`nx_memvel.nx` source

↩ module page · 395 lines · 22165 B
1// nx_memvel.nx -- WHICH process is EATING memory, ranked by SUSTAINED growth (seq1365 / seq1376).
2//
3// WHY IT EXISTS: nx_resmon ranks by MAGNITUDE, so a stable 3 GB tenant outranks a 50 MB process
4// doubling every minute and the real leaker hides. Measured 2026-07-30: swap 525->609 permil in 51 min
5// (~2.03 GB, ~40 MB/min) while the worst_committed process grew ~1 MB. LAW: a census that reports a
6// LEVEL cannot find a LEAK.
7//
8// ★★WHY IT IS N-SAMPLE (this organ's own v1 was WRONG -- seq1376): the FIRST version took ONE 5-second
9// window and I published its top row as a unified root cause. The very next run of the same organ put a
10// DIFFERENT process on top (3560 kB/s vs the previous winner's 1597) and demoted the old winner to #3.
11// The top slot ROTATES. A one-shot ranking of a noisy signal is a coin flip dressed as a finding -- the
12// exact ONE-WINDOW-IS-NOT-A-RATE defect (seq1340) committed by the author of that law, using the tool
13// built to prevent it. Knowing a discipline is not obeying it, so the discipline is now STRUCTURAL:
14// this organ CANNOT report a single-window ranking, because it no longer takes one.
15//
16// ★THE DECIDING COLUMN IS grew_in=k/N, NOT the rate. A real leak grows in EVERY window (k=N). A process
17// that tops one window and vanishes from the next is NOISE, and now says so on its own line. Rate alone
18// cannot distinguish them, which is precisely how v1 misled.
19// Rule 15: top-k, pid-join and rate arithmetic imported from nx_ctxtop_lib / nx_procchurn_lib.
20// Exit 0 = sampled; 3 = UNMEASURED (fail-closed).
21// license_tier: ORIGINAL   Read-only. No hw writes (Rule 26).   expect_exit: 0
22import "nx_ctxtop_lib.nx"
23import "nx_proc_ctl.nx"
24import "nx_ioadmit_lib.nx"   // the ONE shared /proc/stat ncpu parser (ioa_ncpu) -- never a baked core count
25
26const MV_MAXP: i64 = 2048
27const MV_TABLE_BYTES: i64 = 16384
28const MV_DIRBUF: i64 = 65536
29const MV_STATBUF: i64 = 4096
30const MV_TOPK: i64 = 8
31const MV_TOPK_BYTES: i64 = 128
32const MV_ROUNDS: i64 = 5
33const MV_WINDOW_MS: i64 = 1200
34const MV_US_PER_MS: i64 = 1000
35const MV_NAMEOFF: i64 = 6
36const MV_EXIT_UNMEASURED: i64 = 3
37const MV_EXIT_REFUSED: i64 = 4
38const MV_ADMIT_DEFAULT: i64 = 800
39const MV_CONFBUF: i64 = 4096
40const MV_STATBUF: i64 = 65536   // whole-file /proc/stat read, sized like BA_READCAP so it cannot short-read
41const MV_LOADBUF: i64 = 128
42// The status file is FIXED-SHAPE: 6 numeric fields, under 48 bytes of labels, and 6 newlines (one field
43// per line -- rm_field is LINE-ANCHORED). An i64 renders in at most 20 digits, so it cannot exceed
44// 6*20 + 48 + 6 = 174 bytes. 256 is therefore a PROVEN bound derived from the widest value the type can
45// hold -- not a guessed ceiling, and it cannot truncate. (Corrected from 168: the first count omitted
46// the newlines, which is exactly the kind of off-by-a-term that makes a "derived" bound a guess again.)
47const MV_STATUSLINE: i64 = 256
48
49// committed = RSS + Swap. Judging on COMMITTED (never VmSize/VmData) is inherited from nx_resmon's own
50// correction: VmData counts reservations never faulted in and once reported 40.6 GiB on a 36.9 GB box.
