nx_staghyg.nx

nx_staghyg.nx -- STAGING-AREA HYGIENE: census, verdict, and expiry for the deploy queue. THE MEASURED PROBLEM (debt 1785531571, sev-9): the staging area has no expiry, so a .new file that PREDATES the live binary it would replace sits there looking deployable forever. Promoting it is a ROLLBACK WEARING AN UPGRADE FILENAME. Nothing in the tree measured this per-artifact, and nothing refused it at the moment of promote. FOUR VERBS, DELIBERATELY SEPARATED (Rule 9 -- each does ONE thing): census [root] report size+mtime for BOTH sides and DECIDE NOTHING. This is the rung-0 instrument, modelled verbatim on nx_tree_diff, whose banked lesson is that a tool which picks a direction is the clobber bug with a friendlier face. scan [root] the classified verdict: every staged artifact bucketed, counts that SUM. check <livepath> one target. exit 0 = promotable, exit 3 = refused. The gate/promote surface. expire [root] apply disarm artifacts past the expiry window. *EXPIRY RENAMES, IT NEVER DELETES. An expired artifact becomes <name>.new.expired-<epoch>, which md_promote_staged can no longer see (it opens exactly <name>.new) -- so the queue is disarmed while every byte is kept and the act is reversible with a single rename back (Rule 13 additive-only, Rule 26 fail-safe by construction). Without `apply` it only reports. *THE CENSUS COUNTS THE HEALTHY ROWS TOO. An instrument blind to the common case only ever sees crises -- the banked crawler lesson. FORWARD and ORPHAN are reported beside every refusal, and the class counts are printed so a reader can check they SUM to the number scanned (a partition is a claim). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0