nx_restart_guard.nx

nx_restart_guard.nx -- SUPERVISOR CRASH-LOOP GUARD (closes hosting_research gap #4 "watchdog-restart-loop-guard", 3/0 CONFIRMED -- the root cause of the live 2026-06-16 nx_hostctl crash-loop). A bedrock supervision primitive any supervisor (nx_hostctl / nx_keeper / nx_torrent_up) composes so a daemon that crashes immediately on start is NOT respawned forever. module: nishi-core.supervision.restart_guard capability: DAEMON_ROBUSTNESS INCUMBENT (benchmark, sourced via the Nishi researcher -> hosting_research.tsv): systemd unit restart policy -- Restart=on-failure + RestartSec (wait before restart, default 100ms) + StartLimitBurst (N, default 5) within StartLimitIntervalSec (T, default 10s): more than N restarts in T -> unit enters "failed", systemd stops trying. We MATCH that burst-limit semantics, and EXCEED it on two measured axes: (1) DETERMINISTIC / REPLAYABLE -- given the same restart timestamps, the SAME verdict every run, so a supervision session can be replayed bit-for-bit (systemd's behavior depends on wall-clock + monotonic boot time and cannot be replayed). The caller passes `now`; nothing reads a hidden clock here. (2) EXPONENTIAL BACKOFF -- rg_backoff_ms doubles the wait each restart (capped), vs systemd's FIXED RestartSec, so a flapping daemon backs off instead of hammering at a constant rate. STATE per daemon (caller-owned, 2 words): ws[0] = window-start timestamp, cnt[0] = restarts in window.