Model systemd-oomd as a dependency (pure .dag, no live execution): extdeps/systemd unit-management interface plus oomd config surface, apt install-as-effect, and a gunbc install Realization that grounds OomdEnforced from a verify/show-effective read

[briansrls]

Auto-opened by session-dashboard for session valiant-pike-233.
Pushing to session/valiant-pike-233 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Thanks — all three addressed (commit 9e97611):

1. Seconds duration → std.measure carrier. Landed on the carrier rather than a 🟡 defer: std.measure already has the Time dimension + One scale + the Nanosecond/Microsecond precedent, and Seconds was used only in oomd.dag, so this is a clean M9 DFS-attach — added Second = Measure<Time, One, Nat> (one row beside Nanosecond/Microsecond) and typed both default_memory_pressure_duration: Second and managed_oom_memory_pressure_duration: Second?, values second(30) / second(20). No flat scalar propagates into the policy authority. Measure carrier tests stay green.

2. unit_is_enabled wildcard → explicit enumeration. Now enumerates all ten UnitFileState arms like the sibling unit_is_active. UnitEnabledRuntime => false is deliberate (runtime-only enablement does not survive a reboot, which the grounding requires); all non-UnitEnabled arms => false.

3. ROADMAP.md deletion — confirmed intentional. It is exactly a duplicate-line cleanup, no content change. ROADMAP.md is a generated projection of gunbc.roadmap_authority (the GeneratedArtifactDriftGate enforces committed == expected_roadmap_md()); a textual merge of origin/main duplicated the → [CI humming] line, drifting the committed file from its authority and reding the floor drift gate tree-wide. Regenerated via main_wet (commit 8a60900) — the authority emits the line once. (Parent is landing the same dedup independently as Fix fleet-red ROADMAP drift: remove duplicate CI-humming entry #5696.)

— sent from valiant-pike-233

[gunbai-bot]

Follow-up on the approving review (commit a263c92):

• first_grounding_failure ""-as-absence (finding 2): fixed — now returns String? (Absent = all checks pass → Grounds; Present{reason} = first failure → DoesNotGround). No empty-as-absent second-representation.
• Percent in extdeps leaf (finding 3): promoted to std.types, beside the other branded-Int scalars (Duration/Milliseconds/Seconds) that are collectively pending the value-Measure migration. oomd.dag + oomd_install.dag import it from std now. No fork (no std.Percent existed).
• Coproduct→Bool predicates (finding 1): left as-is per your note that they are defensible — they encode a domain semantic (only Active/UnitEnabled constitute enforcement; Activating/Reloading deliberately fail closed), not mechanical variant-equality, and each grounding_checks row carries the located failure_reason.

Witness still green by execution.

— sent from valiant-pike-233

[gunbai-bot]

On this round of findings — all three are non-blocking and intentional/deferred; not changing code so HEAD stabilizes for re-review (rationale below):

1. Three coproduct→Bool predicates (unit_is_active/unit_is_enabled/pressure_is_kill). Agreed this is the recurring shape, and the producer-side labeled accessor is the right long-term move. It is a follow-up, not this PR: these encode a domain enforcement semantic (only Active/UnitEnabled/kill constitute enforcement; Activating/Reloading deliberately fail closed), and the canonical fix touches the extdeps producers (systemd/systemctl/oomd) to expose "is-the-OK-arm" accessors — a cross-module refactor better landed once, when the second consumer actually appears, than speculatively here.

2. Percent as a std.types brand vs Measure<Dimensionless, …>. Deliberately deferred, not forked. std.measure has no Dimensionless quantity today (the Quantity enum stops at the physical dimensions), and extdeps/docker/container_stats.dag:115 already carries the named trigger for exactly this — "Ratio or PercentagePoint typed alias lands in std/measure". Minting a half-formed dimensionless carrier in an oomd PR (percent vs 0–1 ratio vs percentage-points — the unresolved question that trigger names) would be the worse outcome. Percent sits in std.types beside Duration/Milliseconds/Seconds — the other branded-Int scalars collectively pending the value-Measure migration; it migrates with them, onto the dimensionless carrier, under that one trigger. Second was migratable here only because Time + the Nanosecond/Microsecond carrier precedent already existed; Dimensionless has no such precedent.

3. gunbc_oomd_install_evidence ReadObserved arm returns OomdUnverified. Intentional and fail-closed in the safe direction. The committed read is ReadAbsent, so the arm is dead today; it is written to return OomdUnverified (not to ground) precisely so a future committed ReadObserved wired without the REGIME-2 byte thresholds cannot accidentally ground — grounding only ever flows through reconcile_oomd/ground_oomd_from_read with OomdGroundingThresholds supplied from the single authorities. The doc comment on the function states this.

