nx_supervisor.nx

nx_supervisor.nx -- Erlang-OTP-style restart-policy state machine. Closes the SSS-class "subsystem restart gap" named in NISHI_HONEST_TRADE_OFFS.md row 2 + NISHI_PREEMPTIVE_BUG_ABSORPTION.md. Per cardinal user-owns-every-bit: this is a STATE MACHINE primitive. The substrate doesn't fork or exec anything -- caller does the actual process management. Supervisor returns "what action to take now"; caller obeys. Substrate's structural prevention of three known supervisor anti- patterns: 1. Restart storms: max_restarts counter -> ESCALATE once exceeded (don't burn CPU on infinite crash-restart loop) 2. Split-brain restarts: caller is single-supervisor-per-child; sealed enum state means "is this child being restarted right now or not" is unambiguous 3. State-loss across restart: snapshot-before-mark via nx_module_cas integration (queued v2; v1 is stateless) Exponential backoff (RFC 7234-class): 1st crash: base_backoff_ms wait 2nd: 2 * base wait 3rd: 4 * base wait Nth: min(2^(N-1) * base, max_backoff_ms) Healthy-window reset: if (now - last_restart_ms) > healthy_threshold_ms, counter resets to 0. Per Erlang OTP: a child that's been up long enough has "recovered" and the next crash isn't part of the crash storm. Sealed enum: NxSupState (4 states): HEALTHY child running normally (or never-started) BACKING_OFF child crashed; waiting for backoff_ms before restart ESCALATING exceeded max_restarts; parent supervisor should take over TERMINATED explicit stop; no further restart Sealed enum: NxSupAction (4 decisions): ACTION_NONE child healthy, no action needed