code wiki / _hdl_build / nx_daemon_supervisor.nx
`nx_daemon_supervisor.nx` source

↩ module page · 828 lines · 48630 B
1// nx_daemon_supervisor.nx -- SOVEREIGN data-driven daemon supervisor. THE organ that makes daemon
2// lifecycle the ecosystem's job, not Claude's: a daemon is a REGISTRY ROW (data), not compiled into a
3// guard's target list and not nursed by a bash loop. Reads daemons.reg HOT every cycle, responds-health
4// probes each via hp_probe (SERVING / HUNG / REFUSED -- catches the wedge that PID/port checks miss), and
5// REVIVES the dead by fork+execve of the declared argv. 2-consecutive-fail discipline (in-memory, keyed by
6// name) so a single transient probe never triggers a relaunch. On HUNG (wedged, holding the port) it kills
7// the matching process first (the new instance could not bind otherwise), then launches. Zombies reaped
8// every cycle (wait4 WNOHANG). Add a daemon = a registry line + reload -- NO recompile, NO shell.
9//
10// BOUNDED-VSZ DISCIPLINE (2026-07-16): every reusable buffer is allocated ONCE before the loop and reused
11// each cycle. The hot loop performs ZERO sys_mmap. The prior version mmap'd per cycle -- fatally, it read
12// the registry with sys_read_file, whose 4 GiB default cap (used whenever lseek can't size the file) maps
13// 4 GiB of VSZ per cycle and never frees it. That drove VSZ to 116 GB in ~29 cycles, and under heuristic
14// overcommit fork() then returns -ENOMEM (proven: REVIVED ... pid=-12), so revives silently stopped. The
15// registry is now read into a fixed buffer via sys_read; ds_decw is temp-free; VSZ stays flat forever.
16//
17// daemons.reg  (pipe-delimited; lines starting # or blank ignored; args are space-separated, no spaces-in-args):
18//   <name> | <cwd> | <argv0 [arg1 arg2 ...]> | <health_port> | <arm: revive|watch>
19//     health = hp_probe(port): ANY HTTP response on 127.0.0.1:port = healthy (401/404 count).
20//     revive = relaunch (and kill-the-wedge) on 2 consecutive non-SERVING probes; watch = detect+log only.
21// license_tier: ORIGINAL   module: nishi-core.ops.daemon_supervisor
22import "nx_syscalls.nx"
23import "nx_health_probe.nx"    // hp_probe, HP_SERVING, HP_HUNG, HP_REFUSED, HP_BADRESP
24import "nx_metrics_ring.nx"    // mr_append/mr_hash -- the supervisor WRITES its own health history (no separate collector)
25import "nx_dsup_lib.nx"        // ds_decw/ds_sappend/ds_trailer/ds_conf_int/ds_stat_ppid -- PURE helpers, gate-driven (nx_daemon_supervisor_gate)
26const DS_MAGIC_1024: i64 = 1024
27const DS_MAGIC_65536: i64 = 65536
28const DS_MAGIC_65535: i64 = 65535
29const DS_MAGIC_8000: i64 = 8000
30const DS_MAGIC_2048: i64 = 2048
31const DS_MAGIC_2047: i64 = 2047
32const DS_MAGIC_10000: i64 = 10000
33
34const DS_REG:       *u8 = "/volume1/homes/elderwesto/nishihost/daemons.reg" as *u8
35const DS_LOG:       *u8 = "/volume1/homes/elderwesto/nishihost/daemon_supervisor.log" as *u8
36const DS_CYCLE_SEC: i64 = 15
37const DS_MAX:       i64 = 64
38const DS_PROBE_TMO: i64 = 3
39const DS_REGCAP:    i64 = 65536
40const DS_STATUS_PORT: i64 = 18095
41const DS_SHARED_SZ:   i64 = 8192
42const DS_ROW_MAX:     i64 = 256    // one /status row's bound (name<=64 + verdict + counters); reserved BEFORE every row append
43const DS_TRAILER_MAX: i64 = 256    // the progress trailer's bound (tick/row/last/stage ms); reserved so a tick is NEVER dropped for space
44const DS_RING:        *u8 = "metrics.ring" as *u8   // sovereign bounded TSDB the supervisor writes inline
45
46func ds_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
47func ds_p(s: *u8) -> i64 { sys_write(1, s, ds_slen(s)); return 0 }
48func ds_log(s: *u8) -> i64 {
  let fd: i64 = sys_openat_append(DS_LOG, 420)
  if fd >= 0 { sys_write(fd, s, ds_slen(s)); sys_close(fd) }
  sys_write(1, s, ds_slen(s))
  return 0
53}
54// ds_decw / ds_sappend live in nx_dsup_lib.nx (extracted 2026-09-02 so the gate drives the same code the daemon runs)
55
56// read the registry into a pre-allocated buffer (reused every cycle). Returns byte count (0 on error).
57// Deliberately NOT sys_read_file: that mmaps a fresh buffer per call (4 GiB when lseek can't size the file)
58// and never frees it -- the exact leak this rewrite exists to kill.
59func ds_read_reg(buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(DS_REG)
  if fd < 0 { return 0 }
  let n: i64 = sys_read(fd, buf, cap - 1)
  sys_close(fd)
  if n < 0 { return 0 }
  return n
66}
67
68
69// ---- registry line/field walking (pipe fields) ----
70func ds_next_line(buf: *u8, pos: i64, end: i64) -> i64 {
  var p: i64 = pos
  var go: i64 = 1
  while go == 1 { if p >= end { go = 0 } else { if (buf[p] as i64) == 10 { p = p + 1; go = 0 } else { p = p + 1 } } }
  return p
75}
76// end-offset of this line (the index of '\n' or end)
77func ds_line_end(buf: *u8, pos: i64, end: i64) -> i64 {
  var p: i64 = pos
  while p < end { if (buf[p] as i64) == 10 { return p } p = p + 1 }
  return end
81}
82// copy pipe-field #idx (0-based) of the line buf[ls..le) into out (NUL-term, trimmed of edge spaces). ret len.
