`nx_resmon.nx` source

↩ module page · 789 lines · 49276 B
1// nx_resmon.nx -- the RESOURCE axis the health plane never had (debt seq897 / seq1005).
2//
3// WHY THIS EXISTS: on 2026-07-25 nx_health returned {overall:OK, degraded:0, down:0} while the box was
4// at 93.4% swap exhaustion with nr_vmscan_immediate_reclaim 1.33e9 -- sustained thrash. The health plane
5// probes GATEWAYS ONLY, so the single most destabilising condition on the platform was invisible to
6// every instrument we owned.
7// LAW: an instrument that reports OK during the worst outage class it could ever see is not an instrument.
8//
9// TWO AXES:
10//   A. PRESSURE     -- swap consumed / memory available. A LAGGING indicator: by the time it is red the
11//                      box is already thrashing.
12//   B. LEAK CENSUS  -- processes whose VmSize == VmPeak above a COMMITTED-memory floor. A LEADING
13//                      indicator: it fires while swap is still healthy. This is the fingerprint that
14//                      identified the leaking organs in the first place.
15//
16// This organ owns the /proc walk and the printing ONLY. Both policy predicates live in nx_resmon_lib.nx
17// so the gate exercises the SAME code this runs (rule 9 single responsibility, rule 15 DRY).
18// Thresholds are data-driven from knowledge/status/resmon.conf (rule 11). Read-only.
19// Exit code IS the verdict so a caller can gate on it: 0=GREEN 1=AMBER 2=RED.
20//
21// license_tier: ORIGINAL  expect_exit: 0
22import "nx_resmon_lib.nx"
23import "nx_proc_ctl.nx"
24import "nx_logtail.nx"   // lt_read_tail -- THE shared tail reader (runtime/): rm_trend must read the NEWEST rows of its append-only log, never its head (2026-09-02)
25const RM_MAGIC_1941: i64 = 1941
26const RM_MAGIC_1024: i64 = 1024
27const RM_MAGIC_262144: i64 = 262144
28
29const RM_DIRBUF: i64 = 65536
30// AXIS D defaults, in BYTES (see rm_disk_sev for why bytes and not permil).
31const RM_DISK_AMBER_DEFAULT: i64 = 5368709120
32const RM_DISK_RED_DEFAULT:   i64 = 1073741824
33// The two volumes this host actually writes to. "." is the estate's own volume (cwd = nishihost, i.e.
34// /volume1); "/" is the ROOT partition, which is SMALL and was measured at 525 MiB free on 2026-08-28
35// while /volume1 had 21.0 TB -- the exact pair that proves a percentage bar is the wrong ruler.
36// WORST VOLUME DECIDES, the same shape the rest of this organ already uses for its axes.
37const RM_DISK_PATH_ESTATE: *u8 = "."
38const RM_DISK_PATH_ROOT:   *u8 = "/"
39// AXIS D root-partition bars, derived from the MEASURED 2.3 GiB DSM system partition (privileged du
40// census 2026-08-29, knowledge/status/rootfs_du.txt: 1.2 GiB immovable system baseline): red 256 MiB
41// (~11 percent free -- below this a DSM update or a log burst can wedge the system), amber 512 MiB
42// (~22 percent). Bottom tier of rule 17; resmon.conf rows *-root override.
43const RM_DISK_AMBER_ROOT_DEFAULT: i64 = 536870912
44const RM_DISK_RED_ROOT_DEFAULT: i64 = 268435456
45// TREND AXIS (loadgov LV1 rm_trend_gatereg, 2026-08-30): the slow-leak verdict rm_trend WRITES every
46// beat was never COLLECTED -- a 3.7 GB leaker (nx_seed_announc, +114-186 MB/beat) fired verdict=RED
47// in resmon_trend.log for hours and was found only by a lane reading the log by hand. The collector
48// reads the log's LAST line (positional, the gv_last_line shape) and RAISES the verdict to at least
49// AMBER on a fresh RED -- only-raises; a stale, absent or unparseable line ABSTAINS (UNOBSERVABLE,
50// never an acquittal and never a fabricated alarm). Freshness DERIVED from the OBSERVED trend
51// cadence, not the declared one (rows 1788092862 -> 1788096467 = ~3,605 s, an hourly beat): one full
52// missed beat plus the measured scheduler-lag envelope = 2.5x cadence = 9000 s. conf row
53// trend-max-age-s overrides (rule 17).
54const RM_TREND_LOG: *u8 = "knowledge/status/resmon_trend.log"
55const RM_TREND_MAX_AGE_DEFAULT: i64 = 9000
56const RM_TRENDLOG: *u8 = "knowledge/status/resmon_trend.log"
57// ⚠ITS OWN FILE, NEVER resmon.log: rm_trend PARSES that file for worst_committed_kb= on every row of the
58// window, so a verdict line appended there would be read back as a malformed sample and turn this
59// detector UNOBSERVABLE. ★A WRITER THAT LOGS INTO ITS OWN INPUT POISONS THE MEASUREMENT IT JUST TOOK.
60// ONE WRITER, ONE LOG, ONE ROW -- the estate's own remedy for a gatereg row that measures a race.
61// ★CLOSED VOCABULARY ONLY (GREEN/RED), same law as rm_log: a new dialect here becomes another
62// UNREADABLE-DIALECT row in the rollup this is trying to reach. UNOBSERVABLE therefore rides as
63// `observed=0` BESIDE a GREEN verdict, and that trade is deliberate: the common unobservable cases are
64// benign (a short log at startup, the worst process changing inside the window), so mapping them to RED
65// would make this permanently red and therefore ignored. THE IMPRECISION I CHOSE: a genuinely unreadable
66// log also reads GREEN here; it is distinguishable ONLY by observed=0, so any consumer must read it.
67func rm_trend_log(nm: *u8, newest: i64, grew: i64, span: i64, shrank: i64, flat: i64, delta: i64, observed: i64, v: *u8) -> i64 {
  let fd: i64 = sys_openat_append(RM_TRENDLOG, 420)
  if fd < 0 {
      // ★★★★★AN UNWRITABLE TREND MUST ANNOUNCE, NOT VANISH: a silently missing row reads later as "the
      // beat did not fire". Same law as nx_rebuild_drain's rd_trend.
      // ⚠THE FIRST VERSION OF THIS COMMENT BLAMED THE MISSING ANNOUNCE FOR AN "ABSENT" LOG. FALSE, and
      // corrected here: the very first write SUCCEEDED. I had read the log in the same parallel batch
      // that launched the ASYNC job -- before it ran -- and diagnosed a write bug that did not exist.
