nx_lease_wedge_gate.nx

nx_lease_wedge_gate.nx -- THE LEASE-WEDGE DETECTOR (2026-09-04). WHY THIS EXISTS. On 2026-09-04 all four knowledge/lease/heavyio-slot-N.lock slots were found PERMANENTLY WEDGED. The crawler AND the shard-compactor had been dead for 18 HOURS and NOTHING in the estate noticed: /search kept answering 200, every daemon read UP, and the only symptom was a status log whose mtime stopped advancing. The operator's report was "search still searches nothing". THE MECHANISM, read out of buildroot/runtime/nx_lease_lib.nx rather than guessed. A takeover is arbitrated by mkdir on a monotonic generation: ls_acquire_root parses the stamp, and for a released or expired lease calls ls_claim(dir, owner, ttl, g_nonce + 1, g_nonce + 1), whose FIRST act is if ls_mkdir(dir + "/g" + gate) != 0 { return 0 } // 0 == LOST == "busy" and whose stamp write is a SEPARATE, LATER, NON-ATOMIC step: let tfd = sys_openat_wr(tp, LS_MODE) ... sys_write ... sys_renameat(tp, sp) A process killed between the mkdir and the rename leaves g<N> ON DISK with the stamp still reading N-1. Every later acquirer then re-derives the SAME gate from the SAME stamp, retries mkdir g<N>, gets EEXIST, and correctly reports BUSY -- forever, with no recovery path and no diagnostic. The host bugchecked 3x in 72 h (GPU driver), which is exactly the kill this window needs. THE TEST IS THE FAILING CALL ITSELF, NOT A PROXY. This gate does not ask "does maxdir exceed the stamp"; it asks the one question that decides the outcome: DOES THE DIRECTORY THE NEXT TAKEOVER WILL TRY TO CREATE ALREADY EXIST? That is stat of <lease>/g<stamp_gen + 1>. A proxy could be right for the wrong reason; this cannot. THE PROBE PATH IS NEVER CREATED. Calling mkdir on g<gen+1> to test for it WOULD ITSELF WEDGE THE LEASE -- the detector would manufacture the defect it reports. Existence is read with fstatat and nothing here writes to a live lease, ever. CHECK-BEFORE-BUILD (rule: "I didn't know it existed" is a retrieval failure). nx_spendgate reports presubmit=FREE and nx_capsearch over 7,341 organs (corpus_complete=1) returns nx_lease and nx_lease_probe -- the PRIMITIVE itself -- plus nx_lease_lib and nx_vault_lease. None censuses lease HEALTH; there is no acquire/release verb that can even express "this lease can never be claimed again". This is a new capability, not a duplicate ruler. SCOPE, STATED SO NOBODY TRUSTS IT AS EXACT: this detects the WEDGE. It does not detect a lease held by a dead process (that is a TTL question and ls_acquire already expires it), and it says nothing about whether the holder is making progress. OWED, DELIBERATELY NOT ATTEMPTED HERE: ls_claim mkdir-then-stamp has no crash recovery. Fixing a shared estate-wide mutex is not a safe act under load, and that file own comments record TWO prior attempts at exactly this which wedged it or double-admitted. A detector first is the right order.