83func ds_field(buf: *u8, ls: i64, le: i64, idx: i64, out: *u8, cap: i64) -> i64 {
  // advance fs past `idx` pipes to the start of the target field
  var fs: i64 = ls
  var seen: i64 = 0
  while seen < idx {
      if fs >= le { out[0] = 0 as u8; return 0 }
      if (buf[fs] as i64) == 124 { seen = seen + 1 }
      fs = fs + 1
  }
  // field end = next pipe or line end
  var fe: i64 = fs
  var g: i64 = 1
  while g == 1 { if fe >= le { g = 0 } else { if (buf[fe] as i64) == 124 { g = 0 } else { fe = fe + 1 } } }
  // trim leading spaces
  var a: i64 = fs
  var g2: i64 = 1
  while g2 == 1 { if a >= fe { g2 = 0 } else { if (buf[a] as i64) == 32 { a = a + 1 } else { g2 = 0 } } }
  // trim trailing spaces / CR
  var b: i64 = fe
  var g3: i64 = 1
  while g3 == 1 { if b <= a { g3 = 0 } else { let c: i64 = buf[b - 1] as i64; if c == 32 { b = b - 1 } else { if c == 13 { b = b - 1 } else { g3 = 0 } } } }
  var o: i64 = 0
  var k: i64 = a
  while k < b { if o < cap - 1 { out[o] = buf[k]; o = o + 1 } k = k + 1 }
  out[o] = 0 as u8
  return o
109}
110func ds_atoi(s: *u8) -> i64 {
  var v: i64 = 0; var i: i64 = 0; var go: i64 = 1
  while go == 1 { let c: i64 = s[i] as i64; if c < 48 { go = 0 } else { if c > 57 { go = 0 } else { v = v * 10 + (c - 48); i = i + 1 } } }
  return v
114}
115func ds_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
120}
121
122// ---- launch: fork, then (in the CHILD, matching the proven ah_run) build argv, chdir, execve ----
123func ds_launch(cwd: *u8, cmd: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let work: *u8 = sys_mmap(DS_MAGIC_1024)
      var n: i64 = 0
      while cmd[n] != (0 as u8) { work[n] = cmd[n]; n = n + 1 }
      work[n] = 0 as u8
      let argv: *i64 = sys_mmap(64 * 8) as *i64
      var ac: i64 = 0
      var i: i64 = 0
      var scan: i64 = 1
      while scan == 1 {
          var sk: i64 = 1
          while sk == 1 { if i >= n { sk = 0 } else { if (work[i] as i64) == 32 { work[i] = 0 as u8; i = i + 1 } else { sk = 0 } } }
          if i >= n { scan = 0 }
          else {
              if (work[i] as i64) == 34 {
                  // quoted token: "..." = ONE argv entry, quotes stripped -- needed for spaces-in-args
                  // (reader's live argv has the single argument `Nishi Wiki`, /proc-proven)
                  work[i] = 0 as u8
                  i = i + 1
                  if ac < 63 { argv[ac] = (((work as i64) + i)); ac = ac + 1 }
                  var qk: i64 = 1
                  while qk == 1 { if i >= n { qk = 0 } else { if (work[i] as i64) == 34 { work[i] = 0 as u8; i = i + 1; qk = 0 } else { i = i + 1 } } }
              }
              else {
                  if ac < 63 { argv[ac] = (((work as i64) + i)); ac = ac + 1 }
                  var tk: i64 = 1
                  while tk == 1 { if i >= n { tk = 0 } else { if (work[i] as i64) == 32 { tk = 0 } else { i = i + 1 } } }
              }
          }
      }
      argv[ac] = 0
      let envp: *i64 = sys_mmap(8 * 4) as *i64
      envp[0] = ("PATH=/usr/bin:/bin:/usr/local/bin" as *u8) as i64
      envp[1] = ("HOME=/volume1/homes/elderwesto" as *u8) as i64
      envp[2] = 0
      sys_chdir(cwd)
      let nul: i64 = sys_openat_rd("/dev/null\x00" as *u8)
      if nul >= 0 { sys_dup3(nul, 0, 0) }
      sys_execve_clean(argv[0] as *u8, argv, envp)
      sys_exit(127)
  }
  return pid
167}
168
169// ---- kill any process whose /proc/<pid>/cmdline contains `needle` (used on HUNG to free the wedged port).
170// dbuf(dents)/path/cmdbuf allocated ONCE per call and munmap'd on exit -- NEVER sys_read_file (/proc lseek
171// is unknowable, so its 4 GiB fallback cap would map 4 GiB of VSZ per pid scanned). Runs only on HUNG revive.
172func ds_kill_wedged(needle: *u8) -> i64 {
  let nlen: i64 = ds_slen(needle)
  let dfd: i64 = sys_openat_rd("/proc\x00" as *u8)
  if dfd < 0 { return 0 }
  let dbuf: *u8 = sys_mmap(DS_MAGIC_65536)
  let path: *u8 = sys_mmap(64)
  let cmdbuf: *u8 = sys_mmap(DS_MAGIC_65536)
  var killed: i64 = 0
  var reading: i64 = 1
  while reading == 1 {
      let dn: i64 = sys_getdents64(dfd, dbuf, DS_MAGIC_65536)
      if dn <= 0 { reading = 0 }
      else {
          var off: i64 = 0
          while off < dn {
              let recp: *u8 = (((dbuf as i64) + off)) as *u8
              let reclen: i64 = dirent_reclen(recp)
              let nm: *u8 = dirent_name(recp)
              // numeric dir name -> a pid
              if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) {
                  var pi: i64 = 0
                  let pre: *u8 = "/proc/" as *u8
                  while pre[pi] != (0 as u8) { path[pi] = pre[pi]; pi = pi + 1 }
                  var qi: i64 = 0
                  while nm[qi] != (0 as u8) { path[pi] = nm[qi]; pi = pi + 1; qi = qi + 1 }
                  let suf: *u8 = "/cmdline" as *u8
                  var si: i64 = 0
                  while suf[si] != (0 as u8) { path[pi] = suf[si]; pi = pi + 1; si = si + 1 }
                  path[pi] = 0 as u8
                  let cfd: i64 = sys_openat_rd(path)
                  if cfd >= 0 {
                      let clen: i64 = sys_read(cfd, cmdbuf, DS_MAGIC_65535)
                      sys_close(cfd)
                      if clen > 0 {
                          // cmdline is NUL-separated; replace NULs with spaces for substring search
                          var ci: i64 = 0
                          while ci < clen { if (cmdbuf[ci] as i64) == 0 { cmdbuf[ci] = 32 as u8 } ci = ci + 1 }
                          var found: i64 = 0
                          if clen >= nlen {
                              var s: i64 = 0
                              let last: i64 = clen - nlen
                              while s <= last {
                                  var m: i64 = 0
                                  var eq: i64 = 1
                                  while m < nlen { if cmdbuf[s + m] != needle[m] { eq = 0; m = nlen } m = m + 1 }
                                  if eq == 1 { found = 1; s = last + 1 } else { s = s + 1 }
                              }
                          }
                          if found == 1 { nx_kill(ds_atoi(nm), 9); killed = killed + 1 }
                      }
                  }
              } }
              off = off + reclen
          }
      }
  }
  sys_close(dfd)
  sys_munmap(dbuf, DS_MAGIC_65536)
  sys_munmap(path, 64)
  sys_munmap(cmdbuf, DS_MAGIC_65536)
  return killed
233}
234
235// ---- resolve the registry cmd's argv0 to an absolute binary path: "./x"|"x" -> cwd/x ; "/abs" -> as-is ----
236func ds_resolve_bin(cwd: *u8, cmd: *u8, out: *u8) -> i64 {
  var o: i64 = 0
  var s: i64 = 0
  if cmd[0] != (47 as u8) {
      var ci: i64 = 0
      while cwd[ci] != (0 as u8) { out[o] = cwd[ci]; o = o + 1; ci = ci + 1 }
      if o > 0 { if out[o - 1] != (47 as u8) { out[o] = 47 as u8; o = o + 1 } }
      if cmd[0] == (46 as u8) { if cmd[1] == (47 as u8) { s = 2 } }
  }
  var go: i64 = 1
  while go == 1 {
      if cmd[s] == (0 as u8) { go = 0 }
      else { if (cmd[s] as i64) == 32 { go = 0 }
      else { out[o] = cmd[s]; o = o + 1; s = s + 1 } }
  }
  out[o] = 0 as u8
  return o
253}
254
255// ---- exe-identity sweep (ports the tools_selfheal.sh stale-inode port-theft guard into the organ) ----
256// A daemon can look "healthy" while the WRONG binary serves: an instance running from a DELETED inode
257// (pre-deploy binary, or a port thief) responds fine but is stale code -- responds-health cannot see it
258// (this exact class ate a day of post-deploy checks on :18096). Identity = readlink /proc/<pid>/exe vs
259// the registry-resolved binary path. mode 0: return 1 if any "<bin> (deleted)" runner exists. mode 1:
260// kill -9 EVERY match (live or deleted -- mirrors tools_selfheal) and return the kill count. BY DESIGN
261// a deploy (mv new ELF over old) flips every revive row to the new binary within one cycle. Buffers are
262// caller-hoisted (bounded-VSZ); the readlink itself munmaps its own scratch.
