nx_sitesweep_gate.nx

nx_sitesweep_gate.nx -- the referee for the site-wide broken-asset sweep. WHAT IT CAN AND CANNOT PROVE, STATED UP FRONT. nx_sitesweep adds exactly TWO pieces of judgement to nx_page_verify: the ref PREFILTER (which pages can be proven ref-free without a fetch) and the RULER VERDICT PARSER (how nx_page_verify's output is read). Everything else about a page is the ruler's judgement, already refereed by nx_page_verify_gate. So this gate bites those two, and it bites them IN PROCESS by importing nx_sitesweep_lib -- the same copy the sweep ships. There is no second implementation for the teeth to agree with. The in-process teeth need no fork and no network, so they run in milliseconds and are safe on the fast gate roster. The END-TO-END cell is a different cost class: it forks the deployed sweep against six live pages and takes minutes. It is therefore OPT-IN (e2e=1) and, when it does not run, the gate SAYS SO IN A NAMED LINE rather than silently counting one fewer tooth. A skipped cell that announces itself is a fact; a skipped cell that does not is a false sense of coverage. FIXTURES. The bite cells read two PERMANENT PUBLISHED negative controls that exist for exactly this purpose -- sites/nishifamily/render3d/negctl_bare.html (unquoted src=, the form the ruler was blind to until 2026-08-25) and negctl_sq.html (single-quoted src=, the form it was blind to until 2026-08-18). They are read ONLY, never written, so this gate shares no scratch with any production beat; the fixture-ratchet law is about a gate WRITING where a beat writes, and there is no write here at all. Synthetic fixtures are built in memory at RUNTIME, byte by byte, so no detector that scans source can mistake a gate fixture for a real occurrence, and no literal newline inside a string is required. usage: nx_sitesweep_gate [e2e=1] license_tier: ORIGINAL