nx_degmode_gate.nx

nx_degmode_gate.nx -- THE GATE FOR GRACEFUL DEGRADATION, 2026-09-03. SUBJECT: dm_admit / dm_class_of / dm_deferral_state / dm_recover in-process. Pure functions over declared inputs, so this gate is deterministic on any host and never reads the live box -- which matters because the live box is currently IN the degraded state, and a gate that read it could not be told apart from one hardcoded to agree. T4 IS THE POSITIVE CONTROL AND IT IS LOAD-BEARING. T2/T3 assert that work is DEFERRED, and a ladder that deferred everything would pass both. T4 requires every class to be admitted when health is GREEN, so the deny teeth can only pass on a ladder that actually discriminates. T5 IS THE `pr_mode` DEFECT, CAUGHT IN ADVANCE. The live estate has a route table where an unrecognised mode silently returns the PERMISSIVE value, so a mistyped `gated` downgrades a fail-closed route to an open one with no diagnostic. T5 requires an UNDECLARED target to resolve to the LEAST essential class -- the restrictive direction -- and T6 requires that default to be DISTINGUISHABLE from a real declaration, so a caller can say it defaulted rather than silently apply it. T10 IS THE STEADY-STATE GUARD, AND IT IS THE ONE MOST LIKELY TO BE LEFT OUT. A host that was never degraded produces an all-GREEN sample window; a recovery detector that fires on that would re-arm something that never went down. Requiring evidence of a prior fault is what makes the edge an EDGE. T11 IS THE FLAP GUARD, WHICH THE ESTATE'S OWN RECORD DEMANDS: in the Oct-2025 us-east-1 event, health checks alternating between failing and healthy drove automatic failover that removed HEALTHY capacity, and the fix that worked was disabling the automation. An alternating window must NOT read as recovered. Teeth, in order: T1 RED admits E1 restore-capability work -- the whole point of not grounding. T2 RED defers E3 bulk work. T3 AMBER admits E2 but defers E3, so the ladder has three distinct behaviours and not two. T4 POSITIVE CONTROL: GREEN admits every class. T5 an UNDECLARED target resolves to the LEAST essential class, never the permissive one. T6 the undeclared default is DISTINGUISHABLE from a declaration (0 vs a real class). T7 a declared class is read exactly, and an exact-name rule does not leak across a prefix. T8 UNOBSERVABLE ABSTAINS FROM TIGHTENING: it admits every class rather than blocking a host that simply has no such cache. The caller's load bar is untouched and still applies. T9 the MEL clock: within the category it is LIVE, past it EXPIRED, and category A is UNSET. T10 STEADY-STATE GUARD: an all-clear window with no prior fault is NOT a recovery. T11 FLAP GUARD: an alternating window is NOT a recovery. T12 the empty-set denominator: too few samples cannot answer the question at all. T13 ANTI-VACUITY: a genuine RED-then-clear edge DOES recover, so T10-T12 are not passing on a