nx_srcguard.nx

nx_srcguard.nx -- CANONICAL-SOURCE REVERT DETECTOR (seq1439 sev9, the work-destroyer's last mile). THE WOUND: on 2026-07-30 canonical daemon sources were silently reverted THREE times, each revert erasing EATEN debts across three lanes with no error anywhere. seq1379 closed the two SOVEREIGN write paths (nx_fs_write compare-and-swap; nx_treepack refuse-to-backdate) and both hold -- but the third path is RAW scp/rsync over ssh, which never touches an API, so no API-side guard can ever see it. ★You cannot gate a door you do not own. What you CAN do is make the damage IMPOSSIBLE TO MISS. ★★★THE RULER IS SYMBOLS, NOT BYTES (v2, 2026-07-30 -- this organ's OWN first field failure). v1 alarmed on any byte-count DECREASE. Within a day of shipping it, it fired twice and was WRONG BOTH TIMES: once on a file sampled mid-rewrite (a truncate-then-write window read as 0 bytes, and I reported the supervisor source as annihilated when it settled to 279688), and once on a sibling's legitimate refactor of nx_hostctl.nx that removed 1294 bytes while keeping ALL 212 top-level symbols. A shrink is not a revert. Dead code gets deleted, comments get tightened, duplication gets folded -- all of that is the tree getting BETTER, and a guard that calls it destruction trains everyone to ignore the guard. What actually distinguishes a revert is that WORK DISAPPEARS: a func/const/struct that existed is GONE. So the verdict is symbol-set containment -- recorded symbols must all still be present, BY NAME. Growth is silent, refactors are silent, and only a real loss speaks. Same instrument the sibling arrived at independently in nx_treepack (REFUSED-WOULD-DROP-SYMBOLS, seq1467). HONEST LIMITATION, stated because an unstated one is a lie: this tracks symbol EXISTENCE, not symbol BODIES. Gutting a function while keeping its name is invisible here. Byte deltas are still reported (advisory) precisely so that case has a signal to be noticed by -- but it is NOT claimed as covered. WHY A STANDALONE ORGAN: measured in the incident forensics, the CASUALTIES were long-lived shared daemon sources while every NEWLY CREATED file SURVIVED every revert. A guard living inside the file it guards would be reverted with it. This one is clobber-resistant BY CONSTRUCTION. nx_srcguard record [listfile] [statefile] [symsfile] -- snapshot the watched set at a known-good state nx_srcguard check [listfile] [statefile] [symsfile] -- exit 0 clean · 4 = WORK LOST (named symbols) Data-driven (rule 11): the watched set is knowledge/registry/srcguard.list, one path per line. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0