nx_jobcancel_lib.nx

nx_jobcancel_lib.nx -- THE ONE cancel path for the jobs nx_job_run launched (engineshift ES29, 2026-09-15). WHY. MEASURED 2026-09-15: two cross-encoder one-shots launched through nx_job_run held the estate host at load 27 on 8 cpus for over 30 hours with 0 bytes of output, and admission correctly refused every build -- including the builds that would have replaced them. No sovereign surface could stop them: the launcher had no cancel verb, the resource governor's law forbids recycling a one-shot (never terminate what nothing will restart), and the /proc-walking diagnostics refuse to run above the very load the runaway causes. A RUNAWAY JOB THAT CANNOT BE CANCELLED IS A RESOURCE INCIDENT WITH NO REMEDY. This lib is the remedy, and it is BOUNDED BY CONSTRUCTION: * it cancels only a pid the launcher's own journal recorded for that out-file (REFUSED-ABSENT otherwise); * it signals only if /proc/<pid>/cmdline argv[0] is the elf the journal recorded (REFUSED-MISMATCH otherwise -- a recycled pid, a stranger, a daemon: never touched); * TERM first, a named grace (knowledge/jobrun.conf cancel_grace_ms, bootstrap default below), then KILL, then one more grace; every outcome is journaled beside the launch it cancels, so the record reads launch -> cancel -> outcome in one file. The journal row: <kind> TAB <epoch> TAB <pid> TAB <elf> TAB <out-file> TAB <name-or-outcome>, kind = launch | cancel. license_tier: ORIGINAL. No hw writes (Rule 26).