nx_lmexport.nx

nx_lmexport.nx -- SOVEREIGN replacement for nx_landmine_export.cron.sh (2026-08-07). OPERATOR DOCTRINE: .sh is not the Nishi ecosystem. But this wrapper is NOT a pure swap -- I said it was, from reading its FIRST LINE, and filed that as guidance (retracted in debt 1786114148). It carries THREE safety properties, and a bare organ row would have silently deleted all three: (1) FAIL-CLOSED ON EMPTY -- an empty plane load is REFUSED, never exported (the vacuous-verify law). (2) SHRINK GUARD -- a GENERATED VIEW that loses a third of its rows is a CLOBBER SIGNAL, not an export. Refuse when new < cur*2/3. (3) ATOMIC REPLACE -- assemble the whole file in a temp, then rename over the target, so a reader never observes a half-written registry. (STAR)A WRAPPER THAT LOOKS LIKE THE LAST WRAPPER IS NOT THE SAME WRAPPER -- ENUMERATE ITS SERVICES EVERY TIME. The argument-plus-redirection shape that made fallbackharden and ddqbeat pure swaps is exactly what made this one LOOK swappable; the resemblance is the hazard. FAITHFULNESS NOTE ON THE SHRINK TEST. The shell computed $((CUR * 2 / 3)) -- INTEGER division, which TRUNCATES -- and refused when NEW was strictly less than that. The obvious "cleaner" rewrite (new*3 < cur*2) is NOT the same predicate: at cur=10 the shell threshold is 6 and admits new=6, while the cross- multiplied form rejects it. A guard must be ported EXACTLY, not improved in passing, so the truncating form is reproduced verbatim. (STAR)PORTING A GUARD IS NOT REFACTORING IT -- AN OFF-BY-ONE IN A SAFETY PREDICATE IS A SAFETY CHANGE. nx_lmexport (no args; the clock dispatches it bare) Exit: 0 OK · 2 empty-load REFUSED · 3 shrink REFUSED · 1 internal failure. Output goes to stdout, which the clock's per-job capture routes to logs/lmexport.log automatically. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0