51func mv_committed(sbuf: *u8, sn: i64) -> i64 {
  let r: i64 = rm_field(sbuf, sn, "VmRSS:" as *u8)
  let w: i64 = rm_field(sbuf, sn, "VmSwap:" as *u8)
  if r < 0 { return 0 - 1 }
  var t: i64 = r
  if w > 0 { t = t + w }
  return t
58}
59
60func mv_scan(pids: *i64, kbs: *i64, dbuf: *u8, path: *u8, sbuf: *u8) -> i64 {
  var cnt: i64 = 0
  let fd: i64 = sys_openat_rd("/proc" as *u8)
  if fd < 0 { return 0 }
  var run: i64 = 1
  while run == 1 {
      let n: i64 = sys_getdents64(fd, dbuf, MV_DIRBUF)
      if n <= 0 { run = 0 } else {
          var off: i64 = 0
          while off < n {
              let rec: *u8 = ((dbuf as i64) + off) as *u8
              let reclen: i64 = dirent_reclen(rec)
              if reclen <= 0 { off = n } else {
                  let nm: *u8 = dirent_name(rec)
                  if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) { if cnt < MV_MAXP {
                      var p: i64 = 0
                      let pre: *u8 = "/proc/" as *u8
                      var a: i64 = 0
                      while pre[a] != (0 as u8) { path[p] = pre[a]; p = p + 1; a = a + 1 }
                      var pidv: i64 = 0
                      a = 0
                      while nm[a] != (0 as u8) { path[p] = nm[a]; pidv = pidv * 10 + ((nm[a] as i64) - 48); p = p + 1; a = a + 1 }
                      let suf: *u8 = "/status" as *u8
                      a = 0
                      while suf[a] != (0 as u8) { path[p] = suf[a]; p = p + 1; a = a + 1 }
                      path[p] = 0 as u8
                      let sn: i64 = rm_read(path, sbuf, MV_STATBUF)
                      if sn > 0 {
                          let c: i64 = mv_committed(sbuf, sn)
                          if c >= 0 { pids[cnt] = pidv; kbs[cnt] = c; cnt = cnt + 1 }
                      }
                  } } }
                  off = off + reclen
              }
          }
      }
  }
  sys_close(fd)
  return cnt
99}
100
101// Fill <out> with the process name for <pid>, NUL-terminated; returns the length, 0 when the process
102// is gone. EXTRACTED from mv_putname because the status FILE needs the name as DATA, not as stdout.
103// ★★★★★A VALUE THAT EXISTS ONLY AS PRINTED TEXT CANNOT BE PUBLISHED, so every consumer of the status
104// plane learned that something was leaking and had no way to learn WHAT -- the name was computed on
105// every run and thrown away one line later.
106func mv_getname(pid: i64, path: *u8, sbuf: *u8, out: *u8, cap: i64) -> i64 {
  var p: i64 = 0
  let pre: *u8 = "/proc/" as *u8
  var a: i64 = 0
  while pre[a] != (0 as u8) { path[p] = pre[a]; p = p + 1; a = a + 1 }
  p = pc_catn(path, p, pid)
  let suf: *u8 = "/status" as *u8
  a = 0
  while suf[a] != (0 as u8) { path[p] = suf[a]; p = p + 1; a = a + 1 }
  path[p] = 0 as u8
  let sn: i64 = rm_read(path, sbuf, MV_STATBUF)
  if sn <= 0 { out[0] = 0 as u8; return 0 }
  var z: i64 = MV_NAMEOFF
  var w: i64 = 0
  while z < sn { if sbuf[z] == (10 as u8) { z = sn } else { if w < cap - 2 { out[w] = sbuf[z]; w = w + 1 } z = z + 1 } }
  out[w] = 0 as u8
  return w
123}
124// Unchanged behaviour for every existing caller: same "<gone>" on a vanished pid, same bytes on stdout.
125func mv_putname(pid: i64, path: *u8, sbuf: *u8) -> i64 {
  let out: *u8 = sys_mmap(64)
  let w: i64 = mv_getname(pid, path, sbuf, out, 64)
  if w <= 0 { rm_puts("<gone>" as *u8) } else { rm_puts(out) }
  sys_munmap(out, 64)
  return 0
131}
132
133func main() -> i64 {
  // ADMISSION CONTROL (seq341 / seq1389): 5 rounds x ~450 procs = ~2700 openat+read+close per run.
