nx_pub_plane_gate.nx

nx_pub_plane_gate.nx -- the VERIFIER for the publishing plane (nx_pub_lib / nx_pub_plane). Proves the two properties the operator actually asked for: 1. every discovery artifact (sitemap.xml, robots.txt, llms.txt) is DERIVED from the per-site registry -- so what a crawler sees and what the team believes are the same object, and no page can be "put somewhere" and quietly become site truth; 2. the publish GATEWAY is FAIL-CLOSED -- an unregistered path is refused, and an unreadable registry refuses everything rather than waving it through; 3. adoption walks the WHOLE docroot TREE (debt 1785614931: the one-level walk skipped every subdirectory, so a nested page could never be registered and the gateway refused code/ pages forever) -- nested pages enter under their FULL relpath, idempotently, and a beyond-depth tree REFUSES LOUDLY rather than truncating. NON-VACUITY IS STRUCTURAL HERE, not a promise: the exclusion teeth are gv_bite cells, which count only if they FIRE on the crafted-bad input AND stay SILENT on the crafted-good one. A sitemap filter that excluded everything, or nothing, fails both bites. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0