nx_srcfresh.nx

nx_srcfresh.nx -- LIB: IS THIS ARTIFACT BUILT FROM THIS SOURCE? The canonical source-vs-artifact staleness predicate, extracted 2026-08-07 so callers that are not installers can ask the question. WHY IT EXISTS AS A LIB. The predicate already existed and was already PROVEN -- oi_src_stale in nx_offc_install.nx, locked by _freshness_gate.nx (T1 stale / T2 neg-control fresh / T3 artifact-absent / T4 source-absent / T5 mtime round-trip). But it lives inside an INSTALLER that owns main(), so no other organ can import it, and the mtime-stat idiom is consequently open-coded in 10+ places (gv_mtime in nx_gate_verdict_lib, gb_mtime in nx_gatebuilt_gate, nx_pipeline_census, nx_datacurator x3, nx_netobs, nx_imgbook_promote, nx_janitor_sprawl, nx_sov_tree_audit, nx_eff_lib, nx_mem_healer) -- and those copies do NOT agree: several read only st_mtim.tv_sec, so two writes in the same second compare EQUAL and a rebuild-within-a-second reads FRESH when it is stale. A PROVEN PREDICATE TRAPPED INSIDE AN ORGAN THAT OWNS main() IS NOT A SHARED CAPABILITY, IT IS A COPY WAITING TO BE MADE -- AND EVERY COPY IS FREE TO DISAGREE WITH THE ONE THE GATE PROVED. SEMANTICS ARE LIFTED VERBATIM from oi_src_stale rather than re-derived, so the behaviour _freshness_gate already locked carries over unchanged; nx_srcfresh_gate re-asserts all five of its cases against THIS copy (equivalence is asserted, not assumed) and adds the same-second case the second-granularity copies silently fail. Imports ONLY nx_syscalls.nx -- a lib that drags a dependency tree behind it does not get adopted. license_tier: ORIGINAL No hw writes (Rule 26).