263func ds_exe_sweep(bin: *u8, mode: i64, dbuf: *u8, path: *u8, rl: *u8) -> i64 {
  let blen: i64 = ds_slen(bin)
  let dfd: i64 = sys_openat_rd("/proc\x00" as *u8)
  if dfd < 0 { return 0 }
  var hit: i64 = 0
  var reading: i64 = 1
  while reading == 1 {
      let dn: i64 = sys_getdents64(dfd, dbuf, DS_MAGIC_65536)
      if dn <= 0 { reading = 0 }
      else {
          var off: i64 = 0
          while off < dn {
              let recp: *u8 = (((dbuf as i64) + off)) as *u8
              let reclen: i64 = dirent_reclen(recp)
              let nm: *u8 = dirent_name(recp)
              if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) {
                  var pi: i64 = 0
                  let pre: *u8 = "/proc/" as *u8
                  while pre[pi] != (0 as u8) { path[pi] = pre[pi]; pi = pi + 1 }
                  var qi: i64 = 0
                  while nm[qi] != (0 as u8) { path[pi] = nm[qi]; pi = pi + 1; qi = qi + 1 }
                  let suf: *u8 = "/exe" as *u8
                  var si: i64 = 0
                  while suf[si] != (0 as u8) { path[pi] = suf[si]; pi = pi + 1; si = si + 1 }
                  path[pi] = 0 as u8
                  let n: i64 = sys_readlinkat(path, rl, 300)
                  if n >= blen {
                      var eq: i64 = 1
                      var k: i64 = 0
                      while k < blen { if rl[k] != bin[k] { eq = 0; k = blen } k = k + 1 }
                      if eq == 1 {
                          var kind: i64 = 0
                          if n == blen { kind = 1 }
                          if n == blen + 10 {
                              let dsx: *u8 = " (deleted)" as *u8
                              var dj: i64 = 0
                              var deq: i64 = 1
                              while dj < 10 { if rl[blen + dj] != dsx[dj] { deq = 0; dj = 10 } dj = dj + 1 }
                              if deq == 1 { kind = 2 }
                          }
                          if mode == 0 { if kind == 2 { hit = 1 } }
                          if mode == 1 { if kind > 0 { nx_kill(ds_atoi(nm), 9); hit = hit + 1 } }
                      }
                  }
              } }
              off = off + reclen
          }
      }
  }
  sys_close(dfd)
  return hit
314}
315
316// ---- registry integrity gate (2026-07-16): the maturity census surfaced that daemons.reg is an
317// owner-writable plain file -> a local write injects revive-exec. We fork+exec nx_reg_sign VERIFY each
318// cycle (composition -- keeps the never-brick supervisor free of crypto) and apply a FAIL-SAFE policy
319// (below in main). The check itself can NEVER take the fleet down: any non-clean result falls to grace.
320// exit-code extract: signaled/stopped -> -1 (treated as check-unavailable, not tamper).
321func ds_exitcode(status: i64) -> i64 {
  if (status & 127) != 0 { return 0 - 1 }
  return (status >> 8) & 255
324}
325// returns: 0 valid · 3 invalid(TAMPER) · 4 sig-absent(grace) · 126 tool-missing · -1 signaled/timeout
326func ds_verify_reg() -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let nul: i64 = sys_openat_rd("/dev/null\x00" as *u8)
      if nul >= 0 { sys_dup3(nul, 1, 0); sys_dup3(nul, 2, 0) }
      let argv: *i64 = sys_mmap(8 * 6) as *i64
      argv[0] = ("./nx_reg_sign.elf" as *u8) as i64
      argv[1] = ("verify" as *u8) as i64
      argv[2] = ("daemons.reg" as *u8) as i64
      argv[3] = ("tools_cap_secret.key" as *u8) as i64
      argv[4] = 0
      let envp: *i64 = sys_mmap(8 * 2) as *i64
      envp[0] = 0
      sys_execve_clean("./nx_reg_sign.elf" as *u8, argv, envp)
      sys_exit(126)
  }
  if pid < 0 { return 0 - 1 }
  let st: *i64 = sys_mmap(8) as *i64
  var waited: i64 = 0
  var rc: i64 = 0 - 1
  var done: i64 = 0
  while done == 0 {
      let r: i64 = sys_wait4(pid, st, 1)
      if r == pid { rc = ds_exitcode(st[0]); done = 1 }
      else {
          if waited >= DS_MAGIC_8000 { nx_kill(pid, 9); sys_wait4(pid, st, 0); done = 1 }
          sys_sleep_ms(50)
          waited = waited + 50
      }
  }
  sys_munmap(st as *u8, 8)
  return rc
358}
359
360// ---- sovereign /status server (forked child): serves the seqlock-shared fleet snapshot over HTTP on
361// 127.0.0.1:DS_STATUS_PORT. Replaces status FILES (tsv) entirely -- sovereign up and down: organ memory ->
362// shared page -> HTTP text only at the boundary (interop@boundary, sovereign@core). Exact Content-Length
363// (CL-LAW). The seqlock (seq odd=writer-active, re-check after copy) keeps reads tear-free without locks.
