nx_promotestale.nx

nx_promotestale.nx -- IS THE BINARY WE ARE SERVING THE ONE THE LAST BUILD PRODUCED? WHY IT EXISTS, MEASURED 2026-08-14: two organs were found SERVING STALE CODE purely because a human happened to notice nx_catalog's BUILT and PROMOTED columns disagree -- nx_vizsla_digest (47,402 served vs 47,596 built) and nx_vizsla_plan (176,882 served vs 217,561 built: ~40 KB, a FIFTH of the organ, missing from the running binary). Both were invisible to every health check the estate runs, because nothing compares those two numbers across the fleet. -- A RUNNING BINARY THAT IS NOT WHAT ITS SOURCE BUILT IS A SILENT CORRECTNESS AND SECURITY DEFECT: every fix, every audit and every gate verdict describes code that is not the code being executed. -- SPOTTING IT BY EYE DOES NOT SCALE. nx_catalog answers this one NAME at a time; this sweeps. nx_promotestale [registry] [buildroot] THE UNIT IS THE BINARY, NOT THE REGISTRY ROW. Several names legitimately share one elf (nx_status and nx_torstat both point at nx_hostctl; nx_services/nx_health/nx_mgmt all at nx_mgmt_call.elf), so counting rows would INFLATE the population and report one stale binary as three. CLASSES -- a PARTITION whose parts are printed and MUST sum: IDENTICAL served bytes == built bytes -> what we run is what we built STALE both exist and DIFFER -> THE WORKLIST; the served code is not the build NO-BUILD no build artifact to compare against -> CANNOT JUDGE, never folded into IDENTICAL NO-SERVED the registry points at a missing elf -> a dangling row, a different defect entirely -- "I COULD NOT LOOK" GETS ITS OWN BUCKET. Folding NO-BUILD into IDENTICAL would report the fleet healthy in exactly the state this organ exists to catch -- the defect nx_offc_install already made once when it read "no twin to judge" as "not stale". CHEAP BY CONSTRUCTION: size comes from sys_fstatat (a stat, NOT a read), so the common case costs two stats per binary and reads NOTHING. A full byte compare runs ONLY when the sizes match, which is the only case where size cannot decide. Equal size with different bytes is real, so it is never assumed away. exit 0 census printed | 2 usage | 3 cannot read registry | 4 no rows | 5 capacity exceeded (REFUSES) license_tier: ORIGINAL. Read-only. No hw writes (Rule 26).