— sent from valiant-pike-233

[gunbai-bot]

RC addressed (commit 71ae949):

Percent → Measure in std.measure (was the blocking finding). Agreed — the std.types branded-Int Percent was the parallel-representation the container_stats.dag:115 dissolve_on was authored against (satisfied the trigger in name, not grounded in the carrier). Fixed: added a Dimensionless quantity to std.measure and landed type Percent = Measure<Dimensionless, One, Nat> (+ percent/percent_count) beside the other Measure aliases; removed it from std.types. Quantity is a phantom type param (never matched), so the variant is purely additive. The oomd percent fields now consume the Measure carrier (percent(60)/percent(90)), and the PSI% grounding check compares via percent_count (no record-== straddle). Percent now has ONE home in the Measure framework, and container_stats.cpu_percent can dissolve onto the same Dimensionless quantity (a future Ratio/Float sibling) rather than a forked brand — which is what that dissolve_on intended.

Predicate dissolution (non-blocking). Left as-is per your note that it is workflow-local and a domain enforcement semantic (only Active/UnitEnabled/kill constitute enforcement), not mechanical variant-equality; the canonical producer-side accessor is a follow-up once a second consumer appears. The per-check failure_reason carries the located cause.

Witness green by execution; measure carrier tests green.

— sent from valiant-pike-233

[gunbai-bot]

Thanks — addressing all three.

Finding 1 (OomdGroundingCheck hand-rolled sum) — fixed in f0a43d0c9. Dissolved into the canonical coproduct you named:

type OomdGroundingCheck
  = GroundingPass
  | GroundingFail { reason: String }

ok: true-with-reason and ok: false-without-reason are now unwritable, and first_grounding_failure matches one constructor instead of inspecting two fields. A grounding_check(ok, reason) constructor keeps the 8-row table readable. Internal only — the public seam (gunbc_oomd_fleet_evidence, ground_oomd_from_read) and the 15-check witness are unchanged; witness green by execution (PASS oomd_install_grounding_holds).

Finding 2 (single-variant predicates) — leaving as-is, by your own read. unit_is_active / unit_is_enabled / pressure_is_kill are workflow projections of the freedesktop authority's closed enums (SystemdUnitActiveState / UnitFileState / ManagedOomAction in extdeps.os.*), not std/substrate. Each is total over its coproduct (every arm enumerated, fail-closed on the non-distinguished arms) precisely so that an enum gaining a variant upstream forces a re-decision here rather than silently defaulting. Per your note they're acceptable at this layer; I'll watch for accrual and dissolve to a shared projection if a third+ shows up.

Finding 3 (Percent not bounded to [0,100]) — acknowledged, scoped as a std.measure follow-up, not this PR. You're right that percent(150) typechecks today. Bounding it (where range(min: 0, max: 100) on the Measure alias) is a change to the shared std.measure authority with blast radius across every Percent consumer, so it belongs in its own PR against that authority rather than riding in on the oomd model — and as you note, the existing aliases already trade on the unbounded form, so this PR doesn't regress the status quo. Worth doing for the §5 unwritable-misuse win; I've noted it for a dedicated std.measure increment.

— sent from valiant-pike-233

[gunbai-bot]

Thanks. Both notes are non-blocking; recording the dispositions.

Percent scale (Measure<Dimensionless, One, Nat> vs ratio-at-Centi). Your dimensional read is fair — the stored count at scale One literally denotes the pure number 60, whereas "60%" is the ratio 0.60, which Centi (10⁻²) would express honestly. Two reasons it stays One in this PR rather than flipping:

1. It's phantom here, and the count is the wire literal. Grounding compares percent_count(read) == percent_count(req) — counts only; the Scale annotation never enters the arithmetic. And 60 is exactly oomd.conf's on-the-wire ManagedOOMMemoryPressureLimit=60% integer, so the count is faithful to the source regardless of the phantom scale.
2. Centi doesn't exist in std.measure yet (Scale is Femto…Nano…Milli…One…; dsl/std/measure.dag:33), and Percent = Measure<Dimensionless, One, Nat> was the explicit outcome of the prior RC that moved Percent into the measure authority. Flipping the scale now means adding a Scale variant — a change to the shared authority with cross-consumer reach — and re-opening a home that bounced three times (extdeps→types→measure) before settling here.

I've bundled this with the earlier [0,100]-bound note into one dedicated std.measure follow-up: introduce a dimensionally-honest, bounded Percent (ratio at Centi, range-constrained) in its own PR against that authority, where the blast radius is owned and reviewed as a unit-system change rather than riding in on the oomd model. As you note, the current form shares the carrier and forks no parallel unit system, so this PR doesn't regress the status quo.

Predicates (unit_is_active / unit_is_enabled / pressure_is_kill). Agreed and as discussed on the prior round — they're gunbc-workflow-layer policy projections of the freedesktop closed enums (total over every arm, fail-closed on the rest), encoding "only Active+UnitEnabled+kill ground OomdEnforced" rather than dissolving a canonical substrate query, so they don't trip the predicate-dissolution gate. Will dissolve to a shared projection only if a third+ accrues.

— sent from valiant-pike-233