  // That is a real load, and this organ exists to measure a box already under pressure -- exactly when
  // adding to it is worst. ★LAW: A DIAGNOSTIC THAT CANNOT REFUSE TO RUN IS A LOAD GENERATOR WITH GOOD
  // INTENTIONS. Fail-CLOSED: an unreadable loadavg REFUSES (ct_admit), because not knowing the load is
  // not permission to add to it.
  let cbuf: *u8 = sys_mmap(MV_CONFBUF)
  let cn: i64 = rm_read("knowledge/status/procchurn.conf" as *u8, cbuf, MV_CONFBUF)
  let maxload: i64 = rm_conf(cbuf, cn, "admit-max-load-centi" as *u8, MV_ADMIT_DEFAULT)
  let lbuf: *u8 = sys_mmap(MV_LOADBUF)
  let ln: i64 = rm_read("/proc/loadavg" as *u8, lbuf, MV_LOADBUF)
  let loadc: i64 = ct_load_centi(lbuf, ln)
  // RUN-QUEUE ADMISSION (2026-08-21). The deciding axis is CPU headroom, NOT loadavg -- see
  // ct_admit_runq for the measurement that forced it: this organ was refused CONTINUOUSLY for 7.4 h
  // while procs_running sat at 1-3 of 8 and swap climbed past its 700 permil bar, because loadavg on
  // this NAS is dominated by RAID D-state that a procfs walker can neither cause nor deepen. ncpu is
  // DERIVED by the one shared parser. loadavg is still read and still PRINTED as context in the
  // refusal -- it simply no longer decides. Fail-CLOSED on an unreadable /proc/stat.
  let mvsbuf: *u8 = sys_mmap(MV_STATBUF)
  let mvsn: i64 = rm_read("/proc/stat" as *u8, mvsbuf, MV_STATBUF)
  var mv_ncpu: i64 = 0
  var mv_run: i64 = 0 - 1
  if mvsn > 0 {
      mv_ncpu = ioa_ncpu(mvsbuf, mvsn)
      mv_run = rm_field(mvsbuf, mvsn, "procs_running" as *u8)
  }
  if ct_admit_runq(mv_run, mv_ncpu) == 0 {
      rm_puts("NX-MEMVEL verdict=REFUSED procs_running=" as *u8); rm_num(mv_run)
      rm_puts(" ncpu=" as *u8); rm_num(mv_ncpu)
      rm_puts(" load_centi=" as *u8); rm_num(loadc)
      rm_puts(" retired_load_bar=" as *u8); rm_num(maxload)
      rm_puts(" why=CPU run queue saturated; load is CONTEXT ONLY and no longer decides (it counts D-state disk wait a procfs walker cannot cause); a /proc-walking diagnostic must not add to it (seq341)\n" as *u8)
      // ★★★★★★A REFUSING RUN AND A MISSING RUN ARE INDISTINGUISHABLE FROM OUTSIDE, AND THAT
      // INDISTINGUISHABILITY *IS* THE DEFECT. Measured 2026-08-21: memvel.status sat frozen at one
      // epoch for 7.2 h against a 600 s beat (~43 missed intervals) while swap climbed past its 700
      // permil bar -- and FOUR lanes reached FOUR different mechanisms for it (a daily producer, a
      // plumbing mismatch, a cadence-vs-bound error, a dead beat) because from outside there was
      // nothing to read. The beat was firing the whole time; admission was declining it above; the
      // organ returned BEFORE any write. A guard that declines to work must STAMP ITS REFUSAL, or it
      // is silently identical to a dead beat -- and it fails in the FLATTERING direction, so nobody
      // investigates. Witnessed live at load_centi=1300 vs max=800 with the status file untouched.
      // ⚠SEPARATE FILE, NEVER memvel.status: a refusal written into the status artifact would make the
      // leak axis ACQUIT on a measurement that never happened -- strictly worse than the blindness it
      // fixes. A reader proves LIVENESS from max(status.epoch, refused.epoch) and keeps proving the
      // MEASUREMENT from status.epoch alone. Purely additive, so every current consumer parses exactly
      // what it did before (rule 19).
      // ONE FIELD PER LINE -- rm_field's contract, the same one the status write below documents; a
      // space-separated line parses only its FIRST field and every later one reads as ABSENT.