      // ★★★★★A RACE IN THE OBSERVER LOOKS EXACTLY LIKE A DEFECT IN THE SUBJECT, AND THE COMMENT YOU
      // WRITE ABOUT IT OUTLIVES THE MISTAKE. The announce is still correct on its own merits.
      rm_puts("RESMON-TREND trend-log UNWRITABLE rc=" as *u8); rm_num(fd)
      rm_puts(" path=" as *u8); rm_puts(RM_TRENDLOG); rm_puts("\n" as *u8)
      return 0 - 1
  }
  let b: *u8 = sys_mmap(RM_MAGIC_1024)
  var o: i64 = 0
  o = rm_lnum(b, o, sys_now_realtime_sec())
  o = rm_lcat(b, o, "\tRESMON-TREND worst=" as *u8)
  o = rm_lcat(b, o, nm)
  o = rm_lcat(b, o, " newest_kb=" as *u8); o = rm_lnum(b, o, newest)
  o = rm_lcat(b, o, " grew_in=" as *u8); o = rm_lnum(b, o, grew)
  o = rm_lcat(b, o, "/" as *u8); o = rm_lnum(b, o, span)
  o = rm_lcat(b, o, " shrank=" as *u8); o = rm_lnum(b, o, shrank)
  o = rm_lcat(b, o, " flat=" as *u8); o = rm_lnum(b, o, flat)
  o = rm_lcat(b, o, " delta_kb=" as *u8); o = rm_lnum(b, o, delta)
  o = rm_lcat(b, o, " observed=" as *u8); o = rm_lnum(b, o, observed)
  o = rm_lcat(b, o, "\tverdict=" as *u8)
  o = rm_lcat(b, o, v)
  o = rm_lcat(b, o, "\n" as *u8)
  sys_write(fd, b, o)
  sys_close(fd)
  sys_munmap(b, RM_MAGIC_1024)
  return 0
100}
101const RM_STATBUF: i64 = 4096
102
103// ★★★★★★AN INSTRUMENT NOTHING CAN READ IS NOT WIRED. This organ printed its verdict to STDOUT ONLY,
104// and knowledge/gatereg.conf is DERIVED from knowledge/status/*.log files that carry a verdict anchor --
105// so nx_resmon could never enter the roster, never reach nx_gate_rollup, and its RED could never be seen
106// by anyone not running it BY HAND. MEASURED CONSEQUENCE 2026-08-06: swap sat at 938permil with 15 leak
107// suspects and worst=nx_seed_announc at 6.4GB, while nx_gate_rollup read 73/104 and nx_health read
108// overall=OK -- and the live edge stalled hard enough that https://nishifamily.com/writer TIMED OUT for
109// the operator. The organ written precisely because "the single most destabilising condition on the
110// platform was invisible to every instrument we owned" was ITSELF invisible to the one organ that
111// answers "is anything not green?". The header law above indicts this file until this function exists.
112// ★ONE LINE, OVERWRITTEN, NOT APPENDED: nx_gate_rollup reads only the NEWEST line (gv_last_line), and a
113// cumulative status log mined with no time window reports a FIXED problem as a LIVE one -- so a single
114// current-state line is simultaneously what the consumer wants and self-bounding.
115// ★EMITS ONLY THE CLOSED VERDICT VOCABULARY (GREEN/RED), never a new dialect: AMBER maps to RED because
116// a degraded resource state must be SEEN (amber swap is what preceded today's outage), and the nuance
117// rides alongside as state=/sev= for the human. Inventing verdict=AMBER here would have made this organ
118// the twelfth UNREADABLE-DIALECT row in the very rollup it is trying to reach.
119// rm_lcat / rm_lnum MOVED to nx_resmon_lib.nx 2026-08-14: nx_memvel now emits a status line too, and
120// the second organ was about to grow its own copy. ★TWO COPIES OF A HELPER DIVERGE SILENTLY BECAUSE
121// NOTHING COMPARES THEM. (This organ COUNTS leakers; it will not be one -- debt RM_MAGIC_1941.)
122// ---- LOAD-HISTORY COLLECTOR (2026-08-17, the /compare/loadgov rm_load1_centi contract) ----------
123// The arming protocol for the build-admission load ceiling needs a REPRESENTATIVE loadavg window
124// ("sample over a window, set the ceiling above the normal distribution and below the wedge point,
125// record the measurement" -- nx_sov_build_run's own comment), and NO organ logged loadavg anywhere:
126// this log carried swap and mem only, procchurn is event-sparse. One field on the beat line the
127// key-anchored trend readers already parse -- APPENDED as key=value so every existing reader is
128// unmoved. -1 = /proc/loadavg unreadable, PRINTED not hidden: an absent sample must never read as
129// load 0 (an axis that cannot see must abstain, not acquit).
130const RM_LOADAVG: *u8 = "/proc/loadavg"
131const RM_LOADAVG_CAP: i64 = 128
132const RM_ASCII_ZERO: i64 = 48        // '0' -- decimal-digit floor for the loadavg parser
133const RM_ASCII_NINE: i64 = 57        // '9' -- decimal-digit ceiling
134const RM_ASCII_DOT: i64 = 46         // '.' -- the loadavg decimal point, skipped so 14.49 -> 1449
135func rm_load1_centi() -> i64 {
  let lb: *u8 = sys_mmap(RM_LOADAVG_CAP)
  let fd: i64 = sys_openat_rd(RM_LOADAVG)
  if fd < 0 { sys_munmap(lb, RM_LOADAVG_CAP); return 0 - 1 }
  let n: i64 = sys_read(fd, lb, RM_LOADAVG_CAP)
  sys_close(fd)
  if n <= 0 { sys_munmap(lb, RM_LOADAVG_CAP); return 0 - 1 }
  // "14.49 ..." -> 1449: loadavg always prints exactly two decimals, so digits-with-dot-skipped IS
  // the centi value. Separate exit flag, never a clobbered cursor (the banked eol-sentinel hazard).
  var v: i64 = 0
  var seen: i64 = 0
  var i: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i >= n { go = 0 } else {
          let c: i64 = lb[i] as i64
          if c >= RM_ASCII_ZERO { if c <= RM_ASCII_NINE { v = v * 10 + (c - RM_ASCII_ZERO); seen = 1 } else { go = 0 } } else {
              if c != RM_ASCII_DOT { go = 0 }
          }
          i = i + 1
      }
  }
  sys_munmap(lb, RM_LOADAVG_CAP)
  if seen == 0 { return 0 - 1 }
  return v
160}
161
162// procs_seen/procs_vm are the CENSUS COVERAGE (2026-08-22) -- see the declaration comment in main().
163func rm_log(swused_pm: i64, avail_pm: i64, leakers: i64, sustained: i64, leak_observed: i64, worst_kb: i64, worst_nm: *u8, sev: i64, procs_seen: i64, procs_vm: i64) -> i64 {
  let b: *u8 = sys_mmap(RM_MAGIC_1024)
  var o: i64 = 0
  o = rm_lcat(b, o, "RESMON swap_used_permil=" as *u8)
  o = rm_lnum(b, o, swused_pm)
  o = rm_lcat(b, o, " mem_avail_permil=" as *u8)
  o = rm_lnum(b, o, avail_pm)
  o = rm_lcat(b, o, " load1_centi=" as *u8)
  o = rm_lnum(b, o, rm_load1_centi())
  o = rm_lcat(b, o, " flat_committed_screen=" as *u8)
  o = rm_lnum(b, o, leakers)
  // THE TREND LIVES HERE. nx_memvel publishes only the CURRENT value (one overwritten line, so a
  // per-minute reader stays O(1)); this appended row is what lets anyone answer "how long has this
  // been true", which is the first question asked of any red monitor.
