nx_gate_roster_run.nx

nx_gate_roster_run.nx -- THE DATA-DRIVEN GATE ROSTER BEAT: run every gate named in a conf, on the clock, with a deadline, and journal each verdict -- so a promoted gate nobody runs becomes a gate whose verdict is COLLECTED, by adding ONE LINE OF DATA rather than a rebuild. WHY (campaign lane B, 2026-08-18): nx_gateadjudicate measured 3,235 gate sources on the NAS, 919 promoted, and 780 DEPLOYED-DARK -- promoted binaries that no clock row, roster organ, .gates map, gatereg row or MCP call ever runs. The estate's law: "a gate nobody runs does not degrade to neutral -- it degrades to a false sense of coverage, because its existence is counted and its verdict is not." The wiring vehicle that already exists, nx_gfx_gates_beat, is CORRECT in shape (bounded runner, per-gate journal line, ABSENT reported never skipped) but its roster is EIGHT NAMES IN CODE, so admitting a ninth gate is a rebuild. Rule 11/17: rosters are DATA. This organ is that beat with the roster moved to a conf; nx_gfx_gates_beat is the precedent, not a duplicate -- its eight rows can migrate here whenever its owner chooses. ROSTER CONF (default knowledge/gateroster.conf), one gate per line: <gate-name> runs ./<gate-name>.elf from the estate root ; comment / blank ignored (also lines whose first byte is the hash mark) A gate is ADMITTED to the conf only after a TRIAL run has come back GREEN or SKIP -- adoption is not blind wiring, and this organ has a `trial` verb for exactly that: nx_gate_roster_run REFUSED (exit 2): argless mutates NOTHING and prints usage. The beat must NAME its verb -- every proof tool in the estate probes an organ argless, so an argless default that runs the beat makes this organ unprovable and lets a staged binary write production state. nx_gate_roster_run beat [conf] [journal] [ms] the beat. A conf OR journal other than the production defaults writes its heartbeat BESIDE its own journal (<journal>.stamp, announced) and never to the cron-watched production stamp. nx_gate_roster_run trial <listfile> [journal] [ms] run every gate in <listfile> ONCE, journal under tag "trial"; exit 0 always (a trial reports, it does not judge the fleet) nx_gate_roster_run admit <journal> <deadline_ms> [conf] [suspectlist=<conf>.suspect] The journal->conf bridge, so admission is MECHANICAL, never hand-filtered: take the LATEST row per gate; GREEN/SKIP with ms < deadline_ms -> merge-ADD into the conf (additive, rule 13: admission never removes -- a beat RED is an alarm to read, not a row to erase); GREEN with ms >= deadline_ms -> SUSPECT, written to [suspectlist] and NOT admitted. The suspect class exists because journals written before 2026-08-18 came from a runner that returned exit 0 for a watchdog-KILLED child, so a legacy at-deadline GREEN is a timeout wearing a pass; the fixed runner reports 137 and those rows say TIMEOUT, making this class empty going forward. deadline_ms is REQUIRED (it is the value the trial ran with, from its own header line) --