364// ---- PARENT PROBE (2026-09-02) -- the served page names the PARENT's kernel state ------------------------------
365// Measured that day: three generations of this daemon published their initial snapshot and then never reached the
366// registry read, on the NAS only (the same binary ticks every 15 s on the laptop). From outside, a parent blocked in
367// D-state behind a btrfs transaction and a parent that died leave the SAME orphaned child serving the SAME page.
368// The child can answer that itself: /proc/self/stat field 4 is its parent's pid, and /proc/<ppid>/stat + wchan say
369// whether that parent is S, D, R or gone (ppid 1 = ORPHAN). One bounded read each, appended to every response, so
370// the /status page carries the discriminator hostctl's guard and every seat lacked. No syscall the estate lacks.
371const DS_PROC_CAP: i64 = 512
372func ds_proc_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let n: i64 = sys_read(fd, buf, cap - 1)
  sys_close(fd)
  if n < 0 { return 0 - 1 }
  buf[n] = 0 as u8
  return n
380}
381// ds_stat_state_at / ds_atoi_at / ds_stat_ppid live in nx_dsup_lib.nx (gate-driven on real stat-line shapes)
382func ds_proc_path(dst: *u8, pid: i64, leaf: *u8) -> i64 {
  var w: i64 = 0
  w = ds_sappend(dst, w, "/proc/" as *u8)
  w = w + ds_decw(pid, (((dst as i64) + w)) as *u8)
  w = ds_sappend(dst, w, leaf)
  dst[w] = 0 as u8
  return w
389}
390// append "parent pid=<p> state=<c> wchan=<sym>\n" (or the ORPHAN / UNREADABLE form) to body at blen; bounded.
391func ds_parent_line(body: *u8, blen: i64, pst: *u8, pwc: *u8, ppath: *u8) -> i64 {
  if blen + 128 > DS_SHARED_SZ { return blen }
  var w: i64 = blen
  let sn: i64 = ds_proc_read("/proc/self/stat" as *u8, pst, DS_PROC_CAP)
  if sn <= 0 { w = ds_sappend(body, w, "parent UNREADABLE(self-stat)\n" as *u8); return w }
  let ppid: i64 = ds_stat_ppid(pst, sn)
  if ppid <= 1 { w = ds_sappend(body, w, "parent ORPHAN(ppid=" as *u8); w = w + ds_decw(ppid, (((body as i64) + w)) as *u8); w = ds_sappend(body, w, ") -- the supervisor loop is DEAD, this child serves its last snapshot\n" as *u8); return w }
  ds_proc_path(ppath, ppid, "/stat" as *u8)
  let pn: i64 = ds_proc_read(ppath, pst, DS_PROC_CAP)
  ds_proc_path(ppath, ppid, "/wchan" as *u8)
  let wn: i64 = ds_proc_read(ppath, pwc, DS_PROC_CAP)
  w = ds_sappend(body, w, "parent pid=" as *u8); w = w + ds_decw(ppid, (((body as i64) + w)) as *u8)
  w = ds_sappend(body, w, " state=" as *u8)
  let sp: i64 = ds_stat_state_at(pst, pn)
  if pn > 0 { if sp >= 0 { body[w] = pst[sp]; w = w + 1 } }
  if pn <= 0 { w = ds_sappend(body, w, "?" as *u8) }
  w = ds_sappend(body, w, " wchan=" as *u8)
  var k: i64 = 0
  while k < wn { if k < 64 { if pwc[k] != (10 as u8) { body[w] = pwc[k]; w = w + 1 } } k = k + 1 }
  if wn <= 0 { w = ds_sappend(body, w, "?" as *u8) }
  body[w] = 10 as u8; w = w + 1
  return w
413}
414
415func ds_status_server(shm: *u8) -> i64 {
  let shq: *i64 = shm as *i64
  let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
  if lfd < 0 { sys_exit(3) }
  let one: *i64 = sys_mmap(8) as *i64
  one[0] = 1
  sys_setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, one as *u8, 4)
  let sa: *u8 = sys_mmap(16)
  hp_sockaddr(sa, DS_STATUS_PORT, 127, 0, 0, 1)
  if sys_bind(lfd, sa, 16) < 0 {
      // NAMED, not silent (2026-09-02): a bind refusal here used to exit(4) without a word, so an instance whose port
      // was held by an orphaned status child of an earlier generation ran with NO status surface and hostctl's cycle
      // guard read it as silence. The line below is what tells the next reader which of the two it is.
      ds_log("nx_daemon_supervisor: /status child could NOT bind 127.0.0.1:18095 -- another holder owns the port (an orphaned status child of an earlier generation?); this instance runs with NO status surface and hostctl's cycle guard reads it as silent\n" as *u8)
      sys_exit(4)
  }
  sys_listen(lfd, 16)
  let req: *u8 = sys_mmap(DS_MAGIC_2048)
  let body: *u8 = sys_mmap(DS_SHARED_SZ)
  let out: *u8 = sys_mmap(DS_SHARED_SZ + 256)
  let pst: *u8 = sys_mmap(DS_PROC_CAP)     // parent probe scratch (hoisted: no per-request mmap)
  let pwc: *u8 = sys_mmap(DS_PROC_CAP)
  let ppath: *u8 = sys_mmap(64)
  var run: i64 = 1
  while run == 1 {
      let afd: i64 = sys_accept(lfd)
      if afd >= 0 {
          sys_set_socket_timeout(afd, 3)
          sys_read(afd, req, DS_MAGIC_2047)
          var blen: i64 = 0
          var got: i64 = 0
          var tries: i64 = 0
          while got == 0 {
              let s1: i64 = shq[0]
              if (s1 % 2) == 0 {
                  var bl: i64 = shq[1]
                  if bl > DS_SHARED_SZ - 16 { bl = DS_SHARED_SZ - 16 }
                  if bl < 0 { bl = 0 }
                  var ci: i64 = 0
                  while ci < bl { body[ci] = shm[16 + ci]; ci = ci + 1 }
                  if shq[0] == s1 { blen = bl; got = 1 }
              }
              tries = tries + 1
              if tries > DS_MAGIC_10000 { got = 1 }
          }
          blen = ds_parent_line(body, blen, pst, pwc, ppath)
          var w: i64 = 0
          w = ds_sappend(out, w, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: " as *u8)
          w = w + ds_decw(blen, (((out as i64) + w)) as *u8)
          out[w] = 13 as u8; w = w + 1
          out[w] = 10 as u8; w = w + 1
          out[w] = 13 as u8; w = w + 1
          out[w] = 10 as u8; w = w + 1
          var bi: i64 = 0
          while bi < blen { out[w] = body[bi]; w = w + 1; bi = bi + 1 }
          sys_write(afd, out, w)
          sys_close(afd)
      }
  }
  return 0
475}
476
477// ---- BOUNDED LIFE, DATA-DRIVEN (2026-09-02, /compare/loadgov LV9 ds_self_recycle) ----------------------------
478// MEASURED 2026-09-02: this daemon held 5.9 GB of a 24 GB swap (VmSize 9.5 GB, +24-32 kB/s), was EXEMPT-TERM in
479// resgov by the never-terminate-what-nothing-restarts law, and the execution-surface census read it as launched
480// by NOTHING in the estate -- so the largest swap holder on the box was the one process no governor could touch.
