nx_magic.nx

nx_magic.nx -- the MISSING FIXER for law L001 (CLAUDE rule 11, debt seq274 sev8). nx_law_warden DETECTS the breach (2348 inline literals over 600 organs) and cap-autonomy FILES it, but nothing turned a breach into a one-step SAFE edit -- so the operator kept watching workstreams "hit these as bugs and just give them a NEW NUMBER". This organ closes that half. nx_magic map <file.nx> [threshold] -> JSON: every offending line+col+value+context, UNCAPPED nx_magic propose <file.nx> [threshold] -> JSON: the const block + per-value site counts nx_magic apply <file.nx> [threshold] -> ATOMIC rewrite: hoist each distinct value to a named const inserted AFTER the last import and BEFORE the first func (the forward-ref law: a const must be declared above every reader), then replace the sites. SEMANTIC-NEUTRALITY IS PROVABLE, NOT ASSERTED: hoisting a literal to a const must compile to the SAME code, so the caller's proof is a BYTE-IDENTICAL elf on rebuild. Not identical => the transform is NOT neutral => revert. (nx_magic never builds; it stays a pure, reviewable text transform.) SKIPPED BY CONSTRUCTION (false-positive control): comments -- BOTH whole-line and TRAILING-after-code (the trailing case was unhandled until 2026-08-14; this line said "comment lines" and meant it), const/static DECLARATION lines, bytes inside string literals, digits that are part of an identifier (x2048), and any value below the threshold. BOTH BASES SINCE 2026-08-25: decimal AND 0x/0X hex. This line used to read "Decimal only -- hex is DECLARED out of envelope (nearly all hex here is < 1024)", and a declared blind spot is still a blind spot when the number it produces is published as a rule-11 count. MEASURED on buildroot/runtime/_hdl_build/nx_activities_gate.nx at floor 2: 41 sites / 26 distinct INCLUDING a decimal 420 -- and NOT the four `0x1ed` literals four lines away in the same file, which are the same number. The scanner itself now lives in nx_magic_lib.nx so it can be mutation-proven in-process (nx_magic_gate); its header carries the mechanism and the scope of what this does NOT change. IDEMPOTENT: a value whose const already exists is not re-hoisted, so a second apply is a no-op. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0