Function plan 

pub fn plan(
    rule: &CompiledRule,
    procs: &[ProcessInfo],
    already_placed: &[u32],
    cgroup_exists: bool,
    held: bool,
) -> Vec<RuleAction>

Pure planner: decide the actions for one rule given the current process snapshot, the PIDs already in this rule’s cgroup, and whether this rule’s cgroup currently has any process in it.

• matches present, some not placed -> EnsureCgroup + AddPid(each new)
• matches present, all already placed -> EnsureCgroup only (idempotent)
• no matches, cgroup occupied -> nothing (don’t evict)
• no matches, cgroup empty-but-present -> TeardownEmpty
• no matches, no cgroup -> nothing

The freeze guard no longer migrates processes into a separate guard-<pid> cgroup — it acts in place on whatever cgroup a process already lives in (see guard/effector.rs), and rule cgroups are first-class guard targets. So there IS something left to contend over: held is true when the guard currently holds a freeze or cap intervention on this rule’s cgroup (see RulesEnforcer::reconcile), in which case this rule’s actions are skipped outright for the tick — rewriting memory.high/adding PIDs out from under an active intervention would silently no-op the guard’s action while leaving PolicyEngine believing it still holds one.