nx_build_admit_gate.nx

nx_build_admit_gate.nx -- proves the build-admission verdict ADMITS and REFUSES for the right reason. THE DEFECT THIS GATE EXISTS FOR (measured 2026-07-30): nx_build_admit gated a CPU-bound compile on /proc/loadavg field 1, which on Linux counts tasks in R *and* D state. On this host the OS itself split a load1 of 8.33 into IO=3.75 / CPU=4.58 across 8 cores -- 43% of the CPU idle -- and the build was REFUSED. nx_procchurn agreed independently (procs_blocked>=1 with procs_running 3-6: "I/O or lock bound, NOT compute; more CPU would not help"). Every seat's builds were refused on DISK WAIT, and because the fix for the churn is itself a build, the ecosystem could not repair itself through the mgmt API path. THE FIX: a QUEUE verdict must be CONFIRMED by procs_running from /proc/stat -- the TRUE run queue (R only, D excluded). It can only ever admit MORE builds, never fewer, and only when the run queue itself says the CPUs are free. The memory floor remains the ONE unconditional block: it is the measured 2026-07-20 wedge cause, where userspace could not fork at all. Tests execute the imported production policy. The compiler resolves this entry point over the imported module main; no copied policy or substring scan can substitute for execution. Source scans below check textual contracts only, not behavioral equivalence. T8 is the liar-killer: it replays the ORIGINAL loadavg-only policy against the EXACT case the fix was written for and REQUIRES it to refuse. T2 and T8 are the same inputs through the new and old policies: if the fix is ever reverted, T2 fails; if T8 ever stops refusing, this gate is not testing the defect. A gate that cannot demonstrate it catches its own bug is decoration. MIGRATED 2026-08-19 onto nx_gate_verdict (per-tooth gv_check, gv_verdict carries the verdict in the exit code, gv_journal writes the shared gate journal) -- the hand-rolled pass/total pair could print RED and exit 0, and a tooth that silently stopped running lowered both numbers and still read GREEN. The fixture numbers are NAMED for what they measured (rule 11): they are real readings from the incidents the teeth replay, not tuning knobs, and a reader must be able to see which incident each tooth is replaying. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0