nx_ioconfirm_checked_test_20260907.nx

nx_ioconfirm.nx -- THE CONFIRMED I/O-STORM LEVEL: maintained continuously, read in constant time. Rung DG7, /compare/degradation. WHY THIS EXISTS, MEASURED. The D-state witness that gates every build on this estate reads /proc/stat ONCE. nx_blkprofile sampled 2,400 times at 100 ms on 2026-09-04 and found procs_blocked with median 4 against a bar of 8, p90 8, max 15, and 118 permil of SINGLE samples at or above the bar. So roughly one build in eight is refused by a transient spike on a box whose sustained level is HALF the bar. Two nx_dstate rosters 90 s apart shared only four pids: the D population is mostly churn over a small persistent core. AND THE OBVIOUS FIX IS THE WRONG ONE, WHICH IS THE POINT OF THIS ORGAN. Making the gate take a median AT DECISION TIME is already built and wired (ioa_measure_median, armed by two keys in build_admit.conf) and the same run shows why it must not be armed: the refusal curve is STILL FALLING at a 12,000 ms span (118 -> 36 permil) and has not flattened, so any span wide enough to help costs SECONDS on EVERY admission check -- the clock dispatcher's pre-dispatch call included. That does not remove the stall, it relocates it onto every caller. build_admit.conf refuses arming for exactly this reason and asks for the cost to be measured first. It now has been, and the answer is no. THIS IS THE AEROSPACE ANSWER INSTEAD. Flight control does not confirm a fault inside the control law; a monitor confirms CONTINUOUSLY and the law reads an already-confirmed state. So: a beat pays the whole confirmation window once per cadence, off the critical path, and every consumer reads one small file in constant time. The window costs the beat its span and costs the consumer nothing. FRESHNESS IS PART OF THE ANSWER, NOT A FOOTNOTE. A stale level is WORSE than none: it decides with authority about a box it last saw minutes ago. `read` returns FRESH, STALE and ABSENT as three distinct exits so a consumer that cannot get FRESH falls back to its own single sample -- degrade to the incumbent, never acquit on a reading nobody took. KEY NAMES ARE DELIBERATELY NOT build_admit.conf's. That conf is parsed by PLAIN SUBSTRING with no comment handling, and its own header records a measured incident where prose describing a key ARMED it. This file uses confirm_samples and confirm_gap_ms so its bytes can never be mistaken for that envelope. COMPOSES, DOES NOT RE-IMPLEMENT: ioa_measure_median is the same sampler nx_build_admit would use if it were armed, so the level published here is the level that gate would have computed -- one ruler, not two.