nx_build_admit.nx

nx_build_admit.nx -- BUILD ADMISSION CONTROL (the missing gate that let the fleet wedge the host). INCIDENT 2026-07-20: ~10 concurrent sessions were compiling at once (registry grew 198->236 GREEN tools in ONE session). Every /api/build forks nx_cc_sovereign (549KB) on a memory-limited Synology and NOTHING serialized or admitted them -> the NAS went userspace-wedged (sshd could not complete a banner, DSM could not serve a page, every sovereign daemon refused TCP) and then off the network entirely. Measured, not guessed. nx_swarm_admit ALREADY documents itself as the gate "BEFORE any heavy launch (model decode, codec, image-gen, BIG BUILD)" -- but /api/build never called it. A compile IS a heavy launch. This organ is the build-shaped admission verdict, with ZERO deps beyond nx_syscalls so it can never itself be the thing that fails under load. LIAR-KILLED: every number is read live from /proc on the host being protected -- no estimate, no cache. MemAvailable from /proc/meminfo (the honest figure: reclaimable included, unlike MemFree) 1-minute load from /proc/loadavg, carried as CENTI-load (integer; no floats, sovereign law) nx_build_admit check [floor_mb] [max_centiload] exit 0 GRANT -- headroom exists, compile now exit 3 DENY-MEM -- below the memory floor; compiling now risks wedging the HOST, not just the build exit 4 QUEUE -- a pileup a compiler fork would deepen. THIS ORGAN QUEUES NOTHING ITSELF; whether the build is absorbed is the CALLER's answer. /api/build absorbs it (nx_buildq -> plan-build-<t>- + deployq BQ-<t>, fired by nx_orchestrate on headroom) and reports queue_launch_rc; a DIRECT caller of this detector must re-issue itself, paced. exit 2 usage | 5 unreadable /proc (fail-CLOSED: cannot measure => cannot admit) ✅THE ABSORBER SHIPPED, AND SO DID THE STRUCTURAL HALF -- BOTH CLAIMS THIS PARAGRAPH USED TO MAKE WERE STALE, and they are corrected here from the CODE rather than from belief (re-measured 2026-08-20). The sentence they justified was still telling every reader NOTHING IS QUEUED long after that stopped being true: this organ was committing the exact defect it exists to prevent -- A GOVERNOR EXPLAINING ITSELF WRONGLY IS WORSE THAN A GOVERNOR WITH NO EXPLANATION, because the reader acts on the sentence. (1) ma_do_build DOES consult this BEFORE forking the compiler: it calls md_exec_build_admit() and branches on exit 3 (DENY-MEM -> 503) and exit 4 (QUEUE). The "filed rung" is CLOSED. (2) The wait-for-opening absorber EXISTS: nx_buildq seeds plan-build-<target>- plus a deployq BQ-<target> row whose `headroom:` precondition nx_orchestrate evaluates by forking THIS organ, then fires the build on its first pass with headroom. Proven end to end 2026-08-20: one call returned PUT 1 rows=1 / PUT BQ-<t> rows=18 / BUILDQ QUEUED. (3) THE ONE THING THAT REALLY WAS BROKEN WAS AN ADOPTION GAP, NOT A MECHANISM. /api/build launches the enqueue through nx_job_run, which refuses any name that is not an unpinned GREEN row in tool_allowlist.conf -- and nx_buildq was PROMOTED-UNREGISTERED. That refusal IS nx_job_run's exit 4, and it is the queue_launch_rc=4 recorded in debt 1787178882 alongside a MISSING deployq row and an ABSENT capture file. The launcher was correct; the absorber was uncallable. One /api/tools/register closed it. ★A LAUNCHER'S REFUSAL OF AN UNREGISTERED ORGAN IS