nx_param_census.nx

nx_param_census.nx -- LOG_SCAN family, X-PRM-002 (operator rule-11: "No Magic Numbers -- every threshold/limit/timeout/weight/multiplier belongs in svc-config or a database table, not buried in code"). EXTENDS the live params registry X-PRM-001 (knowledge/registry/params.tsv). AUTHOR=ORGAN. Scans TWO REAL surfaces listed in param_surfaces.tsv (growable DATA, no recompile) and COMPUTES coverage/DEBT from file reads, NEVER asserted: HALF A CONF-KEY COVERAGE -- for each `C <conf>` row, extract every `key=value` key and check re_has against the real params.tsv bytes. A conf key with NO params row = an ABSENT coverage gap ("every conf key has a row" made measurable). HALF B SOURCE MAGIC-NUMBER DEBT -- for each `S <organ.nx>` row, scan for named numeric source constants `const NAME: i64 = <digit>`; any NAME not already in params.tsv -> AUTO-FILE a rule-11 DEBT row (the hidden tunable becomes visible work). ABI/syscall consts (SYS_/AT_/O_/SOCK/AF_/CLONE/DT_/SO_/SOL_/SIG) are FIXED-BY-SPEC, excluded so DEBT is signal. Outputs: knowledge/registry/param_census.tsv (full PRESENT/ABSENT/DEBT report, organ-authored header) + new DEBT rows APPENDED (additive, never truncate -- rule-13) to params.tsv after a .bak, + a PRMCENSUS verdict line to stdout AND appended to knowledge/status/param_census.log (the evidence nx_reconcile grades; the organ does NOT flip its own row). SELF-VALIDATING (no false-green, sibling of nx_competitive_census pos/neg + nx_hwmap derived-neg): BEFORE touching the real registry it runs baked controls on /tmp planted fixtures -- ctrl_pos_confkey = a KNOWN registered conf-key (diff_seed) MUST be found in the registry read. ctrl_pos_debtrow = the KNOWN existing DEBT row (an_load_max_rows) MUST be present (won't re-file). ctrl_neg_plantmagic = a /tmp fixture with `const ZZ_PLANTED_MAGIC: i64 = 31337` MUST scan to 1 unregistered DEBT candidate (detector is not blind). ctrl_neg_cleanzero = a /tmp fixture with no named numeric const MUST scan to 0 (no false-positive). Any control wrong -> RED, return 1, and the real params.tsv mutation is SKIPPED. Argv override of the surfaces list routes outputs to a /tmp tamper lane (self-tamper, no oracle). license_tier: ORIGINAL