nx_build_admit_gate.nx source

1// nx_build_admit_gate.nx -- proves the build-admission verdict ADMITS and REFUSES for the right reason. 2// 3// THE DEFECT THIS GATE EXISTS FOR (measured 2026-07-30): nx_build_admit gated a CPU-bound compile on 4// /proc/loadavg field 1, which on Linux counts tasks in R *and* D state. On this host the OS itself split 5// a load1 of 8.33 into IO=3.75 / CPU=4.58 across 8 cores -- 43% of the CPU idle -- and the build was 6// REFUSED. nx_procchurn agreed independently (procs_blocked>=1 with procs_running 3-6: "I/O or lock bound, 7// NOT compute; more CPU would not help"). Every seat's builds were refused on DISK WAIT, and because the 8// fix for the churn is itself a build, the ecosystem could not repair itself through the mgmt API path. 9// 10// THE FIX: a QUEUE verdict must be CONFIRMED by procs_running from /proc/stat -- the TRUE run queue (R 11// only, D excluded). It can only ever admit MORE builds, never fewer, and only when the run queue itself 12// says the CPUs are free. The memory floor remains the ONE unconditional block: it is the measured 13// 2026-07-20 wedge cause, where userspace could not fork at all. 14// 15// Tests execute the imported production policy. The compiler resolves this entry point 16// over the imported module main; no copied policy or substring scan can substitute for execution. 17// Source scans below check textual contracts only, not behavioral equivalence. 18// 19// T8 is the liar-killer: it replays the ORIGINAL loadavg-only policy against the EXACT case the fix was 20// written for and REQUIRES it to refuse. T2 and T8 are the same inputs through the new and old policies: 21// if the fix is ever reverted, T2 fails; if T8 ever stops refusing, this gate is not testing the defect. 22// A gate that cannot demonstrate it catches its own bug is decoration. 23// 24// MIGRATED 2026-08-19 onto nx_gate_verdict (per-tooth gv_check, gv_verdict carries the verdict in the exit 25// code, gv_journal writes the shared gate journal) -- the hand-rolled pass/total pair could print RED and 26// exit 0, and a tooth that silently stopped running lowered both numbers and still read GREEN. The fixture 27// numbers are NAMED for what they measured (rule 11): they are real readings from the incidents the teeth 28// replay, not tuning knobs, and a reader must be able to see which incident each tooth is replaying. 29// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 30import "nx_build_admit.nx" 31import "nx_syscalls.nx" 32import "nx_gate_verdict.nx" 33 34// The real detector's source, looked up from BOTH working directories this gate is forked from: 35// nx_sov_build_run runs it with CWD=buildroot (runtime/...), /api/gate_run with CWD=nishihost 36// (buildroot/runtime/...). Measured 2026-08-19: under gate_run every source-scan tooth went RED with a 37// perfectly good source on disk -- a gate reporting on its OWN cwd in the same word as a real defect. 38const BG_SRC: *u8 = "runtime/_hdl_build/nx_build_admit.nx" 39const BG_SRC_UP: *u8 = "buildroot/runtime/_hdl_build/nx_build_admit.nx" 40// T22's subject: the CALLER whose paraphrase contradicted this ruler (2026-08-21). 