nx_fw_robust_gate.nx

nx_fw_robust_gate.nx -- proves S-class never-brick holds in SUBOPTIMAL conditions. Fault-injects a crash at EVERY interruption point of the A/B + factory + atomic-commit flash and asserts rf_select() still returns a BOOTABLE image -- i.e. the device is never bricked no matter where power is lost; plus a teeth neg-control proving rf_select is honest when truly hopeless: T0 clean-commit : a clean flash commits the inactive bank -> FW_OK + selectable + active flipped F1 powerloss-mid-write : crash while writing the inactive bank -> HELD, active retained + selectable F2 powerloss-pre-commit: crash after verify, before the selector flip-> old bank selected + selectable F3 powerloss-at-commit : crash at/after the atomic selector flip -> new bank selected + selectable F4 double-fault : BOTH banks dead (e.g. bad flash + crash) -> immutable FACTORY + selectable F5 selector-lost : the selector itself is corrupt/missing -> default bank + selectable N1 truly-hopeless (teeth): banks AND factory all gone -> rf_select == null (NOT selectable) GREEN only if T0,F1,F2,F3,F4,F5 are selectable AND N1 is not. Evidence -> knowledge/status/fw_robust_gate.log. Sovereign: imports the robust-flash organ (-> nx_fw_safeflash -> nx_sha256) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL