CI floor never OOMs: derive spawn_width from measured per-shard memory demand (memory-aware width-fold) + expose a per-run ResourceEnvelope; fail-closed DEMAND->CEIL so the floor under-subscribes rather than OOMs. Consume the merged measure ops (#5470/#5478 concurrent_memory_peak_per_share / measure

[briansrls]

What

Expose the CI floor's per-run resource DEMAND as a ResourceEnvelope — the carrier cross-run placement consumes — derived from the memory-aware width fold so the floor's projected memory can never exceed the budget it was derived against. This is the item-3 slice of the work item; items 1–2 were already on main (see Grounding below).

DESIGN refs: §2 (reuse the one ResourceEnvelope carrier, no parallel mint), §3 (single authority — same width inputs as gunbc_ci_floor_spawn_width, no re-derived shard_count fork), §5 (fail-closed; derive, don't hand-set; proven by execution).

Changes

dsl/product/compute_fabric.dag (reuses the existing ResourceEnvelope):

• projected_concurrent_peak(width, per_shard_peak) = width × peak via measure_scale_fraction_ceil (std.measure demand-CEIL follow-up (§1 spawn-width; completes the ceil≠floor money-pair after #5470 landed the FLOOR family). Builds DIRECTLY on merged #5470 (measure.dag now has measure_scale_fraction_floor + measure_fit_count_floor). Authority: warm-lark's #5467 (docs/plans/expressibility-frontier. #5478, the fail-closed CEIL — a run's projected memory is never under-estimated)
• parallel_run_demand_envelope(width, peak) + …_from_budget(…) deriving width via memory_aware_spawn_width (§1-C: memory-aware CI floor spawn_width — derived from measured VmHWM peak + live budget (not pinned 4) #5444) — budget + measurement in, a ⌊0.8·budget⌋-bounded envelope out
• demand_envelope_fits_budget — the shared fit predicate (reuses memory_bytes_honor_demand); both the green path and the red control run through it

src/v2/workflow/ci_floor_plan.dag: gunbc_ci_floor_run_envelope(memory_budget_bytes) reusing the same width inputs as gunbc_ci_floor_spawn_width (breadth, fleet threads, measured per-shard peak, conservative fallback).

Verify by execution (§5)

Discriminating floor-enrolled witnesses (test fn, auto-enrolled):

• ci_floor_run_demand_envelope_model_holds (dsl) — non-binding fits; a planted ~20 GB shard shrinks the derived width 7→2 and still fits; RED control: a memory-blind (fail-open) width × the same peak (140 GB) fails the same fit predicate; 0-byte budget → conservative width.
• ci_floor_run_envelope_witnesses (v2) — on the live floor inputs (real breadth + measured peak): a tight ~10 GB budget backs the derived width below shard_count and the envelope fits; RED control over the live shape; 0-byte → conservative.

All green by execution. Perturbation-checked: making gunbc_ci_floor_run_envelope fail-open (memory-blind width) flips ci_floor_run_envelope_witnesses → false (red), so the witness has real teeth.

Grounding (verification notes — already on main, not re-done here)

• Derive width (memory_aware_spawn_width, §1-C: memory-aware CI floor spawn_width — derived from measured VmHWM peak + live budget (not pinned 4) #5444) and fail-closed DEMAND→CEIL (concurrent_memory_peak_per_share → measure_scale_fraction_ceil, std.measure demand-CEIL follow-up (§1 spawn-width; completes the ceil≠floor money-pair after #5470 landed the FLOOR family). Builds DIRECTLY on merged #5470 (measure.dag now has measure_scale_fraction_floor + measure_fit_count_floor). Authority: warm-lark's #5467 (docs/plans/expressibility-frontier. #5478) are merged and consumed green-by-execution by claim_executor (reads live cgroup memory.max).
• The executor's even-width division bug is gone (CI scheduler fix: model per-node resource demand + stop the executor's even-width division so the heavy discovery corpus gets the memory-budgeted spawn width (CI 24min->~10min), concurrent memory peak fail-closed under budget #5421, does-not-repro): run_walk gives each runnable the full width; DiscoveryBatch uses it as the corpus shard width, SingleClaim ignores it.

Cross-run bin-packing / workflow_dispatch run-doubling are operator/infra-owned and out of scope; this produces the demand model they ride on.