41const BG_CALLER: *u8 = "runtime/_hdl_build/nx_sov_build_run.nx" 42const BG_CALLER_UP: *u8 = "buildroot/runtime/_hdl_build/nx_sov_build_run.nx" 43const BG_LOG: *u8 = "knowledge/status/build_admit_gate.log" 44const BG_CAP: i64 = 2097152 45const BG_MODE: i64 = 420 46// Exit codes mirrored from nx_build_admit.nx; T9 ties them back to the real source. 47const BG_GRANT: i64 = 0 48const BG_DENY: i64 = 3 49const BG_QUEUE: i64 = 4 50 51// ---- FIXTURES: MEASURED READINGS, NAMED FOR THE INCIDENT THEY CAME FROM ------------------------------ 52// The 2026-07-30 false-refusal host: MemAvailable 28302 MB against a 512 MB floor, 8 CPUs, a healthy 53// ceiling of 8.00 (800 centi) derived from ncpu. 54const BG_FX_AVAIL_MB: i64 = 28302 // MemAvailable on the 07-30 host while the false refusal fired 55const BG_FX_AVAIL_QUEUE_MB: i64 = 28035 // MemAvailable minutes later, when the run queue WAS saturated (T3) 56const BG_FX_FLOOR_MB: i64 = 512 // the floor in force (BA_FLOOR_MB) 57const BG_FX_NCPU: i64 = 8 // the host's CPU count (ioa_ncpu over /proc/stat) 58const BG_FX_MAX_CENTI: i64 = 800 // host-derived ceiling, 1.00 x ncpu in centi-load 59const BG_FX_LOAD_HEALTHY: i64 = 400 // 4.00 -- plainly under the ceiling 60const BG_FX_LOAD_DISKWAIT: i64 = 833 // 8.33 -- the 07-30 reading: over the ceiling, IO 3.75 / CPU 4.58 61const BG_FX_LOAD_SATURATED: i64 = 1458 // 14.58 with procs_running 17 on 8 cores: real saturation (T3) 62const BG_FX_LOAD_STORM: i64 = 3500 // 35.00 -- the 2026-08-16 swap-storm shape (4.4 x ncpu, 2 runnable) 63const BG_FX_LOAD_AT_STORM_LINE: i64 = 1600 // exactly BG_HARD_FACTOR x BG_FX_MAX_CENTI (the > vs >= boundary, T12) 64const BG_FX_LOAD_MILD: i64 = 900 // 9.00 -- mild overshoot where only the blocked axis can decide (T14-T17) 65const BG_FX_MAX_UNREACHABLE: i64 = 1000000 // the ceiling nx_sov_build_run actually passes (load axis disabled) 66const BG_FX_BLOCKED_STORM: i64 = 9 // the 2026-08-16 roster: ~9 in D on 8 CPUs (>= ncpu) 67const BG_FX_BLOCKED_DISKWAIT: i64 = 6 // the 07-30 healthy disk-wait case: blocked 1-6 (below ncpu) 68const BG_FX_RUNQ_IDLE: i64 = 1 69const BG_FX_RUNQ_LOW: i64 = 2 70const BG_FX_RUNQ_HEALTHY: i64 = 3 71const BG_FX_RUNQ_DISKWAIT: i64 = 4 // run queue 4/8 while load read 8.33 -- the CPUs were half idle 72const BG_FX_RUNQ_SATURATED: i64 = 17 // run queue 17/8 -- T3 73const BG_FX_RUNQ_ABSURD: i64 = 99 // T7: load AT the ceiling admits regardless of the run queue 74const BG_FX_BELOW_FLOOR_MB: i64 = 100 // T4: under the memory floor 75const BG_FX_LOAD_IDLE: i64 = 100 // 1.00 -- an idle box (T4 pairs it with the below-floor memory) 76const BG_FX_SENSOR_UNREADABLE: i64 = 0 - 1 // the -1 every sensor reports when it could not read 77 78func bg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 79func bg_w(fd: i64, s: *u8) -> i64 { let n: i64 = bg_len(s); sys_write(fd, s, n); return 0 } 80 81// Compatibility wrapper for existing fixtures; the production function owns every decision. 82// BG_HARD_FACTOR mirrors BA_HARD_FACTOR: the run-queue excuse ends at BG_HARD_FACTOR x max_load (the 83// STORM ceiling -- calibration reused from the incumbent, nx_dstate's admit_ceiling = 2.00 x ncpu). 