`nx_resgov.nx` source

↩ module page · 524 lines · 30121 B
1// nx_resgov.nx -- THE UNIFIED RESOURCE GOVERNOR (one-shot, cron-invoked every minute).
2//
3//   nx_resgov [conf] [dry]        conf default knowledge/resgov.conf ; `dry` = decide + log, never signal
4//
5// Walks EVERY process, meters VmRSS + VmSwap (the resource that actually hurts), remembers each
6// process's footprint between runs to compute GROWTH VELOCITY, and escalates gracefully long before a
7// ceiling is reached. Default-covered: an unlisted process is governed by the default cap, not ignored.
8// Death is decided here; RESPAWN stays the guard's job (single responsibility -- no dueling supervisors).
9//
10// STATE (velocity memory): knowledge/status/resgov.state, rows `pid:starttime footprint_kb epoch level_ts`.
11// ★IDENTITY IS pid+starttime, NEVER pid ALONE -- Linux reuses pids, and a reused pid would make the
12// velocity of a brand-new process look like the growth of the dead one it replaced, which is how a
13// predictive breaker kills innocents.
14// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
15import "nx_syscalls.nx"
16import "nx_vsz_watchdog_core.nx"   // proven /proc readers: vw_read, vw_status_kb_of, vw_num_at, vw_contains
17import "nx_resgov_core.nx"
18const RG_MAGIC_4096: i64 = 4096
19const RG_MAGIC_4095: i64 = 4095
20const RG_MAGIC_3600: i64 = 3600
21const RG_MAGIC_1024: i64 = 1024
22const RG_MAGIC_1048576: i64 = 1048576
23
24const RG_CONF_CAP: i64 = 16384
25const RG_STATE_CAP: i64 = 262144
26const RG_DIR_CAP: i64 = 65536
27const RG_CMD_CAP: i64 = 8192
28const RG_MAXROWS: i64 = 64
29const RG_MAXPROC: i64 = 2048
30const RG_STATE_PATH: *u8 = "knowledge/status/resgov.state"
31
32func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
33func g_putn(v: i64) -> i64 {
  if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
  var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
  let d: *u8 = sys_mmap(24); var k: i64 = 0
  while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(24); var i: i64 = 0
  while i < k { o[i] = d[k-1-i]; i = i + 1 }
  sys_write(1, o, k)
  return 0
42}
43func g_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
48}
49func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
50// index of the first space in buf[from,to), or -1. ⚠Written as REAL scans returning a POSITION: the
51// first cut of this parser used the loop variable as a break FLAG (i = to + 1) and therefore threw the
52// position away -- it parsed 0 rows out of a perfectly good conf and every policy silently fell back to
53// the in-code defaults. ★A PARSER THAT LOSES THE POSITION REPORTS SUCCESS AND MEANS NOTHING.
54func g_find_sp(buf: *u8, from: i64, to: i64) -> i64 {
  var i: i64 = from
  var found: i64 = 0 - 1
  while i < to { if buf[i] == (32 as u8) { found = i; i = to } else { i = i + 1 } }
  return found
59}
60// index of the first non-space in buf[from,to), or -1 if only spaces remain.
61func g_skip_sp(buf: *u8, from: i64, to: i64) -> i64 {
  var i: i64 = from
  var found: i64 = 0 - 1
  while i < to { if buf[i] != (32 as u8) { found = i; i = to } else { i = i + 1 } }
  return found
66}
67func g_app(buf: *u8, p: i64, s: *u8) -> i64 { var i: i64 = 0; var q: i64 = p; while s[i] != (0 as u8) { buf[q] = s[i]; q = q + 1; i = i + 1 } return q }
68func g_appn(buf: *u8, p: i64, v: i64) -> i64 {
  var q: i64 = p
  if v == 0 { buf[q] = 48 as u8; return q + 1 }
  var m: i64 = v
  if m < 0 { buf[q] = 45 as u8; q = q + 1; m = 0 - m }
  let t: *u8 = sys_mmap(32); var k: i64 = 0
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { buf[q] = t[k-1-i]; q = q + 1; i = i + 1 }
  return q
78}
79
80// process start-time (field 22 of /proc/<pid>/stat) -- the pid-reuse discriminator. 0 unreadable.
