nx_treecanon_gate.nx

nx_treecanon_gate.nx -- THE DIVERGENCE GATE THAT REFUSES (debt 1785622769, operator directive 2026-08-01: "ONE canonical tree per generation with a lineage manifest ... a divergence gate that REFUSES a build when the deploying tree's copy diverges from canonical"). MEASURED 2026-08-03, and it is why this exists: NAS buildroot vs laptop nxc2 diverge on 8,258 files -- 3,705 NAS-newer, 1,838 laptop-newer, 739 NAS-only, 1,976 laptop-only. NEITHER TREE IS A SUPERSET IN EITHER DIRECTION. A name-level diff saw only 969 of those, because the dangerous class is files present in BOTH with DIFFERENT BYTES (5,543 of them). ⇒ ★A NAME-LEVEL TREE DIFF IS NOT A DIVERGENCE CHECK. It cannot see the failure that actually bites -- editing a file in one tree and compiling the other copy, which is precisely how the unfreed-mmap fix had to be applied twice (the incident that opened this debt). SCOPE, DELIBERATE AND STATED: this gate does NOT try to reconcile the fork. Blocking on all 8,258 would block every build, and mass-merging on a size screen would be DESTRUCTIVE -- byte size is a SCREEN, not proof of newer (banked law: newer mtime + FEWER bytes = REVERT). It enforces a CANON LIST from knowledge/tree_canon.conf (rule 11: the policy is DATA), starting at the crown jewels and growing by measurement. Stopping the bleeding beats an unfinished cleanup. T0 LOADED both manifests parse and index (non-vacuity floor on the inputs) T1 CANON READ the canon list loads and is non-empty (an empty list would pass vacuously) T2 CANON CLEAN every canon path is present in BOTH trees and byte-identical -- REFUSES otherwise T3 BITE the detector fires on a REAL divergent path and stays silent on a REAL identical one, both discovered from the manifests at runtime (no hardcoded fixture) T4 SETTLED OPTIONAL, needs argv[4]: resamples every listed canon file on the LIVE tree TC_SETTLE_MS later and REFUSES if any moved -- T1..T3 read manifests, which are claims about a moment already past and so cannot see a snapshot taken mid-write T5 CONFIRMED OPTIONAL, needs argv[4]: for every canon row T2 called divergent, hashes the LIVE file and asks whether the manifests or the bytes are right -- separating a REAL fork from a STALE MANIFEST. The two manifests are refreshed on DIFFERENT CLOCKS (NAS side hourly by nx_treediverge_beat, laptop side per SessionStart), so manifest lag alone can make identical trees look forked and block every seat's build. usage: nx_treecanon_gate <manifestCANON> <manifestOTHER> <canon.conf> [liveTreeRoot] liveTreeRoot must be the tree manifestCANON describes (e.g. buildroot/runtime on the NAS). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0