  o = rm_lcat(b, o, " sustained_growers=" as *u8)
  o = rm_lnum(b, o, sustained)
  o = rm_lcat(b, o, " leak_axis=" as *u8)
  if leak_observed == 1 { o = rm_lcat(b, o, "OBSERVED" as *u8) } else { o = rm_lcat(b, o, "UNOBSERVABLE" as *u8) }
  o = rm_lcat(b, o, " worst_committed_kb=" as *u8)
  o = rm_lnum(b, o, worst_kb)
  o = rm_lcat(b, o, " worst=" as *u8)
  o = rm_lcat(b, o, worst_nm)
  o = rm_lcat(b, o, " procs_scanned=" as *u8)
  o = rm_lnum(b, o, procs_seen)
  o = rm_lcat(b, o, " procs_with_vm=" as *u8)
  o = rm_lnum(b, o, procs_vm)
  o = rm_lcat(b, o, " state=" as *u8)
  if sev == 0 { o = rm_lcat(b, o, "GREEN" as *u8) }
  if sev == 1 { o = rm_lcat(b, o, "AMBER" as *u8) }
  if sev == 2 { o = rm_lcat(b, o, "RED" as *u8) }
  o = rm_lcat(b, o, " sev=" as *u8)
  o = rm_lnum(b, o, sev)
  o = rm_lcat(b, o, " verdict=" as *u8)
  if sev == 0 { o = rm_lcat(b, o, "GREEN" as *u8) } else { o = rm_lcat(b, o, "RED" as *u8) }
  o = rm_lcat(b, o, "\n" as *u8)
  // ★FIXED 2026-08-07: this was sys_openat_wr, which TRUNCATES. The durable log therefore held
  // exactly ONE row -- the latest -- so the monitor could report that the host is RED but could
  // never answer HOW LONG IT HAS BEEN RED, which is the first question anyone asks of a red
  // monitor and the only one that separates a spike from a standing condition.
  // A MONITOR THAT OVERWRITES ITS LOG CANNOT SHOW A TREND, AND A VERDICT WITHOUT A DURATION
  // CANNOT BE TRIAGED. Every other status log in this estate appends; this one was the outlier.
  // Measured when found: state=RED sev=2, swap_used_permil=817, leak_suspects=15 -- and no way to
  // tell whether that was minutes or weeks old.
  // ⚠0x1a4 was a raw file mode here, the same constant the estate consolidated into MODE_0644 on
  // 2026-08-14 across 39 sites -- this one was missed because it is spelled in hex while the sweep
  // found the decimal 420. ★THE SAME CONSTANT IN TWO BASES IS TWO CONSTANTS TO EVERY SCANNER.
  let fd: i64 = sys_openat_append("knowledge/status/resmon.log" as *u8, MODE_0644)
  if fd < 0 { sys_munmap(b, RM_MAGIC_1024); return 0 - 1 }
  sys_write(fd, b, o)
  sys_close(fd)
  sys_munmap(b, RM_MAGIC_1024)
  return o
215}
216
217// ---- SLOW-LEAK TREND (2026-08-14) ---------------------------------------------------------------
218// THE HORIZON THIS CLOSES: nx_memvel samples 5 windows of 1200 ms and requires growth in EVERY window,
219// so sustained_growers=0 proves NO FAST LEAK, NOT NO LEAK -- anything slower than that window is
220// invisible BY CONSTRUCTION. MEASURED the day this was written: worst_committed_kb crept
221// 2,529,624 -> 2,539,128 across the beat while sustained_growers read 0 every row, which is the CORRECT
222// answer to the question memvel asks and NOT the whole leak question.
223// ★★★★★★AN INSTRUMENT'S SAMPLING WINDOW IS ITS HORIZON, AND A HORIZON MUST BE PUBLISHED OR IT READS AS
224// COMPLETENESS. This is the same deciding-column law ONE TIMESCALE UP: grew in EVERY window becomes grew
225// in EVERY ROW of the durable log.
226// ★A SECOND TIMESCALE IS A NEW READER OF AN OLD LOG, NOT A NEW COLLECTOR: resmon.log is append-only and
227// already carries worst= and worst_committed_kb= on every beat, so this adds ZERO sampling and ZERO
228// /proc load -- which matters, because the condition it hunts appears exactly when the box is busy and
229// the admission gates are refusing new walkers.
230// ⚠SCOPE, STATED: it tracks only the WORST committed process. A slow leak in a smaller process is
231// invisible to it, exactly as a slow leak is invisible to memvel. Two published horizons, not one hidden.
232const RM_TREND_NAMEW: i64 = 64
233// Max log lines the trend scanner indexes in one pass. resmon.log appends one ~180 B row per beat; at
234// the 86400 s (daily) census cadence 8192 rows is >22 years of history, and rm_trend only analyses the
235// last `trend-rows` (default 12) anyway -- this is the index-array bound, not a policy number. Named so
236// the two sites (array alloc + the bounds guard) can never drift apart (rule 11: one constant, one source).
237const RM_TREND_MAXLINES: i64 = 8192
238const RM_LOGCAP: i64 = 1048576
239
240// The integer following `key` inside [lo,hi); -1 when the key is absent in that span.
241// Separate cursor + explicit flag: writing the exit into the search cursor destroys the position the
242// caller needs, a defect this estate has written four times in one day.
243func rm_line_num(buf: *u8, lo: i64, hi: i64, key: *u8) -> i64 {
  let kl: i64 = rm_slen(key)
  var i: i64 = lo
  var found: i64 = 0 - 1
  while i + kl <= hi {
      if found < 0 {
          var j: i64 = 0
          var ok: i64 = 1
          while j < kl { if buf[i+j] != key[j] { ok = 0; j = kl } else { j = j + 1 } }
          if ok == 1 { found = i + kl }
      }
      i = i + 1
  }
  if found < 0 { return 0 - 1 }
  var v: i64 = 0
  var seen: i64 = 0
  var p: i64 = found
  var run: i64 = 1
  while run == 1 {
      if p >= hi { run = 0 } else {
          let c: i64 = buf[p] as i64
          if c < 48 { run = 0 } else {
              if c > 57 { run = 0 } else { v = v * 10 + (c - 48); seen = 1; p = p + 1 }
          }
      }
  }
  if seen == 0 { return 0 - 1 }
  return v
271}
272
273// The space-terminated word following `key` inside [lo,hi) -> out. 1 on success, 0 when absent.
274func rm_line_word(buf: *u8, lo: i64, hi: i64, key: *u8, out: *u8, cap: i64) -> i64 {
  let kl: i64 = rm_slen(key)
  var i: i64 = lo
  var found: i64 = 0 - 1
  while i + kl <= hi {
      if found < 0 {
          var j: i64 = 0
          var ok: i64 = 1
          while j < kl { if buf[i+j] != key[j] { ok = 0; j = kl } else { j = j + 1 } }
          if ok == 1 { found = i + kl }
      }
      i = i + 1
  }
  if found < 0 { out[0] = 0 as u8; return 0 }
  var o: i64 = 0
  var p: i64 = found
  var run: i64 = 1
  while run == 1 {
      if p >= hi { run = 0 } else {
          if buf[p] == (32 as u8) { run = 0 } else {
              if o < cap - 1 { out[o] = buf[p]; o = o + 1 }
              p = p + 1
          }
      }
  }
  out[o] = 0 as u8
  return 1
301}
302
303func rm_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
308}
309
310// rm_tg_find: literal token scan inside one line window [s,e) -- the row is machine-written
311// key=value, so a token match inside the POSITIONALLY-chosen last line is sound.