81// The comm field can contain spaces AND parens, so scanning starts after the LAST ')'.
82func g_starttime(dirname: *u8) -> i64 {
  let path: *u8 = sys_mmap(256)
  var o: i64 = g_app(path, 0, "/proc/" as *u8)
  o = g_app(path, o, dirname)
  o = g_app(path, o, "/stat" as *u8)
  path[o] = 0 as u8
  let b: *u8 = sys_mmap(RG_MAGIC_4096)
  let n: i64 = vw_read(path, b, RG_MAGIC_4095)
  if n <= 0 { return 0 }
  var close: i64 = 0 - 1
  var i: i64 = 0
  while i < n { if b[i] == (41 as u8) { close = i } i = i + 1 }
  if close < 0 { return 0 }
  // fields after comm: state(3) ppid(4) ... starttime(22) -> the 19th token after ')'
  var tok: i64 = 0
  var j: i64 = close + 1
  let ep: *i64 = sys_mmap(16) as *i64
  var res: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      if j < n {
          if b[j] == (32 as u8) { j = j + 1; go = 1 } else {
              tok = tok + 1
              if tok == 20 { res = vw_num_at(b, n, j, ep) } else {
                  while j < n { if b[j] == (32 as u8) { j = n + 1 } else { j = j + 1 } }
                  if j == n + 1 { j = j - 1 }
                  go = 1
              }
          }
      }
  }
  return res
115}
116
117func main(argc: i64, argv: *i64) -> i64 {
  var confp: *u8 = "knowledge/resgov.conf" as *u8
  if argc >= 2 { confp = argv[1] as *u8 }
  var dry: i64 = 0
  if argc >= 3 { if g_streq(argv[2] as *u8, "dry" as *u8) == 1 { dry = 1 } }
122
  // ---- config (data, not code -- rule 11) ----
  var default_cap_gb: i64 = 0          // 0 = INERT until the operator declares one (fail-safe)
  var head_floor: i64 = 150            // permil of RAM free below which the system counts as scarce
  var swap_ceil: i64 = 500             // permil of swap used above which the system counts as scarce
  var eta_warn_s: i64 = RG_MAGIC_3600
  var eta_act_s: i64 = 900
  var cooldown_s: i64 = 600
  // ---- AGGREGATE thresholds: the ACCUMULATED-DEBT regime (rg_aggregate_level) ----
  // Deliberately STRICTER than the per-process bars above. The per-process ladder governs RATE and
  // asks "is any ONE process too big?"; this asks "is the SUM hurting us with nobody individually to
  // blame?" -- the shape a leak epidemic actually takes. Recycling is for real distress, not busy.
  var agg_swap_ceil: i64 = 800        // permil swap used above which ACCUMULATION counts as distress
  var agg_head_floor: i64 = 100       // permil RAM free below which accumulation counts as distress
  var agg_suspect_floor: i64 = 5      // how many non-exempt holders must exist before blaming the sum
  var agg_suspect_mb: i64 = 256       // a non-exempt process this big counts as one suspect
  var agg_min_act_mb: i64 = RG_MAGIC_1024      // never nominate a holder smaller than this (too small to matter)
  let ex_off: *i64 = sys_mmap(RG_MAXROWS * 8) as *i64
  var n_ex: i64 = 0
  // RECYCLE rows: processes the operator declares RESTART-SAFE. Only these may be destroyed by the
  // aggregate regime -- see rg_aggregate_level. Detection stays universal; destruction is opt-in.