481// The clock already solves this shape (TLN_MAXWINDOWS: bounded windows per life, clean exit, hostctl respawns).
482// This is the same discipline for the fleet supervisor, ARMED BY DATA: knowledge/status/daemon_supervisor.conf
483// carries `life_cycles=<n>` (0 or absent = never recycle, i.e. today's behaviour byte-for-byte). It must stay
484// unarmed until a parent exists (hostctl's hc_guard_dsup, same day) -- a supervisor that exits with no reviver
485// leaves the fleet unsupervised, which is why the bound is a conf row and not a compiled constant.
486// PURE decision below so a gate can pin it; the exit path kills the /status child first so the new instance
487// can bind DS_STATUS_PORT instead of inheriting an orphan on it.
488const DS_LIFE_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/status/daemon_supervisor.conf"
489const DS_LIFE_CAP: i64 = 4096
490func ds_self_recycle(cyc: i64, life: i64) -> i64 {
  if life <= 0 { return 0 }
  if cyc >= life { return 1 }
  return 0
494}
495func ds_life_cycles() -> i64 {
  let szp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(DS_LIFE_CONF, szp)
  if (b as i64) == 0 { return 0 }
  let n: i64 = szp[0]
  // ROOT CAUSE OF THE SILENT SUPERVISOR (2026-09-02, measured by the status child's parent probe: parent state=R
  // wchan=0 on every generation since this conf was armed, while the identical binary ticked every 15 s on a laptop
  // that has NO conf). The key match that stood here exited its inner loop by writing 99 into the cursor, which then
  // read key[99] -- 87 bytes PAST the 12-byte literal -- and looped for as long as that rodata byte was non-zero.
  // nx_srclint's CURSOR-SENTINEL idiom, inside the organ that supervises the fleet. The match is now ds_conf_int
  // (nx_dsup_lib): line-anchored, every exit a return, gate-driven with a NAS-shaped conf (nx_daemon_supervisor_gate).
  let v: i64 = ds_conf_int(b, n, "life_cycles=" as *u8)
  sys_munmap(b, n)
  return v
509}
510
511// seqlock publish of stat[0..sw) followed by the trailer tb[0..tw): ONE writer (the parent); the /status child re-checks
512// the seq. Extracted 2026-09-02 so the initial snapshot, every per-row publish and the cycle-end publish are ONE ruler.
513func ds_publish(shm: *u8, shq: *i64, stat: *u8, sw: i64, tb: *u8, tw: i64) -> i64 {
  shq[0] = shq[0] + 1
  var pj: i64 = 0
  while pj < sw { shm[16 + pj] = stat[pj]; pj = pj + 1 }
  var tj: i64 = 0
  while tj < tw { shm[16 + sw + tj] = tb[tj]; tj = tj + 1 }
  shq[1] = sw + tw
  shq[0] = shq[0] + 1
  return 0
522}
523// ds_clamp0 / ds_trailer live in nx_dsup_lib.nx (the progress trailer is gate-pinned there)
524// a row past its own probe bound is blocked OUTSIDE the probe (exe sweep / ring append / fork = the storm's D-state) --
525// name the stage in the log so the blocker is read, not guessed. lb is the hoisted 256 B line buffer.
526func ds_slow_row(lb: *u8, nm: *u8, total: i64, a: i64, b: i64, c: i64) -> i64 {
  var w: i64 = 0
  w = ds_sappend(lb, w, "supervisor: SLOW-ROW " as *u8); w = ds_sappend(lb, w, nm)
  w = ds_sappend(lb, w, " ms=" as *u8); w = w + ds_decw(ds_clamp0(total), (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " sweep=" as *u8); w = w + ds_decw(ds_clamp0(a), (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " probe=" as *u8); w = w + ds_decw(ds_clamp0(b), (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " after=" as *u8); w = w + ds_decw(ds_clamp0(c), (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " (blocked outside the probe bound)\n" as *u8)
  lb[w] = 0 as u8
  return ds_log(lb)
536}
537func ds_cycle_log(lb: *u8, rows: i64, ms: i64) -> i64 {
  var w: i64 = 0
  w = ds_sappend(lb, w, "nx_daemon_supervisor: first cycle published rows=" as *u8); w = w + ds_decw(rows, (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " cycle_ms=" as *u8); w = w + ds_decw(ds_clamp0(ms), (((lb as i64) + w)) as *u8)
  w = ds_sappend(lb, w, " (the /status snapshot now carries cycle=1 with rows)\n" as *u8)
  lb[w] = 0 as u8
  return ds_log(lb)
544}
545
546func main() -> i64 {
  ds_log("nx_daemon_supervisor: LIVE -- data-driven fleet supervision from daemons.reg (responds-health + tls-probe + exe-identity + revive + /status, bounded-VSZ)\n" as *u8)
  // per-name consecutive-fail state (parallel arrays, matched by name each cycle). names[] entries are
  // persisted name copies (mmap'd once per NEW name, bounded to DS_MAX -- not a per-cycle allocation).
  let names: *i64 = sys_mmap(DS_MAX * 8) as *i64
  let fails: *i64 = sys_mmap(DS_MAX * 8) as *i64
  var nstate: i64 = 0
  // sovereign /status surface: THIS loop writes the fleet snapshot into a fork-shared seqlock page each
  // cycle; a forked child serves it on 127.0.0.1:DS_STATUS_PORT. No tsv, no status files, no shell.