84// The procs_blk/blocked_max pair mirrors IOA_BLOCKED_PER_CPU x ncpu (nx_ioadmit_lib): procs_blocked >= 85// blocked_max is the I/O-STORM WITNESS, deliberately INDEPENDENT of max_load because both wired lanes 86// disable the load ceiling (the runner passes max_centiload=1000000, mgmt passes 100000) -- this axis is 87// the only one that can refuse a storm on the lanes that actually run. 88const BG_HARD_FACTOR: i64 = 2 89func bg_verdict(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64, procs_run: i64, ncpu: i64, procs_blk: i64, blocked_max: i64) -> i64 { 90 return ba_verdict(avail_mb, floor_mb, load1, max_load, procs_run, ncpu, procs_blk, blocked_max) 91} 92// The PRE-STORM policy (run-queue excuse UNBOUNDED), kept ONLY so T13 can prove the storm ceiling is a 93// real change: measured 2026-08-16, load 4.4 x ncpu with 2 runnable and the fleet in D-state on a 94// swapping RAID -- this policy GRANTED a compiler fork into that pileup. 95func bg_verdict_prestorm(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64, procs_run: i64, ncpu: i64) -> i64 { 96 if avail_mb < floor_mb { return BG_DENY } 97 if load1 <= max_load { return BG_GRANT } 98 if procs_run >= 0 { if procs_run < ncpu { return BG_GRANT } } 99 return BG_QUEUE 100} 101// The PRE-BLOCKED policy (storm ceiling but NO D-state witness), kept ONLY so T17 can prove the blocked 102// axis is a real change: with the wired lanes' max_centiload=1000000 this policy GRANTS a build while 103// nine workers sit in uninterruptible I/O -- the 2026-08-16 class on the lanes that actually run. 104func bg_verdict_preblocked(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64, procs_run: i64, ncpu: i64) -> i64 { 105 if avail_mb < floor_mb { return BG_DENY } 106 if load1 <= max_load { return BG_GRANT } 107 if load1 > max_load * BG_HARD_FACTOR { return BG_QUEUE } 108 if procs_run >= 0 { if procs_run < ncpu { return BG_GRANT } } 109 return BG_QUEUE 110} 111// The ORIGINAL pre-fix policy (loadavg only, no run-queue confirmation), kept ONLY so T8 can prove that 112// this gate detects the defect it was written for. 113func bg_verdict_old(avail_mb: i64, floor_mb: i64, load1: i64, max_load: i64) -> i64 { 114 if avail_mb < floor_mb { return BG_DENY } 115 if load1 > max_load { return BG_QUEUE } 116 return BG_GRANT 117} 118 119func bg_read(path: *u8, buf: *u8) -> i64 { 120 let fd: i64 = sys_openat_rd(path) 121 if fd < 0 { return 0 - 1 } 122 var tot: i64 = 0 123 var go: i64 = 1 124 while go == 1 { 125 let rem: i64 = BG_CAP - tot 126 if rem <= 0 { go = 0 } 127 if go == 1 { 128 let q: *u8 = buf + tot 129 let r: i64 = sys_read(fd, q, rem) 130 if r <= 0 { go = 0 } 131 if r > 0 { tot = tot + r } 132 } 133 } 134 sys_close(fd) 135 return tot 136} 137func bg_find(buf: *u8, n: i64, pat: *u8) -> i64 { 138 let pl: i64 = bg_len(pat) 139 if pl <= 0 { return 0 } 140 var i: i64 = 0 141 while i + pl <= n { 142 var k: i64 = 0 143 var hit: i64 = 1 144 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } 145 if hit == 1 { return 1 } 146 i = i + 1 147 } 148 return 0 149} 150 151func main() -> i64 { 152 let ctr: *i64 = gv_ctr() 153 gv_head("nx_build_admit_gate -- production-policy fixtures; resource calibration is separate" as *u8) 154 let A: i64 = BG_FX_AVAIL_MB 155 let F: i64 = BG_FX_FLOOR_MB 156 let M: i64 = BG_FX_MAX_CENTI 157 let N: i64 = BG_FX_NCPU 158 159 // T1 healthy: load under the ceiling admits regardless of anything else. 160 var t1: i64 = 0 161 if bg_verdict(A, F, BG_FX_LOAD_HEALTHY, M, BG_FX_RUNQ_HEALTHY, N, 0, N) == BG_GRANT { t1 = 1 } 162 gv_check("T1 load under ceiling -> GRANT (healthy host still builds)" as *u8, t1, ctr) 163 164 // T2 THE FIX, with the REAL measured numbers from the false refusal: load1 8.33 over an 800 ceiling, 165 // but a run queue of 4 on 8 cores. The load was disk wait; the CPUs were half idle. 166 var t2: i64 = 0 167 if bg_verdict(A, F, BG_FX_LOAD_DISKWAIT, M, BG_FX_RUNQ_DISKWAIT, N, 0, N) == BG_GRANT { t2 = 1 } 168 gv_check("T2 load OVER ceiling but run queue 4/8 (I/O-driven) -> GRANT (the fix)" as *u8, t2, ctr) 169 170 // T3 the refuse arm, also with real measured numbers: load1 14.58 with procs_running 17 on 8 cores. 171 var t3: i64 = 0 172 if bg_verdict(BG_FX_AVAIL_QUEUE_MB, F, BG_FX_LOAD_SATURATED, M, BG_FX_RUNQ_SATURATED, N, 0, N) == BG_QUEUE { t3 = 1 } 173 gv_check("T3 configured load/run-queue policy -> QUEUE" as *u8, t3, ctr) 174 175 // T4 ORDERING: the memory floor outranks everything -- neither an idle run queue NOR a raging 176 // blocked storm may change a below-floor verdict (it stays DENY, never becomes QUEUE). 177 var t4: i64 = 0 178 if bg_verdict(BG_FX_BELOW_FLOOR_MB, F, BG_FX_LOAD_IDLE, M, BG_FX_RUNQ_IDLE, N, BG_FX_BLOCKED_STORM, N) == BG_DENY { t4 = 1 } 179 gv_check("T4 below the memory floor -> DENY even with idle run queue + blocked storm (floor outranks)" as *u8, t4, ctr) 180 181 // T5 FAIL-CLOSED: an unreadable /proc/stat yields procs_run = -1 and must NOT unlock the gate. 182 var t5: i64 = 0 183 if bg_verdict(A, F, BG_FX_LOAD_DISKWAIT, M, BG_FX_SENSOR_UNREADABLE, N, 0, N) == BG_QUEUE { t5 = 1 } 184 gv_check("T5 run-queue sensor unreadable (-1) -> QUEUE (fail-closed, never fail-open)" as *u8, t5, ctr) 185 186 // T6 BOUNDARY: procs_running exactly == ncpu is saturation (the test is >=, not >). 187 var t6: i64 = 0 188 if bg_verdict(A, F, BG_FX_LOAD_DISKWAIT, M, N, N, 0, N) == BG_QUEUE { t6 = 1 } 189 gv_check("T6 configured run-queue boundary == ncpu -> QUEUE" as *u8, t6, ctr) 190 191 // T7 BOUNDARY: load exactly AT the ceiling is not ABOVE it, so it admits. 192 var t7: i64 = 0 193 if bg_verdict(A, F, M, M, BG_FX_RUNQ_ABSURD, N, 0, N) == BG_GRANT { t7 = 1 } 194 gv_check("T7 boundary load1 == max_centiload -> GRANT (ceiling is >, not >=)" as *u8, t7, ctr) 195 196 // T8 LIAR-KILLER / NEG-CONTROL: the OLD loadavg-only policy, given T2's exact inputs, must REFUSE. 197 // Same inputs, both policies: this is the mutation proof that T2 measures a real change. 198 var t8: i64 = 0 199 if bg_verdict_old(A, F, BG_FX_LOAD_DISKWAIT, M) == BG_QUEUE { t8 = 1 } 200 gv_check("T8 neg-control-old-loadavg-only-policy-REFUSES-T2-inputs (proves the bug was real)" as *u8, t8, ctr) 201 202 // T11 STORM CEILING (measured 2026-08-16): load 4.4 x ncpu with a near-empty run queue is an I/O or 203 // swap PILEUP, not idle-CPU disk wait -- the unbounded excuse GRANTED a compiler fork into it. 204 var t11: i64 = 0 205 if bg_verdict(A, F, BG_FX_LOAD_STORM, M, BG_FX_RUNQ_LOW, N, BG_FX_RUNQ_LOW, N) == BG_QUEUE { t11 = 1 } 206 gv_check("T11 STORM: load 4.4x ncpu, run queue 2/8 -> QUEUE (run-queue excuse is bounded)" as *u8, t11, ctr) 207 208 // T12 BOUNDARY: the storm ceiling is >, not >= -- load exactly AT hard x max still gets the excuse. 