  let rec_off: *i64 = sys_mmap(RG_MAXROWS * 8) as *i64
  var n_rec: i64 = 0
  let cap_off: *i64 = sys_mmap(RG_MAXROWS * 8) as *i64
  let cap_gb: *i64 = sys_mmap(RG_MAXROWS * 8) as *i64
  var n_cap: i64 = 0
148
  let conf: *u8 = sys_mmap(RG_CONF_CAP)
  let cn: i64 = vw_read(confp, conf, RG_CONF_CAP - 1)
  if cn <= 0 { g_puts("[resgov] INERT (no conf at " as *u8); g_puts(confp); g_puts(")\n" as *u8); return 0 }
  let ep: *i64 = sys_mmap(16) as *i64
  var ls: i64 = 0
  while ls < cn {
      var le: i64 = ls
      var sc: i64 = 0
      while sc == 0 { if le >= cn { sc = 1 } else { if conf[le] == (10 as u8) { sc = 1 } else { le = le + 1 } } }
      if le > ls { if conf[ls] != (35 as u8) {
          // key = first token, rest = args
          let keyend: i64 = g_find_sp(conf, ls, le)
          if keyend > ls {
              var vstart: i64 = g_skip_sp(conf, keyend + 1, le)
              if vstart < 0 { vstart = le }
              conf[keyend] = 0 as u8
              let key: *u8 = ((conf as i64) + ls) as *u8
              if g_streq(key, "default_cap_gb" as *u8) == 1 { default_cap_gb = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "headroom_floor_permil" as *u8) == 1 { head_floor = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "swap_ceiling_permil" as *u8) == 1 { swap_ceil = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "eta_warn_s" as *u8) == 1 { eta_warn_s = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "eta_act_s" as *u8) == 1 { eta_act_s = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "cooldown_s" as *u8) == 1 { cooldown_s = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "agg_swap_ceiling_permil" as *u8) == 1 { agg_swap_ceil = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "agg_headroom_floor_permil" as *u8) == 1 { agg_head_floor = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "agg_suspect_floor" as *u8) == 1 { agg_suspect_floor = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "agg_suspect_mb" as *u8) == 1 { agg_suspect_mb = vw_num_at(conf, le, vstart, ep) }
              if g_streq(key, "agg_min_act_mb" as *u8) == 1 { agg_min_act_mb = vw_num_at(conf, le, vstart, ep) }
                              // ***A NEEDLE TERMINATED AT END-OF-LINE SWALLOWS THE TRAILING COMMENT.*** This read
              // conf[le]=0, so `exempt nx_hostctl   # the supervisor itself: ...` produced the needle
              // "nx_hostctl   # the supervisor itself: ..." -- which can never match a cmdline, so the
              // exemption was SILENTLY INERT. FOUR of five rows carried comments: nx_hostctl,
              // nx_daemon_supervisor, nx_resgov and sites.elf -- THE EDGE THAT SERVES EVERY DOMAIN was
              // one over-cap sweep away from being SIGTERMed by its own governor. Only the bare
              // `exempt nx_hub_gw` row ever worked. FOUND 2026-08-06 because the new aggregate pass
              // nominated pid 20547 = ./nx_hostctl supervise, a process it should never have been able
              // to see. ***AN INSTRUMENT THAT REPORTS SOMETHING IMPOSSIBLE HAS FOUND A REAL BUG --
              // IN ITSELF OR IN WHAT IT READS. NEVER EXPLAIN IT AWAY.***
              // Terminate at the first blank instead, matching how `cap` already parses its needle.