  let shm: *u8 = sys_mmap_shared(DS_SHARED_SZ)
  let shq: *i64 = shm as *i64
  shq[0] = 0
  shq[1] = 0
  let sspid: i64 = sys_fork()
  if sspid == 0 { ds_status_server(shm); sys_exit(0) }
  var cyc: i64 = 0
  // --- hoisted reusable buffers: allocated ONCE, reused every cycle. The loop below does ZERO sys_mmap. ---
  let rst:    *i64 = sys_mmap(8) as *i64
  let regbuf: *u8  = sys_mmap(DS_REGCAP)
  let nm:     *u8  = sys_mmap(64)
  let cwd:    *u8  = sys_mmap(256)
  let cmd:    *u8  = sys_mmap(512)
  let pb:     *u8  = sys_mmap(16)
  let arm:    *u8  = sys_mmap(16)
  let pt:     *u8  = sys_mmap(16)
  let lb:     *u8  = sys_mmap(256)
  let rb:     *u8  = sys_mmap(256)
  let sbin:   *u8  = sys_mmap(320)
  let sdbuf:  *u8  = sys_mmap(DS_MAGIC_65536)
  let spath:  *u8  = sys_mmap(64)
  let srl:    *u8  = sys_mmap(320)
  let stat:   *u8  = sys_mmap(DS_SHARED_SZ)
  let tb:     *u8  = sys_mmap(DS_TRAILER_MAX)
  var tick: i64 = 0                        // monotonic publish counter (see ds_trailer)
  // INITIAL SNAPSHOT (2026-09-02): publish `cycle=1 starting` BEFORE the first probe loop. The status child served an
  // EMPTY body for the whole first cycle (and forever, when a parent died before its first publish), and hostctl's
  // cycle guard could not tell "starting" from "orphaned". cycle=1 here, so the guard's first observation is an
  // ADVANCE from its zeroed state; the loop's first publish repeats 1 and its second advances to 2.
  var sw0: i64 = 0
  sw0 = ds_sappend(stat, sw0, "nx_daemon_supervisor fleet (daemons.reg) cycle=1 starting -- first probe loop not yet complete\n" as *u8)
  tick = tick + 1
  let tw0: i64 = ds_trailer(tb, tick, 0, "-" as *u8, 0, 0, 0, 1, 0)
  ds_publish(shm, shq, stat, sw0, tb, tw0)
  let goodbuf: *u8 = sys_mmap(DS_REGCAP)   // last integrity-VALID registry bytes (held on tamper)
  var goodlen: i64 = 0
  var trust_state: i64 = 0 - 1             // prev integrity state, for edge-triggered (no-spam) logging
  var forever: i64 = 1
  while forever == 1 {
      // reap any exited launched children so they never zombie (reuses rst)
      var reap: i64 = 1
      while reap == 1 { if sys_wait4(0 - 1, rst, 1) > 0 { reap = 1 } else { reap = 0 } }
597
      cyc = cyc + 1
      var rowi: i64 = 0                                 // rows completed this cycle (the trailer's row=)
      let t_cyc0: i64 = sys_now_realtime_ms()
      // BOUNDED LIFE (2026-09-02): data-armed via daemon_supervisor.conf life_cycles=; 0/absent = never. Kills the
      // /status child first so the respawned instance can bind DS_STATUS_PORT; the children in daemons.reg are NOT
      // touched (they are setsid daemons and the next instance re-adopts them by name, exactly as after a crash).
      if ds_self_recycle(cyc, ds_life_cycles()) == 1 {
          ds_log("nx_daemon_supervisor: LIFE-RECYCLE -- cycle bound reached (daemon_supervisor.conf life_cycles); clean exit, the parent guard (nx_hostctl hc_guard_dsup) respawns a fresh instance; fleet daemons untouched\n" as *u8)
          nx_kill(sspid, 9)
          sys_exit(0)
      }
      let now: i64 = sys_now_realtime_sec()   // one timestamp for this cycle's TSDB samples
      var sw: i64 = 0
      sw = ds_sappend(stat, sw, "nx_daemon_supervisor fleet (daemons.reg) cycle=" as *u8)
      sw = sw + ds_decw(cyc, (((stat as i64) + sw)) as *u8)
613
      var rlen: i64 = ds_read_reg(regbuf, DS_REGCAP)
      // PRE-LOOP STAGE TICKS (2026-09-02): the registry read and the signature verify (a fork+exec of nx_reg_sign under an
      // 8 s bound) run BEFORE the first row, so a parent that blocks or dies there publishes no row tick and the page reads
      // exactly like a parent that never started its loop. Publish a tick after each stage, named in last=, so the page
      // says WHICH pre-loop stage the parent last completed. ms_after carries the stage's own cost.
      tick = tick + 1
      let twg: i64 = ds_trailer(tb, tick, rowi, "stage:regread" as *u8, 0, 0, sys_now_realtime_ms() - t_cyc0, 1, 0)
      ds_publish(shm, shq, stat, sw, tb, twg)
      let t_vr0: i64 = sys_now_realtime_ms()
      // ---- INTEGRITY GATE (verify-before-apply; FAIL-SAFE; never bricks) ----
      // signing is a DELIBERATE act (nx_reg_sign sign), so an un-re-signed change = "changed outside the
      // signer" = the threat. valid -> apply + cache good. sig-absent -> grace (migration). invalid ->
      // HOLD last-good (tamper caught + surfaced), or cold-start grace if no good yet. check-unavailable
      // (tool missing/timeout) -> grace + a DISTINCT note (never a false tamper alarm).
      let vrc: i64 = ds_verify_reg()
      var trust: *u8 = "signed" as *u8
      var tcode: i64 = 0
      if vrc == 0 {
          goodlen = rlen
          var gi: i64 = 0; while gi < rlen { goodbuf[gi] = regbuf[gi]; gi = gi + 1 }
      } else { if vrc == 4 {
          trust = "unsigned-grace" as *u8; tcode = 1
          goodlen = rlen
          var gj: i64 = 0; while gj < rlen { goodbuf[gj] = regbuf[gj]; gj = gj + 1 }
      } else { if vrc == 3 {
          if goodlen > 0 {
              trust = "HELD-TAMPER" as *u8; tcode = 2
              var gk: i64 = 0; while gk < goodlen { regbuf[gk] = goodbuf[gk]; gk = gk + 1 }
              rlen = goodlen
          } else { trust = "UNVERIFIED-coldstart" as *u8; tcode = 3 }
      } else {
          // tool missing / signaled / timeout: cannot claim integrity, but do not brick or false-alarm
          trust = "check-unavailable" as *u8; tcode = 4
          if goodlen == 0 { goodlen = rlen; var gm: i64 = 0; while gm < rlen { goodbuf[gm] = regbuf[gm]; gm = gm + 1 } }
      } } }
      // edge-triggered security log (only on transition -- no 15s spam)
      if tcode != trust_state {
          var lw: i64 = 0
          if tcode == 2 { lw = ds_sappend(lb, lw, "supervisor: SECURITY daemons.reg signature INVALID -> HOLDING last-good, refusing to apply (run nx_reg_sign after legit edits)\n" as *u8) }
          else { if tcode == 3 { lw = ds_sappend(lb, lw, "supervisor: SECURITY daemons.reg INVALID at cold-start, no last-good -> grace-applied (CRITICAL: sign the registry)\n" as *u8) }
          else { if tcode == 1 { lw = ds_sappend(lb, lw, "supervisor: NOTE daemons.reg UNSIGNED -> grace; run nx_reg_sign sign to enable tamper-evidence\n" as *u8) }
          else { if tcode == 4 { lw = ds_sappend(lb, lw, "supervisor: NOTE integrity check unavailable (nx_reg_sign.elf?) -> grace-applied\n" as *u8) }
          else { lw = ds_sappend(lb, lw, "supervisor: daemons.reg integrity OK (signed)\n" as *u8) } } } }
