nx_supervised_dispatch_gate.nx

nx_supervised_dispatch_gate.nx -- the REFEREE for WMS rung M5 (supervisor binding). module: nishi-core.autonomy.supervised_dispatch_gate capability: GATE (prints a VERDICT computed from REAL checks; incl negative control + tamper) PROVES (the gate requirement, exactly): T1 dispatch-binds -- M4 picks+leases a READY rung -> M5 forks a REAL supervised child (dl_dispatch fd>=0 AND sd_spawn pid>0 AND job.state==RUNNING) T2 limit-applied -- the job is resource-LIMITED (Job-Object-with-a-limit): a child caps ITSELF via nx_prlimit(RLIMIT_AS) and the cap reads back == SD_AS_LIMIT (proven by an in-organ probe child that exits with a code that ENCODES "limit stuck", reaped here -- no fabrication) T3 beats-while-alive-- a supervised job emits a heartbeat: hbm_scan at a fresh `now` sees the spawned ws == HB_ALIVE (stalled==0) T4 kill->stalled -- KILL the supervised job (nx_kill SIGKILL); advance injected `now` past the threshold -> hbm_scan sees the missing heartbeat == HB_STALLED (stalled==1). M1 detects the death. T5 restart/reassign -- M5 restarts on the stall (the kernel/OS payoff): sd_supervise_tick returns ACTION_RESTART(1), job.pid is NEW (!= killed pid), restarts==1, and the fresh beat -> next hbm_scan == HB_ALIVE = PROVEN BY A SECOND SUPERVISED RUN. T6 NEG CONTROL -- a job that COMPLETES NORMALLY is NOT restarted (no thrash): spawn a CLEAN payload, reap its exit(0) (state==EXITED_OK); then sd_supervise_tick returns ACTION_NONE(0), restarts stays 0, no new pid. A buggy M5 that restarts on "pid not alive" FAILS HERE. T7 TAMPER -- restart storms are BOUNDED: drive 4 consecutive stalls (> SD_MAXRESTART=3) -> tick returns ACTION_ESCALATE(3), no further respawn = no infinite restart loop / car-alarm. VALIDITY (why the neg-control genuinely bites): T4 and T6 ride the SAME sd_supervise_tick/hbm_scan path with OPPOSITE stimuli -- a killed job (no fresh beat -> STALLED -> RESTART) vs a cleanly-exited job (state==EXITED_OK -> NONE). If M5 ignored the heartbeat it FAILS T4; if it restarted on every dead pid it FAILS T6. The two lanes cross-check the restart predicate exactly as the M1 gate cross-checks STALLED vs ALIVE. HERMETIC: own scratch heartbeat channel /tmp/sdg_<ms>.log + scratch queue /tmp/sdg_<ms>.tsv + lease dir /tmp/sdg_<ms>/ (mirrors the M4 gate's g_scratch_paths). Time is INJECTED (now/threshold = gate consts) so it is deterministic and re-runnable. WRITE DISCIPLINE: every evidence record = ONE buffer -> ONE locked fa_appendz to