312func rm_tg_find(b: *u8, s: i64, e: i64, pat: *u8) -> i64 {
  var pl: i64 = 0
  while pat[pl] != (0 as u8) { pl = pl + 1 }
  var i: i64 = s
  while i + pl <= e {
      var k: i64 = 0
      var m: i64 = 1
      while k < pl { if b[i+k] != pat[k] { m = 0; k = pl } else { k = k + 1 } }
      if m == 1 { return i }
      i = i + 1
  }
  return 0 - 1
324}
325// rm_trend_gatereg (loadgov LV1): COLLECT the slow-leak verdict from resmon_trend.log's LAST line.
326// Returns 2 fresh-RED / 0 fresh-GREEN / -1 UNOBSERVABLE (absent, empty, stale, future-stamped, or
327// unparseable -- every cannot-look is an ABSTENTION, never an acquittal). namebuf (>=64 B) receives
328// the row's worst= token on any parse so the raise can NAME its subject. Composes sys_read_file
329// (sized from the file -- the fixed-cap reader class is banned in this organ since 2026-08-29).
330func rm_trend_gatereg(maxage: i64, namebuf: *u8) -> i64 {
  namebuf[0] = 0 as u8
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(RM_TREND_LOG, lp)
  let n: i64 = lp[0]
  if (b as i64) == 0 { return 0 - 1 }
  if n <= 0 { return 0 - 1 }
  var e: i64 = n
  var t1: i64 = 1
  while t1 == 1 { if e > 0 { if b[e-1] == (10 as u8) { e = e - 1 } else { t1 = 0 } } else { t1 = 0 } }
  if e <= 0 { return 0 - 1 }
  var s: i64 = e
  var t2: i64 = 1
  while t2 == 1 { if s > 0 { if b[s-1] != (10 as u8) { s = s - 1 } else { t2 = 0 } } else { t2 = 0 } }
  var ts: i64 = 0
  var i: i64 = s
  var dig: i64 = 1
  while dig == 1 { if i < e { let c: i64 = b[i] as i64; if c >= 48 { if c <= 57 { ts = ts * 10 + (c - 48); i = i + 1 } else { dig = 0 } } else { dig = 0 } } else { dig = 0 } }
  if ts <= 0 { return 0 - 1 }
  let age: i64 = sys_now_realtime_sec() - ts
  if age < 0 { return 0 - 1 }
  if age > maxage { return 0 - 1 }
  let wv: i64 = rm_tg_find(b, s, e, "worst=" as *u8)
  if wv >= 0 {
      var wp: i64 = wv + 6
      var wo: i64 = 0
      var wg: i64 = 1
      while wg == 1 { if wp < e { let wc: i64 = b[wp] as i64; if wc == 32 { wg = 0 } else { if wc == 9 { wg = 0 } else { if wo < 63 { namebuf[wo] = b[wp]; wo = wo + 1 } wp = wp + 1 } } } else { wg = 0 } }
      namebuf[wo] = 0 as u8
  }
  if rm_tg_find(b, s, e, "verdict=RED" as *u8) >= 0 { return 2 }
  if rm_tg_find(b, s, e, "verdict=GREEN" as *u8) >= 0 { return 0 }
  return 0 - 1
363}
364// ⚠logpath IS A PARAMETER, NOT A CONSTANT, AND THAT IS A TESTABILITY REQUIREMENT NOT A CONVENIENCE.
365// The first cut hardcoded knowledge/status/resmon.log, which meant this detector COULD NOT BE POINTED AT
366// A FIXTURE -- and every gate in this estate works by planting a known-bad and demanding RED. ★★★★★★AN
367// ANALYSIS ORGAN THAT HARDCODES ITS INPUT PATH CANNOT BE GATED, SO ITS GREEN CAN NEVER BE EARNED: it can
368// only ever be run against whatever production happens to hold, which is exactly the state that cannot
369// contain a planted counter-example. Default preserved, so the beat and every existing caller are unchanged.
370func rm_trend(logpath: *u8) -> i64 {
  // conf read composes sys_read_file -- the fixed RM_STATBUF cap silently dropped the conf tail
  // once the file outgrew 4096 B (measured 2026-08-29 in main; same class here): remove, never raise.
  let tclp: *i64 = sys_mmap(16) as *i64
  var cbuf: *u8 = sys_read_file("knowledge/status/resmon.conf" as *u8, tclp)
  var cn: i64 = tclp[0]
  if (cbuf as i64) == 0 { cbuf = sys_mmap(16); cn = 0 }
  // WINDOW IN ROWS, NOT MINUTES, because the beat interval is the clock's business and this organ must
  // not assume it. 12 rows at the declared 300s resmonbeat is ~1 hour of history -- long enough that a
  // creep invisible to a 1.2s window shows up, short enough to still be a LIVE signal and not a fossil.
  let rows: i64 = rm_conf(cbuf, cn, "trend-rows" as *u8, 12)
  let lbuf: *u8 = sys_mmap(RM_LOGCAP)
  // TAIL, NOT HEAD (2026-09-02): rm_read kept the first RM_LOGCAP bytes, so once resmon.log outgrew 1 MiB the
  // "newest" row was a torn partial line and this verb froze at UNOBSERVABLE for 65 beats. rm_trend_read_tail
  // (nx_resmon_lib, composing lt_read_tail) keeps the NEWEST rows and declares the envelope in tenv --
  // printed on the report line below as log_bytes= tail_trunc=, because a partial read that is not declared
  // is the defect this replaces.
  let tenv: *i64 = sys_mmap(64) as *i64
  let ln: i64 = rm_trend_read_tail(logpath, lbuf, RM_LOGCAP, tenv)
  if ln <= 0 { rm_puts("RESMON-TREND verdict=UNOBSERVABLE why=log-unreadable path=" as *u8); rm_puts(logpath); rm_puts("\n" as *u8); return 3 }
  // Collect the START offset of every line, then analyse only the last `rows`.
  let starts: *i64 = sys_mmap(8 * RM_TREND_MAXLINES) as *i64
  var nl: i64 = 0
  starts[0] = 0
  nl = 1
  var i: i64 = 0
  while i < ln {
      if lbuf[i] == (10 as u8) { if nl < RM_TREND_MAXLINES { starts[nl] = i + 1; nl = nl + 1 } }
      i = i + 1
  }
  // The last entry may be the empty tail after the final newline; drop it.
  if nl > 0 { if starts[nl - 1] >= ln { nl = nl - 1 } }
  if nl < rows {
      rm_puts("RESMON-TREND verdict=UNOBSERVABLE why=not-enough-history rows_available=" as *u8); rm_num(nl)
      rm_puts(" rows_needed=" as *u8); rm_num(rows); rm_puts("\n" as *u8)
      return 3
  }
  let nmA: *u8 = sys_mmap(RM_TREND_NAMEW)
  let nmB: *u8 = sys_mmap(RM_TREND_NAMEW)
  // Newest row first: walk BACKWARDS and stop at the first row that breaks the run.
