nx_staging_guard_candidate_t296.nx

nx_staging_guard.nx -- REFUSE A PROMOTE THAT WOULD WALK A TARGET BACKWARDS. WHY (measured 2026-08-06): the deploy queue is armed to destroy work. md_promote_staged already carries md_prov_ok, which refuses a promote whose CONTENT this target ALREADY HELD (seq1484). That guard is blind to the COMMON CASE: a staged .new that was never itself promoted is a FIRST SIGHTING, so md_prov_ok records it as the baseline and returns ALLOW -- even when the staged file PREDATES the live binary it would replace. A .new older than its live .elf is not a pending upgrade, it is A ROLLBACK WEARING AN UPGRADE FILENAME, and nothing in the staging area marks it as one. It sits there looking deployable forever. *SIZE IS A SCREEN, NOT PROOF (nx_treecanon_gate:15, and the banked law: a byte DECREASE after an addition is a REVERT). A legitimate refactor can shrink a binary, and an operator-swap fix is BYTE-IDENTICAL. So this module never decides on size alone: it also measures CAPABILITY-TOKEN LOSS -- how many long printable tokens present in the LIVE binary are ABSENT from the staged one. That is the honest reading of would-lose-capability; size is only the cheap first screen. (2026-08-18: that sentence became TRUE IN CODE, not only in prose -- see the SHRINK note in sg_classify. Whole-program DCE in nx_cc made "smaller" the normal direction of every rebuild.) *IT REFUSES, IT NEVER DELETES. Every verdict is fail-closed and reversible: a refusal leaves live, .prev and the staged file untouched (Rule 13 additive-only, Rule 26 never-brick). Nothing in this module writes persistent state of any kind. *THRESHOLDS ARE DATA (Rule 11), read from knowledge/staging_hygiene.conf; the consts below are bootstrap defaults only, and every one of them is overridable without a rebuild (Rule 17). DIALECT: this module is IMPORTED by nx_mgmt_data -> nx_mgmt_api, so it must compile under today's hub compiler: plain-if (NO else -- seq533 desyncs the imported parser), no empty string literals (seq907 aliases the next literal), <=6 params (seq239). ONE implementation, every consumer (Rule 15) -- a guard that only the CLI imports is not a guard the deploy plane has. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0