nx_servedrift.nx

nx_artifactdrift.nx -- IS THE BINARY WE ARE SERVING THE ONE THE LAST BUILD PRODUCED? ⚠THIS ORGAN WAS NAMED WRONG TWICE, AND BOTH GUARDS WERE RIGHT. It shipped as `nx_promotestale` and nx_job_run's launch guard refused it: that guard splits the name on '_' and denies any SEGMENT STARTING WITH a control-plane stem, so "promotestale" reads as promote. Renamed to `nx_servedrift`, /api/promote then refused it as a DAEMON and nx_job_run refused it again -- "servedrift" starts with "serve", and that guard's header states it chose stem-prefix DELIBERATELY so `nx_server` could never escape, calling an escaped server "the brick". -- BOTH REFUSALS WERE CORRECT. A launch guard must be wrong in the direction of REFUSING, and a name that starts with `serve` genuinely looks like a server. The tempting fix -- patch an allow-path into a never-brick guard so it consults organ_kind.conf -- would trade a real safety property for a bad name. -- SO THE NAME MOVED, NOT THE GUARD: this measures DRIFT BETWEEN THE BUILT AND SERVED ARTIFACT, which `artifactdrift` says exactly and claims to be no kind of server. ★★AN ORGAN'S NAME IS PART OF ITS INTERFACE, BECAUSE THE ESTATE'S OWN SAFETY RULES READ IT -- and when a guard and a name disagree, the guard is the thing with a proof behind it. WHY IT EXISTS, MEASURED 2026-08-14: two organs were found SERVING STALE CODE purely because a human happened to notice nx_catalog's BUILT and PROMOTED columns disagree -- nx_vizsla_digest (47,402 served vs 47,596 built) and nx_vizsla_plan (176,882 served vs 217,561 built: ~40 KB, a FIFTH of the organ, missing from the running binary). Both were invisible to every health check the estate runs. -- A RUNNING BINARY THAT IS NOT WHAT ITS SOURCE BUILT IS A SILENT CORRECTNESS AND SECURITY DEFECT: every fix, every audit and every gate verdict then describes code that is not the code being executed. -- SPOTTING IT BY EYE DOES NOT SCALE. nx_catalog answers this one NAME at a time; this sweeps. nx_servedrift [registry] [buildroot] THE UNIT IS THE BINARY, NOT THE REGISTRY ROW. Several names legitimately share one elf (nx_status and nx_torstat both point at nx_hostctl; nx_services/nx_health/nx_mgmt all at nx_mgmt_call.elf), so counting rows would INFLATE the population and report one stale binary as three. CLASSES -- a PARTITION whose parts are printed and MUST sum: IDENTICAL served bytes == built bytes -> what we run is what we built STALE both exist and DIFFER -> THE WORKLIST; the served code is not the build NO-BUILD no build artifact to compare against -> CANNOT JUDGE, never folded into IDENTICAL NO-SERVED the registry points at a missing elf -> a dangling row, a different defect entirely -- "I COULD NOT LOOK" GETS ITS OWN BUCKET. Folding NO-BUILD into IDENTICAL would report the fleet healthy in exactly the state this organ exists to catch -- the defect nx_offc_install already made once when it read "no twin to judge" as "not stale". CHEAP BY CONSTRUCTION: size comes from sys_fstatat (a stat, NOT a read), so the common case costs two