nx_mgmt_promote_gate.nx

nx_mgmt_promote_gate.nx -- referee for POST /api/promote: fail-closed, never-brick, AND lease-clean. In-process (no socket): crafts request BYTES and feeds the pure handler ma_do_promote, with the whole filesystem rooted at /tmp/nx_promote_gt so nothing it does can touch the serving root. mau_build_path builds BARE relative paths, which is what makes that isolation total rather than hopeful. MIGRATED ONTO nx_gate_verdict 2026-08-20 (was D001: a hand-rolled `fails` counter and a bare sys_exit, so /api/gate_run could read a verdict but nx_gate_green could not, and the declared tooth count could drift from the executed one). Every tooth is now a gv_check, so declared == executed by construction. WHAT IS NEW HERE, AND WHY. /api/promote took its 300s lease and then RETURNED THROUGH THREE EXITS THAT NEVER RELEASED IT: the stage-rename failure, and both md_promote_staged_ex failure exits (one of which answers 200 NOTHING-STAGED, so it reads as a harmless no-op while holding the lane shut for five minutes). The release was written once, at the bottom of the success path. That defect was independently rediscovered five times in three weeks because NOTHING WATCHED THE LEASE PLANE -- every existing tooth read the RESPONSE TEXT, and the response of a leaking call is indistinguishable from a clean one. So these teeth ask the PLANE, not the handler: they try to take the lease afterwards. Busy means leaked. The second defect on the same endpoint was a magic number pair: the lease is held for 300s and the refusal advertised retry_after_s:30, so a caller obeying the advice hammered a lock that could not be free for another 270. Both now render from MA_PROMOTE_LEASE_TTL_S, and a tooth below builds its expected substring FROM THAT SAME CONST -- so the two cannot drift apart again without this going RED. license_tier: ORIGINAL expect_exit: 0 No hw writes (Rule 26).