Already restored here: countfile (exact output contract, thr locked to the deployed 1024) and the rewritten string/comment-aware inlinelit scanner plus teeth T21-T27. ============================================================================================ nx_law_warden.nx -- MECHANICAL ENFORCEMENT for written laws (ws=cap-autonomy, 2026-07-20). Operator: "make sure autonomously that our nishi ecosystem is getting sota ... what needs to become mcp or api or raci or workflows or agents or other modern capabilities just gets logged and worked without me having to call its need out"; + "our magic number audit and bug stuff dont appear to be autonomous ... lots of workstreams are flagging them as bugs they hit and then just gave a new number to"; + "callouts of using webrtc or webassembly ... not building from the first byte up to a sovereign nishi os and browser". THE GAP THIS EATS: every conformance surface we own is a CURATED manifest -- nx_favela_census states it outright ("unnamed shanty stays invisible until a row names it"). A written law (CLAUDE rule 11, the first-byte-up doctrine, F208 modernization) therefore has NO detector: a human must NOTICE a breach and NAME it before anything tracks it. That is exactly the call-it-out tax the operator is paying. This organ is the DETECTOR tier: laws live as DATA in the sovereign **lawreg- seg-store plane** (nx_store_put, same substrate as raci-/debt-/frontier-), each row carrying its own detector + threshold + severity + RACI owner, and the warden MEASURES live artifacts against them. NO flat TSV, NO truncating .log -- the registry is a plane (provenanced hist- rows) and the evidence is an append-only .jrnl (history is sacred). RULE-11 COMPLIANT BY CONSTRUCTION: every POLICY number (threshold, severity, corpus, owner, token set) is manifest data, never code. Point the warden at its own source and the property holds -- that is a gate tooth, not a promise. The consts below are structural envelopes (buffer sizes, byte codes), all NAMED, never inline. DETECTORS (detector <param> over <corpus>) valuenamed CLAUDE-11 breach, the GOODHART half (seq1348): a `const NAME = V` whose NAME contains V's own digits (SS_MAGIC_65536 = 65536). Clears `inlinelit` while explaining nothing, so part of the inlinelit improvement is a DETECTOR ARTIFACT. Reported as its OWN law -- never folded into inlinelit, because a