Module mem_supervisor 

Memory-pressure-aware host supervision — P0 of docs/specs/SPEC_MEMORY_PRESSURE_SUPERVISION_2026_06_16.md.

The launcher’s host-relaunch ladder (HOST_RESTART_BUDGET) is otherwise memory-blind: on a system out-of-memory host crash it relaunches straight back into the same commit-starved condition, burns the budget in seconds, and gives up — a silent vanish (see docs/retro/retro-oom-crash-2026-06-16.md).

This module adds the discrimination: a system-OOM exit is waited out (commit- gated, backed-off relaunch on a separate, longer OOM budget), while a genuine host fault still trips the fast wedged-host budget + degraded ladder unchanged. The decision logic here is pure and unit-tested; the platform commit probe and the backoff wait are thin wrappers over the OS.

Enums

HostExitClass

Classification of an abnormal (non-zero, non-clean-shutdown) host exit.

Constants

BACKOFF_CAP

BACKOFF_START

Commit-gated relaunch backoff: while commit-free is below RESUME_FLOOR_MB, wait this long and re-probe, doubling each time up to the cap. Relaunching into a starved system just re-OOMs, so waiting is the only thing that works.

CHROMIUM_OOM_EXIT_CODE

Chromium’s intentional out-of-memory abort code (base::win::kOomExceptionCode, raised non-continuably via KERNELBASE!RaiseException when an allocation fails). It surfaces as the host’s exit code; ExitStatus::code() returns it as an i32, so the unsigned 0xE000_0008 reads back as -536_870_904.

OOM_GIVEUP_BODY

OOM_GIVEUP_TITLE

User-facing copy for the graceful give-up dialog (SPEC §5.C). Shown via the launcher’s show_fatal_dialog (a renderer-free Win32 MessageBoxW) so the crash is never a silent vanish.

OOM_RELAUNCH_DEADLINE

Hard ceiling on how long to wait for commit to recover before giving up (and showing the honest “out of memory” dialog rather than waiting forever).

OOM_RESTART_BUDGET

Restart budget for system-OOM host exits — larger and longer than the wedged-host HOST_RESTART_BUDGET (3 / 60 s), because transient system pressure is the OS’s problem, not a host bug, and recovery can legitimately take minutes (SPEC §5.B / §6).

OOM_RESTART_WINDOW

RESUME_FLOOR_MB

Minimum commit-free (available page file) headroom, in MB, before it is safe to (re)launch a CEF host without it instantly re-OOMing. A fresh host + renderer commits on the order of a few hundred MB; 512 leaves margin. Shared starting point with the renderer spec’s RESUME_FLOOR (SPEC §6).

Functions

await_commit_recovery

Wait for system commit to recover above RESUME_FLOOR_MB, probing with exponential backoff (BACKOFF_START → BACKOFF_CAP). Returns true once recovered, or false if OOM_RELAUNCH_DEADLINE elapses first (the caller then gives up gracefully). log is the launcher’s logger, threaded in so the wait is observable in the launcher log. subject names whatever is being waited on for the two terminal log lines (“relaunching {subject}” / “giving up {subject} relaunch”) — this function is shared by the host-OOM wait (subject: "host") and the srv-OOM wait (subject: "srv", SPEC_MEMORY_PRESSURE_SUPERVISION’s srv counterpart). Hardcoding “host” here made the srv-OOM wait’s log misleadingly claim it was relaunching the host during an actual srv-OOM incident — reagent P1 on PR #2206.

budget_exhausted

Crash-budget bookkeeping, factored out so it is unit-testable. Retains only restarts within window of now; if the surviving count is already at budget, returns true (exhausted — caller gives up) WITHOUT recording. Otherwise records now and returns false. Matches the existing inline wedged-host budget semantics (check-before-push).

classify_host_exit

Classify an abnormal host exit. OOM is identified two ways, deliberately defensive — Chromium sometimes surfaces an OOM as a generic crash code rather than the exact OOM exception (electron#40426):

commit_free_mb

Linux commit proxy: MemAvailable from /proc/meminfo. The kernel OOM-killer (a SIGKILL) is the real OOM signal here; the abnormal-exit-plus-low-commit reading together approximate it (SPEC §9.4 open question).

next_backoff

Next backoff duration: double prev, capped at BACKOFF_CAP.