          lb[lw] = 0 as u8
          ds_log(lb)
          trust_state = tcode
      }
      sw = ds_sappend(stat, sw, " integrity=" as *u8)
      sw = ds_sappend(stat, sw, trust)
      stat[sw] = 10 as u8
      sw = sw + 1
      tick = tick + 1
      let twv: i64 = ds_trailer(tb, tick, rowi, "stage:verify" as *u8, 0, 0, sys_now_realtime_ms() - t_vr0, 1, 0)
      ds_publish(shm, shq, stat, sw, tb, twv)
668
      if rlen > 0 {
          var pos: i64 = 0
          while pos < rlen {
              // skip blank / comment lines
              if (regbuf[pos] as i64) == 35 { pos = ds_next_line(regbuf, pos, rlen) }
              else { if (regbuf[pos] as i64) == 10 { pos = pos + 1 }
              else { if (regbuf[pos] as i64) == 13 { pos = pos + 1 }
              else {
                  let le: i64 = ds_line_end(regbuf, pos, rlen)
                  let nn: i64 = ds_field(regbuf, pos, le, 0, nm, 64)
                  ds_field(regbuf, pos, le, 1, cwd, 256)
                  ds_field(regbuf, pos, le, 2, cmd, 512)
                  ds_field(regbuf, pos, le, 3, pb, 16)
                  ds_field(regbuf, pos, le, 4, arm, 16)
                  ds_field(regbuf, pos, le, 5, pt, 16)     // probe type: "tls" or "" (default http)
                  if nn > 0 {
                      let t_row0: i64 = sys_now_realtime_ms()
                      let port: i64 = ds_atoi(pb)
                      // find/allocate fail-state slot for this name
                      var slot: i64 = 0 - 1
                      var si: i64 = 0
                      while si < nstate { if ds_streq((names[si]) as *u8, nm) == 1 { slot = si; si = nstate } si = si + 1 }
                      if slot < 0 { if nstate < DS_MAX {
                          let np: *u8 = sys_mmap(64); var ci: i64 = 0; while nm[ci] != (0 as u8) { np[ci] = nm[ci]; ci = ci + 1 } np[ci] = 0 as u8
                          names[nstate] = np as i64; fails[nstate] = 0; slot = nstate; nstate = nstate + 1
                      } }
                      // arm semantics ladder: watch (observe) < guard (kill wedges + stale inodes; the
                      // PRIMARY owner relaunches -- control-plane wedge-arm parity) < revive (guard + the
                      // organ itself relaunches when nothing else does).
                      let is_rev: i64 = ds_streq(arm, "revive" as *u8)
                      let is_grd: i64 = ds_streq(arm, "guard" as *u8)
                      // exe-identity guard (revive+guard rows): a stale-inode runner serves "healthy"
                      // from pre-deploy code. KILL every match, then DON'T launch here -- a faster primary
                      // owner (nx_hostctl's ppid-respawn, seconds) relaunches from the new inode and the
                      // next probe sees SERVING; with no primary, the normal 2-fail discipline backstops.
                      // Launching here would contest the bind against the primary's respawn loop.
                      if is_rev + is_grd >= 1 {
                          ds_resolve_bin(cwd, cmd, sbin)
                          if ds_exe_sweep(sbin, 0, sdbuf, spath, srl) == 1 {
                              let nk: i64 = ds_exe_sweep(sbin, 1, sdbuf, spath, srl)
                              var rw: i64 = 0
                              let f1: *u8 = "supervisor: EXE-PURGE " as *u8; var fi: i64 = 0; while f1[fi] != (0 as u8) { rb[rw] = f1[fi]; rw = rw + 1; fi = fi + 1 }
                              var fn: i64 = 0; while nm[fn] != (0 as u8) { rb[rw] = nm[fn]; rw = rw + 1; fn = fn + 1 }
                              let f2: *u8 = " stale-inode killed=" as *u8; fi = 0; while f2[fi] != (0 as u8) { rb[rw] = f2[fi]; rw = rw + 1; fi = fi + 1 }
                              rw = rw + ds_decw(nk, (((rb as i64) + rw)) as *u8)
                              let f3: *u8 = " (relaunch: primary owner, else 2-fail backstop)" as *u8; fi = 0; while f3[fi] != (0 as u8) { rb[rw] = f3[fi]; rw = rw + 1; fi = fi + 1 }
                              rb[rw] = 10 as u8; rw = rw + 1; rb[rw] = 0 as u8
                              ds_log(rb)
                          }
                      }
                      let t_sw: i64 = sys_now_realtime_ms()
                      var v: i64 = 0
                      if ds_streq(pt, "tls" as *u8) == 1 { v = hp_probe_tls(port, DS_PROBE_TMO) }
                      else { if ds_streq(pt, "ws" as *u8) == 1 { v = hp_probe_ws(port, DS_PROBE_TMO) }
                      else { v = hp_probe(port, DS_PROBE_TMO) } }
                      let t_pr: i64 = sys_now_realtime_ms()
                      if v == HP_SERVING { if slot >= 0 { fails[slot] = 0 } }
                      else {
                          if slot >= 0 { fails[slot] = fails[slot] + 1 }
                          // slot < 0 means the name table filled (DS_MAX): fails[-1] reads the word BEFORE the
                          // array -- a garbage counter that then decides BOTH remediation (fc == 2 revives) and
                          // log suppression (fc <= 3 logs, else every 40th), so an over-capacity row could be
                          // silently never revived AND never logged -- invisible in both channels at once.
                          // The increment above was already guarded; this read was not.
                          var fc: i64 = 0
                          if slot >= 0 { fc = fails[slot] }
                          // log the down/hung sighting (reuses lb)
                          var w: i64 = 0
                          let m1: *u8 = "supervisor: " as *u8; var mi: i64 = 0; while m1[mi] != (0 as u8) { lb[w] = m1[mi]; w = w + 1; mi = mi + 1 }
                          var qi: i64 = 0; while nm[qi] != (0 as u8) { lb[w] = nm[qi]; w = w + 1; qi = qi + 1 }
                          let m2: *u8 = " probe=" as *u8; mi = 0; while m2[mi] != (0 as u8) { lb[w] = m2[mi]; w = w + 1; mi = mi + 1 }
                          let pv: *u8 = hp_name(v); var vi: i64 = 0; while pv[vi] != (0 as u8) { lb[w] = pv[vi]; w = w + 1; vi = vi + 1 }
                          let m3: *u8 = " fails=" as *u8; mi = 0; while m3[mi] != (0 as u8) { lb[w] = m3[mi]; w = w + 1; mi = mi + 1 }
                          w = w + ds_decw(fc, (((lb as i64) + w)) as *u8)
                          lb[w] = 10 as u8; w = w + 1; lb[w] = 0 as u8
                          // suppress steady-state down-spam on watch rows: log the transition (fails 1-3),
                          // then resurface every 40th cycle (~10 min). /status always shows live truth.
