nx_undopath_lib.nx

nx_undopath_lib.nx -- DOES EACH DEPLOY TARGET'S REVERSE GEAR REVERSE ITS OWN SUBJECT? THE QUESTION NOTHING ELSE ASKED. nx_deploycover_gate asks whether the deploy plane COVERS the fleet (is there a row at all); nx_deploy_listen_gate asks whether the post-deploy check verified the INCOMING listener. Neither asks the third question in that family: when the row's reverse gear FIRES, does it reverse THIS target -- or somebody else's? MEASURED 2026-09-03, and this is why the lib exists: 16 of 31 rows in deploy_targets.conf declared `rollback` in field 5, and nx_hostctl.cmd_rollback() TAKES NO TARGET ARGUMENT -- it unconditionally renames sites.elf.prev over sites.elf and kills sites.elf. So the declared reverse gear of 16 daemons reverted THE PUBLIC FRONT DOOR and left the bad daemon live. And /api/deploy's health watchdog invokes field 5, so that wrong-subject destruction was AUTOMATIC, not merely a manual footgun. ★THE ESTATE HAD ALREADY DIAGNOSED THIS TWICE BY HAND -- docportal corrected 2026-09-02, comparegw dodging it with a deliberately unknown verb -- with the sentence "every gdeploy row above carries that word" sitting in the same file. A DEFECT NAMED IN A COMMENT BESIDE THE ROWS THAT STILL HAVE IT IS NOT DOCUMENTED, IT IS ADVERTISED. When a comment says "every row above has this", that sentence IS the census and it belongs in an exit code. FOUR STATES, and the fourth is the one that keeps this honest: UP_OWN -- the gear provably acts on this row's own subject. UP_WRONG -- the gear provably acts on a DIFFERENT subject. The finding. UP_FAILSAFE -- the verb is not implemented at all, so the sub is a proven no-op (nx_hostctl's dispatcher tail: hc_puts("unknown subcommand"); sys_exit(2)). comparegw chose this DELIBERATELY, and it is strictly safer than a wrong subject. UP_UNPROVEN -- a verb exists but its subject could not be resolved from source. ABSTAIN, NEVER ACQUIT: an unreadable reverse gear must not read as a correct one. The decision is PURE over already-resolved booleans so a gate can drive every branch without a host, and so /api/deploy can one day REFUSE a wrong-subject rollback at the door using the SAME ruler that censuses it -- one ruler, never two. license_tier: ORIGINAL Read-only. No hw writes (Rule 26). lib (no main)