              if g_streq(key, "exempt" as *u8) == 1 { if n_ex < RG_MAXROWS {
                  var xend: i64 = g_find_sp(conf, vstart, le)
                  if xend <= vstart { xend = le }
                  if xend > le { xend = le }
                  conf[xend] = 0 as u8
                  ex_off[n_ex] = (conf as i64) + vstart; n_ex = n_ex + 1 } }
                              if g_streq(key, "recycle" as *u8) == 1 { if n_rec < RG_MAXROWS {
                  var rend: i64 = g_find_sp(conf, vstart, le)
                  if rend <= vstart { rend = le }
                  if rend > le { rend = le }
                  conf[rend] = 0 as u8
                  rec_off[n_rec] = (conf as i64) + vstart; n_rec = n_rec + 1 } }
              if g_streq(key, "cap" as *u8) == 1 {
                  // cap <needle> <gb>
                  let nend: i64 = g_find_sp(conf, vstart, le)
                  if nend > vstart {
                      let gstart: i64 = g_skip_sp(conf, nend + 1, le)
                      if gstart > 0 {
                          let gb: i64 = vw_num_at(conf, le, gstart, ep)
                          if gb >= 1 { if n_cap < RG_MAXROWS { conf[nend] = 0 as u8; cap_off[n_cap] = (conf as i64) + vstart; cap_gb[n_cap] = gb; n_cap = n_cap + 1 } }
                      }
                  }
              }
          }
      } }
      ls = le + 1
  }
215
  // ---- system pressure (measured live, never assumed) ----
  let mi: *u8 = sys_mmap(RG_CONF_CAP)
  let min_: i64 = vw_read("/proc/meminfo" as *u8, mi, RG_CONF_CAP - 1)
  var headroom: i64 = 0 - 1
  var swapper: i64 = 0 - 1
  if min_ > 0 {
      let mtot: i64 = rg_meminfo_kb(mi, min_, "MemTotal:" as *u8)
      let mav: i64 = rg_meminfo_kb(mi, min_, "MemAvailable:" as *u8)
      let stot: i64 = rg_meminfo_kb(mi, min_, "SwapTotal:" as *u8)
      let sfree: i64 = rg_meminfo_kb(mi, min_, "SwapFree:" as *u8)
      headroom = rg_headroom_permil(mav, mtot)
      if stot > 0 { if sfree >= 0 { swapper = rg_swap_permil(stot - sfree, stot) } }
  }
  let pressured: i64 = rg_system_pressured(headroom, swapper, head_floor, swap_ceil)
230
  // SWAP FLOW -- MEASURED AND EMITTED, DELIBERATELY NOT ACTED ON (2026-08-07).
  // swap_permil above is OCCUPANCY, a STOCK. Measured live this morning it read 677 permil on a box
  // doing 1 kB/s swap-in, 0 kB/s swap-out, 0 major faults/s, with the edge answering in 22 ms --
  // cold pages parked where they belong, which is swap doing its job, not scarcity. So `pressured=1`
  // can be true on a completely healthy box, which is exactly what it reported.
  // Pressure is a FLOW. These cumulative counters make the RATE derivable from any two consecutive
  // runs (the sweep is on a fixed interval), at zero state cost.
  // WHY THE PREDICATE IS UNTOUCHED: gate tooth T12 encodes occupancy-as-pressure deliberately,
  // against the real 08-04 outage -- and the paging RATE during that incident was never recorded.
  // Gating pressure on flow now would weaken a governor that prevented a real outage on the strength
  // of an assumption about data nobody has. Collect the evidence first; let the next incident decide
  // on numbers instead of on my reasoning about a past one.