      // Buffer reuses MV_STATUSLINE deliberately: same purpose (a status record this organ writes),
      // and this record is 3 fields against the status write's 9, so it cannot be the binding one.
      let rnl: *u8 = sys_mmap(8)
      rnl[0] = 10 as u8
      rnl[1] = 0 as u8
      let rb: *u8 = sys_mmap(MV_STATUSLINE)
      var ro: i64 = 0
      ro = rm_lcat(rb, ro, "epoch=" as *u8)
      ro = rm_lnum(rb, ro, sys_now_realtime_sec())
      ro = rm_lcat(rb, ro, rnl)
      ro = rm_lcat(rb, ro, "load_centi=" as *u8)
      ro = rm_lnum(rb, ro, loadc)
      ro = rm_lcat(rb, ro, rnl)
      ro = rm_lcat(rb, ro, "max_centi=" as *u8)
      ro = rm_lnum(rb, ro, maxload)
      ro = rm_lcat(rb, ro, rnl)
      let rfd: i64 = sys_openat_wr("knowledge/status/memvel.refused" as *u8, MODE_0644)
      var rw: i64 = 0
      if rfd >= 0 { rw = sys_write(rfd, rb, ro); sys_close(rfd) }
      sys_munmap(rb, MV_STATUSLINE)
      sys_munmap(rnl, 8)
      // THE PUBLISH ANNOUNCES ITSELF, so a silent failure is a number rather than a guess.
      rm_puts("NX-MEMVEL refusal_publish fd=" as *u8); rm_num(rfd)
      rm_puts(" wrote=" as *u8); rm_num(rw)
      rm_puts(" of=" as *u8); rm_num(ro)
      rm_puts(" path=knowledge/status/memvel.refused\n" as *u8)
      return MV_EXIT_REFUSED
  }
  let pa: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64   // previous scan pids
  let ka: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64   // previous scan committed kB
  let pb: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64   // current scan pids
  let kb: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64   // current scan committed kB
  let ap: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64   // accumulator pids
  let asum: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64 // accumulator summed positive delta (kB)
  let acnt: *i64 = sys_mmap(MV_TABLE_BYTES) as *i64 // accumulator: in how many windows it GREW
  let dbuf: *u8 = sys_mmap(MV_DIRBUF)
  let path: *u8 = sys_mmap(256)
  let sbuf: *u8 = sys_mmap(MV_STATBUF)
219
  let t0: i64 = sys_now_us()
  var na: i64 = mv_scan(pa, ka, dbuf, path, sbuf)
  if na <= 0 { rm_puts("NX-MEMVEL verdict=UNMEASURED why=/proc walk empty\n" as *u8); return MV_EXIT_UNMEASURED }
  var nacc: i64 = 0
  var grew_total: i64 = 0
  var r: i64 = 0
  var nb: i64 = 0
  while r < MV_ROUNDS {
      sys_sleep_ms(MV_WINDOW_MS)
      nb = mv_scan(pb, kb, dbuf, path, sbuf)
      var i: i64 = 0
      while i < nb {
          let j: i64 = ct_find(pa, na, pb[i])
          if j >= 0 {
              let d: i64 = kb[i] - ka[j]
              if d > 0 {
                  grew_total = grew_total + d
                  var s: i64 = ct_find(ap, nacc, pb[i])
                  if s < 0 { if nacc < MV_MAXP { ap[nacc] = pb[i]; asum[nacc] = 0; acnt[nacc] = 0; s = nacc; nacc = nacc + 1 } }
                  if s >= 0 { asum[s] = asum[s] + d; acnt[s] = acnt[s] + 1 }
              }
          }
          i = i + 1
      }
      // current becomes previous (copy, so the next round diffs against THIS scan)
      var c: i64 = 0
      while c < nb { pa[c] = pb[c]; ka[c] = kb[c]; c = c + 1 }
      na = nb
      r = r + 1
  }
  let el: i64 = (sys_now_us() - t0) / MV_US_PER_MS
  if el <= 0 { rm_puts("NX-MEMVEL verdict=UNMEASURED why=zero-length observation\n" as *u8); return MV_EXIT_UNMEASURED }
252
  let tp: *i64 = sys_mmap(MV_TOPK_BYTES) as *i64
  let tr: *i64 = sys_mmap(MV_TOPK_BYTES) as *i64
  var used: i64 = 0
  var q: i64 = 0
  while q < nacc { used = ct_topk_insert(tp, tr, MV_TOPK, used, ap[q], asum[q]); q = q + 1 }
258
  // ★THE DECIDING COLUMN, AGGREGATED (2026-08-14). acnt[] already held "in how many of the N windows
  // did this process grow", and the report has always printed it PER ROW -- but a per-row field that
  // is never totalled is a measurement no caller can branch on. So every consumer fell back to the
  // LEVEL census in nx_resmon, whose leak axis is a SNAPSHOT relation (VmSize==VmPeak) that cannot
  // express growth at all and therefore flags arena-once daemons -- the leak-FREE design -- as leaks.
