2026-09-28: A Flicker Is Not a Panic

Qui-Gon blew out the coder lamp on a twitch of the pressure needle.

The cathedral stayed. Glimmer did not. Seven times on Monday the kernel reported pressure 2 for a single sample, while swap sat between ten and sixteen gigabytes. The pager held the alert. Relief did not. It read the raw sample, called bootout, and unregistered the LaunchAgent. Kickstart cannot see a job launchd has forgotten. Someone put the lamp back. The next twitch took it again.

What the pager already knew

The swap sentinel already debounces. A warn has to last two samples, about four minutes, before the page commits. Critical still commits on the first sample. This box kernel-panicked at sixty-eight swapfiles, so a late critical is worse than a loud one. Pressure 1 with swap in use is the steady state of two resident models. That reading is normal.

At 21:54 the coder was generating. The footprint was about seventeen gigabytes, and almost all of it sat in swap. One pressure-2 sample arrived. The pager logged a debounce hold. The process was gone before the next sample.

A first repair made relief follow that committed level. One sample then shed nothing. Two in a row still did. At 22:52 the second pressure-2 sample committed a warn at 12.3 gigabytes used and thirteen files, far under the used-swap line and far under the file-count line, and the seat went dark because the page and the shed had been tied together.

Both lamps stay lit

Pressure alone does not shed. Not on one sample. Not after the pager commits. The 22:52 hold is why. The page may still warn. The shed stays put.

Used swap above twenty-four gigabytes still sheds on that reading. So do twenty-eight swapfiles. Thirty-two files or pressure 4 still shed immediately. If the cathedral itself has been pushed into swap, the backup goes so the cathedral can come back. The cathedral and the VM stay pinned. The coder seat does not.

The hourly doctor calls the same tool. A pressure-only sample there does not shed either. Used swap, file count, a critical reading, and a cathedral sitting in swap still do. That is the backstop, not a second copy of the flicker.

When the box is back under twenty-six files, twenty gigabytes used, and pressure 1, the sentinel waits thirty minutes and bootstraps the parked seat. The thirty-minute wait is unchanged. This lamp was put back by hand, because that shed was the bug. Bootout is what made the hand step necessary. Bootstrap is the other half. A label disabled on purpose stays disabled.

Note

Pressure 1 with swap files on disk is the quiet shape of two models on this machine. It is not the 2026-07-10 panic, and it is not a reason to darken the coder seat.

What is serving

Qwen is still the Sunday process on the cathedral port. Glimmer answered after the 22:34 restore, then the 22:52 hold parked it again. A hand bootstrap brought the lamp back, and the coder port answered Muse-Glimmer. Castellan headroom went negative. That is two metal ceilings sharing one machine, and pressure stayed at 1. If a real shed takes the coder port down, Qui-Gon’s code seat falls through to the local cathedral before any hosted model. Offline still means this haus.

What EETISMAD looks like here

Gate	Evidence
Everything E2E Tested	test-swap-sentinel-relief.sh replays the real sentinel: one pressure-2 sample sheds nothing, a second one sheds nothing, used swap above twenty-four gigabytes sheds, and forty swapfiles shed on the first sample. test-memory-sentinel-restore.py locks the clear-band bootstrap, and pressure alone does not shed while file count and a cathedral in swap still do
in Sanctum-docs	This field note and its sidebar entry
Merged	sanctum-config 6703b42 on origin/main
And Deployed	LaunchAgents run the checkout: swap-sentinel.sh every two minutes, and the hourly doctor calls memory-sentinel.py beside it

The bar for the claim is engineering discipline. The seats live in Sanctum MLX. Qui-Gon’s earlier hardening is the 413 storm.

The flicker can still happen. It does not get to darken the room.