nx_resgov_core.nx

nx_resgov_core.nx -- PURE DECISION CORE of the unified resource-governance regime (nx_resgov). WHY THIS SUPERSEDES THE VSZ WATCHDOG (operator 2026-08-04: "resource management should be proactive, intelligent and SOTA, not watching the hardware get hammered"; debt 1785863639). The incumbent breaker had three structural defects, each fixed here BY CONSTRUCTION: 1. WRONG INSTRUMENT. It thresholded on VSZ. VSZ is reserved ADDRESS SPACE -- nx_wiki_gw sits at 47.4GB VSZ on 355MB resident and is perfectly healthy; a naive VSZ rule kills it. The pressure that actually degraded the estate on 08-04 was RESIDENT memory + SWAP. We meter VmRSS + VmSwap. 2. COVERAGE BY ALLOW-LIST. Rows named 7 remembered processes; every grower nobody listed was invisible (a transient 4GB nx_web_shard_co appeared and exited mid-session -- the population is dynamic and unlistable by hand). Here the policy is INVERTED: a DEFAULT cap covers EVERY process and exemptions are the explicit, auditable rows. ★A DETECTOR'S COVERAGE IS TWO SETS -- WHAT IT MATCHES AND WHERE IT LOOKS; a default-deny breaker has no blind names. 3. REACTIVE ONLY. It fired after a ceiling was crossed -- i.e. after the hardware was already being hammered. Here the primary signal is PREDICTIVE: growth VELOCITY from persisted samples gives an ETA to the ceiling, and the ladder engages while headroom still exists. ★ESCALATION, NEVER A BINARY KILL (rule 14, graceful degradation). Levels: OK -> WATCH (measured, logged) -> WARN (predicted to breach inside the horizon) -> RENICE (deprioritise, let it finish) -> TERM (polite, guard respawns fresh) -> KILL (last resort). A breaker whose only verb is SIGKILL cannot be trusted to run every minute, so it gets disabled -- which is exactly how the incumbent came to be unwired. ★SYSTEM PRESSURE GATES ACTION. A 3GB process on an idle box is not a problem; the same process at 95% memory is. Every destructive level requires BOTH a per-process finding AND real system scarcity, so a healthy fleet is never disturbed. FAIL-SAFE BY CONSTRUCTION: unknown/unreadable measurement -> level OK (never act on ignorance); exempt -> capped at OK; cap<1 -> inert row; cooldown suppresses storms; the CLI never touches pid<=300 or itself. Decisions live here (gate-locked, pure); the /proc walk, state and signals live in the CLI. license_tier: ORIGINAL No hw writes (Rule 26).