  // A process that grew in EVERY window (k==N) is the only shape that is a leak rather than a
  // rotating top slot. That count is what this organ owes its callers, emitted on a canonical LAST
  // line so the parse anchors BY POSITION and never on prose that happens to use the same word.
  // THE COUNT IS THE DECISION, so it lives in nx_resmon_lib where its referee can reach it and where
  // there is exactly ONE definition of "sustained". The rate below is REPORTING, not judgement.
  let sustained: i64 = rm_sustained_count(acnt, nacc, MV_ROUNDS)
  var sust_rate: i64 = 0
  // ★★★★★A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE. The published status carried sustained=1 and a
  // rate but never WHICH PROCESS, so resgov, the beat and a human all learned that something was
  // leaking and none of them could open an investigation. Measured 2026-08-16: two runs reported
  // sustained=1 at 1027 and 1264 kB/s and the only way to learn the offender was to re-run the organ
  // by hand and read its stdout -- on a host that REFUSES the scan when it is saturated, which is
  // exactly when you need the name. Carry the identity with the number that indicts it.
  // WORST, not first: with several sustained growers the actionable one is the fastest, and "first"
  // would hand the investigator whichever pid happened to sort earliest.
  var sust_pid: i64 = 0
  var sust_worst: i64 = 0
  var u: i64 = 0
  while u < nacc {
      if acnt[u] >= MV_ROUNDS {
          let r: i64 = pc_rate(asum[u], el)
          sust_rate = sust_rate + r
          if r > sust_worst { sust_worst = r; sust_pid = ap[u] }
      }
      u = u + 1
  }
290
  rm_puts("NX-MEMVEL rounds=" as *u8); rm_num(MV_ROUNDS)
  rm_puts(" total_ms=" as *u8); rm_num(el)
  rm_puts(" procs=" as *u8); rm_num(nb)
  rm_puts(" grew_kb=" as *u8); rm_num(grew_total)
  rm_puts(" growers=" as *u8); rm_num(nacc); rm_puts("\n" as *u8)
  var k: i64 = 0
  while k < used {
      let s2: i64 = ct_find(ap, nacc, tp[k])
      rm_puts("  #" as *u8); rm_num(k + 1)
      rm_puts(" pid=" as *u8); rm_num(tp[k])
      rm_puts(" kb_per_sec=" as *u8); rm_num(pc_rate(tr[k], el))
      rm_puts(" grew_in=" as *u8)
      if s2 >= 0 { rm_num(acnt[s2]) } else { rm_num(0) }
      rm_puts("/" as *u8); rm_num(MV_ROUNDS)
      rm_puts(" name=" as *u8)
      mv_putname(tp[k], path, sbuf)
      rm_puts("\n" as *u8)
      k = k + 1
  }
  rm_puts("READ grew_in FIRST: k/" as *u8); rm_num(MV_ROUNDS)
  rm_puts(" = SUSTAINED leak; anything less is a rotating top slot = NOISE, not a finding (seq1376)\n" as *u8)
  if nb >= MV_MAXP { rm_puts("  WARNING scan CAPPED -- coverage INCOMPLETE, totals are a floor\n" as *u8) }
  var cov: i64 = 1
  if nb >= MV_MAXP { cov = 0 }
  rm_puts("NX-MEMVEL sustained=" as *u8); rm_num(sustained)
  rm_puts(" sustained_kb_per_sec=" as *u8); rm_num(sust_rate)
  rm_puts(" rounds=" as *u8); rm_num(MV_ROUNDS)
  rm_puts(" coverage_complete=" as *u8); rm_num(cov)
  rm_puts("\n" as *u8)
320
  // PUBLISH IT. nx_resmon runs on a per-minute beat and must not pay 6 seconds and ~3000 syscalls to
  // learn this number, so the measurement is published as ONE OVERWRITTEN LINE rather than an append
  // log: the reader wants CURRENT, and the trend is already carried by resmon.log, which stamps this
  // value into its own appended row every beat. ★ONE FILE, ONE PURPOSE -- and a log nothing reads is
  // an unwired artifact, not a feature.
