nx_model_lane_core.nx source
↩ module page · 327 lines · 11649 B
1// nx_model_lane_core.nx -- SOVEREIGN MODEL-LANE LEASE (pure core, no main; CLI = nx_model_lane,
2// gate = nx_model_lane_gate). Eats the 2026-07-16 bug class: multiple sessions launching
3// model-scale workloads (11-12GB dequant caches) into one WSL VM -> kernel OOM storm / VM
4// collapse (dmesg: nx_forge_bestof OOM-killed alongside the 1.5B serve). The Nishi-owned cure:
5// ONE lane lease file gates model-scale launches on this worker -- claim BEFORE launching,
6// free after. Composes the proven idioms: O_EXCL create = the lock (dl_lock/rt_lock lineage,
7// kernel-guaranteed single creator, no TOCTOU) + holder record stamped INTO the lease +
8// staleness = holder-pid dead (via /proc/<pid>/comm) OR age>ttl + /proc/meminfo MemAvailable
9// HEADROOM CHECK (nx_resource_arbiter DENIED_NO_BUDGET semantics at the file level: a FREE
10// lane still refuses a claim the box cannot back).
11// rc map: 0 ok · 10 held-by-other (live holder printed) · 11 headroom-denied ·
12// 12 bad-args · 13 free-refused-not-holder · 14 lease-corrupt (fail-loud, never steal).
13// Record: holder|est_mb|pid|epoch_us|ttl_sec\n (pid = the WORKLOAD's pid, callers pass $$,
14// never the claim CLI's own pid -- the CLI exits immediately).
15// license_tier: ORIGINAL
16import "nx_syscalls.nx"
17import "nx_lib_std.nx"
18
19const ML_LEASE_DEFAULT: *u8 = "knowledge/status/model_lane.lease"
20const ML_OEXCL: i64 = 193 // O_CREAT|O_EXCL|O_WRONLY (dl lineage)
21const ML_MODE: i64 = 420 // 0644
22const ML_FLOOR_MB: i64 = 2048 // headroom floor the CLI enforces above est_mb
23
24func ml_unlink(path: *u8) -> i64 { return __syscall(263, AT_FDCWD, path as i64, 0, 0, 0, 0) }
25
26// ---- host-load admission (the anti-load-105 guard). RESTORED 2026-07-30: the NAS copy of this file was
27// missing ml_ncores/ml_load1/ml_load_over while the laptop SSOT had them, so nx_swarm_queue.nx:303 and
28// nx_swarm_admit.nx:44 could not compile -> nx_swarm_queue_gate + nx_swarm_tend_gate were NEVER BUILT ->
29// the whole `swarm` domain graded CLAIM-ONLY (944 permil claimed, ZERO executable evidence). The seq1379
30// unpack anti-backdating guard REFUSED the fix because it compares MTIME, and the truncated NAS file had
31// been written more recently -- so the guard was protecting the damage. Restored via the content-based
32// CAS write path instead. LAW: mtime ordering is not content correctness.
33// count online cores = /proc/stat lines starting "cpu" + a digit. fallback 1.
34func ml_ncores() -> i64 {
35 let buf: *u8 = sys_mmap(65536) as *u8
36 let fd: i64 = sys_openat_rd("/proc/stat" as *u8)
37 if fd < 0 { return 1 }
38 let n: i64 = sys_read(fd, buf, 65535)
39 sys_close(fd)
40 var cnt: i64 = 0
41 var i: i64 = 0
42 var atbol: i64 = 1
43 while i < n {
44 let c: i64 = buf[i] as i64
45 if atbol == 1 {
46 if i + 3 < n {
47 if buf[i] == (99 as u8) && buf[i+1] == (112 as u8) && buf[i+2] == (117 as u8) {
48 let d: i64 = buf[i+3] as i64
49 if d >= 48 && d <= 57 { cnt = cnt + 1 }
50 }
51 }
52 }
53 atbol = 0
54 if c == 10 { atbol = 1 }
55 i = i + 1
56 }
57 if cnt < 1 { cnt = 1 }
58 return cnt
59}
60
61// 1-minute loadavg INTEGER part from /proc/loadavg field 1 ("68.00" -> 68). -1 unreadable.
