nx_sitesweep.nx

nx_sitesweep.nx -- THE STANDING ANSWER TO "HOW MANY PAGES ON OUR PUBLIC SITE SERVE BROKEN ASSETS?" WHY THIS EXISTS. nx_page_verify answers that question for ONE page, browser-grade (fetch, extract every asset ref, refuse a relative ref by law, fetch each asset, deep-decode PNGs). It was BLIND to unquoted HTML attributes until 2026-08-25; the instant it could see, /world/foundation turned out to have had 15 images broken in every browser while reporting GREEN-PARTIAL. NOBODY KNEW HOW MANY OTHER PAGES WERE LIKE THAT, because there was no instrument over the POPULATION -- only over a page a human happened to name. A RULER WITH NO SWEEP MEASURES WHATEVER SOMEONE REMEMBERED TO POINT IT AT, AND ITS SILENCE ON EVERYTHING ELSE READS AS HEALTH. ONE RULER, NEVER TWO. This organ does NOT extract refs, does NOT decode PNGs and does NOT re-state the relative-ref law. It FORKS nx_page_verify per page and reads its verdict. Every judgement about a page is that organ's judgement; this organ enumerates, budgets, classifies and reconciles. The two pieces of judgement it DOES add -- the ref prefilter and the verdict parser -- live in nx_sitesweep_lib.nx, which its gate imports, so the tested copy and the shipped copy cannot differ. COVERAGE IS A BUDGET PROBLEM AND THE BUDGET IS DECLARED. The docroot holds tens of thousands of servable pages (33,243 entries in the generated organ-card tree alone, measured 2026-08-25). Live-verifying all of them every beat would make this sweep the dominant load source on the box, which the operator standing order names a BUG, not thoroughness. So: the ENUMERATION is complete every run (cheap, local), and the LIVE CHECK is a deadline-bounded, cursor-advancing slice that rotates across beats. That is a DECLARED PREFIX WITH A CURSOR, NOT A SAMPLE -- the run prints how many it examined, how many it deferred and where the cursor now sits, and corpus_complete drops to 0 the moment anything is deferred. THE LEDGER IS THE ANSWER, NOT THE RUN. One row per enumerated page, rewritten whole (TRUNCATE) every run: this run's slice gets a fresh result, every other page carries its previous row forward with its own at= epoch so staleness is visible per row. So "how many pages serve broken assets" is answered from the accumulated ledger, and the partition SUMS to the enumeration by construction. THE THIRD STATE IS PLUMBED THROUGH. nx_page_verify already separates "I could not reach it" (UNOBSERVABLE) and "our domain with an unusable registry endpoint" (UNMEASURED) from RED. This organ keeps them as their own buckets and NEVER folds them into broken. A sweep that convicts a page it never reached is reporting on its own environment. A ruler run that yields no readable verdict at all (fork failure, per-page timeout, a capture cut so the tail carrying VERDICT was destroyed) is UNREADABLE -- also never RED. usage: nx_sitesweep [root=<subpath>] [deadline=<secs>] [max=<pages>] [cursor=<n>] [probe=1] root= sweep only docroot/<subpath>. FORCES PROBE: a different population must never write the beat's ledger or cursor, or the coverage claim silently becomes about a subtree.