nx_win_ledger.nx

nx_win_ledger.nx -- the WIN-LEDGER organ (ADDITIVE; no main, no shared edits). REASON TO EXIST (operator's mandate): a "win" is not a win until it is EXPLAINED (why, cited), PROVEN (a repro gate with a known answer), and FALSIFIABLE (an explicit assumptions[] list, so a bad assumption is catchable). This organ is the bookkeeping layer for those wins, recorded ADDITIVELY over the hash-chained nx_journal_log (which itself stores its payloads content-addressed in nx_blob_store -- the snapshot/attest substrate). A re-verify RE-RUNS a recorded win's repro and asserts the expected known answer -> HOLDS; a regression / broken assumption / a deliberately-wrong expected FAILS LOUD -> REFUTED. The status downgrade is the whole point: the ledger must be able to flip a stale win to REFUTED. SOVEREIGNTY: the re-gate path mirrors nx_gate_runner exactly -- compile the repro *_test.nx via the PINNED nx_cc_known_good.elf (NEVER the active, possibly-poisoned compiler; cf. the g1 regalloc miscompile history), then as + ld, then run capturing stdout, and substring-match the expected known-answer. We capture STDOUT (not just the exit code) so the ledger catches a regression where the gate still exits 0 but emits a DIFFERENT answer -- and so a deliberately-wrong expected string genuinely flips to REFUTED. ADDITIVE: this is a NEW file. It does NOT edit nx_warden_lib / nx_gate_runner / nx_conductor / nx_eqsat. It REUSES, concept-not-copy: * nx_blob_store.nx -- content-addressed snapshot substrate (under journal) * nx_journal_log.nx -- hash-chained append-only win record store * nx_syscalls.nx -- raw fork/exec/wait + file I/O (NOT copied; imported) license_tier: ORIGINAL