nx_mcu_ready.nx

nx_mcu_ready.nx -- THE HARDWARE-TEST CHOKEPOINT: composes the two independent questions a board must answer before anyone plugs one in. 1. DOES IT FIT? nx_mcu_fit -- core->SRAM, weights+table->flash, KV->PSRAM, refusing UNMEASURED. 2. IS IT SAFE? nx_mcu_brick -- eFuse burns refused as a class; flash permitted only while the mask-ROM UART recovery path is intact. ★SAFETY DOMINATES, ALWAYS. A config that fits perfectly is still REFUSED if the write is irreversible. The reverse is not symmetric: a safe write that does not fit is merely a sizing problem, recoverable by choosing a smaller model. An unsafe write that fits is a DEAD BOARD. So the composition is deliberately NOT a symmetric AND -- when both fail, the reported blocker is SAFETY, because that is the one the operator must never work around. WHY A SEPARATE ORGAN RATHER THAN A FLAG ON EITHER. Both inputs already exist and are gated (nx_mcu_fit 13/13, nx_neverbrick_gate 9/9). What did not exist was a SINGLE CALL a bring-up path can route through, and per the adoption law a capability proven only inside its own gate IS the baseline. This is the wire. FIRST- vs THIRD-PARTY: identical logic, different data. A first-party board is a row in mcu_targets.conf we have benched; a third-party board is a row we have NOT, so its fields are -1 and nx_mcu_fit REFUSES with UNMEASURED. That refusal is the correct answer for an unknown board -- it returns a work order ("bench these fields") rather than a guess, which is exactly what makes third-party testing safe. license_tier: ORIGINAL No hw writes (Rule 26).