Adom Hydrogen (platform base)

@@ -364,6 +364,60 @@ if command -v claude-rc >/dev/null 2>&1; then   [ -n "$out" ] && echo "  $out" fi +# 4g. Memory guardrails (John 2026-09-29, AdomLapper). The workspace froze for hours at WSL's+#     16 GB cap while a Claude session rendered video: with swap on, Linux never runs out, it+#     thrashes, and the kernel's own OOM killer waits for zero. Three changes, all proven on+#     AdomLapper (a 12 GB Python hog was stopped in 39 s, code-server untouched):+#       - earlyoom: SIGTERM at 8% available memory, SIGKILL at 4%, whatever the swap state;+#         prefers typical runaways (ffmpeg, python, headless chrome, compilers), never the AI+#         CLIs or the system plumbing.+#       - code-server's OOMScoreAdjust=-900 is dropped to 0: every child inherited it (the+#         extension host, Claude, and whatever Claude ran), so the kernel and earlyoom could not+#         tell a runaway render from the editor. By size, the runaway is always the largest.+#       - vm.swappiness=10: drop page cache before swapping out working memory.+#     ah only (systemd as PID 1, passwordless sudo); quiet when already in place; never fatal.+if [ "${ADOM_DESKTOP_MODE:-}" = "local" ] && [ -d /run/systemd/system ] && sudo -n true 2>/dev/null; then+  {+    changed=""+    if ! command -v earlyoom >/dev/null 2>&1; then+      sudo -n env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq earlyoom >/dev/null 2>&1 \+        || { sudo -n apt-get update -qq >/dev/null 2>&1; sudo -n env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq earlyoom >/dev/null 2>&1; } || true+      command -v earlyoom >/dev/null 2>&1 && changed="$changed earlyoom-installed"+    fi+    if command -v earlyoom >/dev/null 2>&1; then+      want='EARLYOOM_ARGS="-m 8,4 -s 100,100 -r 3600 --avoid ^(claude|codex|kimi|agy|systemd|systemd-.*|init|sshd|earlyoom|dbus-daemon)$ --prefer ^(ffmpeg|python3?|chrome|chromium|headless_shell|cc1plus|rustc|ld|java)$ -n"'+      if [ "$(cat /etc/default/earlyoom 2>/dev/null)" != "$want" ]; then+        printf '%s\n' "$want" | sudo -n tee /etc/default/earlyoom >/dev/null && changed="$changed earlyoom-config"+      fi+      # pgrep, not systemctl is-active: through Hydrogen's /exec route the adom user cannot+      # read systemd's state, and is-active answered nothing (seen on arav-rog).+      if [ -n "$changed" ] || ! pgrep -x earlyoom >/dev/null 2>&1; then+        sudo -n systemctl reset-failed earlyoom >/dev/null 2>&1 || true+        sudo -n systemctl enable earlyoom >/dev/null 2>&1 || true+        sudo -n systemctl restart earlyoom >/dev/null 2>&1 || true+      fi+    fi+    oom_dropin=/etc/systemd/system/code-server.service.d/90-adom-oom.conf+    if [ "$(cat "$oom_dropin" 2>/dev/null)" != "$(printf '[Service]\nOOMScoreAdjust=0')" ]; then+      sudo -n mkdir -p "$(dirname "$oom_dropin")" && printf '[Service]\nOOMScoreAdjust=0\n' | sudo -n tee "$oom_dropin" >/dev/null+      sudo -n systemctl daemon-reload >/dev/null 2>&1 || true+      # the running tree still carries the inherited -900: reset it now, no restart, no editor reload+      for pid in $(ls /proc | grep -E '^[0-9]+$'); do+        [ "$(cat /proc/"$pid"/oom_score_adj 2>/dev/null)" = "-900" ] && echo 0 | sudo -n tee /proc/"$pid"/oom_score_adj >/dev/null 2>&1+      done+      changed="$changed code-server-oom"+    fi+    if [ "$(cat /etc/sysctl.d/90-adom-memory.conf 2>/dev/null)" != "vm.swappiness = 10" ]; then+      echo 'vm.swappiness = 10' | sudo -n tee /etc/sysctl.d/90-adom-memory.conf >/dev/null+      sudo -n sysctl -q -p /etc/sysctl.d/90-adom-memory.conf >/dev/null 2>&1 || true+      changed="$changed swappiness"+    fi+    if [ -n "$changed" ]; then+      echo "  memory guardrails:${changed} (earlyoom $(pgrep -x earlyoom >/dev/null 2>&1 && echo running || echo NOT running))"+    fi+  } || echo "  memory guardrails: skipped this sweep (will retry)"+fi+ # 5. code-server config.yaml — silence code-server's own update nags. install -d -m 0755 "$HOME/.config/code-server" cat > "$HOME/.config/code-server/config.yaml" <<'CSCONF'

@@ -4,7 +4,7 @@   "type": "bootstrap",   "title": "Adom Hydrogen (platform base)",   "brief": "Layer Hydrogen's workspace onto a standard Adom workstation.",-  "version": "0.5.67",+  "version": "0.5.68",   "description": "Hydrogen's PLATFORM-GENERIC workspace layer on top of adom/core. Installs adom/core for the full Adom ecosystem, then adds everything common to running inside Hydrogen on ANY platform: the runtime-neutral hydrogen-* skills and the generic editor configuration (Claude Code CLI + extension, VS Code settings, trusted domains). Platform-specific layers depend on THIS: adom/hydrogen-windows-bootstrap (WSL2), adom/hydrogen-mac-bootstrap, adom/hydrogen-ubuntu-bootstrap. The reference design other orgs copy to build their own bootstrap on adom/core.",   "org": "adom",   "tags": [@@ -47,5 +47,6 @@     "install grok",     "grok bot",     "connect grok"-  ]-}+  ],+  "changelog": "0.5.68: memory guardrails in every Hydrogen workspace (section 4g): earlyoom stops a runaway job at 8% free memory before the workspace thrashes, code-server's inherited OOM protection is removed so the runaway is the one chosen, and swappiness drops to 10. Proven on AdomLapper: a 12 GB hog stopped in 39 s, code-server untouched."+}\ No newline at end of file

@@ -4,7 +4,7 @@   "type": "bootstrap",   "title": "Adom Hydrogen (platform base)",   "brief": "Layer Hydrogen's workspace onto a standard Adom workstation.",-  "version": "0.5.67",+  "version": "0.5.68",   "description": "Hydrogen's PLATFORM-GENERIC workspace layer on top of adom/core. Installs adom/core for the full Adom ecosystem, then adds everything common to running inside Hydrogen on ANY platform: the runtime-neutral hydrogen-* skills and the generic editor configuration (Claude Code CLI + extension, VS Code settings, trusted domains). Platform-specific layers depend on THIS: adom/hydrogen-windows-bootstrap (WSL2), adom/hydrogen-mac-bootstrap, adom/hydrogen-ubuntu-bootstrap. The reference design other orgs copy to build their own bootstrap on adom/core.",   "org": "adom",   "tags": [@@ -63,5 +63,6 @@     "install grok",     "grok bot",     "connect grok"-  ]+  ],+  "changelog": "0.5.68: memory guardrails in every Hydrogen workspace (section 4g): earlyoom stops a runaway job at 8% free memory before the workspace thrashes, code-server's inherited OOM protection is removed so the runaway is the one chosen, and swappiness drops to 10. Proven on AdomLapper: a 12 GB hog stopped in 39 s, code-server untouched." }\ No newline at end of file