  let vm: *u8 = sys_mmap(RG_CONF_CAP)
  let vmn: i64 = vw_read("/proc/vmstat" as *u8, vm, RG_CONF_CAP - 1)
  var pswpin: i64 = 0 - 1
  var pswpout: i64 = 0 - 1
  if vmn > 0 {
      pswpin = rg_meminfo_kb(vm, vmn, "pswpin " as *u8)
      pswpout = rg_meminfo_kb(vm, vmn, "pswpout " as *u8)
  }
251
  // ---- prior samples (velocity memory) ----
  let st: *u8 = sys_mmap(RG_STATE_CAP)
  let stn: i64 = vw_read(RG_STATE_PATH, st, RG_STATE_CAP - 1)
  // parsed prior rows: key string offsets + footprint + epoch + last-action ts
  let p_key: *i64 = sys_mmap(RG_MAXPROC * 8) as *i64
  let p_kb: *i64 = sys_mmap(RG_MAXPROC * 8) as *i64
  let p_t: *i64 = sys_mmap(RG_MAXPROC * 8) as *i64
  let p_act: *i64 = sys_mmap(RG_MAXPROC * 8) as *i64
  var n_prior: i64 = 0
  if stn > 0 {
      var s2: i64 = 0
      while s2 < stn {
          var e2: i64 = s2
          var sc2: i64 = 0
          while sc2 == 0 { if e2 >= stn { sc2 = 1 } else { if st[e2] == (10 as u8) { sc2 = 1 } else { e2 = e2 + 1 } } }
          if e2 > s2 { if n_prior < RG_MAXPROC {
              // key kb epoch act
              let kend: i64 = g_find_sp(st, s2, e2)
              if kend > s2 {
                  st[kend] = 0 as u8
                  p_key[n_prior] = (st as i64) + s2
                  var f: i64 = kend + 1
                  p_kb[n_prior] = vw_num_at(st, e2, f, ep)
                  f = ep[0] + 1
                  p_t[n_prior] = vw_num_at(st, e2, f, ep)
                  f = ep[0] + 1
                  let av: i64 = vw_num_at(st, e2, f, ep)
                  if av < 0 { p_act[n_prior] = 0 } else { p_act[n_prior] = av }
                  n_prior = n_prior + 1
              }
          } }
          s2 = e2 + 1
      }
  }
286
  let now: i64 = sys_now_realtime_sec()
  let selfpid: i64 = vw_selfpid()
  let fd: i64 = sys_openat_rd("/proc" as *u8)
  if fd < 0 { g_puts("[resgov] cannot open /proc\n" as *u8); return 0 }
  let dbuf: *u8 = sys_mmap(RG_DIR_CAP)
  let clbuf: *u8 = sys_mmap(RG_CMD_CAP)
  let out: *u8 = sys_mmap(RG_STATE_CAP)
  var op: i64 = 0
  var scanned: i64 = 0
  var acted: i64 = 0
  var warned: i64 = 0
  var watched: i64 = 0
  // AGGREGATE accumulators (largest NON-EXEMPT holder + suspect count), filled by the walk below.
  var agg_worst_foot: i64 = 0
  var agg_worst_pid: i64 = 0
  var agg_worst_lastact: i64 = 0
  var agg_worst_recyclable: i64 = 0
  var agg_suspects: i64 = 0
  var run: i64 = 1
  while run == 1 {
      let n: i64 = sys_getdents64(fd, dbuf, RG_DIR_CAP)
      if n <= 0 { run = 0 } else {
          var off: i64 = 0
          while off < n {
              let rec: *u8 = ((dbuf as i64 + off) as *u8)
              let reclen: i64 = dirent_reclen(rec)
              if reclen <= 0 { off = n } else {
                  let name: *u8 = dirent_name(rec)
                  if name[0] >= (48 as u8) { if name[0] <= (57 as u8) {
                      let pid: i64 = vw_num_at(name, g_slen(name), 0, ep)
                      if pid > 300 { if pid != selfpid {
                          let rss: i64 = vw_rss_kb_of(name)
                          if rss > 0 {
                              scanned = scanned + 1
                              let swp: i64 = vw_status_kb_of(name, "VmSwap:" as *u8)
                              let foot: i64 = rg_footprint_kb(rss, swp)
                              // cmdline for policy matching
                              var o3: i64 = g_app(clbuf, 0, "/proc/" as *u8)
                              o3 = g_app(clbuf, o3, name)
                              o3 = g_app(clbuf, o3, "/cmdline" as *u8)
                              clbuf[o3] = 0 as u8
                              let cmdpath: *u8 = sys_mmap(256)
                              var cp: i64 = g_app(cmdpath, 0, "/proc/" as *u8)
                              cp = g_app(cmdpath, cp, name)
                              cp = g_app(cmdpath, cp, "/cmdline" as *u8)
                              cmdpath[cp] = 0 as u8
                              let cln: i64 = vw_read(cmdpath, clbuf, RG_CMD_CAP - 1)