  // ★★THE EPOCH FIELD IS LOAD-BEARING: without it a reader cannot tell a fresh measurement from a
  // fossil, and A STALE FIXTURE SILENCES A GATE. Consumers MUST treat absent-or-stale as UNOBSERVABLE,
  // never as zero -- an unobserved leak axis voting GREEN is exactly the failure this work removed.
  // ONE FIELD PER LINE -- this is rm_field's CONTRACT, not a formatting preference. Its docstring is
  // explicit: "first integer on the line that STARTS with key". A space-separated line therefore
  // parses only its FIRST field and every later one reads as ABSENT. My first cut wrote all six on
  // one line: epoch= parsed, sustained= returned -1, and nx_resmon reported the axis UNOBSERVABLE
  // with a perfectly good file sitting right there. ★★★★★READ THE PARSER'S CONTRACT BEFORE CHOOSING
  // THE PRODUCER'S FORMAT -- the reader was already written, already correct and already documented;
  // the producer was the half that was wrong, and a format mismatch fails as a CONFIDENT WRONG ANSWER
  // ("unobservable") rather than as an error.
  // ⚠The newline is CONSTRUCTED, never a bare literal: a string literal that IS a newline is ambiguous
  // to the nx lexer and has silently unseparated whole output streams in this estate before.
  let nlb: *u8 = sys_mmap(8)
  nlb[0] = 10 as u8
  nlb[1] = 0 as u8
  let sb: *u8 = sys_mmap(MV_STATUSLINE)
  var so: i64 = 0
  so = rm_lcat(sb, so, "epoch=" as *u8)
  so = rm_lnum(sb, so, sys_now_realtime_sec())
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "sustained=" as *u8)
  so = rm_lnum(sb, so, sustained)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "kbps=" as *u8)
  so = rm_lnum(sb, so, sust_rate)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "rounds=" as *u8)
  so = rm_lnum(sb, so, MV_ROUNDS)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "procs=" as *u8)
  so = rm_lnum(sb, so, nb)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "coverage=" as *u8)
  so = rm_lnum(sb, so, cov)
  so = rm_lcat(sb, so, nlb)
  // THE ACTIONABLE HALF. ONE FIELD PER LINE, per rm_field's contract documented above -- these are
  // APPENDED after the existing fields, so every current reader keeps parsing exactly what it did
  // (rule 19: adding a field is safe, moving one is not).
  // worst_pid=0 / worst_name=none is the HONEST empty state: it says "no sustained grower", which is
  // a different fact from "I did not look" (that one is the absent-or-stale epoch above).
  let wn: *u8 = sys_mmap(64)
  var wl: i64 = 0
  if sust_pid > 0 { wl = mv_getname(sust_pid, path, sbuf, wn, 64) }
  if wl <= 0 { wn[0] = 110 as u8; wn[1] = 111 as u8; wn[2] = 110 as u8; wn[3] = 101 as u8; wn[4] = 0 as u8 }
  so = rm_lcat(sb, so, "worst_pid=" as *u8)
  so = rm_lnum(sb, so, sust_pid)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "worst_kbps=" as *u8)
  so = rm_lnum(sb, so, sust_worst)
  so = rm_lcat(sb, so, nlb)
  so = rm_lcat(sb, so, "worst_name=" as *u8)
  so = rm_lcat(sb, so, wn)
  so = rm_lcat(sb, so, nlb)
  sys_munmap(wn, 64)
  sys_munmap(nlb, 8)
  let sfd: i64 = sys_openat_wr("knowledge/status/memvel.status" as *u8, MODE_0644)
  var wrote: i64 = 0
  if sfd >= 0 { wrote = sys_write(sfd, sb, so); sys_close(sfd) }
  sys_munmap(sb, MV_STATUSLINE)
  // ★★★★★★THE FEATURE ANNOUNCES ITSELF, SO ITS ABSENCE IS VISIBLE IN NORMAL OUTPUT. A publish that
  // fails silently produces a clean build and a green run -- absent code has no failure mode, and the
  // only symptom is a consumer that quietly never sees the value. Printing the fd/errno turns a silent
  // no-op into a number, which is the difference between diagnosing this and guessing at it.
  rm_puts("NX-MEMVEL status_publish fd=" as *u8); rm_num(sfd)
  rm_puts(" wrote=" as *u8); rm_num(wrote)
  rm_puts(" of=" as *u8); rm_num(so)
  rm_puts(" path=knowledge/status/memvel.status\n" as *u8)
  return 0
395}
nx_memvel.nx source

`nx_memvel.nx` source