  let newest: i64 = nl - 1
  var lo: i64 = starts[newest]
  var hi: i64 = ln
  rm_line_word(lbuf, lo, hi, "worst=" as *u8, nmA, RM_TREND_NAMEW)
  var newest_kb: i64 = rm_line_num(lbuf, lo, hi, "worst_committed_kb=" as *u8)
  var prev_kb: i64 = newest_kb
  var oldest_kb: i64 = newest_kb
  var grew: i64 = 0
  var shrank: i64 = 0
  var flat: i64 = 0
  var same_name: i64 = 1
  var readable: i64 = 1
  var r: i64 = 1
  // ★WALK THE WHOLE WINDOW. The first cut BROKE OUT at the first non-increase, so grew/delta described
  // a PREFIX while being printed as if they described the window -- a bounded loop reporting the bound.
  var walking: i64 = 1
  while walking == 1 {
      if r >= rows { walking = 0 } else {
          let idx: i64 = newest - r
          lo = starts[idx]
          hi = starts[idx + 1]
          rm_line_word(lbuf, lo, hi, "worst=" as *u8, nmB, RM_TREND_NAMEW)
          let kb: i64 = rm_line_num(lbuf, lo, hi, "worst_committed_kb=" as *u8)
          if rm_streq(nmA, nmB) == 0 { same_name = 0; walking = 0 } else {
              if kb < 0 { readable = 0; walking = 0 } else {
                  // walking BACKWARDS: prev_kb is the NEWER sample, kb the OLDER one.
                  if prev_kb > kb { grew = grew + 1 } else {
                      if prev_kb < kb { shrank = shrank + 1 } else { flat = flat + 1 }
                  }
                  prev_kb = kb
                  oldest_kb = kb
                  r = r + 1
              }
          }
      }
  }
  let span: i64 = rows - 1
  rm_puts("RESMON-TREND rows=" as *u8); rm_num(rows)
  rm_puts(" log_bytes=" as *u8); rm_num(tenv[0])
  rm_puts(" tail_trunc=" as *u8); rm_num(tenv[3])
  rm_puts(" worst=" as *u8); rm_puts(nmA)
  rm_puts(" newest_kb=" as *u8); rm_num(newest_kb)
  rm_puts(" grew_in=" as *u8); rm_num(grew); rm_puts("/" as *u8); rm_num(span)
  rm_puts(" shrank=" as *u8); rm_num(shrank)
  rm_puts(" flat=" as *u8); rm_num(flat)
  rm_puts(" delta_kb=" as *u8); rm_num(newest_kb - oldest_kb)
  if same_name == 0 { rm_puts(" name_changed=1" as *u8) }
  // A STRICT-MONOTONIC RUN TEST CANNOT SEE A LEAK THAT IS MONOTONIC IN AGGREGATE BUT FLAT IN
  // INDIVIDUAL SAMPLES, AND THE SLOWER THE LEAK THE MORE FLAT SAMPLES IT HAS -- SO THE OLD PREDICATE
  // WENT BLIND EXACTLY AS ITS TARGET GOT HARDER. MEASURED 2026-08-16: it printed
  // `grew_in=7/11 delta_kb=4752 verdict=GREEN` -- REPORTED 4.75 MB OF GROWTH AND ACQUITTED -- while
  // nx_wiki_gw.elf rose 2,774,600 -> 2,938,272 KB over 220 beats without ever once falling. The flat
  // rows are QUANTIZATION: deltas land on multiples of 264 KB, so a ~633 KB/beat creep rounds to zero
  // about every tenth beat. Strictness also did no work its stated reason claimed -- the SEPARATE
  // same_name check already excludes "worst in some beats and not others". A LEAK NEVER RETURNS
  // MEMORY: a SHRINK refutes; flat is what a leak looks like sampled below its own quantum.
  if same_name == 0 {
      rm_puts(" verdict=UNOBSERVABLE (the worst process changed inside the window; this ruler follows ONE name)\n" as *u8)
      rm_trend_log(nmA, newest_kb, grew, span, shrank, flat, newest_kb - oldest_kb, 0, "GREEN" as *u8)
      return 3
  }
  if readable == 0 {
      rm_puts(" verdict=UNOBSERVABLE (a row lacks worst_committed_kb)\n" as *u8)
      rm_trend_log(nmA, newest_kb, grew, span, shrank, flat, newest_kb - oldest_kb, 0, "GREEN" as *u8)
      return 3
  }
  if shrank == 0 { if newest_kb > oldest_kb {
      rm_puts(" verdict=RED (never fell and ended higher: a SLOW leak below memvel's 1200ms window)\n" as *u8)
      rm_trend_log(nmA, newest_kb, grew, span, shrank, flat, newest_kb - oldest_kb, 1, "RED" as *u8)
      return 1
  } }
  rm_puts(" verdict=GREEN (memory was returned inside the window, or the span did not grow)\n" as *u8)
  rm_trend_log(nmA, newest_kb, grew, span, shrank, flat, newest_kb - oldest_kb, 1, "GREEN" as *u8)
  return 0
484}
485
486func main(argc: i64, argv: *i64) -> i64 {
  // TREND VERB: slow-timescale analysis over this organ's OWN durable log. An ARGLESS invocation keeps
  // the beat path byte-for-byte identical, so adding a verb cannot change what the clock already does.
  if argc >= 2 { if rm_streq(argv[1] as *u8, "trend" as *u8) == 1 {
      // Optional 3rd arg = an ALTERNATE log to analyse, which is what makes this gateable against a
      // planted fixture. Absent, it reads the production log exactly as before.
      if argc >= 3 { return rm_trend(argv[2] as *u8) }
      return rm_trend("knowledge/status/resmon.log" as *u8)
  } }
  // CONF READ COMPOSES sys_read_file (sized FROM the file; cannot short-read). The old fixed
  // RM_STATBUF (4096) cap silently dropped the conf's TAIL the day the file grew to 4,604 B --
  // the tail held memvel-max-age-s, so the axis quietly fell back to its bottom-tier default (300)
  // while the file on disk read correct (measured live 2026-08-29: file said 2400, report said 300).
  // THE FIXED-CAP-READER CLASS (the nx_cron_reconcile precedent): REMOVE the cap, never raise it.
  let clp: *i64 = sys_mmap(16) as *i64
  var cbuf: *u8 = sys_read_file("knowledge/status/resmon.conf" as *u8, clp)
  var cn: i64 = clp[0]
  if (cbuf as i64) == 0 { cbuf = sys_mmap(16); cn = 0 }
  let sw_amber: i64 = rm_conf(cbuf, cn, "swap-used-permil-amber" as *u8, 700)
  let sw_red: i64   = rm_conf(cbuf, cn, "swap-used-permil-red" as *u8, 850)
  let av_amber: i64 = rm_conf(cbuf, cn, "mem-avail-permil-amber" as *u8, 250)
  let av_red: i64   = rm_conf(cbuf, cn, "mem-avail-permil-red" as *u8, 100)
  let leak_min: i64 = rm_conf(cbuf, cn, "leak-min-kb" as *u8, RM_MAGIC_262144)
  let leak_amber: i64 = rm_conf(cbuf, cn, "leak-count-amber" as *u8, 3)
  let leak_red: i64   = rm_conf(cbuf, cn, "leak-count-red" as *u8, 6)
  // FRESHNESS BOUND on the velocity measurement. Like every default above it this is the BOTTOM tier
  // of the configuration hierarchy (rule 17), overridden by resmon.conf -- not a tuned constant.
