nx_mcu_brick.nx

nx_mcu_brick.nx -- Rule-26 reversibility classifier for persistent-state writes on MCU targets. WHY THIS EXISTS: Rule 26 is absolute and brand-critical, and it demands the never-brick guarantee be PROVEN MECHANICALLY, never asserted as a promise. Flashing an ESP32 writes persistent hardware state. So the guard is built BEFORE the gun: this classifier exists before any flashing capability does, and it is the function a write chokepoint must call. A capability gated only inside a gate IS the baseline. THE SILICON FACTS THIS ENCODES (verified 2026-07-31 against Espressif ESP-IDF security docs): - eFuses are ONE-TIME PROGRAMMABLE. Default bit value is 0 after manufacturing and once set they cannot be reverted. So EVERY eFuse burn is irreversible BY CONSTRUCTION, not by policy. - SPI flash writes ARE recoverable: the first-stage bootloader lives in unerasable mask ROM and re-enters UART download mode, so a bad app image is re-flashable -- annoying, not a brick. - THE KEYSTONE, and the whole reason this is a function and not a constant: that recovery path is ITSELF an eFuse. Burning DIS_DOWNLOAD_MODE (CONFIG_SECURE_DISABLE_ROM_DL_MODE, or a runtime esp_efuse_disable_rom_download_mode() call) permanently removes it. The instant download mode is burned, the ENTIRE flash surface converts from reversible to irreversible. Hence flash-class writes are GREEN only while the recovery path is intact -- reversibility is CONDITIONAL, never intrinsic. Anything undeclared is RED, fail-closed, because an unclassified write is precisely the case where we do not know whether it bricks. license_tier: ORIGINAL No hw writes (Rule 26).