                          if fc <= 3 { ds_log(lb) } else { if (fc % 40) == 0 { ds_log(lb) } }
                          // ARMED remediation on 2 consecutive fails, split by verdict:
                          //   HUNG    -> KILL-ONLY (frees the wedged port; primary respawns, else the
                          //              REFUSED path backstops next cycle -- never contest the bind)
                          //   REFUSED -> revive rows launch (nothing is listening; safe to bind)
                          //   BADRESP -> wrong process holds the port; surfaced via log//status only
                          if fc >= 2 { if is_rev + is_grd >= 1 {
                              if v == HP_HUNG {
                                  let wk: i64 = ds_kill_wedged(cmd)
                                  var ww: i64 = 0
                                  let w1: *u8 = "supervisor: WEDGE-KILL " as *u8; var wi: i64 = 0; while w1[wi] != (0 as u8) { rb[ww] = w1[wi]; ww = ww + 1; wi = wi + 1 }
                                  var wn: i64 = 0; while nm[wn] != (0 as u8) { rb[ww] = nm[wn]; ww = ww + 1; wn = wn + 1 }
                                  let w2: *u8 = " killed=" as *u8; wi = 0; while w2[wi] != (0 as u8) { rb[ww] = w2[wi]; ww = ww + 1; wi = wi + 1 }
                                  ww = ww + ds_decw(wk, (((rb as i64) + ww)) as *u8)
                                  let w3: *u8 = " (relaunch: primary owner, else backstop)" as *u8; wi = 0; while w3[wi] != (0 as u8) { rb[ww] = w3[wi]; ww = ww + 1; wi = wi + 1 }
                                  rb[ww] = 10 as u8; ww = ww + 1; rb[ww] = 0 as u8
                                  ds_log(rb)
                              }
                              if v == HP_REFUSED { if is_rev == 1 {
                                  let newpid: i64 = ds_launch(cwd, cmd)
                                  var rw: i64 = 0
                                  let r1: *u8 = "supervisor: REVIVED " as *u8; var ri: i64 = 0; while r1[ri] != (0 as u8) { rb[rw] = r1[ri]; rw = rw + 1; ri = ri + 1 }
                                  var ni: i64 = 0; while nm[ni] != (0 as u8) { rb[rw] = nm[ni]; rw = rw + 1; ni = ni + 1 }
                                  let r2: *u8 = " pid=" as *u8; ri = 0; while r2[ri] != (0 as u8) { rb[rw] = r2[ri]; rw = rw + 1; ri = ri + 1 }
                                  rw = rw + ds_decw(newpid, (((rb as i64) + rw)) as *u8)
                                  rb[rw] = 10 as u8; rw = rw + 1; rb[rw] = 0 as u8
                                  ds_log(rb)
                                  fails[slot] = 0
                              } }
                          } }
                      }
                      // SOVEREIGN TSDB (folded in 2026-07-16, operator "no sprawl"): the PRODUCER writes
                      // its own sample -- the supervisor already computed v (this cycle's probe) + the fail
                      // count, so it appends inline. No separate collector, no HTTP self-poll (that was
                      // sprawl re-deriving this organ's own output). Fail-safe: mr_append returns <0 on any
                      // error and is ignored -- a bounded data-file append can never brick (rule 26 = hw).
                      var rf: i64 = 0
                      if slot >= 0 { rf = fails[slot] }
                      mr_append(DS_RING, now, mr_hash(nm), v, rf)
                      // /status row: name verdict fails arm probe :port (bounded append)
                      if sw < DS_SHARED_SZ - DS_ROW_MAX - DS_TRAILER_MAX {
                          sw = ds_sappend(stat, sw, nm)
                          sw = ds_sappend(stat, sw, " " as *u8)
                          sw = ds_sappend(stat, sw, hp_name(v))
                          sw = ds_sappend(stat, sw, " fails=" as *u8)
                          var fv: i64 = 0
                          if slot >= 0 { fv = fails[slot] }
                          sw = sw + ds_decw(fv, (((stat as i64) + sw)) as *u8)
                          sw = ds_sappend(stat, sw, " " as *u8)
                          sw = ds_sappend(stat, sw, arm)
                          sw = ds_sappend(stat, sw, " " as *u8)
                          if pt[0] == (0 as u8) { sw = ds_sappend(stat, sw, "http" as *u8) } else { sw = ds_sappend(stat, sw, pt) }
                          sw = ds_sappend(stat, sw, " :" as *u8)
                          sw = sw + ds_decw(port, (((stat as i64) + sw)) as *u8)
                          stat[sw] = 10 as u8
                          sw = sw + 1
                      }
                      // PER-ROW PROGRESS (2026-09-02): publish after EVERY row, not only at cycle end, so /status shows the row
                      // being worked and its stage costs while the cycle is in flight. A cycle-granular counter read "wedged"
                      // for a cycle that was merely slow under the storm; a row-granular tick names the slow stage instead.
                      rowi = rowi + 1
                      let t_ap: i64 = sys_now_realtime_ms()
                      tick = tick + 1
                      let twr: i64 = ds_trailer(tb, tick, rowi, nm, t_sw - t_row0, t_pr - t_sw, t_ap - t_pr, 1, 0)
                      ds_publish(shm, shq, stat, sw, tb, twr)
                      if t_ap - t_row0 > DS_PROBE_TMO * 1000 { ds_slow_row(lb, nm, t_ap - t_row0, t_sw - t_row0, t_pr - t_sw, t_ap - t_pr) }
                  }
                  pos = ds_next_line(regbuf, pos, rlen)
              } } }
          }
      }
      // seqlock publish of this cycle's snapshot (odd seq = writer active; readers re-check)
      tick = tick + 1
      let twc: i64 = ds_trailer(tb, tick, rowi, "-" as *u8, 0, 0, 0, 0, sys_now_realtime_ms() - t_cyc0)
      ds_publish(shm, shq, stat, sw, tb, twc)
      // the first boundary is LOGGED once (2026-09-02): a parent that dies inside its first cycle leaves no trace, and
      // a parent that finishes it leaves this line -- the discriminator the orphan investigation lacked. Carries rows= and
      // cycle_ms= so the first cycle's cost under whatever load it met is a number, not an adjective.
      if cyc == 1 { ds_cycle_log(lb, rowi, sys_now_realtime_ms() - t_cyc0) }
      sys_sleep_ms(DS_CYCLE_SEC * 1000)
  }
  return 0
828}
nx_daemon_supervisor.nx source

`nx_daemon_supervisor.nx` source
