nx_mf_hold.nx

nx_mf_hold.nx -- ADVANCE A SYNC WATERMARK EXCEPT WHERE IT WAS NEVER EARNED. WHY IT EXISTS (measured 2026-08-16, treecanon flow-back lane): sync_nas_ahead.ps1 ended with `if ($Apply) { Copy-Item $cur $base -Force }` -- it advanced the baseline manifest to the CURRENT NAS manifest WHOLESALE. For a REFUSE that is correct: the file was examined, declined, and durably queued in conflicts.log for conflicts.ps1 to rank. But a FETCH FAILURE `continue`d BEFORE that ledger append, so it was recorded NOWHERE -- and the watermark then advanced past a file the lane had never even looked at, marking it synced permanently and silently. => A TRANSIENT FAILURE THAT IS NEITHER RETRIED NOR RECORDED IS A PERMANENT ONE. SCOPE CORRECTION WORTH KEEPING, because the first version of this header got it wrong: the watermark answers "what changed on the NAS", NOT "what is still unreconciled". Those are different questions with different readers, and conflicts.log/conflicts.ps1 already answer the second (837 distinct files / 1185 events, measured the same day). Holding every refusal here would re-fetch all 837 on every hourly run to rebuild a worklist that already exists -- a duplicate ruler that also hammers the NAS. BEFORE BUILDING A QUEUE, CHECK WHETHER THE REFUSAL LEDGER IS ALREADY ONE. WHAT IT DOES out = current, EXCEPT that any path named in holdlist keeps its BASELINE row -- or is OMITTED entirely when the baseline has no row for it, so it re-surfaces next run as B-ONLY rather than being silently blessed. PER-PATH, deliberately. Holding the WHOLE watermark whenever anything was held would let one stuck file pin it forever and turn every later run into a full re-fetch: one silence traded for one flood. SELF-TESTS ON EVERY RUN AND REFUSES TO WRITE IF ANY TOOTH FAILS. Precedent in this same lane: nx_normdiff withholds its verdict when its supersede predicate regresses, so the failure mode is "no adopt", never "wrong adopt". Emitting a CORRUPT baseline is strictly worse than emitting none, because a corrupt watermark is indistinguishable from a converged one. ROW FORMAT: "<64hex> <bytes> <relpath>\n" -- what nx_treehash writes and nx_hashdiverge parses. IMPRECISION ACCEPTED AND NAMED: relpath is the bytes between the second space and the newline, so a relpath CONTAINING A SPACE parses short. nx_treehash never emits one. The parse is deliberately the SAME SHAPE as nx_hashdiverge's rather than a cleverer one, because two parsers that disagree under the same input is the duplicate-ruler defect wearing a bugfix. sys_openat_wr has NO O_TRUNC, so a shorter rewrite over a longer file leaves a live tail -- on a BASELINE manifest that is corrupt trailing rows that read as real. There is no sys_openat_trunc (proven absent over buildroot/runtime, corpus_complete=1), so: UNLINK FIRST.