STAGE-2 PR-1: fleet-resource model (per-type baselines + shared build pool) + §3 jobserver single-authority

[gunbai-bot]

STAGE-2 PR-1: fleet-resource model (per-type baselines + ONE shared build pool), pure .dag, zero host effects

Builds on #5650 (the SessionReservationMode authority). This is PR-1 of 2: the typed model + witnesses + the §3 single-authority fix. PR-2 (follow-on) emits the systemd units / admission / runner-slice-cap config as drift-gated GeneratedArtifacts + the detection-only live-read floor gate.

What it models

The operator's "unify the build between GHA-CI and agent sessions" — recognizing the expensive thing in both a runner and a session is the build (cargo, ~per-job memory envelope), already unified host-wide by the existing ctrl-jobserver (scheduling) + ctrl-sccache (caching) services.

• extdeps/ctrl/jobserver.dag — cites install-ctrl-jobserver.sh as the build-pool authority. CtrlJobserverConfig {margin, mem_reserve, mib_per_job}; tokens are installer-DERIVED (derive_jobserver_tokens = min(nproc - margin, fit(mem_total - mem_reserve, mib_per_job))), not a baked literal — on a 128-core/125GiB host this derives to 66 (the memory bound binds), not 120. Committed citation is CtrlJobserverAbsent (fail-closed; /opt/ctrl is root-only — flip to Cited is a later 1-line fill).
• gunbc/fleet_container.dag — per-type idle baselines as measured ResourceEnvelopes: GhaRunnerContainer ~300 MiB, AgentSessionContainer ~450 MiB (vs the 31.27 GiB docker cap = ~70× over-reservation). ContainerBaselineUnmeasured fails closed (no silent zero).
• gunbc/fleet_host_budget.dag — the conserving host budget (reuses product.budget_tree BudgetNode + node_conserves): host = overhead + Σ(baselines) + capped_build_pool + headroom + runner_slice_cap. The build is a typed RealizedStep<Nano> (content-addressed CreateIfAbsent keyed on the compile content-hash, materialization: Share = sccache, cost.space = mib_per_job) — the §2 grounding. Headroom is a fail-closed operator policy lower-bounded by a derived oomd_actuation_floor. runner_slice_cap is the conserving value for the existing 10-resource-caps.conf drop-in (not a new cap). Every fail-closed path (Absent / Unmeasured / headroom Unset / below-floor / OomdUnverified) returns FleetHostPlanUnsound; the live fleet_host_plan() is Unsound today.

§3 single-authority (D1)

product.compute_fabric's HostJobserverFifo provider-constraint now config_ref: CtrlJobserverConfig instead of its own token_cap: Int — the jobserver token count has one home; the duplicate is unwritable by construction. Verified: zero constructors/readers broke.

Verification (green by execution)

fleet_model_holds = true (15 witnesses): the fail-closed paths; tokens-memory-bound-binds (=66, not 120); capped-conservation (node_conserves + an uncapped-overcommit discriminating RED); the disk≠live runner-slice drift red-receipt (the live MemoryMax=INFINITY bug, the real over-commit vector, as a witness); and the #5650-marker dissolution (exact conservation: the coarse Regime2 aggregate = the fine Σbaselines + capped_build_pool, nothing lost). runner_placement_holds + ci_budget_tree_holds unbroken.

🤖 Generated with Claude Code

[gunbai-bot]

Thanks — both addressed.

Finding 1 (HardwareThreadCount hard-blocker) — fixed by construction in f181ad3599. nproc, margin, and the derived token count now consume the canonical HardwareThreadCount (std.measure, = Measure<Count, One, Nat>) that compute_fabric already uses, rather than bare Int:

• CtrlJobserverConfig.margin: Int → HardwareThreadCount
• derive_jobserver_tokens(nproc: HardwareThreadCount, …) → HardwareThreadCount (values extracted for the min/monus arithmetic, reconstructed at the boundary)
• jobserver_build_pool_bytes / nominal_build_pool / fleet_host_plan_for nproc params → HardwareThreadCount; FleetHostPlanDerived.effective_build_tokens → HardwareThreadCount; the nproc: 128 literal → hardware_thread_count(count: 128).

This is the construction fix (consume the existing authority), not a dissolve-on deferral — distinct from #5650's cardinal counts, which have no carrier. All three suites green by execution after the change (fleet_model_holds incl tokens-memory-bound-binds = 66 < 120, runner_placement_holds, ci_budget_tree_holds).

Finding 2 (parallel Optional<ByteSize>-shaped coproducts) — kept distinct by design, not folded. The three "absent" arms are semantically different states, not one repeated None:

• RunnerSliceCapEffectiveness.CapUnbounded = the runtime cgroup has no limit (MemoryMax=INFINITY) — an unbounded/infinity reading, the actual drift bug.
• HeadroomPolicy.HeadroomUnset = the operator hasn't chosen a policy — fail-closed pending a decision.
• ContainerBaseline.ContainerBaselineUnmeasured = no measurement exists yet.

Per DESIGN's recurring failure mode "state-space conflation (an Option/None meaning >2 things — split into named variants)", collapsing these into a shared Optional<ByteSize> would conflate three distinct meanings into one None and lose the named reason at each site. The structural identity (X{bytes} | Y) is shallow; the meanings diverge. So this is a deliberate split-don't-conflate, not accidental duplication. (A future parameterized Absence<Reason> carrier that preserves the distinct reasons would be a separate, non-lossy consideration; a bare Optional would not.) Agreed it is non-blocking.

— sent from cool-boar-883

[gunbai-bot]

Thanks — verified the minor note against the code and it's actually a real fail-open, not merely defensive, so I pushed a fix (04fa715718).

The grounded numeric tower realizes Nat as a native Int, so nproc_v - margin_v is integer subtraction, not monus. Proven by execution: nproc=8 / margin=64 produced a negative token count that flowed silently into jobserver_build_pool_bytes — a §5 fail-open (wrong value, not a typed error), masked-but-not-fixed by the downstream nat_min with the memory bound.

Fix at the carrier, single-authority: added hardware_thread_count_saturating_sub to std.realization_width (sibling of byte_size_saturating_sub / bounded_host_spawn_width, the saturating-sub home) and consume it in derive_jobserver_tokens. margin >= nproc now saturates to 0 tokens (degenerate-but-sound: a host that cannot build). Covered by a new discriminating witness witness_margin_exceeds_nproc_saturates wired into fleet_model_holds; all three suites (fleet_model_holds, runner_placement_holds, ci_budget_tree_holds) green by execution.

— sent from cool-boar-883

[gunbai-bot]

Took the non-blocking §5 note and dissolved it by construction (38ea8fb288) rather than deferring — it aligns with the project's construction-over-validation principle and the head moves at retarget anyway.

You're right that baseline_or_zero was a fail-open shape, and it was actually worse than it looked: fleet_host_plan_for resolved both baselines at the gate, then discarded the bytes (bytes: _) and re-resolved via baselines_sum with the zero fallback (resolve-discard-reresolve). Per your pointer ("refuse to call baselines_sum outside the resolved branch"): I now bind the resolved ByteSize at the gate (bytes: rb / bytes: sb) and flow them forward; baselines_sum and fleet_host_budget_tree take resolved ByteSize instead of FleetContainerType; baseline_or_zero is deleted. The only sink for an unmeasured baseline is now FleetHostPlanUnsound at the gate — the zero arm is unwritable.

Tests single-source the fixture baseline bytes so no zero-fallback shape survives there either; witness_baseline_unmeasured_unsound proves unmeasured → Unsound. All three suites green by execution.

— sent from cool-boar-883