209 var t12: i64 = 0 210 if bg_verdict(A, F, BG_FX_LOAD_AT_STORM_LINE, M, BG_FX_RUNQ_LOW, N, BG_FX_RUNQ_LOW, N) == BG_GRANT { t12 = 1 } 211 gv_check("T12 boundary load1 == BG_HARD_FACTOR x max -> GRANT (storm ceiling is >, not >=)" as *u8, t12, ctr) 212 213 // T13 NEG-CONTROL: the PRE-STORM policy grants T11's exact inputs -- same inputs, both policies, 214 // the T2/T8 pattern: proves T11 measures a real change, not a tooth that cannot fail. 215 var t13: i64 = 0 216 if bg_verdict_prestorm(A, F, BG_FX_LOAD_STORM, M, BG_FX_RUNQ_LOW, N) == BG_GRANT { t13 = 1 } 217 gv_check("T13 neg-control-pre-storm-unbounded-excuse-GRANTS-T11-inputs (the bug was real)" as *u8, t13, ctr) 218 219 // T14 D-STATE WITNESS ON THE WIRED LANES: max_centiload=1000000 is what nx_sov_build_run actually 220 // passes (mgmt passes 100000), so the load ceiling and storm ceiling CANNOT fire there. Nine 221 // workers in uninterruptible I/O on 8 CPUs must QUEUE anyway -- the only axis protecting the 222 // lanes that really run. 223 var t14: i64 = 0 224 if bg_verdict(A, F, BG_FX_LOAD_MILD, BG_FX_MAX_UNREACHABLE, BG_FX_RUNQ_LOW, N, BG_FX_BLOCKED_STORM, N) == BG_QUEUE { t14 = 1 } 225 gv_check("T14 BLOCKED STORM: 9 in D on 8 CPUs, wired-lane max=1000000 -> QUEUE" as *u8, t14, ctr) 226 227 // T15 BOUNDARY: the witness is >=, so blocked one below the ceiling abstains and load rules. 228 var t15: i64 = 0 229 if bg_verdict(A, F, BG_FX_LOAD_MILD, BG_FX_MAX_UNREACHABLE, BG_FX_RUNQ_LOW, N, N - 1, N) == BG_GRANT { t15 = 1 } 230 gv_check("T15 boundary procs_blocked == blocked_max - 1 -> GRANT (witness is >=)" as *u8, t15, ctr) 231 232 // T16 ABSTAIN, NOT ACQUIT-OR-REFUSE: an unreadable blocked sensor (-1) cannot testify; the other 233 // axes rule. (A wholly unreadable /proc/stat still fails closed in main before ba_verdict.) 234 var t16: i64 = 0 235 if bg_verdict(A, F, BG_FX_LOAD_HEALTHY, M, BG_FX_RUNQ_HEALTHY, N, BG_FX_SENSOR_UNREADABLE, N) == BG_GRANT { t16 = 1 } 236 gv_check("T16 blocked sensor unreadable (-1) -> axis abstains, healthy host still GRANTs" as *u8, t16, ctr) 237 238 // T17 NEG-CONTROL: the PRE-BLOCKED policy grants T14's exact load/run inputs -- same inputs, both 239 // policies, the T8/T13 pattern: proves T14 measures a real change. 240 var t17: i64 = 0 241 if bg_verdict_preblocked(A, F, BG_FX_LOAD_MILD, BG_FX_MAX_UNREACHABLE, BG_FX_RUNQ_LOW, N) == BG_GRANT { t17 = 1 } 242 gv_check("T17 neg-control-pre-blocked-policy-GRANTS-T14-inputs (the hole was real)" as *u8, t17, ctr) 243 244 // T18 BOTH SIGNALS AT ONCE: two teeth that each isolate one axis do not prove the composition; a 245 // full 2026-08-16-shaped storm (load 4.4x ncpu AND 9 in D) must QUEUE. 246 var t18: i64 = 0 247 if bg_verdict(A, F, BG_FX_LOAD_STORM, M, BG_FX_RUNQ_LOW, N, BG_FX_BLOCKED_STORM, N) == BG_QUEUE { t18 = 1 } 248 gv_check("T18 BOTH: load storm AND blocked storm together -> QUEUE" as *u8, t18, ctr) 249 250 // T19 PRESERVATION: the 2026-07-30 motivating case measured procs_blocked 1-6 beside a free run 251 // queue -- ordinary disk wait with blocked BELOW the ceiling must still admit. 252 var t19: i64 = 0 253 if bg_verdict(A, F, BG_FX_LOAD_DISKWAIT, M, BG_FX_RUNQ_DISKWAIT, N, BG_FX_BLOCKED_DISKWAIT, N) == BG_GRANT { t19 = 1 } 254 gv_check("T19 disk-wait with blocked 6/8 (below ceiling) -> GRANT (the 07-30 fix survives)" as *u8, t19, ctr) 255 256 // T9 SOURCE CONSISTENCY: tie this mirror to the real detector. Drift is RED, not rot. 257 let buf: *u8 = sys_mmap(BG_CAP) 258 var n: i64 = bg_read(BG_SRC, buf) 259 if n <= 0 { n = bg_read(BG_SRC_UP, buf) } 260 // THIRD STATE: an unreadable source is a missing precondition (SKIP), not a RED about the detector. 