nx_dispatch_lease_gate.nx

nx_dispatch_lease_gate.nx -- the REFEREE for WMS rung M4 (leasing dispatcher). module: nishi-core.autonomy.dispatch_lease_gate capability: GATE (prints a VERDICT computed from REAL checks; incl negative control) PROVES (the gate requirement, exactly): T1 picks-READY -- dl_pick_ready returns the highest-w READY rung, never blocked T2 dispatch-leases -- dl_dispatch leases that rung (fd>=0, id matches, lease file exists) T3 second-dispatch-DENIED -- a 2nd dl_try_lease on the SAME stream returns -1 (the collision proof: two workers cannot hold one stream) T3b keep-moving -- a fresh dl_dispatch while the top is leased returns the NEXT ready stream (not the blocked one, not a stall) T4 NEG CONTROL -- a deliberately BLOCKED stream (unmet dep) is NEVER dispatched: dl_ready==0 AND no dispatch ever returns its id T5 release-then-redispatch -- after dl_release the same stream leases again (fd>=0): proves it is a LEASE (releasable), not a permanent mark T6 TAMPER -- (a) fa_append oversize -> -2 (durability rejects, never torn) (b) a stale lease (epoch older than DL_STALE_SEC) is STOLEN (fd>=0) -- a dead worker's lease cannot wedge the machine VALIDITY (why the neg-control genuinely bites): if dl_pick_ready ignored an_deps_done it would return G-BLOCKED -> T1/T4 RED. If dl_try_lease used plain open not O_EXCL, T3 would return fd>=0 (collision) -> RED. If dl_release didn't unlink, T5 would stay -1 -> RED. HERMETIC: the gate WRITES its own scratch queue to /tmp/dlg_<ms>.tsv (9-field rows, same grammar) and uses a fresh scratch lease dir /tmp/dlg_<ms>/ -- it NEVER touches production. <ms> = sys_now_realtime_ms() so two concurrent gate runs never share lease state. WRITE DISCIPLINE: every evidence record (one buffer -> one locked fa_appendz) to knowledge/status/dispatch_lease_gate.log -- eating our own dogfood (the torn-line floor). license_tier: ORIGINAL