nx_ingest_admit.nx

nx_ingest_admit.nx -- INGEST ADMISSION CONTROL (/compare/mediaingest R2; contract symbol ig_disk_floor). WHY: a capture path that writes an asset onto a filesystem below its free-space floor risks a TORN write -- a half-written file that then classifies as a real item. Harvestr guards this with min_disk_gb plus a disk manager; ours had the disk axis (sys_fs_avail_bytes, landed in nx_syscalls 2026-08-27) and NOTHING in the capture path read it. This is the one admission check every capture verb calls before it opens a destination. THREE STATES, because "I could not measure the disk" is not "the disk is fine": IG_ADMIT the volume holding <root> has at least <floor> bytes free to a non-root writer IG_REFUSE_FULL measured, and below the floor -- the capture must not write IG_UNMEASURABLE statfs failed (unmounted / permission / gone) -- FAIL-CLOSED: the caller must refuse, because "unmeasurable" read as "empty" is the most flattering possible lie (nx_syscalls says so of the permil twin). A transient statfs failure blocking one capture is safe; a torn write is not. The floor is DATA (rule 11): knowledge/status/ingest_floor.conf holds a single decimal byte count; absent or unreadable falls back to IG_DEFAULT_FLOOR_BYTES, named for its purpose, never buried as a literal at a call site. license_tier: ORIGINAL