nx_magicratchet.nx

nx_magicratchet.nx -- F881 MAGIC-NUMBER RATCHET (the enforcement the operator demanded 2026-07-21: catch me at submission, not by re-sweeping). A build must NOT INCREASE an organ's inline-magic-number count vs its stored baseline. First build self-baselines (grandfathers existing violations); a build that ADDS a magic number is REFUSED. Non-breaking (existing organs build). ⚠⚠DO NOT RESTATE THE WIRING STATE IN THIS COMMENT. ASK THE INSTRUMENT: nx_shelltool grep nx_magicratchet buildroot/runtime nx -> nx_wiredclaim nx_magicratchet <out> This header has now been WRONG IN BOTH DIRECTIONS. It first claimed "unbypassable (wired into /api/build)" when nothing called it (sev-8 1785530277). That was corrected to "NOT CURRENTLY REACHED FROM /api/build ... nx_wiredclaim call_sites=0" -- and then the wiring LANDED THE SAME DAY (2026-08-15: md_exec_magicratchet in nx_mgmt_data, called from nx_mgmt_api:1502) and the correction itself went stale, now understating the organ instead of overstating it. MEASURED 2026-08-16: nx_wiredclaim -> WIRED call_sites=3. A reader trusting the stale line was one step from re-wiring an already-wired guard, or from editing the estate's BUILD RUNNER to do it. ★★A COMMENT THAT MIRRORS A MEASURABLE STATE IS A CACHE WITH NO INVALIDATION -- IT DRIFTS IN WHICHEVER DIRECTION THE CODE MOVED LAST, AND IT IS BELIEVED BECAUSE IT IS SPECIFIC. Name the instrument, not the answer; the instrument is never stale. fail-OPEN on any count/read uncertainty (a false refusal would be worse than a miss). Counting is DELEGATED to `nx_law_warden countfile` -- ONE canonical L001 counter, no divergent reimplementation. Rule-11 CLEAN itself (named consts, no inline magic). license_tier: ORIGINAL No hw writes (Rule 26).