nx_stalecensus.nx

nx_stalecensus.nx -- RESOLVE THE AMBIGUITY nx_stalesweep NAMES (2026-08-07). nx_stalesweep already measures stale MIRRORS by mtime and maintains knowledge/status/stale_mirror.worklist. Its own header states the limit it cannot pass, and states it honestly: "source-newer is AMBIGUOUS (pending upgrade vs uncommitted WIP), so the debt says TRIAGE and explicitly forbids blanket-rebuild." That is correct AND it leaves every entry unactionable -- an mtime says a dependency MOVED, never that codegen CHANGED, and never whether rebuilding is SAFE. This organ consumes that worklist and resolves each row to a verdict by the only instrument that can: nx_stale_check rebuilds the target and byte-compares against the DEPLOYED elf, and its capability_check refuses a rebuild that would DELETE shipped strings. *THE WORKLIST IS CONSUMED, NEVER RE-DERIVED. A second scan would drift from the one the clock already maintains, and two censuses that disagree about the corpus are worse than either alone. WHY THE CAPABILITY SPLIT IS THE WHOLE POINT: hand-sampling 8 targets gave 6 safe / 2 CAPABILITY-LOSS -- nx_verify's rebuild drops 19 of 64 shipped strings, and nx_render3d's rebuild is LARGER and still loses 2. So a blanket rebuild of the flagged population would delete working features from roughly a quarter of it, silently. 8 samples is enough to know the split is not uniform and nowhere near enough to plan against; this produces the distribution. *A SIZE INCREASE DOES NOT PROVE NOTHING WAS LOST -- only the string-level check decides. DETECT-ONLY, DELIBERATELY. It never promotes. nx_stale_check is the safe half of the deploy-drift loop precisely because it never writes, and a census that promoted as it went could not be re-run to check its own work. Promotion stays an explicit per-target operator step (/api/build + /api/promote with expect_sha256), and CAP-LOSS rows must never be promoted at all until their source is recovered. ENVELOPE, declared in-band and never silent: bounded by an explicit max (REFUSES <= 0 -- no runaway over a 1,500-row worklist), resumable by an explicit skip, and every per-target rebuild carries a deadline because ONE hanging compile must not wedge the sweep. usage: nx_stalecensus <max> [skip] [timeout_ms] [worklist] license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0