nx_refdrift.nx

nx_refdrift.nx -- DOES THE URL STILL SERVE THE BYTES WE PINNED? The refs referee proves the mirror matches its pin, which is a claim about OUR disk. It says so about itself in its own verdict note: "fetch-time provenance proves the mirror is OF the url. It does NOT prove the url still serves those bytes." This organ closes that residual, and it exists because the gap was measured the hard way on 2026-09-04: two pinned standards had MOVED upstream since they were fetched, and a seat only discovered it by re-fetching them for an unrelated reason. A CITATION THAT DRIFTS SILENTLY IS A CLAIM WITH AN EXPIRY DATE NOBODY RECORDED -- the pin still matches the mirror, the mirror still matches the pin, and the source has changed. IT COMPARES BYTES, NOT HASHES, AND THAT IS DELIBERATE. The refs referee already proves pin == filehash of the mirror, so the mirror IS the pinned bytes. Re-fetching and byte-comparing against the mirror therefore answers the drift question exactly, with no second hash implementation to drift from the first. One ruler. IT IS BOUNDED BY CONSTRUCTION AND SAYS SO. The operator's standing law is that hammering the estate is a defect in its own right, so this organ takes ONE refs file and a MAXIMUM number of rows per run, both from argv, and it PRINTS the bound beside the result. A run that stops at its cap declares checked and total, so a partial pass can never read as a clean sweep -- the self-ceiling defect this estate names as law L011. nx_refdrift check <refsfile> [max] -> per-row MATCH / DRIFTED / UNREACHABLE, plus a summing partition nx_refdrift selftest -> teeth, exit 0 GREEN / 1 RED Exit: 0 no drift found | 1 DRIFTED rows exist | 2 usage | 3 UNREADABLE refs file. verdict= is LAST. license_tier: ORIGINAL. Forks the sovereign fetcher, writes one reused temp mirror. No hw writes (Rule 26).