nx_self_build.nx

nx_self_build.nx -- the 3-tier SELF-BUILD POLICY + the reversible-modify transaction (snapshot -> write -> re-gate -> AUTO-ROLLBACK). THE NET BEFORE THE TRAPEZE. Before the engine is ever pointed at a real source file, this organ proves -- on a DELIBERATE failed write -- that a reversible modify either lands gated-green OR is rolled back BYTE-IDENTICAL to the pre-write snapshot. A rollback you have not proven on a deliberate failure is not a safety net. ============================================================================ THE OPERATOR'S 3-TIER POLICY (the spec): TIER 1 ADDITIVE : new file / append / soft-flag is_current=0 -> ALLOW autonomously (cannot break existing code). TIER 2 REVERSIBLE : overwrite an existing file -> ALLOW only via SNAPSHOT -> WRITE -> RE-GATE -> AUTO-ROLLBACK on failure. No breaking without a proven, byte-identical rollback. TIER 3 DESTRUCTIVE: delete / drop / overwrite WITHOUT backup / truncate history -> DENY + require explicit operator confirm (Cardinal #13 additive-only). FAIL-CLOSED on unknown. ============================================================================ ADDITIVE-OVER-WARDEN: the classifier never WEAKENS any warden verdict. It can only refuse where warden refuses, or ADD the rollback discipline on top of an overwrite that warden hard-denies. Warden stays the single source of cardinal-truth; this is a pure composition layer (no edit to nx_warden_lib). CRASH-SAFETY (the headline trap defended): every destructive write is done write-temp -> fsync -> renameat2 (atomic on the same fs), NEVER truncate-in- place. The ORIGINAL is never mutated until the new version is published; on a gate-fail we restore from a DURABLE on-disk snapshot (not RAM-only) via the same atomic path, then VERIFY the restored bytes rehash to the snapshot hash. RE-GATE DECOUPLING (avoids the gate-runner's hardcoded /tmp scratch-path collision under concurrent ticks, AND keeps this module free of the heavy fork+exec re-gate dependency). The transaction is TWO-PHASE: nx_self_build_begin(txn) : snapshot (durable) -> journal INTENT -> atomic-write the new bytes. The new file now sits on disk for the caller to GATE. <caller runs its gate on `target`> (prod: nx_gate_runner.gr_gate;