                              // policy: exemption wins, then explicit cap, then the DEFAULT (coverage inversion)
                              var exempt: i64 = 0
                              var recyclable: i64 = 0
                              var mycap: i64 = default_cap_gb
                              if cln > 0 {
                                  var xi: i64 = 0
                                  while xi < n_ex {
                                      let nd: *u8 = ex_off[xi] as *u8
                                      if vw_contains(clbuf, cln, nd, g_slen(nd)) == 1 { exempt = 1; xi = n_ex }
                                      xi = xi + 1
                                  }
                                  var rj: i64 = 0
                                  while rj < n_rec {
                                      let nd3: *u8 = rec_off[rj] as *u8
                                      if vw_contains(clbuf, cln, nd3, g_slen(nd3)) == 1 { recyclable = 1; rj = n_rec }
                                      rj = rj + 1
                                  }
                                  var ci: i64 = 0
                                  while ci < n_cap {
                                      let nd2: *u8 = cap_off[ci] as *u8
                                      if vw_contains(clbuf, cln, nd2, g_slen(nd2)) == 1 { mycap = cap_gb[ci]; ci = n_cap }
                                      ci = ci + 1
                                  }
                              }
                              // identity key = pid:starttime (pid reuse would poison the velocity)
                              let stt: i64 = g_starttime(name)
                              let keyb: *u8 = sys_mmap(64)
                              var kp: i64 = g_appn(keyb, 0, pid)
                              keyb[kp] = 58 as u8; kp = kp + 1
                              kp = g_appn(keyb, kp, stt)
                              keyb[kp] = 0 as u8
                              // find prior sample for this identity
                              var prev_kb: i64 = 0
                              var prev_t: i64 = 0
                              var last_act: i64 = 0
                              var pi: i64 = 0
                              while pi < n_prior {
                                  if g_streq(p_key[pi] as *u8, keyb) == 1 {
                                      prev_kb = p_kb[pi]; prev_t = p_t[pi]; last_act = p_act[pi]; pi = n_prior
                                  }
                                  pi = pi + 1
                              }
                              let vel: i64 = rg_velocity_kb_s(prev_kb, prev_t, foot, now)
                              var already_termed: i64 = 0
                              if last_act > 0 { if now - last_act < cooldown_s { already_termed = 1 } }
                              // AGGREGATE accumulation, on the SAME walk (no extra /proc traversal).
                              // NON-EXEMPT ONLY: an exemption is a promise here too, so the nominee can
                              // never be the supervisor, the edge, or the governor itself.
                              if exempt == 0 {
                                  if foot >= agg_suspect_mb * RG_MAGIC_1024 { agg_suspects = agg_suspects + 1 }
                                  if foot > agg_worst_foot { agg_worst_foot = foot; agg_worst_pid = pid; agg_worst_lastact = last_act; agg_worst_recyclable = recyclable }
                              }
                              let lvl: i64 = rg_level(exempt, mycap, rss, swp, vel, pressured, already_termed, eta_warn_s, eta_act_s)
                              var act_ts: i64 = last_act
                              // ★EXEMPT FROM ACTION IS NOT EXEMPT FROM SCRUTINY. rg_level returns OK for an
                              // exempt process, which would make the estate's biggest growers INVISIBLE in
                              // the log -- the blind spot this whole regime exists to end. Recompute the
                              // level it WOULD have had and report that, while still acting on nothing.
