nx_scratch.nx

nx_scratch.nx -- SOVEREIGN SCRATCH ARENA. The god-level fix for the unfreed-mmap class. THE ROOT DEFECT, stated plainly: NishiLang has no scratch allocator. `sys_mmap` is a raw page-granular syscall with NO allocator and NO free behind it, so every organ that needs a temporary buffer hand-rolls `sys_mmap(N)` -- and every one of them re-derives the same bug. That is 455 occurrences across ~210 files. Fixing them one at a time is 455 chances to get it wrong; fixing the missing primitive is one chance to get it right, inherited by everything below. MEASURED cost of the status quo (nx_mmapleak_gate): an unpaired scratch mmap leaks a full 4096-byte page per call -- even sys_mmap(4) -- so 2000 calls grow a process by 4000 pages. In a supervised daemon that is unbounded: nx_seed_announce_all reached 8.8 GB committed and drove the build host into swap. MODEL: one process-lifetime arena, bump-allocated, reset at the top of each work iteration (per request, per sweep, per connection). Scratch is by definition dead at the end of an iteration, so a reset is the whole free. ★FAIL-SAFE BY CONSTRUCTION: on overflow nxs_alloc does NOT return null and does NOT truncate -- it falls back to exactly the sys_mmap the caller performed BEFORE adopting this library, and counts it. So adoption can never make a caller worse or introduce a null it does not check, and the arena gets sized from evidence (nxs_overflows) instead of guesswork. Refuse-and-report, never silently shrink. ⚠CONTRACT: memory returned by nxs_alloc is INVALID after the next nxs_reset(). Never hold it across an iteration boundary, and never use it for state that must outlive the request. license_tier: ORIGINAL layer: runtime-core module: nishi-core.runtime.scratch