nx_shipjoin_gate.nx

nx_shipjoin_gate.nx -- THE REFEREE for nx_dora `shipjoin` (DM6, devmgmt rung). END-TO-END: forks the DEPLOYED nx_dora elf, so it grades the artifact callers run. The accept rule, verbatim from devmgmt.plan: "deploy-frequency and lead-time computed from organ_ship.jrnl match a hand count over one week of journal." A hand count is only possible if every joined row is PUBLISHED, so the first thing this gate asserts is that the per-row worklist exists at all -- an average with no rows behind it cannot be checked by anybody. The fixture is built to break the three joins that would each produce a confident wrong number: * INTERLEAVING -- another target is BUILT between alpha's build and alpha's ship, so a join that takes "the previous BUILD row" instead of "the previous BUILD row FOR THIS TARGET" reports lead=15 where the truth is 20. Both numbers look plausible; only the fixture separates them. * AN UNMATCHED SHIP -- a SHIPPED with no BUILD for its target. Averaging over a set you cannot reconstruct is how a lead time stops being auditable, so it must land in its own bucket. * A REFUSAL COUNTED AS A FAILURE -- a refused ship never reached production. Naming it a change-failure inverts the sign of the one metric an operator reads as bad news. Plus a row before the window (must not be counted), and a malformed row (must be COUNTED as unparsed, never silently dropped -- a parser that discards in silence reports a smaller, cleaner, wrong population). The window anchor is asserted explicitly: window_end must equal the FIXTURE'S newest epoch, which is years away from wall clock, so a gate that passed on a clock-anchored implementation could not. Fixtures live under /tmp/nx_shipjoin_gate/ and are rewritten O_TRUNC each run (idempotent). license_tier: ORIGINAL Read-only outside /tmp. No hw writes (Rule 26).