V4.1 capacity measurement: startup receipt, Engram residency, probe, staircase, production gate

[gunbai-bot]

V4.1 capacity measurement is the first serving action (operator-approved 2026-09-25). This PR adds the model, a dry-run plan, and the fixture witness. The wet run on srv5-8 comes after the srv8 runtime image exists (#12294). That is a declared frontier, v41_wet_runner_frontier.

What lands

Upstream-shape kernel readers. Each cites its kernel document and declares the kernel version it depends on:

• extdeps.linux.psi: PSI some/full cumulative totals, per accounting/psi.rst (4.20+). A full-stall interval is the delta of two totals, and a total that went backwards is typed as unmeasurable.
• extdeps.linux.diskstats: /proc/diskstats read fields, per iostats.rst. Sectors are always 512 bytes. The read interval carries bytes, IOPS and mean await. An absent device is its own arm, not a zero read.
• extdeps.linux.mincore: mincore(2) file residency. It is RESIDENCY only, never touches.
• extdeps.linux.cgroup_v2_memory: memory.stat (anon, file, file_mapped, workingset_refault_file, pgmajfault), with the per-key kinds stated.

gunbc.spark.v41_capacity_measurement:

1. Startup receipt from every rank, judged by the MIN rank. Each field is optional in the reading and required in admission, so a missing field is refused by name. A missing, duplicate or out-of-range rank refuses. So does a rank on a different run id, image digest or vLLM commit. Effective bytes/token = available KV bytes / the engine's "GPU KV cache size" tokens; blocks × block size is not used, per extdeps.vllm.kv_cache. The x6 and x16 thresholds are derived as concurrency × 262,144, not authored.
2. Bets. The side-chat KV and Engram figures are TranscribedUncited bets. Each gets a verdict of Confirmed, Falsified or Unreadable, and no capacity is computed from a bet.
3. Residency timeline. 4 phases × 4 ranks, admitted by identity join per image arm. The startup arm is EngramCacheRetained / EngramCacheReleased, bound by image patch digest rather than a runtime flag (ruling, proud-deer-538). The bindings stay empty until the first srv8 image exists.
4. Cold/warm probe cells (32k x1; 262k x1/x2/x4/x6). Distinct touches come from V41EngramLookupObservable, which is TouchCounterUnavailable until the follow-up counter lane lands after quick-lynx-421's fetch_rows change (ruling). So the Engram-resident capacity refuses today.
5. Staircase x1→x16. It stops at the first KV preemption, superlinear refault, sustained PSI full stall, NVMe await, or SLO breach. A step with no reading is a stop, never a skip. The thresholds are a PolicyProposed row, and the staircase refuses until the operator signs it.
6. Three separate capacities: KV-admission, Engram-resident and SLA-sustainable. The production gate admits the minimum of the three and refuses otherwise. The measurement serve is its own admitted realization, so the gate is not circular.

Evidence

claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/spark/v41_capacity_measurement_witness_test.dag --functions <all 22>: 22 PASS, run in-session. Revert arm: making the min-rank fold pick the max rank turns the_startup_receipt_is_judged_by_the_min_rank into a FAIL.

Open

• Operator sign-off on the proposed staircase thresholds (sent to proud-deer-538).
• Wet fleet mode after Fabric store: owner/group/mode derived from its two writers (CI claim principal can write) #12294, and the distinct-touch counter follow-up lane.

🤖 Generated with Claude Code

[gunbai-bot]

Review 71351 (/api/reviews/71351/artifacts/stdout.log): both findings fixed in 243bbde. MincoreFileResidency.page_bytes and the mincore_page_count/mincore_file_residency parameters are now ByteSize, and the arithmetic goes through byte_size_count/byte_size. diskstats_sector_bytes is byte_size(count: 512). The same commit fixes the floor refusal (UnimportedBareProvider): filter is imported from v2.std.algebra and list_at_optional from v2.std.collection, with no roster rows added. All 22 witness claims pass in-session on this head.

[gunbai-bot]

Review 71369 (/api/reviews/71369/artifacts/stdout.log): fixed in f7c6816. V41EngramResidentBet.resident is now a Gibibyte (gibibyte(count: n)), converted with std.measure gibibyte_to_byte_size. The review also exposed that nothing consumed these bets. v41_judge_engram_resident_bet now pairs each bet with the rank's after-requests mincore residency from the admitted timeline (v41_after_requests_resident), in bytes. The figures are point bets ("about 19 GiB") with no stated tolerance, so the verdict is PointBetObserved { bet, observed } or PointBetUnreadable, not confirmed or falsified; I did not want to invent a band. A new claim covers both arms. 23/23 witness claims pass in-session.