nx_fw_robust_flash.nx

nx_fw_robust_flash.nx -- S-CLASS never-brick: survives suboptimal/adverse conditions. module: nishi-core.genealogy.fw_robust_flash capability: CORE_COMPUTE (never-brick that holds through power loss at ANY step + double faults) THE PROBLEM (operator 2026-06-16: "make our never brick s class even in suboptimal situations"): nx_fw_safeflash's golden recovery assumes the golden anchor is always intact and the recovery itself completes. Real devices brick from the SUBOPTIMAL cases: power loss MID-flash, power loss MID-recovery, a corrupted recovery copy, torn writes, double faults. S-class never-brick must survive ALL of them. The proven field design (dual-BIOS + flashback ROM) is modeled here: * TWO banks A/B + an IMMUTABLE FACTORY anchor (the write-protected last resort). * A flash writes ONLY the INACTIVE bank, verifies it (sha256), then ATOMICALLY flips a tiny selector (write-temp + rename -- power loss leaves it fully-old or fully-new, never torn). The ACTIVE bank is NEVER overwritten, so a crash before the commit leaves the OLD image selected = still bootable. * rf_select (what firmware runs at power-on): preferred bank -> the other bank (self-heal) -> the immutable factory. It returns a BOOTABLE image unless EVEN THE FACTORY is gone. INVARIANT (S-class never-brick): as long as the immutable factory survives (it is write- protected by design), rf_select returns a bootable image after ANY interruption sequence. Sandboxed (/tmp only). Sovereign: reuses nx_fw_safeflash image+sha256 primitives. license_tier: ORIGINAL