Wet-witness host-premise census; host_capacity ledger cells take a supplied memory reading

[gunbai-bot]

Work item: wet-witness audit (assumed host state across all wet claims).

Census. docs/plans/wet-witness-host-premise-census.md classifies all 51 modules on v2.workflow.local_repo_wet_terminal local_repo_wet_schedule, one row per witness and claim: the premise it assumes and its disposition, under RFM wet_witness_keyed_to_the_runner_not_its_subject.

• Runner-keyed: spark ×2, manager_unaskable and ntfy readback are already repaired (spark wet witnesses: supply the off-fleet premise; real-read route claims (unblocks srv1-placed floors) #12478/The spark authority witnesses stop reading the runner's live log #12532, manager_unaskable wet witness asserts the route relation on manager hosts; rfm row for runner-keyed wet witnesses #12456, Enrolment code: memory-bounded scope for the verb; ntfy auth-file is the observed auth.db #12614). mtcollins1 is still open in mtcollins1 census wet witness: per-run temp dir, not host-global /tmp paths #12467. The pair_serving_d0 front door belongs to crisp-lynx-364 and is untouched here. One new finding: the fabric_storage read-only-chmod claim flips on any runner that executes as root.
• Latent: host_capacity live memory, the runner user's global git config leaking into git-backed claims, the credential env / ancestor .cargo in fleet_release_bins, fixed absent paths, umask, and a fixed sleep. Tool-presence premises are recorded but not scheduled.
• Clean: the remaining modules.

The census was produced by reading the sources, not by executing the claims.

Fix, batch 1: test.claim.compute.host_capacity_wet_witness. Three ledger cells went through compute_reserve_on, which reads the runner's /proc/meminfo. On a busy runner they answered ComputeHostBelowFloor. This is the residual the RFM's census receipt names. They now reserve against a supplied reading (reserve_with_room), as the headroom cells already did (DESIGN §3, a witness discriminates at one interface).

The pairing obligation is kept by the new the_real_reservation_route_admits_exactly_what_the_reading_backs. It runs the real compute_reserve_on route and asserts its verdict as a relation to the host's own reading: admitted if at least 1 MiB is free, below-floor otherwise, and a typed refusal if the reading is unobserved. It never asserts a fixed arm. The claim is enrolled in the wet schedule and in floor_route_gap_expectation_chunk_21; it reaches fresh_root like its siblings.

Evidence: none local yet. A remote gunbc run of the claims hit its 45-minute limit without a verdict, so the wet lane on this PR is the execution receipt.

Later batches follow the census: git config isolation, fleet_release_bins env/ancestor, fixed absent paths / umask / chmod-as-root / sleep. No CI jobs are added.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 72722 in 9977a14: the supplied reading is now data supplied_host: Kibibyte = kibibyte(count: 67108864) and is passed straight through as total:/available:. The older one_gibibyte_in_kibibytes bare Int is untouched, as the review noted. — sent from neat-moth-20

[gunbai-bot]

Local wet receipt (claim_batch built from source into a private target dir, aarch64 session container, uid 1000)

• head: 9e7f365324bb915ab25c166d2cc0419968d8cb95, which is 9977a14 merged with main. The seed binary checks a view field that Bare-provider gate: read bare references from the full parse; delete the byte scanner #12609 added, so the branch needed main.
• command: claim_batch --wet --source-root dag --source-root src/v2 --entry dag/test/claim/compute/host_capacity_wet_witness_test.dag --functions <all 9 test fns>
• exit 0, peak RSS 9.2 GiB

PASS competing_reservations_cannot_over_reserve_and_a_release_returns_the_capacity
PASS a_request_the_machine_cannot_back_refuses_below_the_live_floor
PASS an_appropriation_larger_than_the_machine_refuses_rather_than_admitting
PASS two_instances_on_one_host_resolve_to_one_pool_at_one_root
PASS a_reused_reference_is_a_ledger_refusal_and_never_reported_as_a_full_pool
PASS two_requests_summing_past_the_observed_headroom_cannot_both_admit
PASS the_real_observation_reads_this_machine
PASS releasing_one_seat_twice_is_not_a_ledger_failure_and_charges_nothing
PASS the_real_reservation_route_admits_exactly_what_the_reading_backs

This host had well over 1 MiB free, so the real-route claim took its admitted arm. The below-floor arm of the relation did not execute here.

On BuildBuddy, the same run was OOM-killed (exit 137, about 7–8 GB runners) before any claim ran.

— sent from neat-moth-20

[gunbai-bot]

CI wet receipt for floor job 109589210076 (run 36620781638) at head 9e7f365, runner srv3-16: all 9 test.claim.compute.host_capacity_wet_witness identities show [local-repo-wet] … expected=passed observed=passed, including the_real_reservation_route_admits_exactly_what_the_reading_backs. The 4 changed identities read [changed-witness] standing=hermetic-route-gap-held-and-wet-passed. — sent from neat-moth-20