  // ★ITS FAILURE MODE IS SAFE IN BOTH DIRECTIONS: too tight or too loose, a stale reading never
  // fabricates an answer, it degrades the axis to UNOBSERVABLE, which can neither raise nor lower
  // the verdict. A threshold that gates a judgement must be wrong in the direction of saying nothing.
  let mv_max_age: i64 = rm_conf(cbuf, cn, "memvel-max-age-s" as *u8, 300)
  // ---- AXIS D thresholds: FREE BYTES, not a percentage. See rm_disk_sev for the derivation and the
  // three measured volumes that force it. Bottom tier of the config hierarchy (rule 17): resmon.conf
  // overrides. 1 GiB red / 5 GiB amber are floors a build's scratch and a store append must clear;
  // they are a FIRST calibration to be ratcheted from observed near-misses, not tuned constants.
  let disk_amber: i64 = rm_conf(cbuf, cn, "disk-avail-bytes-amber" as *u8, RM_DISK_AMBER_DEFAULT)
  let disk_red: i64   = rm_conf(cbuf, cn, "disk-avail-bytes-red" as *u8, RM_DISK_RED_DEFAULT)
523
  // ---- AXIS A: pressure ----
  let mbuf: *u8 = sys_mmap(RM_STATBUF)
  let mn: i64 = rm_read("/proc/meminfo" as *u8, mbuf, RM_STATBUF)
  let memtotal: i64 = rm_field(mbuf, mn, "MemTotal:" as *u8)
  let memavail: i64 = rm_field(mbuf, mn, "MemAvailable:" as *u8)
  let swtotal: i64  = rm_field(mbuf, mn, "SwapTotal:" as *u8)
  let swfree: i64   = rm_field(mbuf, mn, "SwapFree:" as *u8)
  var swused_pm: i64 = 0
  if swtotal > 0 { swused_pm = ((swtotal - swfree) * 1000) / swtotal }
  var avail_pm: i64 = 1000
  if memtotal > 0 { avail_pm = (memavail * 1000) / memtotal }
535
  // ---- AXIS B: leak census ----
  let dbuf: *u8 = sys_mmap(RM_DIRBUF)
  let path: *u8 = sys_mmap(256)
  let sbuf: *u8 = sys_mmap(RM_STATBUF)
  var leakers: i64 = 0
  // COVERAGE OF THIS CENSUS (2026-08-22). A worst= verdict WITHOUT ITS DENOMINATOR CANNOT BE AUDITED:
  // when a reader asks "why did it not name process X", nothing in the output answers, and the only
  // way to find out is to re-implement the walk by hand -- which is exactly what had to be done the
  // day this was added. An independent /proc walk saw 749 numeric entries and 431 carrying VM fields
  // while this organ published a worst= with no way to tell whether it had seen them all. It agreed,
  // but AGREEING AND BEING AUDITABLE ARE DIFFERENT PROPERTIES.
  // *EVERY CLAIM CARRIES ITS COVERAGE -- a census that prints a winner and hides its population is one
  // silent skip away from naming an innocent, and no reader can tell the two apart.
  // Purely additive: existing consumers parse by key (rm_line_num), so nothing that reads this line
  // today changes behaviour (rule 19).
  var procs_seen: i64 = 0
  var procs_vm: i64 = 0
  var worst_kb: i64 = 0
  let worst_nm: *u8 = sys_mmap(64)
  worst_nm[0] = 63 as u8
  worst_nm[1] = 0 as u8
  // WORST_PID + WORST_VMSIZE (2026-08-14). This organ named the worst holder but not its PID, so
  // acting on its own RED required re-walking all ~1000 /proc entries by hand -- the scan it had
  // JUST DONE. An alarm that identifies a culprit by name only is not actionable.
  // VmSize is published beside RSS+Swap because it is what separates the two explanations for a
  // standing leak_suspect: a large VmSize with modest RSS is FILE-BACKED mapping (evictable page
  // cache, e.g. an mmap'd seg-store shard) which this detector's VmSize==VmPeak rule flags as a leak
  // by construction, whereas VmSize tracking RSS is genuine anonymous growth. Without both numbers a
  // reader cannot tell an leaking daemon from one doing its job, and this detector has been RED all
  // day on nx_hub_gw, which a full static mmap/munmap census (nx_mmapbal file) shows is nearly the
  // CLEANEST daemon in the fleet at 4 unbalanced funcs / 7 sites.
  let worst_pid: *u8 = sys_mmap(32)
  worst_pid[0] = 63 as u8
  worst_pid[1] = 0 as u8
  var worst_vsz: i64 = 0
  let fd: i64 = sys_openat_rd("/proc" as *u8)
  if fd >= 0 {
      var run: i64 = 1
      while run == 1 {
          let n: i64 = sys_getdents64(fd, dbuf, RM_DIRBUF)
          if n <= 0 { run = 0 } else {
              var off: i64 = 0
              while off < n {
                  let rec: *u8 = ((dbuf as i64) + off) as *u8
                  let reclen: i64 = dirent_reclen(rec)
                  if reclen <= 0 { off = n } else {
                      let nm: *u8 = dirent_name(rec)
                      if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) {
                          procs_seen = procs_seen + 1
                          var p: i64 = 0
                          let pre: *u8 = "/proc/" as *u8
                          var a: i64 = 0
                          while pre[a] != (0 as u8) { path[p] = pre[a]; p = p + 1; a = a + 1 }
                          a = 0
                          while nm[a] != (0 as u8) { path[p] = nm[a]; p = p + 1; a = a + 1 }
                          let suf: *u8 = "/status" as *u8
                          a = 0
                          while suf[a] != (0 as u8) { path[p] = suf[a]; p = p + 1; a = a + 1 }
                          path[p] = 0 as u8
                          let sn: i64 = rm_read(path, sbuf, RM_STATBUF)
                          if sn > 0 {
                              let vsz: i64 = rm_field(sbuf, sn, "VmSize:" as *u8)
                              let vpk: i64 = rm_field(sbuf, sn, "VmPeak:" as *u8)
                              let vrs: i64 = rm_field(sbuf, sn, "VmRSS:" as *u8)
                              let vsw: i64 = rm_field(sbuf, sn, "VmSwap:" as *u8)
                              if vsz > 0 { procs_vm = procs_vm + 1 }
                              if rm_is_leaker(vsz, vpk, vrs, vsw, leak_min) == 1 {
                                  leakers = leakers + 1
                                  var touched: i64 = 0
                                  if vrs > 0 { touched = touched + vrs }
                                  if vsw > 0 { touched = touched + vsw }
                                  if touched > worst_kb {
                                      worst_kb = touched
                                      // /proc/<pid>/status opens with "Name:\t<comm>\n", so the comm
                                      // starts at byte 6 and ends at the first newline.
