nx_treecanon_gate.nx

nx_treecanon_gate.nx -- THE DIVERGENCE GATE THAT REFUSES (debt 1785622769, operator directive 2026-08-01: "ONE canonical tree per generation with a lineage manifest ... a divergence gate that REFUSES a build when the deploying tree's copy diverges from canonical"). MEASURED 2026-08-03, and it is why this exists: NAS buildroot vs laptop nxc2 diverge on 8,258 files -- 3,705 NAS-newer, 1,838 laptop-newer, 739 NAS-only, 1,976 laptop-only. NEITHER TREE IS A SUPERSET IN EITHER DIRECTION. A name-level diff saw only 969 of those, because the dangerous class is files present in BOTH with DIFFERENT BYTES (5,543 of them). ⇒ ★A NAME-LEVEL TREE DIFF IS NOT A DIVERGENCE CHECK. It cannot see the failure that actually bites -- editing a file in one tree and compiling the other copy, which is precisely how the unfreed-mmap fix had to be applied twice (the incident that opened this debt). SCOPE, DELIBERATE AND STATED: this gate does NOT try to reconcile the fork. Blocking on all 8,258 would block every build, and mass-merging on a size screen would be DESTRUCTIVE -- byte size is a SCREEN, not proof of newer (banked law: newer mtime + FEWER bytes = REVERT). It enforces a CANON LIST from knowledge/tree_canon.conf (rule 11: the policy is DATA), starting at the crown jewels and growing by measurement. Stopping the bleeding beats an unfinished cleanup. T0 LOADED both manifests parse and index (non-vacuity floor on the inputs) T1 CANON READ the canon list loads and is non-empty (an empty list would pass vacuously) T2 CANON CLEAN every canon path is present in BOTH trees and byte-identical -- REFUSES otherwise T3 BITE the detector fires on a REAL divergent path and stays silent on a REAL identical one, both discovered from the manifests at runtime (no hardcoded fixture) license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0