fix(ci-overflow): admit hosted jobs at measured p90 estimate + headroom M; release runner-less cancels (t_f459aa52)

[Kyzcreig]

Stacked on #1125 (base = its branch; retargets to main when #1125 merges).

Apollo D4 ruling (option 1b) on t_f459aa52. The day drained to remaining_allowance=1 at 02:54Z because 13-14 concurrent merge_group attempts each held 300 reserved minutes, while real billed use was about 55-73 min per run.

• Ledger(estimate_headroom=M): reserve() prices each hosted job at E, the p90 of the ledger's billed_samples[slice|e2e]. Until 20 samples exist, E falls back to the ceiling of 35/20. A job is admitted while consumed + E + M <= limit. None keeps legacy D4 ceiling mode, and an invalid M admits no cloud.
• Reconcile charges min(ceil(billed), ceiling), including billed above E. An unmeasured executed job is charged the ceiling. Measured jobs are recorded as samples, capped at 200 per kind.
• 5.3a ride-along: a job with status=completed, conclusion=cancelled, empty runner_name and steps=[] is released.
• Validator: reservation must be 1..ceiling, hosted_minutes 1..ceiling (it may exceed the reservation), and billed_samples is optional and validated.
• Mutation gate: 36/36 mutants killed, including 10 new D4a arms.

The controller side (config admission_headroom, passing conclusion+steps, vendor repin) is a separate fleet-ops-scripts PR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: kanban-t_f459aa52 · gate: BYPASS: FR PAUSED by Ace ruling 2026-09-22 (state/fleetreview-pause-20260922.md); Apollo-reviewed lands via bypass · why: Apollo review PASS (D4 option 1b): p90-per-kind admission estimate with MIN_SAMPLES ceiling fallback, headroom M, reconcile charges max(billed,estimate)+records samples, runner-less cancel release w/ negative control; rebased over #1125 (0 conflicts), ledger suite 92/92 via test-gate; the one red slice (test_mcp_serve startup-baseline) is unrelated to the PR's files and passed on rerun

[ang-fleet-lander]

🤖 merged-by: apollo · lane: review-1216 · gate: BYPASS: FR PAUSED by Ace ruling 2026-09-22 (state/fleetreview-pause-20260922.md); Apollo-reviewed lands via bypass · why: Apollo review PASS (D4 option 1b; ledger suite 92/92 on rebased head); rebased on #1232 e2b9ba8, checks green

[ang-prism]

FleetReview

Review: post-merge · head fb4d12216f31 · duration 17m 33s
Profile: light (merit: default light: lines 243<800, files 3<1000000, hunks 14<1000000, no hot path) · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), F → gpt-6-sol (openai), G → grok-4.6 (xai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 243<800, files 3<1000000, hunks 14<1000000, no hot path) · round 0 · members: B-assert-ctx, B-state, F, G · families: openai,xai

Confidence: 2/5

Findings

• P1 scripts/ci_overflow_ledger.py:359 — Premature charge · agreed: B-assert-ctx,B-state,G (openai, xai)
• P1 scripts/ci_overflow_ledger.py:286 — Estimated admission cannot recover jobs the planner already put on the local pool · agreed: F (openai)

---

FleetReview provenance · models: B=gpt-6-sol, D=grok-4.6, F=gpt-6-sol · cost: $0.91 · duration: 17m 30s · rounds: 1 · files examined: 3