                              if exempt == 1 {
                                  let shadow: i64 = rg_level(0, mycap, rss, swp, vel, pressured, 0, eta_warn_s, eta_act_s)
                                  if shadow != RG_OK {
                                      watched = watched + 1
                                      g_puts("[resgov] EXEMPT-" as *u8); g_puts(rg_level_name(shadow))
                                      g_puts(" pid=" as *u8); g_putn(pid)
                                      g_puts(" foot_mb=" as *u8); g_putn(foot / RG_MAGIC_1024)
                                      g_puts(" cap_gb=" as *u8); g_putn(mycap)
                                      g_puts(" vel_kb_s=" as *u8); g_putn(vel)
                                      g_puts(" (action withheld by an auditable exemption; scrutiny continues)\n" as *u8)
                                  }
                              }
                              if lvl != RG_OK {
                                  g_puts("[resgov] " as *u8); g_puts(rg_level_name(lvl))
                                  g_puts(" pid=" as *u8); g_putn(pid)
                                  g_puts(" foot_mb=" as *u8); g_putn(foot / RG_MAGIC_1024)
                                  g_puts(" cap_gb=" as *u8); g_putn(mycap)
                                  g_puts(" vel_kb_s=" as *u8); g_putn(vel)
                                  let eta: i64 = rg_eta_s(foot, mycap * RG_MAGIC_1048576, vel)
                                  g_puts(" eta_s=" as *u8); g_putn(eta)
                                  g_puts(" headroom=" as *u8); g_putn(headroom)
                                  g_puts(" swap=" as *u8); g_putn(swapper)
                                  if lvl == RG_WATCH { watched = watched + 1; g_puts(" (over cap but system calm -- big is not harmful)\n" as *u8) }
                                  if lvl == RG_WARN { warned = warned + 1; g_puts(" (forecast breach -- early signal, no action)\n" as *u8) }
                                  if lvl == RG_RENICE {
                                      if dry == 1 { g_puts(" DRY renice\n" as *u8) } else {
                                          sys_setpriority_of(pid, 15)
                                          acted = acted + 1
                                          g_puts(" DEPRIORITISED (slowed while headroom remains)\n" as *u8)
                                      }
                                  }
                                  if rg_is_destructive(lvl) == 1 {
                                      if rg_cooldown_ok(last_act, now, cooldown_s) == 1 {
                                          if dry == 1 { g_puts(" DRY " as *u8); g_puts(rg_level_name(lvl)); g_puts("\n" as *u8) } else {
                                              if lvl == RG_TERM { nx_kill(pid, 15) } else { nx_kill(pid, 9) }
                                              act_ts = now
                                              acted = acted + 1
                                              g_puts(" SIGNALLED (guard respawns fresh)\n" as *u8)
                                          }
                                      } else { g_puts(" HELD (cooldown)\n" as *u8) }
                                  }
                              }
                              // persist this sample (velocity memory for the next run)
                              if op < RG_STATE_CAP - 128 {
                                  op = g_app(out, op, keyb)
                                  out[op] = 32 as u8; op = op + 1
                                  op = g_appn(out, op, foot)
                                  out[op] = 32 as u8; op = op + 1
                                  op = g_appn(out, op, now)
                                  out[op] = 32 as u8; op = op + 1
                                  op = g_appn(out, op, act_ts)
                                  out[op] = 10 as u8; op = op + 1
                              }
                          }
                      } }
                  } }
                  off = off + reclen
              }
          }
      }
  }
  sys_close(fd)
454
  // atomic-ish state write (whole file, one open)
  if op > 0 {
      let sfd: i64 = sys_openat_wr(RG_STATE_PATH, 420)
      if sfd >= 0 {
          var w: i64 = 0
          while w < op { let k: i64 = sys_write(sfd, ((out as i64) + w) as *u8, op - w); if k <= 0 { w = op } else { w = w + k } }
          sys_close(sfd)
      }
  }
464
  // ---- AGGREGATE PASS: act on accumulated debt that NO per-process rule can ever name ----
  // Every acting branch of rg_level requires ONE process to be over ITS OWN cap. On 2026-08-06 the
  // box sat at swap 822 permil with 14 leak suspects, each individually legal under the 6GB default;
  // this governor scanned 504 processes, reported acted=0, was CORRECT every minute, and the live
  // edge stalled until nishifamily.com/writer timed out for the operator.
