nx_heavyio_lib.nx

nx_heavyio_lib.nx -- THE HEAVY-I/O CONCURRENCY BOUND, in the PRIMITIVE layer (runtime/) so every bulk-I/O producer can reach it (the seq1450 layering rule: primitives may not import the organ layer). WHY (measured 2026-09-02): the estate's storm ruler nx_ioadmit_lib is an INSTANTANEOUS, PER-CALLER check. The clock scheduler, nx_compare_regen's fork burst, seg-compact, a daemon restart and a seat-launched job EACH read "not stormed" at their own instant and all proceed -- and the storm is their SUM, which none of them individually caused (a TOCTOU / thundering-herd gap). Operator: "this is not sota or best of breed coordination and discipline for hub spoke resource management". A bound must count what is RUNNING across every surface, not what was true at one caller's instant. IT COMPOSES THE TWO INCUMBENTS, NEVER A THIRD RULER: nx_poolgov.pg_width derives K from THIS box (hw budget, PROPORTIONAL squeeze above the load ceiling, fail-safe to wmin) and pg_count_procs counts the running heavy class across every surface; nx_ioadmit_lib.ioa_spawn_budget stays as the storm witness, a SECOND conjunct. Data (rule 11): knowledge/heavyio.conf -- producer <proc-name-needle> one row per heavy-I/O producer (the class this bound governs) slots_per_cpu <n> floor <n> max_centi <n> wmin <n> wmax <n> size the width (reasoning in the conf) hio_decide() is PURE and gate-driven; hio_admit() is the thin /proc wrapper. Three states, never a guess: HIO_ADMIT 1 | HIO_DEFER 0 | HIO_UNOBSERVABLE (-1): conf or /proc unreadable. THE CALLER OWNS THE UNOBSERVABLE POLICY and must NAME it: a periodic beat announces and proceeds (a missing conf must never silence the estate's publishers -- the clock's own ioadmit dispatch check still guards the storm); an interactive spawner may refuse. license_tier: ORIGINAL Read-only. No hw writes (Rule 26). lib (no main)