nx_ship_fleet.nx
buildroot/runtime/nx_ship_fleet.nx
about
nx_ship_fleet.nx -- INTELLIGENT (adaptive-concurrency) FLEET SHIPPER. Drains a list of targets by running
as many concurrent ships as the box can take RIGHT NOW -- never serially (too slow to drain a backlog),
never blindly (3 blind concurrent ships stormed the box on 2026-09-02). It composes the estate's existing
pieces into the DRIVER that was missing:
SENSE nx_sysload (sl_ncpu / sl_loadavg_milli / sl_freemem_mb / sl_active_conns_8443)
GOVERN nx_resource_governor rg_worker_budget -> the polite headroom budget, used here as a concurrency
WIDTH (the governed drivers computed this budget and then fired ONE task per beat -- the budget
was never used as a width, which is exactly why concurrent shipping was ungoverned)
ADMIT fork _offc/nx_build_admit.elf -> its exit code is the DIRECT I/O-storm signal (D-state witness),
which the CPU-load budget alone cannot see (our storms are I/O on a degraded RAID, not CPU)
AIMD nx_shipfleet_lib -- +1 on progress, halve on a storm refusal, ceilinged by the polite budget
POOL fork _offc/nx_organ_ship.elf per target; reap with wait4(WNOHANG); requeue nothing blindly
Research (Sept 2026): AIMD adaptive concurrency limits (Netflix concurrency-limits, Envoy
adaptive_concurrency filter, ThomWright/congestion-limiter) + HPA-style headroom budgeting. The field
infers congestion from latency; our exceed is a measured congestion signal (build_admit reads /proc).
usage: nx_ship_fleet <targets-file> [plan]
<targets-file> one target name per line; '#' and blank lines skipped
plan SENSE + print the width the controller WOULD use, fork NOTHING (safe live demo)
license_tier: ORIGINAL
dependencies 4 imports · 0 importers
imports: nx_syscalls.nxnx_sysload.nxnx_resource_governor.nxnx_shipfleet_lib.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 28 | const SF_MEM_FLOOR_MB: i64 = 256 |
| 29 | const SF_CEIL_MILLI: i64 = 800 // back off at 0.8 core/cpu (rg default; shipping is background, not latency-sacred) |
| 30 | const SF_BASE_BACKOFF_MS:i64 = 2000 // AIMD storm back-off base (rg_backoff_ms scales it up with overload) |
| 31 | const SF_TICK_MS: i64 = 250 // settle time between launch ticks (avoid busy-spin on /proc) |
| 32 | const SF_MAX_STORM_TICKS:i64 = 120 // ~ bounded: consecutive storm/busy ticks before giving up (killable, deferred reported) |
| 33 | const SF_MAXTARGETS: i64 = 4096 |
| 34 | const SF_NAMECAP: i64 = 128 |
| 35 | const SF_INFLIGHT_CAP: i64 = 256 |
| 36 | const SF_READCAP: i64 = 1048576 |
| 37 | const SF_SHIP_ELF: *u8 = "_offc/nx_organ_ship.elf" as *u8 |
| 38 | const SF_ADMIT_ELF: *u8 = "_offc/nx_build_admit.elf" as *u8 |
| 39 | const SF_DEVNULL: *u8 = "/dev/null\x00" as *u8 |
functions
| 41 | func sf_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: sf_w |
| 42 | func sf_w(s: *u8) -> i64 { sys_write(1, s, sf_slen(s)); return 0 } |
| 43 | func sf_n(v: i64) -> i64 |
| 54 | func sf_read(path: *u8, buf: *u8, cap: i64) -> i64 |
| 63 | func sf_admit_grant() -> i64 |
| 81 | func sf_launch(target: *u8) -> i64 |
| 96 | func sf_rg_budget(ncpu: i64, load: i64, freemb: i64) -> i64 |
| 102 | func main(argc: i64, argv: *i64) -> i64 |