nx_survey_serve.nx

nx_survey_serve.nx -- the SURVEY/POLL product surface over nx_survey_engine (pure core, no main; the nx_office_serve/nx_relate_serve discipline). A one-question welfare pulse and a deep survey are the SAME app -- surveys are spec DATA loaded through the admin lane, never code. ROUTES (base = URL mount prefix, e.g. "/survey" behind the sovereign edge): GET / open+closed survey list GET /s/<id> the survey form (respondent token from ?t=<tok> or freshly minted; the served app.js keeps one stable token per browser -> revote-replace works) POST /s/<id> record a ballot (engine validates; revote REPLACES by construction) GET /s/<id>/done thanks page GET /s/<id>/results AGGREGATE-ONLY results: counts/means/bars; k-floor (@kmin) withholds below quorum; text answers NEVER render here; @results admin -> 403 GET /app.js progressive-enhancement client (token persistence; no-JS still works) POST /admin/load|close|report -- key-file-gated (CWD survey_admin.key; FAIL-CLOSED when absent) POST /admin/insights -- key-gated deep analytics report (cross-tab + chi-square significance, segment means, key drivers, concern flags, open-text themes) over nx_survey_stats PRIVACY BY CONSTRUCTION: anon surveys never emit tokens anywhere public; results are counts only; free text is admin-report only; deep breakdowns that could reveal a small cell are admin-lane only. Same-origin POST guard. license_tier: ORIGINAL