nx_provclass_lib.nx

nx_provclass_lib.nx -- THE PROVENANCE-CLASS RULER. One classifier, read by every organ that admits a measured fact, so a class can never mean one thing to the writer and another to the reader. WHAT IT ADDS TO nx_refcorpus, AND WHAT IT DELIBERATELY DOES NOT TOUCH. rc_admit already walls off asset PAYLOAD (length + plain alphabet) and enforces a global k-floor RC_KMIN=8. Both are properties of the VALUE. Neither looks at WHERE the measured assets came from: rc_put_row bounds `provenance` and `license` by LENGTH ONLY, so `unverified` and `cc0` pass identically. This lib is the missing axis, and it is STRICTLY ADDITIVE -- it can only ever REFUSE something rc_admit would have taken. It never loosens rc_admit and it is not a second copy of it. TWO REASONS THE `use` COLUMN EXISTS, and the second is the one that matters: 1. `shipped` -- provenance is verifiable, the class may inform artifacts we ship. 2. `reference-only` -- AGGREGATE STATISTICS ONLY. Never a shape target, never a fitted generator axis, never resolved from a build closure. Keeping an asset out of the build path stops us shipping its BYTES. It does not stop its IDENTITY propagating through a generator fitted to it -- and that output IS shipped. The build-path rule is structurally blind to that path; `reference-only` is what makes it enforceable rather than promised. FAIL CLOSED, IN BOTH DIRECTIONS THAT MATTER: * an UNKNOWN tag refuses. It does not fall through to the permissive value. The estate has already measured that cost: pr_mode returned BUFFERED for any unrecognised token, silently downgrading a fail-closed route to an open one with no diagnostic. * an UNREADABLE conf refuses too, with its own named code. A classifier that cannot read its table must ABSTAIN, never acquit -- an admission wall that opens when its rules go missing is worse than no wall, because its existence is counted as coverage. TWO-ROOT PROBE, ON PURPOSE. `knowledge/...` is a CWD-RELATIVE EXPRESSION and this estate has already paid for that: the same literal names a different tree depending on the forking process's CWD. pc_load probes the bare path FIRST, then the buildroot twin, and RECORDS WHICH ONE RESOLVED (pc_conf_which) -- a resolver that returns bytes without saying where they came from reproduces the original defect one layer up. NO LOOP-EXIT SENTINELS. The scanners below return early from helpers instead of writing a sentinel into the cursor. The estate has recorded that defect four times in one day ("a loop-exit sentinel written into the search cursor erases the answer"), and the first draft of THIS file committed it. license_tier: ORIGINAL