cores_per_slot = 1 per operator ruling; the CPU axis stops binding, CPUQuota stays unset

[gunbai-bot]

Reworks #11684 (convergence item F) under the operator ruling of 2026-09-19, verbatim:
"there is no CPU demand - the processes we run are single core - do NOT overthink it please".

What changes

gunbc.runner_slot_allocation

• cores_per_slot is an authored POLICY of 1 (gunbc_runner_cores_per_slot_policy), citing the ruling. It is not derived from memory_max and not from a vendor price list.
• The memory-per-core ratio path is DELETED, not left beside it: gunbc_runner_memory_per_core, runner_memory_per_core_of, RunnerMemoryPerCoreResolution (incl. the now-unreachable MemoryPerCoreUnresolved arm), RunnerCoresPerSlotResolution, and the survey/ubicloud/ci_runner.types imports. gunbc_runner_cores_per_slot() returns a plain HardwareThreadCount.
• Consequently the CPU axis admits 128 (cited Ampere M128-30 cores / 1) and stops binding; host_cpu_admitted_width and gunbc_derived_runner_slots_per_host lose their unreachable unresolved arms and return Int. Committed widths become the memory admissions: srv1 15, srv3/srv4 17 (srv2 still refused).
• F-R3: only the CPU-survey refusal path is deleted. The memory-side unknown/zero conflation in gunbc_runner_slots_per_host (srv2's unestablished session charge reads as a scalar 0) remains, with its existing owner and trigger (a typed RunnerWidthResolution carried to every consumer) restated on the function.
• The reason: authority row carries the ruling and the re-derived widths at its head; the stale "CPU binds" annotations are corrected.
• The cores × memory_per_core ≥ memory_max conjunct of gunbc_runner_slot_allocation_wall_holds is deleted (it was the deleted derivation read back as a relation); the compiler-admission specimen recorded on it is kept on the wall's annotation.
• Source cores_per_slot from a workload reserve, not a VM price list #11684's ByteSize reserve carrier (review 68200) is gone with the byte reserve.

CPUQuota: kept unset/unlimited, and the unset is affirmative. cpu_quota WAS derived from cores_per_slot; at a policy of 1 it would have rendered CPUQuota=100% on every runner unit and fabric cell slice, throttling parallel link/codegen. So:

• RunnerSlotCpuQuota = CpuQuotaResolved { threads } | SlotCpuQuotaUnbounded (the refusing arm had no producer once the survey went); gunbc_runner_slot_cpu_quota() is SlotCpuQuotaUnbounded. cpu_weight=100 unchanged.
• extdeps.systemd.unit_file gains DirectiveReset (the empty assignment, which systemd.resource-control(5) documents as the unset for CPUQuota= — infinity is not a value that parser admits) and the mint slice_cpu_quota_unbounded() → CPUQuota=.
• The reset is emitted on both paths — gunbc.host_converge runner_cpu_boundary_knobs renders the per-slot drop-in knob as CPUQuota= under the new RunnerCpuBoundary::NoCpuCeiling arm, and gunbc.fabric_cell_effect always emits six directives with CPUQuota= as the sixth. What this PR does NOT claim (F-R1/F-R2): the reset does not clear a previously installed finite quota by production convergence. Both existing-quota repair paths are EXPLICITLY BLOCKED in source with cause and trigger: (a) fabric — an existing boundary differing only by a finite quota reconciles as MemberChanged → CellChangeNotYetRealizable, so the drift is detected and refused, not repaired; trigger is gunbc.change_realization admitting a bounded resource-boundary change at that address (set-property on the existing slice, never delete/recreate). (b) runner unit — the knob is the desired representation only; host_axis_caps does not enrol the CPU drop-in, host_runner_memory_provision has no live apply, and runner_unit_live_read yields no verdict for CPUQuota; trigger is enrolling the CPU drop-in in the actuated managed set plus a CPUQuotaPerSecUSec readback verdict (write CPUQuota=, read infinity, unreadable does not satisfy). The reported srv4 runner-unit census found unlimited quotas; other runner units and the fabric boundary (fabric-cell-srv3-06.slice) require their own readback; this PR does not establish fleet-wide quota conformity.
• gunbc.ci_runner_placement runner_cpu_boundary_for now takes the slot's cpu_quota rather than a thread count, so the deploy boundary follows the row instead of re-deriving from cores_per_slot. RunnerCoreRatioUnresolved (no producer) deleted.
• gunbc.fabric_cell_converge desired digest spells unbounded through the same systemd_cpu_quota_per_sec_identity(CpuQuotaUnbounded) the observed side uses, so a host printing infinity reconciles as satisfied by construction (and a host still at a finite quota reads as drift — visible, and refused rather than repaired per F-R1). fabric_cell_address_standing_for_quota and the SliceDirectivesQuotaSurveyRefused / CellCpuQuotaSurveyRefused arms are deleted with their producer.
• gunbc.runner_microvm cell entitlement maps the unbounded row to CpuEntitlementRelativeOnly with a cause naming the ruling; the declared guest size is therefore the served answer.

Witnesses migrated to the policy, not the old literal: w_live_ratio_resolves_to_the_vendors_decimal_gigabytes and its two refusal siblings are deleted with their subject and replaced by w_cpu_axis_admits_the_catalog_core_count_at_one_core_per_slot; runner_slot_allocation_committed_widths_are_the_minimum_over_axes now pins 15/17/17 == memory admission with CPU at 128; new rows drive both quota arms by fixture (witness_boundary_add_renders_the_quota_line_under_both_arms, witness_an_unbounded_host_quota_is_satisfied_under_the_unbounded_row, the_cpu_quota_unset_renders_the_empty_assignment, the_cell_entitlement_is_the_slot_quota_arm_for_arm); the sudoers witness asserts CPUQuota= and no line-terminal % grant (narrowed per review 68479).

Sudoers projections regenerated through generated_artifact_gate main_wet.

Evidence

Scoped claim_batch runs on every touched witness module (all green; the one microvm row that flipped is recorded on the row). Pre-existing reds NOT introduced here: five rows in test.claim.host_allocation_conservation (srv4_commits_memory_width_disk_gated_at_apply, session_hosts_refuse_the_managed_width, derived_width_reproduces_the_surviving_host_classes, the_control_plane_reaches_the_commitment_only_where_memory_still_binds, the_uncharged_widths_are_what_the_charged_ones_are_measured_against) pin 16 GiB-era widths (29/25/21) and FAIL identically on a clean main ancestor (7261964); the module is outside required_gate_prefixes. Left as found — a separate repair.

Supersedes #11684.

🤖 Generated with Claude Code