                                      var z: i64 = 6
                                      var w: i64 = 0
                                      while z < sn { if sbuf[z] == (10 as u8) { z = sn } else { if w < 62 { worst_nm[w] = sbuf[z]; w = w + 1 } z = z + 1 } }
                                      worst_nm[w] = 0 as u8
                                      var q: i64 = 0
                                      while nm[q] != (0 as u8) { if q < 30 { worst_pid[q] = nm[q] } q = q + 1 }
                                      if q > 30 { q = 30 }
                                      worst_pid[q] = 0 as u8
                                      worst_vsz = vsz
                                  }
                              }
                          }
                      } }
                      off = off + reclen
                  }
              }
          }
      }
      sys_close(fd)
  }
631
  // ---- AXIS B2: the LEAK axis, fed by the ONLY instrument that can answer it ----
  // ★★★★★★A LEAK IS A DERIVATIVE AND THIS ORGAN IS A SNAPSHOT. The census above is a SCREEN
  // (necessary-not-sufficient): a genuine leaker always shows VmSize==VmPeak, but so does every daemon
  // that mmaps its arena once and never unmaps -- the leak-FREE design. Driving a verdict off the
  // screen made this organ RED PERMANENTLY: 17 suspects against a red threshold of 6, while the true
  // sustained-grower count measured 0. The sufficient half needs two samples in time, which only
  // nx_memvel takes, so it is READ here rather than re-derived. ★COMPOSE THE RULER, NEVER RE-IMPLEMENT
  // IT -- a second leak predicate in this file would be the duplicate-ruler defect, and it would be
  // the WRONG one, because a per-minute beat cannot afford memvel's 5-window observation itself.
  let vbuf: *u8 = sys_mmap(RM_STATBUF)
  let vn: i64 = rm_read("knowledge/status/memvel.status" as *u8, vbuf, RM_STATBUF)
  var sustained: i64 = 0
  var leak_observed: i64 = 0
  var mv_age: i64 = 0 - 1
  if vn > 0 {
      let stamp: i64 = rm_field(vbuf, vn, "epoch=" as *u8)
      let scnt: i64 = rm_field(vbuf, vn, "sustained=" as *u8)
      if stamp > 0 { if scnt >= 0 {
          mv_age = sys_now_realtime_sec() - stamp
          // A NEGATIVE AGE IS CLOCK SKEW, NOT FRESHNESS. Accepting it would let a future-stamped file
          // pass forever, so it is refused exactly like a stale one.
          if mv_age >= 0 { if mv_age <= mv_max_age { sustained = scnt; leak_observed = 1 } }
      } }
  }
656
  // rm_verdict_blind COMPOSES rm_verdict and can only RAISE: the pressure axes keep their exact
  // arithmetic, and a leading axis that has been dark for two full freshness windows now contributes an
  // amber of its own instead of costing nothing. Abstention is still not a leak claim -- this alarms on
  // the BLINDNESS, never on a leak nobody measured.
  // ---- AXIS D: DISK. Measure BOTH volumes and let the WORST decide -- a healthy 21 TB data volume
  // must not mask a root partition with half a gigabyte left. sys_fs_avail_bytes returns STATFS_ERR
  // (negative) when it could not look, and rm_disk_sev treats that as ABSTAIN, never as roomy.
  let d_estate: i64 = sys_fs_avail_bytes(RM_DISK_PATH_ESTATE)
  let d_root: i64   = sys_fs_avail_bytes(RM_DISK_PATH_ROOT)
  // PER-PATH BARS (2026-08-29). One bar pair judged BOTH volumes, so the 2.3 GiB DSM root
  // partition -- whose baseline is 1.2 GiB of system packages, PROVEN by the privileged du census
  // (knowledge/status/rootfs_du.txt) -- could never satisfy the 5 GiB estate amber bar and the
  // axis was RED BY CONSTRUCTION: the permanently-red detector everyone learns to ignore. The
  // worst PATH is now chosen by worst SEVERITY under its OWN bars, never by raw bytes under one
  // bar. Root defaults are derived from the measured partition: red 256 MiB (~11 percent -- below
  // this a DSM update or a log burst can wedge the system), amber 512 MiB (~22 percent). conf rows
  // disk-avail-bytes-amber-root / disk-avail-bytes-red-root override (rule 17). Abstain semantics
  // unchanged: a negative avail yields a negative sev, which can never win the worst-of comparison,
  // and if BOTH abstain the estate's negative avail flows through to rm_verdict_disk which abstains.
  let disk_amber_root: i64 = rm_conf(cbuf, cn, "disk-avail-bytes-amber-root" as *u8, RM_DISK_AMBER_ROOT_DEFAULT)
  let disk_red_root: i64   = rm_conf(cbuf, cn, "disk-avail-bytes-red-root" as *u8, RM_DISK_RED_ROOT_DEFAULT)
  let sev_de: i64 = rm_disk_sev(d_estate, disk_amber, disk_red)
  let sev_dr: i64 = rm_disk_sev(d_root, disk_amber_root, disk_red_root)
  var d_worst: i64 = d_estate
  var d_worst_is: *u8 = RM_DISK_PATH_ESTATE
  var d_bar_amber: i64 = disk_amber
  var d_bar_red: i64 = disk_red
  if sev_dr > sev_de { d_worst = d_root; d_worst_is = RM_DISK_PATH_ROOT; d_bar_amber = disk_amber_root; d_bar_red = disk_red_root }
  let dp_estate: i64 = sys_fs_used_permil(RM_DISK_PATH_ESTATE)
  let dp_root: i64   = sys_fs_used_permil(RM_DISK_PATH_ROOT)
687
  let sev0: i64 = rm_verdict_disk(swused_pm, avail_pm, sustained, leak_observed, sw_amber, sw_red, av_amber, av_red, leak_amber, leak_red, mv_age, mv_max_age, d_worst, d_bar_amber, d_bar_red)
  // TREND AXIS COLLECTION (loadgov LV1): the raise happens HERE so it is part of the verdict every
  // consumer branches on, not a decoration beside it. Only-raises to AMBER: a slow-leak RED is a
  // multi-window trend, real (this axis's motivating leak was 3.7 GB), but a single axis must not
  // max the verdict without calibration -- the detector-with-false-positives law.
  let tmax: i64 = rm_conf(cbuf, cn, "trend-max-age-s" as *u8, RM_TREND_MAX_AGE_DEFAULT)
  let tnm: *u8 = sys_mmap(64)
  let taxis: i64 = rm_trend_gatereg(tmax, tnm)
  var sev: i64 = sev0
  if taxis == 2 { if sev < 1 { sev = 1 } }
698
  rm_puts("=== nx_resmon -- the resource axis nx_health lacks (seq897) ===\n" as *u8)
  rm_puts("swap_used_permil=" as *u8); rm_num(swused_pm)
  rm_puts(" (amber>=" as *u8); rm_num(sw_amber); rm_puts(" red>=" as *u8); rm_num(sw_red); rm_puts(")\n" as *u8)
  rm_puts("mem_avail_permil=" as *u8); rm_num(avail_pm)
  rm_puts(" (amber<=" as *u8); rm_num(av_amber); rm_puts(" red<=" as *u8); rm_num(av_red); rm_puts(")\n" as *u8)
  rm_puts("swap_total_kb=" as *u8); rm_num(swtotal); rm_puts(" swap_free_kb=" as *u8); rm_num(swfree); rm_puts("\n" as *u8)
  rm_puts("mem_total_kb=" as *u8); rm_num(memtotal); rm_puts(" mem_avail_kb=" as *u8); rm_num(memavail); rm_puts("\n" as *u8)
  // ⚠RENAMED 2026-08-14 from leak_suspects=, which was a lie with an authoritative name: this is a
  // SCREEN, it does not vote, and it never did measure a leak. No consumer outside this file read the
  // old name (checked over the whole tree), so the rename breaks nothing.