62func ml_load1() -> i64 {
63 let buf: *u8 = sys_mmap(256) as *u8
64 let fd: i64 = sys_openat_rd("/proc/loadavg" as *u8)
65 if fd < 0 { return 0 - 1 }
66 let n: i64 = sys_read(fd, buf, 255)
67 sys_close(fd)
68 if n <= 0 { return 0 - 1 }
69 var v: i64 = 0
70 var i: i64 = 0
71 while i < n {
72 let c: i64 = buf[i] as i64
73 if c >= 48 && c <= 57 { v = v * 10 + (c - 48); i = i + 1 }
74 if c < 48 || c > 57 { i = n }
75 }
76 return v
77}
78
79// PURE policy (gate-testable deterministically): is load1 at/over the ceiling? load_max<=0 = disabled.
80func ml_load_over(load1: i64, load_max: i64) -> i64 {
81 if load_max <= 0 { return 0 }
82 if load1 < 0 { return 0 }
83 if load1 >= load_max { return 1 }
84 return 0
85}
86
87// MemAvailable from /proc/meminfo, in MB. -1 if unreadable (callers fail-closed).
88func ml_meminfo_avail_mb() -> i64 {
89 let key: *u8 = "MemAvailable:" as *u8
90 let buf: *u8 = sys_mmap(8192) as *u8
91 let fd: i64 = sys_openat_rd("/proc/meminfo" as *u8)
92 if fd < 0 { return 0 - 1 }
93 let n: i64 = sys_read(fd, buf, 8191)
94 sys_close(fd)
95 if n <= 0 { return 0 - 1 }
96 let kl: i64 = std_slen(key)
97 var pos: i64 = 0 - 1
98 var i: i64 = 0
99 let stop: i64 = n - kl
100 while i <= stop {
101 var j: i64 = 0
102 var hit: i64 = 1
103 while j < kl {
104 let idx: i64 = i + j
105 if buf[idx] != key[j] { hit = 0; j = kl }
106 if hit == 1 { j = j + 1 }
107 }
108 if hit == 1 { pos = i + kl; i = stop + 1 }
109 if hit == 0 { i = i + 1 }
110 }
111 if pos < 0 { return 0 - 1 }
112 var kb: i64 = 0
113 var p: i64 = pos
114 var scan: i64 = 1
115 while scan == 1 {
116 if p >= n { scan = 0 }
117 if scan == 1 {
118 let c: i64 = buf[p] as i64
119 if c == 32 { p = p + 1 }
120 if c >= 48 && c <= 57 { kb = kb * 10 + (c - 48); p = p + 1 }
121 if c != 32 && (c < 48 || c > 57) { scan = 0 }
122 }
123 }
124 return kb / 1024
125}
126
127// is pid alive on this box? (open /proc/<pid>/comm)
128func ml_pid_alive(pid: i64) -> i64 {
129 let pre: *u8 = "/proc/" as *u8
130 let suf: *u8 = "/comm" as *u8
131 let pb: *u8 = sys_mmap(64) as *u8
132 var o: i64 = 0
133 var i: i64 = 0
134 while pre[i] != (0 as u8) { pb[o] = pre[i]; o = o + 1; i = i + 1 }
135 let dl: i64 = std_itoa(pid, pb + o)
136 o = o + dl
137 i = 0
138 while suf[i] != (0 as u8) { pb[o] = suf[i]; o = o + 1; i = i + 1 }
139 pb[o] = 0 as u8
140 let fd: i64 = sys_openat_rd(pb)
141 if fd < 0 { return 0 }
142 sys_close(fd)
143 return 1
144}
145
146// parse "holder|est|pid|us|ttl" -> holder copied into hbuf (cap 64), nums into f[0..3]
147// (est_mb, pid, epoch_us, ttl_sec). 0 ok, -1 malformed.
