nx_tooldiff.nx

nx_tooldiff.nx -- toolsplane (seq162 DETECTION half #2: the tool_allowlist ROW-SET shrink detector). Sibling of nx_route_diff (which covers /api routes): THIS catches any GREEN tool row VANISHING (or being de-GREENed) vs a captured baseline -- the allowlist-clobber class (a hub re-assemble, stale-mirror deploy, or bad edit silently killing MCP capability for every session). Transactional use: `snapshot` before a deploy/registry edit, `check` after -> a MISSING name = a capability regression (exit 3 + restore hint). READ-ONLY over the live registry; baseline + verdict land in the evidence layer (deploy_checks row tool-shrink -> nx_deploy_ready surfaces it). ENFORCEMENT/auto-rollback stays mgmt-owned, same stance as nx_route_diff (a cron cannot know intent; the deploy transaction can -- filed rung). nx_tooldiff snapshot | check ENVELOPE (declared in output): TD_MAXTOOLS rows, TD_REGCAP registry read. exit: 0 GREEN | 3 RED-SHRINK | 4 read-fail | 2 usage. RULE-11 (seq274 / law-warden L001, own-house-first 2026-07-20): v1 of this organ shipped with inline literals (16000/16384/32768/262144). REWRITTEN, not patched -- every bound is a NAMED CONST below, so a future session tuning a limit edits a declaration instead of burying a new magic number in the body. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0