nx_hostctl_keepbackoff_gate.nx

nx_hostctl_keepbackoff_gate.nx -- proves the reader-keeper's respawn CIRCUIT-BREAKER actually engages for the failure mode that really happens. Written because the fix it guards touches a CROWN-JEWEL file (nx_hostctl, the supervisor) and must not ship on "it compiles". THE DEFECT THIS GATE EXISTS FOR (found 2026-07-20 while diagnosing a wedged NAS): cmd_reader_keep counted ONLY fast (<5s) code=1 bind-fails toward its breaker: if sig == 0 { if code == 1 { if life_us < 5000000 { isfast = 1 } } } ...but cmd_reader_keep's OWN header documents the real failure mode as "reliably kills it ~15s later". 15s > 5s, so isfast was never set, fastfails never reached 8, and THE BREAKER WAS DEAD CODE FOR THE ONLY FAILURE THAT ACTUALLY HAPPENS -- an unbounded ~1-per-16s respawn, forever, with no escalation and no give-up. WHY THE POLICY IS MIRRORED HERE RATHER THAN IMPORTED: making nx_hostctl import a new module would leave the supervisor UNBUILDABLE on any host that has not yet received that module -- a deploy trap for a crown-jewel target. So the policy is mirrored, and T7 MECHANICALLY TIES THE MIRROR TO REALITY by reading nx_hostctl.nx and asserting the real thresholds are present. A silent drift between the two therefore FAILS the gate instead of rotting quietly (this is the anti-dup-source discipline). T6 is the liar-killer: it replays the ORIGINAL (fast-only) policy against the observed failure mode and REQUIRES it to fail to escalate. A gate that cannot demonstrate it catches the bug it was written for is decoration. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0