nx_ioadmit_gate.nx

nx_ioadmit_gate.nx -- referee for nx_ioadmit_lib, the I/O-storm admission ruler every I/O spawner (first consumer: nx_torrent_daemon) asks before adding uninterruptible I/O to the shared array. It gates the SAME functions the daemon runs (nx_ioadmit_lib.nx), not a reimplementation. The budget arithmetic is tested as a pure function on synthetic inputs (deterministic, no box state needed); the /proc readers are tested against the live kernel (any Linux answers) plus a fixture parse so the parser is proven on bytes whose answer is KNOWN, not merely "something came back". THE TEETH THAT MATTER: T3/T4 pin the two numbers that make this a ruler and not a wish: the storm line clamps the budget to ZERO (never negative, never "a little over"), and the reserve slot is LOAD-BEARING -- drop it and the spawner becomes the process that crosses the line. T5 is the THIRD STATE: unobservable inputs return IOA_UNREADABLE, never a budget. A caller that reads -1 as "minus one worker" would be the fabrication this estate forbids; the daemon names its own fallback (D_UNOBS_SPAWNS) and this tooth proves the lib never invents one. T7 neg-control: a comm nobody runs counts 0 -- a counter that returns >0 for a nonsense name is counting something other than the name. T8 positive control: the gate's OWN comm (read from /proc/self/comm, not assumed) counts >= 1, so the /proc walk is proven to SEE a running process, not just to return without error. T9 bite: the ruler FIRES at the storm line and stays SILENT with headroom -- proven in one cell. license_tier: ORIGINAL expect_exit: 0