nx_organ_ship_review_candidate_t371.nx

nx_organ_ship.nx -- THE SHIP LOOP AS ONE ORGAN (operator 2026-08-18: "i want all of our workflows mined and built and developed and tested and deployed etc i dont want all this grep and shell and ps1 and other bullshit you have been doing except as fallbacks"). This session hand-pecked the ws-cycle phases WORK->PROVE->EXPOSE->PUBLISH->VERIFY-LIVE ~40 times: build, run gate, contentdiff, behaveprobe, promote with expect_sha256, read the artifact back, register, verify. Every step exists as an organ; nothing ran them as ONE loop with the refusals in the right order. This does, in the nx_dr_chain shape: one call, whole loop, every stage's evidence printed, REFUSE at the first RED with the unblock named. STAGES (each composes the incumbent, never re-implements; each announces its evidence line): 1 BUILD /api/build target=X via nx_mgmt_call (the never-brick lane; the response's src_path MUST name X -- the banked wrong-target compile is caught here -- and its sha256 is captured). REFUSE if src_path is not X (exit 11) or the API refused (exit 12; the API's own reason is printed: magic-ratchet, admit-gate, etc). 2 PROVE RESOLVE the gate that proves X (nx_organ_ship_lib), then RUN it; its EXIT CODE is the verdict (gv_verdict law). Resolution order: gate=<name> the caller declared -> a row in knowledge/organ_gate.conf -> the <X>_gate convention -> X ITSELF when X ends in _gate -> X minus its last underscore segment plus _gate. Each candidate is probed at the serving root (<n>.elf) and at buildroot/_build/ (<n>.sov.elf), and EVERY path probed is printed. FRESHNESS (2026-08-25): for the ONE candidate that is the target this run just built, buildroot/_build/ is probed FIRST -- it holds code from THIS build while the serving root holds the PREVIOUS promote, and an in-process gate compiles its subject IN, so promoted-first reported a tooth count from code the loop did not build. Measured in this loop's own journal: ONE build sha 2d9c5011..., PROVE RED from ./nx_uvunwrap_gate.elf and PROVE GREEN from the artifact just built, consecutive rows. It fails in the FLATTERING direction too -- nx_editstack_gate and nx_domain_map_gate each went GREEN against the promoted copy moments after a build. Every PROVE line, its journal row and the last line now carry artifact=<which one produced this verdict>. REFUSE on a nonzero gate exit (21) with the gate's tail. REFUSE (22) when the caller DECLARED a gate that does not exist -- a caller error, never the ordinary no-gate case. Nothing resolved is announced NO-GATE-FOUND with its full search transcript, journalled, and carried into the final line as prove=NO-GATE-FOUND UNPROVEN: a NAMED loud absence. (Before 2026-08-20 this searched ONE name and silently continued on a miss, so shipping nx_gate_roster_run -- gate nx_gate_roster_gate -- proved nothing and still said SHIPPED.) EVERY DECLARED ROW RUNS (2026-08-23): when organ_gate.conf carries several rows for X (the compiler: one gate per language rung) each further row is resolved at the same two roots and RUN after the first; a declared row with no artifact REFUSES (22) and a RED refuses (21). The last line prints gates_proven=N of_declared=M so a partial proof can never read as a whole one. (Until today only the first row ran and the conf delegated the rest to "the lane's checklist" -- a law that has to be remembered gets skipped.) 2a VINTAGE WHOSE TREE DID THAT VERDICT DESCRIBE? (2026-08-25, part 2). The freshness swap above fixed