  rm_puts("flat_committed_screen=" as *u8); rm_num(leakers)
  rm_puts(" (SCREEN ONLY, casts no vote: VmSize==VmPeak and RSS+Swap>=" as *u8); rm_num(leak_min)
  rm_puts("kB -- also true of every arena-once daemon, which is the leak-FREE design)\n" as *u8)
  rm_puts("sustained_growers=" as *u8); rm_num(sustained)
  rm_puts(" leak_axis=" as *u8)
  if leak_observed == 1 { rm_puts("OBSERVED" as *u8) } else { rm_puts("UNOBSERVABLE" as *u8) }
  rm_puts(" memvel_age_s=" as *u8); rm_num(mv_age)
  rm_puts(" max_age_s=" as *u8); rm_num(mv_max_age)
  rm_puts(" (amber>=" as *u8); rm_num(leak_amber); rm_puts(" red>=" as *u8); rm_num(leak_red)
  rm_puts("; UNOBSERVABLE contributes NOTHING to the verdict -- it is not a GREEN vote)\n" as *u8)
  // ★★★★★★AN ABSTAINING AXIS THAT CANNOT SAY *WHY* IT IS BLIND RAISES NO ALARM ANYWHERE, BY DESIGN:
  // abstention is safe for the verdict and invisible to the operator, so the safest possible verdict
  // silently becomes the least informative one. MEASURED 2026-08-21: this axis read UNOBSERVABLE for
  // 7.2 h (~43 missed 600 s beats) while the pressure axis went amber at swap 752 permil, and FOUR
  // lanes reached FOUR different mechanisms for it -- because a beat that RAN AND WAS REFUSED and a
  // beat that IS DEAD are indistinguishable from outside. nx_memvel now stamps memvel.refused on
  // every admission refusal, so they are separable HERE for the first time, and their remedies are
  // OPPOSITE: REFUSING means shed load, DEAD means fix the beat.
  // ⚠THE VERDICT ARITHMETIC IS DELIBERATELY UNTOUCHED. The law asks for an alarm OF ITS OWN, not a
  // vote: folding blindness into sev would hold this organ RED for as long as the box is busy -- the
  // permanently-red detector everyone learns to ignore. STRICTLY ADDITIVE, so no run that was GREEN
  // can now be anything else.
  // The freshness bound is the SAME mv_max_age the measurement uses, read from conf -- ONE bound, so
  // the two answers can never disagree about what "fresh" means.
  let rjb: *u8 = sys_mmap(RM_STATBUF)
  let rjn: i64 = rm_read("knowledge/status/memvel.refused" as *u8, rjb, RM_STATBUF)
  var rj_age: i64 = 0 - 1
  var rj_load: i64 = 0 - 1
  if rjn > 0 {
      let rstamp: i64 = rm_field(rjb, rjn, "epoch=" as *u8)
      if rstamp > 0 {
          rj_age = sys_now_realtime_sec() - rstamp
          rj_load = rm_field(rjb, rjn, "load_centi=" as *u8)
      }
  }
  // ★COMPOSE THE RULER, NEVER RE-IMPLEMENT IT: the classification lives in nx_resmon_lib beside the
  // other two predicates (rm_verdict, rm_sustained_count), so its referee can reach it as a PURE
  // function while this organ keeps only the printing. An inline copy here would be a second,
  // UNGATED definition of "blind" -- the duplicate-ruler defect, and the untested copy is always the
  // one that drifts. The clock-skew refusal and the freshness bound both live inside it now.
  let blind: i64 = rm_blind_class(leak_observed, rj_age, mv_max_age)
  rm_puts("leak_axis_blind=" as *u8)
  if blind == 0 { rm_puts("NO" as *u8) }
  if blind == 1 { rm_puts("REFUSING" as *u8) }
  if blind == 2 { rm_puts("DEAD" as *u8) }
  rm_puts(" refused_age_s=" as *u8); rm_num(rj_age)
  rm_puts(" refused_load_centi=" as *u8); rm_num(rj_load)
  rm_puts(" (REFUSING=the beat ran and admission declined it, shed load; DEAD=neither artifact fresh, fix the beat; -1=no refusal stamped yet)\n" as *u8)
  // AXIS D printed with BOTH volumes and the bar in the SAME units it is judged in, so a reader never
  // has to convert a permil into a decision. The permil rides as CONTEXT and is explicitly NOT the bar.
  rm_puts("disk_avail_bytes_estate=" as *u8); rm_num(d_estate)
  rm_puts(" disk_used_permil_estate=" as *u8); rm_num(dp_estate)
  rm_puts(" disk_avail_bytes_root=" as *u8); rm_num(d_root)
  rm_puts(" disk_used_permil_root=" as *u8); rm_num(dp_root)
  rm_puts("\n" as *u8)
  rm_puts("disk_axis worst_path=" as *u8); rm_puts(d_worst_is)
  rm_puts(" worst_avail_bytes=" as *u8); rm_num(d_worst)
  rm_puts(" (amber<=" as *u8); rm_num(d_bar_amber); rm_puts(" red<=" as *u8); rm_num(d_bar_red)
  rm_puts("; THE BAR IS BYTES REMAINING, NOT A PERCENTAGE -- a permil bar is size-blind and would alarm" as *u8)
  rm_puts(" on a 21TB volume at 879 permil while staying silent on a root partition with 525MiB left." as *u8)
  rm_puts(" A NEGATIVE avail is STATFS_ERR = could-not-look, which ABSTAINS and never scores as roomy.)\n" as *u8)
  rm_puts("worst_committed_kb=" as *u8); rm_num(worst_kb); rm_puts(" worst=" as *u8); rm_puts(worst_nm)
  rm_puts(" worst_pid=" as *u8); rm_puts(worst_pid)
  rm_puts(" worst_vmsize_kb=" as *u8); rm_num(worst_vsz)
  rm_puts(" procs_scanned=" as *u8); rm_num(procs_seen)
  rm_puts(" procs_with_vm=" as *u8); rm_num(procs_vm)
  rm_puts(" (VmSize >> RSS+Swap => FILE-BACKED mapping, evictable, not an anonymous leak)\n" as *u8)
  rm_puts("trend_axis=" as *u8)
  if taxis == 2 { rm_puts("RED worst=" as *u8); rm_puts(tnm) }
  if taxis == 0 { rm_puts("GREEN" as *u8) }
  if taxis < 0 { rm_puts("UNOBSERVABLE" as *u8) }
  rm_puts(" (LV1: the slow-leak verdict rm_trend writes is now COLLECTED -- last line of resmon_trend.log, positional; a fresh RED raises the verdict to at least AMBER and NAMES its subject, a stale or absent line ABSTAINS and never acquits)\n" as *u8)
  rm_puts("verdict=" as *u8)
  if sev == 0 { rm_puts("GREEN" as *u8) }
  if sev == 1 { rm_puts("AMBER" as *u8) }
  if sev == 2 { rm_puts("RED" as *u8) }
  rm_puts(" sev=" as *u8); rm_num(sev); rm_puts("\n" as *u8)
  // Durable + rosterable. Without this the whole organ is a private opinion.
  rm_log(swused_pm, avail_pm, leakers, sustained, leak_observed, worst_kb, worst_nm, sev, procs_seen, procs_vm)
  return sev
789}
nx_resmon.nx source

`nx_resmon.nx` source
