nx_build_admit.nx

nx_build_admit.nx -- BUILD ADMISSION CONTROL (the missing gate that let the fleet wedge the host). INCIDENT 2026-07-20: ~10 concurrent sessions were compiling at once (registry grew 198->236 GREEN tools in ONE session). Every /api/build forks nx_cc_sovereign (549KB) on a memory-limited Synology and NOTHING serialized or admitted them -> the NAS went userspace-wedged (sshd could not complete a banner, DSM could not serve a page, every sovereign daemon refused TCP) and then off the network entirely. Measured, not guessed. nx_swarm_admit ALREADY documents itself as the gate "BEFORE any heavy launch (model decode, codec, image-gen, BIG BUILD)" -- but /api/build never called it. A compile IS a heavy launch. This organ is the build-shaped admission verdict, with ZERO deps beyond nx_syscalls so it can never itself be the thing that fails under load. LIAR-KILLED: every number is read live from /proc on the host being protected -- no estimate, no cache. MemAvailable from /proc/meminfo (the honest figure: reclaimable included, unlike MemFree) 1-minute load from /proc/loadavg, carried as CENTI-load (integer; no floats, sovereign law) nx_build_admit check [floor_mb] [max_centiload] exit 0 GRANT -- headroom exists, compile now exit 3 DENY-LOAD -- below the memory floor; compiling now risks wedging the HOST, not just the build exit 4 QUEUE -- load above the ceiling; hand to nx_orchestrate wait-for-opening and come back exit 2 usage | 5 unreadable /proc (fail-CLOSED: cannot measure => cannot admit) COMPOSES (does not duplicate): the QUEUE verdict is designed to be absorbed by nx_orchestrate's wait-for-opening deploy queue -- the same anti-collision primitive shipped this session, pointed at COMPUTE instead of deploys. The structural half is mgmt-owned: ma_do_build must consult this BEFORE forking the compiler (filed rung) -- until then this is the session-callable discipline half, same two-tier pattern as nx_route_diff/nx_tooldiff (detector live, enforcement filed). FAIL-CLOSED BY CONSTRUCTION: an unreadable /proc returns exit 5, never GRANT. A guard that cannot measure must refuse, never wave through -- the same law as an instrument that must not score bytes it did not fetch. ENVELOPE (declared in output): 64KB per /proc read; thresholds are NAMED CONSTS (rule-11) and argv-overridable. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0