nx_robot_hal_gate.nx

nx_robot_hal_gate.nx -- R-ROBO-5 GATE: the fail-safe hardware-write driver, never-brick PROVEN MECHANICALLY (the proof #26 demands -- not a promise). VERIFIES: (1) safe-default on init (all outputs 0); (2) clamp HIGH: a huge command lands as exactly HW_SAFE_MAX; (3) clamp LOW: a hugely-negative command lands as exactly HW_SAFE_MIN; (4) pass-through: an in-envelope command lands unchanged; (5) EXHAUSTIVE never-brick: sweep commands incl. extremes (+/-1e9) -- the actual written value is ALWAYS within [HW_SAFE_MIN, HW_SAFE_MAX] (0 escapes -> the mechanical never-brick proof); (6) e-stop latches and forces every output safe (0), and stays safe after; (7) watchdog overrun auto-e-stops (fail-safe on a stalled loop); (8) sensor range-check flags out-of-range readings invalid; (9) NEGATIVE CONTROL: the raw (non-fail-safe) write path DOES escape the envelope -- proving the clamp is what provides the guarantee. 100% sovereign, integer-only. license_tier: ORIGINAL expect_exit: 0