nx_supervised_dispatch_tamper.nx

nx_supervised_dispatch.nx -- WMS rung M5: OS / KERNEL SUPERVISOR BINDING. module: nishi-core.autonomy.supervised_dispatch capability: BIND_DISPATCH_TO_SUPERVISED_JOB (a dispatched rung becomes a real, resource-LIMITED, reaped, RESTART-on-death supervised job) WHAT THIS UNIFIES (the M5 payoff): M4 (nx_dispatch_lease) LEASES the next ready rung but never RUNS it; M1 (nx_heartbeat_monitor) detects a stalled stream but never ACTS; the supervisor policy (nx_supervisor) decides RESTART/ESCALATE but never forks. M5 is the missing seam: it FORKS the leased rung as a governed child (with a kernel resource limit = prlimit64 RLIMIT_AS, the Linux analog of a Job-Object memory limit), beats its heartbeat, and -- when M1 sees a missing heartbeat (a crashed job) -- it RESTARTS/reassigns (a second supervised run). Conductor loop + kernel scheduler + workstream manager collapse into ONE control plane. REUSE / lineage (compose, do not reinvent -- check-registries-before-building): - dl_dispatch / dl_try_lease / dl_release <- nx_dispatch_lease.nx (M4): lease the rung - an_newcx / an_load / an_find / an_id_at <- nx_assign_core (surfaced via M4) - hb_beat_at / hbm_scan / HB_STALLED/HB_ALIVE <- nx_heartbeat_monitor.nx (M1) - fa_cat / fa_catn / fa_appendz <- nx_framed_append.nx (R0b): the locked single-write status discipline (every record = ONE buffer -> ONE atomic write) - the fork -> child-setup -> sys_wait4 status-decode model is the nx_container.nx idiom (lo = status & 0xFF; exited iff lo==0; code = (status>>8)&0xFF) -- reimplemented HERE (NOT imported) because nx_container.nx imports nx_syscalls_x86_64.nx and that would surface a SECOND syscall table against M1/M4's nx_syscalls.nx = the double-import rc=6 trap. M5 keeps a SINGLE syscall surface (nx_syscalls.nx via all three imports). SOVEREIGN PAYLOAD (no /bin dependency): the supervised child does NOT execve a foreign ELF. After fork it caps ITSELF (nx_prlimit) then runs an IN-ORGAN payload selector -- the same organ post-fork executing a payload function (the nx_container fork model minus execve). payload=0 clean work+exit(0); payload=1 "crash" exit(70); payload=2 hang (finite busy then exit WITHOUT beating = the never-beats stall the gate KILLs/detects). SUPERVISOR POLICY (inlined, ~ nx_supervisor's 4-state restart-budget machine): a STALLED job under budget -> RESTART (respawn + restarts++ + fresh beat); over budget -> ESCALATE (bounded, no thrash storm); an ALIVE / clean-exited job -> NONE (the no-thrash neg-ctrl). WRITE DISCIPLINE (the torn-line bug we must NOT reintroduce): every status record is assembled into ONE buffer and emitted with a SINGLE locked fa_appendz (the cn_emit_* discipline) -- never a sequence of sys_write() calls. Additive: new file only; one tiny