nx_workstream_audit_gate.nx

nx_workstream_audit_gate.nx -- THE REFEREE for WMS-R4 (the boot-time completeness/crash audit). Structural twin of nx_workstream_registry_gate: that proves the registry is an internally-complete SSOT; THIS proves the registry is EXTERNALLY complete -- cross-checked against the real filesystem (memory .md + code .nx) and the assignment_queue, so a lost/moved/never-registered workstream is reported LOUDLY (orphan / untracked / unregistered) rather than silently dropped on crash recovery. HERMETIC: the gate seeds its OWN test store (knowledge/store/wsaudit-) with controlled fixtures (NOT production claims) AND builds tiny fixture dirs under knowledge/store/wsaudit_fix/{mem,code}/ so the FS walk runs over CONTROLLED data (a real DATA-driven walk, not one hardcoded branch). Assertions (flat pass-tally, avoids the LM-002 deep-nested-if landmine): T1 clean-store no-orphan : every fixture row's mem/code link resolves -> ws_audit_orphans_p==0 T2 orphan caught : one fixture row's memory_link points at a .md that was NOT created -> orphans>=1 AND that id in orphan_out T3 untracked NEG-CONTROL : a .nx organ dropped in wsaudit_fix/code/ with NO matching code_link in the registry -> ws_audit_untracked_p>=1 AND its basename reported. THE mandatory neg-control: a hidden workstream present in code but absent from the registry is CAUGHT. T4 no-false-positive : a fully-registered fixture organ (its basename IS a code_link) is NOT in untracked_out (proves T3 isn't a constant non-zero). T5 unregistered caught : a hermetic queue fixture row id T-PROSE-ONLY not in the registry -> ws_audit_unregistered_p>=1 with that id reported; a registered id NOT. T6 production roll-up : against the live ws- prefix + real memory/runtime/queue, ws_audit_complete_r4_p runs and PRINTS orphan/untracked/unregistered counts; GREEN-gate invariant = production ORPHANS==0 (the lost-things invariant, using the basename-resolving code check so the path-shifted links nx_geo/nx_drv_proto_emit/nx_root_trace do NOT false-orphan). GREEN only if T1..T6 all hold. Evidence -> knowledge/status/workstream_audit_gate.log. license_tier: ORIGINAL