What the Sensor Costs

The sensor shares a machine with whatever that machine is for. What keeps it in its place is a split between work that must happen now and work that can wait, a governor that reads how busy the host is, and ceilings declared on the service unit, where the operating system enforces them rather than the sensor.

Now, or later

The hot path does the minimum: take the event, forward it, move on. Everything expensive is deferred. Hashing a file, enriching a process, scanning a region of memory all run as deferred work, at low scheduling priority and idle I/O priority, in a child control group of the sensor's own. Bursts of similar events are coalesced instead of handled one at a time, so a machine spawning thousands of short-lived processes costs a fraction of what it would event by event.

The governor

An on-host governor decides how much deferred work may run, reading the machine rather than the calendar: kernel pressure counters, processor time, load average, whether the host is on battery, its thermal state, whether somebody is logged in, and how hard the network interfaces are working. Under pressure it holds work back. When the host is idle it catches up. When it cannot tell, it does less, not more.

This is also what keeps a start-up honest. Seeding the processes that were already running when the sensor started is the most expensive minute it will ever have, and it is deferred like anything else.

Where the ceilings live

The generated unit carries the sensor's resource ceilings, so the guarantee rests with the operating system rather than with the sensor's own good behaviour. Read your own machine's:

systemctl cat whisper-sensor

There you will find the processor ceiling, a soft and a hard memory ceiling, swap held at zero, a low I/O weight and a ceiling on tasks. The sensor service lists them with the hardening directives that sit alongside.

It tells you what it used

Every digest the sensor ships carries a footprint proof, and the service journal prints the same reading as a heartbeat: what it used, against what it is allowed, and whether the deferred queue is keeping up. The reading that matters is the one from your own fleet, on your own hardware, under your own load.

How hard a sensor works is also a setting. The console carries a footprint preset per identity, trading how much the sensor does against how much it says, and a safety floor the presets cannot go below.

Failing the safe way

If the governor cannot read the host, if the uplink cannot be reached, or if deferred work falls behind, the sensor drops work rather than the machine. The host keeps running, the local stream keeps being written, and what did not ship is visible as a gap in your fleet rather than as silence that reads like calm.