nx_buildecho.nx

nx_buildecho.nx -- READ WHAT THE BUILDER SAID IT COMPILED (2026-08-07). Extracted from nx_mgmt_api's ma_do_build so the cross-target guard can be BITE-TESTED. It was written inline inside a 296KB daemon that binds a port and needs a live estate, which made the one piece of logic standing between "wrong organ promoted under the right name" and "refused" the piece nobody could exercise. *A GUARD BURIED IN A DAEMON IS A GUARD THAT ONLY GETS TESTED IN PRODUCTION.* WHAT IT PARSES -- the builder's own echo, the ONLY witness to what was actually compiled: [hostctl] buildrun: compile 'nx_seg_store_gate' on the NAS (nx_cc -> nxasm) WHY THE ECHO AND NOT THE OBVIOUS FIELDS (all three measured 2026-08-07): expect_sha256 -- proves the staged bytes are the ones just built. When the WRONG source was compiled that digest IS the wrong binary's digest, so promote installs it and says PROMOTED. A GUARD THAT CHECKS THE ARTIFACT AGAINST THE BUILD CANNOT TELL YOU THE BUILD WAS OF THE WRONG THING. src_path -- ma_gate_src DERIVES it from the REQUESTED name, so it agrees BY CONSTRUCTION whatever the compiler read. A FIELD COMPUTED FROM THE QUESTION CANNOT CORROBORATE THE ANSWER. ABSENCE IS NOT A MISMATCH. A capture without the marker returns 0 and the caller proceeds exactly as before. *A GUARD THAT CANNOT SEE ITS EVIDENCE MUST ABSTAIN, NEVER ACCUSE* -- turning "I could not look" into "it is wrong" would break every build the day the echo format changes. license_tier: ORIGINAL No hw writes (Rule 26).