nx_provcensus.nx

nx_provcensus.nx -- THE FLEET PROVENANCE-DRIFT CENSUS (2026-08-26). nx_organ_ship consults nx_provcheck so a gate is rebuilt when its import CLOSURE drifted even with no import edge to notice. Two gates were caught DRIFTED by hand the day that shipped. NOBODY HAD MEASURED THE FLEET, so nobody knew how many ships had already proved the wrong subject -- and a rate nobody has measured is not a small number, it is an unknown one. This organ measures it. POPULATION: every "<name>_gate.provenance" sidecar in the estate root -- exactly "the gates that have a provenance record" -- enumerated from ONE directory via nx_dir_list rather than a tree walk. That is deliberate and measured: nx_shelltool find AND glob both return matches=0 with corpus_complete=0 over this root for sidecars that demonstrably exist (2026-08-26), because the walk exhausts its budget in the subtrees before it reports the root's own files. A tree scanner cannot establish this population at all, and only its coverage envelope stops the zero being published as absence. PARTITION -- each bucket its own remedy, printed with the count, and the parts are SUMMED against the population rather than assumed to agree: CURRENT | DRIFTED | UNRECORDED | NOSIDECAR | UNREADABLE (+ SKIPPED-OVER-BUDGET, reconciled too) NO-RECORD is reported BESIDE the partition, never inside it: it counts "<name>_gate.elf" at the root with no sidecar at all. That is a different question with a different denominator, and folding it in would silently break the reconciliation -- a bucket that overlaps a partition must be a separate axis. Composes nx_provcheck per row instead of re-deriving CURRENT/DRIFTED, so there stays exactly ONE definition of the verdict in the estate and this inherits every future fix to it. All judgement lives in nx_provcensus_lib.nx so the gate can mutation-prove it in-process. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0