148func ml_parse(buf: *u8, n: i64, hbuf: *u8, f: *i64) -> i64 {
149 var i: i64 = 0
150 var ho: i64 = 0
151 var ok: i64 = 1
152 var scan: i64 = 1
153 while scan == 1 {
154 if i >= n { ok = 0; scan = 0 }
155 if scan == 1 {
156 let c: i64 = buf[i] as i64
157 if c == 124 { scan = 0 }
158 if c != 124 {
159 if ho < 63 { hbuf[ho] = c as u8; ho = ho + 1 }
160 i = i + 1
161 }
162 }
163 }
164 hbuf[ho] = 0 as u8
165 if ok == 0 { return 0 - 1 }
166 if ho == 0 { return 0 - 1 }
167 i = i + 1
168 var fi: i64 = 0
169 while fi < 4 {
170 var v: i64 = 0
171 var got: i64 = 0
172 var s2: i64 = 1
173 while s2 == 1 {
174 if i >= n { s2 = 0 }
175 if s2 == 1 {
176 let c2: i64 = buf[i] as i64
177 if c2 >= 48 && c2 <= 57 { v = v * 10 + (c2 - 48); got = 1; i = i + 1 }
178 if c2 < 48 || c2 > 57 { s2 = 0 }
179 }
180 }
181 if got == 0 { return 0 - 1 }
182 f[fi] = v
183 fi = fi + 1
184 if fi < 4 {
185 if i >= n { return 0 - 1 }
186 let sep: i64 = buf[i] as i64
187 if sep != 124 { return 0 - 1 }
188 i = i + 1
189 }
190 }
191 return 0
192}
193
194// try the O_EXCL create + stamp. 0 won, -1 lost (exists), -2 write-fail.
195func ml_try_create(path: *u8, holder: *u8, est_mb: i64, pid: i64, ttl_sec: i64) -> i64 {
196 let fd: i64 = __syscall(257, AT_FDCWD, path as i64, ML_OEXCL, ML_MODE, 0, 0)
197 if fd < 0 { return 0 - 1 }
198 let rec: *u8 = sys_mmap(256) as *u8
199 var o: i64 = 0
200 var i: i64 = 0
201 while holder[i] != (0 as u8) { rec[o] = holder[i]; o = o + 1; i = i + 1 }
202 rec[o] = 124 as u8
203 o = o + 1
204 o = o + std_itoa(est_mb, rec + o)
205 rec[o] = 124 as u8
206 o = o + 1
207 o = o + std_itoa(pid, rec + o)
208 rec[o] = 124 as u8
209 o = o + 1
210 let now: i64 = sys_now_us()
211 o = o + std_itoa(now, rec + o)
212 rec[o] = 124 as u8
213 o = o + 1
214 o = o + std_itoa(ttl_sec, rec + o)
215 rec[o] = 10 as u8
216 o = o + 1
217 let w: i64 = sys_write(fd, rec, o)
218 sys_close(fd)
219 if w != o { ml_unlink(path); return 0 - 2 }
220 return 0
221}
222
223// CLAIM the lane. floor_mb: headroom floor added to est_mb (CLI passes ML_FLOOR_MB; gate 0).