261 var srcok: i64 = 0 262 if n > 0 { srcok = 1 } 263 gv_need("nx_build_admit.nx source readable from this cwd" as *u8, srcok, ctr) 264 var t9: i64 = 0 265 if n > 0 { 266 var ok: i64 = 1 267 if bg_find(buf, n, "ba_verdict" as *u8) == 0 { ok = 0 } 268 if bg_find(buf, n, "procs_running" as *u8) == 0 { ok = 0 } 269 if bg_find(buf, n, "BA_PROCSRUN_OFF" as *u8) == 0 { ok = 0 } 270 if bg_find(buf, n, "procs_run < ncpu" as *u8) == 0 { ok = 0 } 271 if bg_find(buf, n, "BA_HARD_FACTOR" as *u8) == 0 { ok = 0 } 272 if bg_find(buf, n, "max_load * BA_HARD_FACTOR" as *u8) == 0 { ok = 0 } 273 if bg_find(buf, n, "procs_blocked" as *u8) == 0 { ok = 0 } 274 if bg_find(buf, n, "IOA_BLOCKED_PER_CPU" as *u8) == 0 { ok = 0 } // the shared ruler (nx_ioadmit_lib) -- drift from it is RED 275 if bg_find(buf, n, "ioa_ncpu" as *u8) == 0 { ok = 0 } // ONE ncpu parser, shared 276 t9 = ok 277 } 278 if srcok == 1 { gv_check("T9 nx_build_admit.nx still carries ba_verdict + procs_running + the run-queue confirm + the shared I/O ruler" as *u8, t9, ctr) } 279 280 // T10 NEG-CONTROL on the scanner itself -- a string that must NOT be found. 281 var t10: i64 = 0 282 if n > 0 { if bg_find(buf, n, "zzz_not_in_build_admit_zzz" as *u8) == 0 { t10 = 1 } } 283 if srcok == 1 { gv_check("T10 neg-control-source-scanner-does-not-report-an-absent-string" as *u8, t10, ctr) } 284 285 // T20 THE ONE ENVELOPE (2026-08-18): thresholds come from knowledge/build_admit.conf (argv > conf > 286 // host-derived) and the report line NAMES the source. Source-consistency tooth in this gate's own 287 // style; the behaviour half is measured live (bare `check` on the box prints envelope_src=conf with 288 // the conf's numbers; a conf floor of 999999999 turns the verdict DENY). RED before, GREEN after. 289 // (Was a second tooth labelled T11 -- two teeth with one name cannot be told apart in a journal.) 290 var t20: i64 = 0 291 if n > 0 { 292 var ok20: i64 = 1 293 if bg_find(buf, n, "ba_conf_load" as *u8) == 0 { ok20 = 0 } 294 if bg_find(buf, n, "knowledge/build_admit.conf" as *u8) == 0 { ok20 = 0 } 295 if bg_find(buf, n, "envelope_src" as *u8) == 0 { ok20 = 0 } 296 if bg_find(buf, n, "max_stated" as *u8) == 0 { ok20 = 0 } 297 t20 = ok20 298 } 299 if srcok == 1 { gv_check("T20 nx_build_admit.nx reads knowledge/build_admit.conf (floor/max/blocked) and names envelope_src" as *u8, t20, ctr) } 300 301 // T21 THE VERDICT TOKEN MUST NAME ITS OWN AXIS (2026-08-21). BA_EXIT_DENY is returned ONLY for 302 // avail_mb < floor_mb -- a pure MEMORY condition -- yet the emitted token read VERDICT=DENY-LOAD 303 // for three weeks. That token is not free: nx_swarm_admit uses DENY-LOAD for a GENUINE load 304 // denial (SA_DENY_LOAD, load1 >= ncpu), so two admission controllers were emitting ONE token for 305 // OPPOSITE axes -- while this organ's own caller already mapped rc=3 to DENY-MEM. POSITIVE AND 306 // NEGATIVE together: asserting only that DENY-MEM is present would still pass if BOTH spellings 307 // were in the file, which is exactly the state a half-done rename leaves behind. 