nx_budget_alloc.nx

nx_budget_alloc.nx -- bits-up sovereign memory-ceiling enforcement. THIS is the Nishi way to make nx_budget's ceiling claim load-bearing. NO Linux cgroups dependency. NO kernel delegation. The substrate IS the enforcement. Replaces direct sys_mmap calls from cell-resident code with nx_budget_mmap, which composes nx_budget_request + sys_mmap: 1. Reserve bytes from the cell's declared budget 2. Only if reservation succeeded, actually call sys_mmap 3. Over-ceiling -> NULL; never reaches sys_mmap 4. sys_mmap failure (rare) -> release the reservation + return NULL This pattern works IDENTICALLY on: - Linux (any version; no cgroups needed) - Windows (when nx_os_windows ships; same code) - macOS (when nx_os_darwin ships) - bare metal (when nx_os_baremetal ships) - WASM because the enforcement is in the substrate, not the host kernel. Per [[feedback-bits-up-exceed-never-match]] we never delegate enforcement to a third-party (host kernel cgroups counts as third-party; the substrate is sovereign). Distinct from nx_cgroup_v2_probe.nx which is INSPECTION-ONLY for diagnostic visibility on Linux hosts. cgroups probe tells the operator "this host CAN delegate to kernel cgroups if you want"; THIS primitive is what the substrate actually USES, and the answer is "the substrate enforces itself, never delegates." Driver cardinal (verbatim from operator 2026-05-20): "make sure we are building bits up nishi not linux or whatever" genealogy_id: cardinal_2026-05-19_cooperative_resource_arbitration + cardinal_2026-05-20_bits_up_nishi_not_linux + nx_budget_v1 lineage_id: substrate_budget_alloc_v1 nx_capability_manifest: