nx_loadceil_lib.nx

nx_loadceil_lib.nx -- DERIVE THE BUILD-ADMISSION LOAD CEILING FROM THE BOX'S OWN HEALTHY-BEAT HISTORY, function side (LV3, loadgov.plan, 2026-08-24). Split from the CLI so nx_loadceil_gate composes it in-process. Removes a real magic number: the ceiling sits DISABLED at an unreachable max_centiload (mgmt 100000, runner 1000000) because, until nx_resmon began logging load1_centi on every beat, there was no history to calibrate it from. That history is now live (resmon.log carries load1_centi= and state= per row), so the ceiling can be a MEASURED quantile of the loads at which the box was actually GREEN. THE ARITHMETIC THIS COUPLES TO, READ FROM ba_verdict: a build QUEUEs when load1 > max_centiload * BA_HARD_FACTOR (=2). So the STORM TRIGGER is 2*max_centiload; this derives the trigger from a high quantile of GREEN load and reports max_centiload = trigger / BA_HARD_FACTOR. Every ba_verdict failure is a QUEUE (defer), never a hard DENY -- so a mis-calibration defers builds, it cannot brick the lane; the safe direction is UP and this derives a HIGH quantile with the whole distribution returned for audit. NO MAGIC: quantile level and minimum sample are conf rows; LC_HARD_FACTOR is mirrored from the coupled organ and NAMED (the gate asserts recommend*factor == trigger). Below the minimum GREEN sample it REFUSES rather than arm from too little history -- the permanently-red-detector failure the plan's risk row names. GENERALISED 2026-08-25 (lane E). The shape here -- parse a line-oriented log, take a per-line key= integer, filter by a per-line marker, sort, nearest-rank quantile, abstain below a sample floor -- is not specific to load. It is now parameterised (lc_collect_kv / lc_recommend_kv) so a SECOND magic number is killed by the SAME calibrator instead of a second ruler: nx_replyreserve derives edge_window.conf reply_reserve_ms from reply_ms= on lane=sync-promoted actlog rows. lc_collect / lc_recommend / lc_line_green are now thin delegates passing the original literals, so the load-ceiling path is unchanged BY CONSTRUCTION rather than by assertion. Three additions the second caller forced, each a defect the first caller never hit: lc_conf_line_num -- LINE-ANCHORED conf lookup mirroring nx_tool_exec_allow.tea_conf_int, the contract that actually owns knowledge/edge_window.conf. The whole-buffer lc_conf_num is WRONG there: the keys edge_window_ms and reply_reserve_ms both occur inside that file PROSE above their rows, so a first-occurrence scan reads the comment, finds no digits, and silently returns the default. lc_read_tail -- a journal is APPEND-ONLY, so a head read samples its PAST. Measured 2026-08-25: every reply_ms= row sat in the last 25 KB of a 30 MB actlog, and a 4 MB read from offset 0 finds ZERO of them -- an abstention for the wrong reason, from an organ that could then never arm itself. lc_first_int -- first integer ANYWHERE after a key on its line, for space-separated conf rows. license_tier: ORIGINAL