308 var t21: i64 = 0 309 if n > 0 { 310 var ok21: i64 = 1 311 if bg_find(buf, n, "VERDICT=DENY-MEM" as *u8) == 0 { ok21 = 0 } 312 if bg_find(buf, n, "VERDICT=DENY-LOAD" as *u8) != 0 { ok21 = 0 } 313 t21 = ok21 314 } 315 if srcok == 1 { gv_check("T21 memory-floor verdict token names MEM and the LOAD spelling is absent (no axis collision with nx_swarm_admit)" as *u8, t21, ctr) } 316 317 // T22 NO CALLER MAY PARAPHRASE THIS RULER'S VERDICT (2026-08-21 -- the defect that burned lanes). 318 // nx_sov_build_run printed "1-minute load is ABOVE THE CEILING" on rc=4: the ONE conjunct that 319 // knowledge/build_admit.conf makes UNREACHABLE (max_centiload=100000). sbr_run passes 320 // redir_out=-1 (INHERIT), so this ruler's own figures print immediately ABOVE it -- and the 321 // paraphrase then contradicted them on the LAST line, which is the line readers take. A seat 322 // read it and concluded the two governors disagreed on a ceiling when they agree exactly. 323 // DECLARED IMPRECISION: a literal-substring check on the phrase that actually shipped. A 324 // differently-worded false cause would evade it. This pins the MEASURED regression; it does not 325 // decide the general question of whether prose restates a verdict. 326 let cbuf: *u8 = sys_mmap(BG_CAP) 327 var cn2: i64 = bg_read(BG_CALLER, cbuf) 328 if cn2 <= 0 { cn2 = bg_read(BG_CALLER_UP, cbuf) } 329 var callerok: i64 = 0 330 if cn2 > 0 { callerok = 1 } 331 gv_need("nx_sov_build_run.nx source readable from this cwd" as *u8, callerok, ctr) 332 var t22: i64 = 0 333 if cn2 > 0 { 334 var ok22: i64 = 1 335 if bg_find(cbuf, cn2, "1-minute load is ABOVE THE CEILING" as *u8) != 0 { ok22 = 0 } 336 if bg_find(cbuf, cn2, "BUILD-ADMIT report ABOVE names which conjunct fired" as *u8) == 0 { ok22 = 0 } 337 t22 = ok22 338 } 339 if callerok == 1 { gv_check("T22 the caller defers to this ruler's own figures and names no conjunct of its own" as *u8, t22, ctr) } 340 341 gv_check("R1 memory reason takes precedence over blocked/load policy", ba_reason(100, F, 3500, M, 17, N, 9, N) == BA_REASON_MEMORY, ctr) 342 gv_check("R2 blocked reason takes precedence over load policy", ba_reason(A, F, 3500, M, 17, N, 9, N) == BA_REASON_BLOCKED, ctr) 343 gv_check("R3 hard load ceiling is distinguished from runqueue", ba_reason(A, F, 3500, M, 2, N, 0, N) == BA_REASON_LOAD, ctr) 344 gv_check("R4 missing runqueue is not reported as CPU saturation", ba_reason(A, F, 833, M, 0 - 1, N, 0, N) == BA_REASON_RUN_UNREADABLE, ctr) 345 gv_check("R5 load and runqueue branch identified exactly", ba_reason(A, F, 833, M, N, N, 0, N) == BA_REASON_RUNQUEUE, ctr) 346 gv_check("R6 grant is explicitly a policy result", ba_reason(A, F, 400, M, 3, N, 0, N) == BA_REASON_GRANT, ctr) 347 348 // The rollup still reads this gate's own log line on GREEN (gatereg row); gv_journal writes the shared 349 // journal regardless. Both are appends; neither decides the verdict. 350 if ctr[1] == ctr[0] { 351 let lg: i64 = sys_openat_append(BG_LOG, BG_MODE) 352 if lg >= 0 { bg_w(lg, "NX-BUILD-ADMIT verdict=GREEN production policy fixture checks passed; not a capacity calibration\n" as *u8); sys_close(lg) } 353 } 354 return gv_verdict("BUILD-ADMIT-GATE" as *u8, ctr, "production policy executed directly; fixture checks do not establish CPU saturation, disk capacity, or optimal admission thresholds" as *u8) 355}