nx_degmode_lib.nx

nx_degmode_lib.nx -- GRACEFUL DEGRADATION AS A DECIDABLE FUNCTION, NOT A GROUND STOP. WHY THIS EXISTS (operator, 2026-09-03, after a day in which every build was refused): "research as of september 2026 what estates do like the military when functionality is degraded to still get the best they can get till hardware is avilable and then have it automatically recover". WHAT THE FIELD DOES, AND WHAT WE WERE DOING INSTEAD. The estate's admission is ONE load bar applied to ALL work: `ba_verdict` returns GRANT or QUEUE and carries NO priority concept (grepped, absent). So a one-line restore-capability fix and a 600-domain census sweep received the identical answer. That is a GROUND STOP, and grounding for every defect is the exact failure mode the field's doctrine exists to avoid: - Safety-systems doctrine: graceful degradation means the priorities, triggers and behaviours are designed UP FRONT and verified, so the degraded state is DELIBERATE AND AUDITABLE, not accidental. Ours was accidental -- no declared class, no clock, no exercise. - Aviation's Minimum Equipment List: an aircraft is DISPATCHED with named items inoperative under named limitations, and every deferral carries a REPAIR CATEGORY WITH A CLOCK (A specified, B 3 days, C 10 days, D 120 days). Permitted dispatch becomes a CONTROLLED DEFERRAL; only an impermissible one grounds the aircraft. Our defect ran ~a day with no category and nothing counting, which is how a day passes without anyone deciding. - Degraded-ops training doctrine: workarounds are learned in an exercise, not on the battlefield. Our degraded path had never been exercised, which is why that day was archaeology. THE THREE DECISIONS THIS LIB MAKES, and each is DATA rather than a literal (rules 11 and 17): dm_admit(class, health) -- shed by ESSENTIALITY instead of shutting the door on everyone dm_deferral_state(age, limit) -- the MEL clock, so a degraded state cannot run silently forever dm_recover(samples, ...) -- the automatic re-arm, with the flap guard the field insists on THE CLASS IS AN EXPLICIT DECLARATION, NEVER A NAME MATCH. This estate has been bitten repeatedly by classifiers keyed on a name substring (a DAEMON read as a gate because of a `_gate` suffix; a gate fleet invisible because it is declared `oracle`), and its own conclusion each time was that the fix is an explicit declaration, never a rename. So dm_class_of reads a declaration table and an UNDECLARED target gets DM_E3 -- the LEAST essential class -- and that default is ANNOUNCED by dm_class_declared rather than silently applied. An unknown input must never resolve to the PERMISSIVE value: that is exactly the live `pr_mode` defect, where a mistyped route mode silently downgrades fail-closed to open. UNOBSERVABLE ABSTAINS FROM TIGHTENING, IT DOES NOT ACQUIT AND IT DOES NOT BLOCK. Most hosts have no flashcache at all, so treating IOADM_UNOBS as RED would refuse every build on every machine that never had the fault -- a false-positive generator that everyone would disable within a day. This axis therefore contributes NOTHING when it cannot see: dm_admit returns admit for every class, and the CALLER'S EXISTING LOAD BAR IS UNCHANGED AND STILL APPLIES. The axis declining to