nx_headroom.nx

nx_headroom.nx -- S4 of the SRE program (seq1295, incident 2026-07-29): the SPAWN-TIME HEADROOM GATE every background producer must consult before forking work. The outage proof: an 8-wide TLS fork pool spooling to tmpfs on a memory-tight box (which had ALREADY refused a build on the MemAvailable floor) co-produced a host-wide starvation + hard crash. /api/build has this gate baked in; this organ EXTRACTS it as the shared, config-driven primitive so no producer derives width from taste again (bounds-derived law). nx_headroom width <cap> <child_cost_mb> [meminfo] [loadavg] [cpuinfo] -> NX-HEADROOM ok width=<n> avail_mb= usable_mb= cores= load1_centi= (exit 0) -> NX-HEADROOM REFUSED reason=mem_floor|load_ceiling ... (exit 5) width = min(cap, cores/2, (MemAvailable-floor)/child_cost), floor 1 -- else REFUSED. nx_headroom gate <need_mb> [meminfo] [loadavg] [cpuinfo] -> ok (exit 0) iff need_mb fits above the floor AND load is under ceiling; else REFUSED exit 5. Conf headroom.conf in CWD: floor_mb= loadceil_centi_per_core= (else derived defaults below). Path override args exist so the GATE can prove exact math on fixture files -- real callers omit them. Read-only; no hw writes (Rule 26). license_tier: ORIGINAL expect_exit: 0