Pin the group-affinity invariants GH-3792 relies on, and simulate a version bump with slow starts

[jeremydmiller]

Immediate follow-up to #3792, adding the regression coverage identified while reviewing it. Relates to #3753, #3779, #3785.

Four new tests, each verified red against the pre-#3792 implementation

Three placement pins in distribute_by_group_affinity:

1. A settled blue/green split is a fixed point — re-evaluating the settled state (same fleet, same capabilities, everything running where the last evaluation put it) moves nothing. Database affinity is per agent family, not per database: 73% of shard databases have durability and projections on different nodes #3785 counted ~45,000 ReassignAgent decisions in six minutes during a rollout ramp; the partition incumbent rule (members[0].AssignedNode, all-members-on-one-node) is subtle enough to regress silently, and churn here means agent restarts at 512-database scale.
2. A rolling restart costs at most two hosts per database. The partition key is the exact declaring node-id set — flagged in Fix DistributeByGroupAffinity assigning a bumped projection version to nodes that cannot build it #3792 as a deliberate judgment call, with an offer to relax it. This pins the invariant that makes the strictness safe to keep or relax: overlapping-but-unequal capability sets still land every database on ≤2 hosts. Anyone coarsening the key can now refactor against this.
3. Asymmetric fleets strand nothing. The per-node ceiling is computed over all nodes including incapable ones, so a brand-new green fleet declaring only the bumped agents is where the arithmetic would break first: nothing unassigned, every bumped agent on green, neither green node idle.

One end-to-end sim in slow_agent_start_convergence — the #3753 deploy shape:

#3753 is not about slow starts in general (production converges fine without a version bump). It is slow starts and a blue/green capability split at the same time — and until #3792 those two conditions were each covered by tests that passed while their intersection failed. The existing sim ran homogeneous capabilities through DistributeEvenly; this variant drives the real NodeAgentController.EvaluateAssignmentsAsync with:

• grouped agents through DistributeByGroupAffinity, as EventSubscriptionAgentFamily uses for a multi-database store
• a blue leader whose own family cannot enumerate the green agents — they reach the grid solely through node capabilities, exactly as in production
• the field-calibrated long-tailed start costs (p50 27s / p95 82s / 215s tail)

and asserts convergence in bounded rounds, zero cross-fleet placement at any point during the wave, zero stops/reassignments/double-starts, and the two-hosts-per-database pool bound holding throughout.

Harness seams (no existing behavior changed)

• FakeAgentFamily: constructor over explicit agent names (names may carry path segments to model grouped, versioned agents), and an overridable Distribution.
• SlowStartCluster: overload taking the leader's family + per-node capability sets, deriving the agent universe from the capability union the same way NodeAgentController seeds the real grid.

Verification

• All 4 new tests fail with the pre-Fix DistributeByGroupAffinity assigning a bumped projection version to nodes that cannot build it #3792 AssignmentGrid.Distribution.cs swapped in; pass with it.
• CoreTests: 2236 passed (net9.0), full suite.
• dotnet build wolverine.slnx -c Release: clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_0116vfBcKwcjWn8msM4ZjkuA