nx_organ_ship_review_lib_candidate_t371.nx

nx_organ_ship_lib.nx -- WHICH GATE PROVES THIS TARGET? The resolver the ship loop was missing. WHY (measured 2026-08-20). nx_organ_ship's PROVE stage looked for exactly ONE name, "<target>_gate", and when that artifact did not exist it announced GATE=NONE and carried on. Shipping nx_gate_roster_run therefore SKIPPED THE PROOF STAGE ENTIRELY -- its gate is nx_gate_roster_gate -- and the loop reported SHIPPED having proven nothing about the binary it installed. A SHIP LOOP THAT SILENTLY SKIPS ITS PROOF STAGE WHEN A NAME DOES NOT MATCH IS THE VACUOUS-TEST DEFECT IN THE ONE ORGAN EVERY OTHER SHIP DEPENDS ON. THE REMEDY IS NOT A RENAME. Renaming a gate to satisfy a classifier is dodging by luck; the estate settled that question once already for a sibling classifier (organ_kind.conf: "renaming a third time would be dodging classifiers by luck"). So: RESOLVE the gate, and PUBLISH THE SEARCH. Every candidate path probed is appended to `tried` in the order probed, so a miss can NAME what it looked for instead of being a silent skip, and a hit can NAME the rule that found it. RESOLUTION ORDER -- declaration first, derivation second (rule 17): 1 explicit the caller passed gate=<name>. A caller ASSERTION: if it is absent the loop REFUSES, because a declared gate that is not there is a caller error, not a missing gate. 2 conf row knowledge/organ_gate.conf, "<target> TAB <gatename>". The declaration path: a target whose gate cannot be derived from its name gets a ROW, never a rename. 3 convention <target>_gate -- what the estate mostly does. 4 self the target ITSELF when it ends in _gate. Shipping a gate used to skip PROVE for the same reason (nx_foo_gate_gate does not exist); a gate proves itself by running. 5 strip1 <target minus its LAST underscore segment>_gate. This is the measured shape: nx_gate_roster_run -> nx_gate_roster_gate. EXACTLY ONE segment, deliberately. Each further strip walks toward a DIFFERENT organ's gate, and A GATE WHOSE SUBJECT IS NOT THE TARGET PROVES NOTHING ABOUT THE TARGET -- a resolver that reached far enough would manufacture a FALSE proof, which is strictly worse than the silent skip it replaces. ROOT ORDER -- WHICH COPY OF THE RESOLVED GATE RUNS (added 2026-08-25). Each candidate is probed at two roots: the promoted serving root and the build scratch. Promoted-first is right for a gate that is a DIFFERENT organ from the target, because this invocation did not build it. It is WRONG for the one candidate that IS the target just built, and for an in-process gate -- whose subject is compiled INTO the gate -- that means reporting a tooth count from code the loop did not build. `fresh` names the target so osl_try_fresh can flip the order for that candidate alone; osl_root_of reports which root any resolved path came from, so the number always travels with its provenance. WHY A LIB AND NOT A FUNCTION INSIDE THE LOOP: nx_organ_ship's main() BUILDS before it proves, so a gate that drove main() would fork real compiles. The roots are PARAMETERS here (dir + suffix pairs)