Module mem_supervisor 

Memory-pressure-aware host supervision — P0 of docs/specs/SPEC_MEMORY_PRESSURE_SUPERVISION_2026_06_16.md.

The launcher’s host-relaunch ladder (HOST_RESTART_BUDGET) is otherwise memory-blind: on a system out-of-memory host crash it relaunches straight back into the same commit-starved condition, burns the budget in seconds, and gives up — a silent vanish (see docs/retro/retro-oom-crash-2026-06-16.md).

This module adds the discrimination: a system-OOM exit is waited out (commit- gated, backed-off relaunch on a separate, longer OOM budget), while a genuine host fault still trips the fast wedged-host budget + degraded ladder unchanged. The decision logic here is pure and unit-tested; the platform commit probe and the backoff wait are thin wrappers over the OS.

Enums

HostExitClass

Classification of an abnormal (non-zero, non-clean-shutdown) host exit.

Constants

BACKOFF_CAP

BACKOFF_START

Commit-gated relaunch backoff: while commit-free is below RESUME_FLOOR_MB, wait this long and re-probe, doubling each time up to the cap. Relaunching into a starved system just re-OOMs, so waiting is the only thing that works.

CHROMIUM_OOM_EXIT_CODE

Chromium’s intentional out-of-memory abort code (base::win::kOomExceptionCode, raised non-continuably via KERNELBASE!RaiseException when an allocation fails). It surfaces as the host’s exit code; ExitStatus::code() returns it as an i32, so the unsigned 0xE000_0008 reads back as -536_870_904.

OOM_GIVEUP_BODY

OOM_GIVEUP_TITLE

User-facing copy for the graceful give-up dialog (SPEC §5.C). Shown via the launcher’s show_fatal_dialog (a renderer-free Win32 MessageBoxW) so the crash is never a silent vanish.

OOM_RELAUNCH_DEADLINE

Hard ceiling on how long to wait for commit to recover before giving up (and showing the honest “out of memory” dialog rather than waiting forever).

OOM_RESTART_BUDGET

Restart budget for system-OOM host exits — larger and longer than the wedged-host HOST_RESTART_BUDGET (3 / 60 s), because transient system pressure is the OS’s problem, not a host bug, and recovery can legitimately take minutes (SPEC §5.B / §6).

OOM_RESTART_WINDOW

RESUME_FLOOR_MB

Minimum commit-free (available page file) headroom, in MB, before it is safe to (re)launch a CEF host without it instantly re-OOMing. A fresh host + renderer commits on the order of a few hundred MB; 512 leaves margin. Shared starting point with the renderer spec’s RESUME_FLOOR (SPEC §6).

Functions

await_commit_recovery

Wait for system commit to recover above RESUME_FLOOR_MB, probing with exponential backoff (BACKOFF_START → BACKOFF_CAP). Returns true once recovered, or false if OOM_RELAUNCH_DEADLINE elapses first (the caller then gives up gracefully). log is the launcher’s logger, threaded in so the wait is observable in the launcher log.

budget_exhausted

Crash-budget bookkeeping, factored out so it is unit-testable. Retains only restarts within window of now; if the surviving count is already at budget, returns true (exhausted — caller gives up) WITHOUT recording. Otherwise records now and returns false. Matches the existing inline wedged-host budget semantics (check-before-push).

classify_host_exit

Classify an abnormal host exit. OOM is identified two ways, deliberately defensive — Chromium sometimes surfaces an OOM as a generic crash code rather than the exact OOM exception (electron#40426):

commit_free_mb

Available commit (page file) in MB. The OS commit pool is process-global, so the launcher reads it directly — no shared memory with the host’s heartbeat is needed. Returns u64::MAX if the probe fails, so a probe failure can never gate a relaunch (fail open).

next_backoff

Next backoff duration: double prev, capped at BACKOFF_CAP.