nx_page_verify.nx

nx_page_verify.nx -- BROWSER-GRADE LIVE PAGE VERIFIER (the "my verify was shit" cure, operator 2026-07-16). Status-200-on-the-page is NOT verification: a page can 200 while every image on it is broken (the /render3d incident: the edge 301-strips trailing slashes, so RELATIVE img srcs resolve to the site root -> 404/fallback -> broken images that a direct asset fetch never catches). This organ verifies a page THE WAY A BROWSER EXPERIENCES IT: 1. fetch the page (sovereign TLS, redirects followed) -- must be 200 2. extract every asset ref (img/script src=, link href=) 3. LAW CHECK: a RELATIVE asset ref = RED by construction on our slash-stripping edge (use absolute /path) 4. fetch every same-origin asset -- 200 required 5. DEEP-DECODE: PNG assets run through the full sovereign decoder (nx_png_decode: signature, IHDR, zlib inflate, unfilter incl Paeth) -- "200 + magic bytes" is not proof; DECODED WxH is 6. an asset that answers with HTML (the 404-fallback class) = RED even though its status is 200 Composes nx_https_fetch_follow (the games_url_check fetch spine) + nx_png_decode. Exit = broken count. usage: nx_page_verify <https-url> [connect-host:port] (run from repo root: needs data/mozilla_certdata.txt) [connect-host:port] = OPTIONAL connect-override (curl --connect-to): page + every asset fetch opens TCP+TLS to THIS endpoint while SNI/Host/cert-name stay the URL host -- use 127.0.0.1:8443 to verify our OWN vhosts deterministically from the sovereign edge (kills the DSM-nginx :443 coin-flip false-RED). license_tier: ORIGINAL