224func ml_claim(path: *u8, holder: *u8, est_mb: i64, pid: i64, ttl_sec: i64, floor_mb: i64) -> i64 {
225 let avail: i64 = ml_meminfo_avail_mb()
226 if avail < 0 { std_putln("MODEL-LANE headroom-unreadable (fail closed)" as *u8); return 11 }
227 let need: i64 = est_mb + floor_mb
228 if avail < need {
229 std_puts("MODEL-LANE DENIED-HEADROOM avail_mb=" as *u8)
230 std_pdec(avail)
231 std_puts(" need_mb=" as *u8)
232 std_pdec(need)
233 std_puts("\n" as *u8)
234 return 11
235 }
236 var attempt: i64 = 0
237 while attempt < 2 {
238 let cr: i64 = ml_try_create(path, holder, est_mb, pid, ttl_sec)
239 if cr == 0 {
240 std_puts("MODEL-LANE CLAIMED holder=" as *u8)
241 std_puts(holder)
242 std_puts(" est_mb=" as *u8)
243 std_pdec(est_mb)
244 std_puts("\n" as *u8)
245 return 0
246 }
247 // exists -> inspect holder
248 let buf: *u8 = sys_mmap(512) as *u8
249 let hb: *u8 = sys_mmap(64) as *u8
250 let f: *i64 = sys_mmap(64) as *i64
251 let rfd: i64 = sys_openat_rd(path)
252 if rfd < 0 { attempt = attempt + 1 }
253 if rfd >= 0 {
254 let n: i64 = sys_read(rfd, buf, 511)
255 sys_close(rfd)
256 let pr: i64 = ml_parse(buf, n, hb, f)
257 if pr != 0 {
258 std_putln("MODEL-LANE CORRUPT lease (refusing; inspect + unlink manually)" as *u8)
259 return 14
260 }
261 let alive: i64 = ml_pid_alive(f[1])
262 let age_us: i64 = sys_now_us() - f[2]
263 let ttl_us: i64 = f[3] * 1000000
264 if alive == 1 && age_us <= ttl_us {
265 std_puts("MODEL-LANE HELD holder=" as *u8)
266 std_puts(hb)
267 std_puts(" pid=" as *u8)
268 std_pdec(f[1])
269 std_puts(" est_mb=" as *u8)
270 std_pdec(f[0])
271 std_puts("\n" as *u8)
272 return 10
273 }
274 std_puts("MODEL-LANE reaping stale lease (holder=" as *u8)
275 std_puts(hb)
276 std_puts(" alive=" as *u8)
277 std_pdec(alive)
278 std_puts(")\n" as *u8)
279 ml_unlink(path)
280 attempt = attempt + 1
281 }
282 }
283 std_putln("MODEL-LANE claim lost race after reap" as *u8)
284 return 10
285}
286
287// FREE the lane (holder must match; idempotent on already-free).
288func ml_free(path: *u8, holder: *u8) -> i64 {
289 let buf: *u8 = sys_mmap(512) as *u8
290 let hb: *u8 = sys_mmap(64) as *u8
291 let f: *i64 = sys_mmap(64) as *i64
292 let rfd: i64 = sys_openat_rd(path)
293 if rfd < 0 {
294 std_putln("MODEL-LANE FREE-ALREADY" as *u8)
295 return 0
296 }
297 let n: i64 = sys_read(rfd, buf, 511)
298 sys_close(rfd)
299 let pr: i64 = ml_parse(buf, n, hb, f)
300 if pr == 0 {
301 if std_streq(hb, holder) == 0 {
302 std_puts("MODEL-LANE FREE-REFUSED not-holder (held by " as *u8)
303 std_puts(hb)
304 std_puts(")\n" as *u8)
305 return 13
306 }
307 }
308 ml_unlink(path)
309 std_putln("MODEL-LANE FREED" as *u8)
310 return 0
311}
312
313// STATUS: print FREE or the record.
314func ml_status(path: *u8) -> i64 {
315 let buf: *u8 = sys_mmap(512) as *u8
316 let rfd: i64 = sys_openat_rd(path)
317 if rfd < 0 {
318 std_putln("MODEL-LANE FREE" as *u8)
319 return 0
320 }
321 let n: i64 = sys_read(rfd, buf, 511)
322 sys_close(rfd)
323 std_puts("MODEL-LANE " as *u8)
324 if n > 0 { sys_write(1, buf, n) }
325 if n <= 0 { std_putln("(empty lease file)" as *u8) }
326 return 0
327}