  // AGGREGATE COOLDOWN gets its OWN marker: the per-process state rows are keyed on pid:starttime,
  // and a recycled nominee comes back with a NEW identity, so its own history can never throttle the
  // next nomination. Without this the pass could walk down the table one process per minute.
  let agg_ts_path: *u8 = "knowledge/status/resgov_agg.ts" as *u8
  let aggb: *u8 = sys_mmap(64)
  let aggn: i64 = vw_read(agg_ts_path, aggb, 63)
  var agg_last: i64 = 0
  if aggn > 0 { agg_last = vw_num_at(aggb, aggn, 0, ep) }
  var agg_termed: i64 = 0
  if agg_last > 0 { if now - agg_last < cooldown_s { agg_termed = 1 } }
  var agg_lvl: i64 = RG_OK
  if agg_termed == 0 {
      agg_lvl = rg_aggregate_level(headroom, swapper, agg_head_floor, agg_swap_ceil, agg_suspects, agg_suspect_floor, agg_worst_foot, 0, agg_worst_recyclable, agg_min_act_mb * RG_MAGIC_1024, 0)
  }
  if agg_lvl != RG_OK {
      g_puts("[resgov] AGGREGATE-" as *u8); g_puts(rg_level_name(agg_lvl))
      g_puts(" pid=" as *u8); g_putn(agg_worst_pid)
      g_puts(" foot_mb=" as *u8); g_putn(agg_worst_foot / RG_MAGIC_1024)
      g_puts(" suspects=" as *u8); g_putn(agg_suspects)
      g_puts(" headroom=" as *u8); g_putn(headroom)
      g_puts(" swap=" as *u8); g_putn(swapper)
      g_puts(" (individually legal, collectively harmful -- the sum no per-process cap can name)" as *u8)
      if rg_is_destructive(agg_lvl) == 0 {
          watched = watched + 1
          g_puts(" NO RESTART-SAFE NOMINEE -- named, never acted on. NEVER TERMINATE WHAT NOTHING WILL RESTART: add a `recycle <needle>` row for a daemon a guard revives, or fix the leak.\n" as *u8)
      } else { if dry == 1 { g_puts(" DRY\n" as *u8) } else {
          nx_kill(agg_worst_pid, 15)
          acted = acted + 1
          let afd: i64 = sys_openat_wr(agg_ts_path, 420)
          if afd >= 0 {
              let ab2: *u8 = sys_mmap(64)
              var ao: i64 = g_appn(ab2, 0, now)
              ab2[ao] = 10 as u8
              sys_write(afd, ab2, ao + 1)
              sys_close(afd)
          }
          g_puts(" SIGNALLED (guard respawns fresh)\n" as *u8)
      } }
  }
509
  g_puts("[resgov] scanned=" as *u8); g_putn(scanned)
  g_puts(" watch=" as *u8); g_putn(watched)
  g_puts(" warn=" as *u8); g_putn(warned)
  g_puts(" acted=" as *u8); g_putn(acted)
  g_puts(" headroom_permil=" as *u8); g_putn(headroom)
  g_puts(" swap_permil=" as *u8); g_putn(swapper)
  g_puts(" pswpin=" as *u8); g_putn(pswpin)
  g_puts(" pswpout=" as *u8); g_putn(pswpout)
  g_puts(" pressured=" as *u8); g_putn(pressured)
  g_puts(" default_cap_gb=" as *u8); g_putn(default_cap_gb)
  g_puts(" exempt_rows=" as *u8); g_putn(n_ex)
  g_puts(" cap_rows=" as *u8); g_putn(n_cap)
  g_puts("\n" as *u8)
  return 0
524}
nx_resgov.nx source

`nx_resgov.nx` source
