Runner host protection: conservation model + sound converge script (swap-off) + drift-gate heal

[briansrls]

What this does

Makes a CI run unable to crash the host, and gives the operator a single sound, runnable script to apply the intent to the fleet.

1. Conservation allocation model (replaces the residual/gate tangle)

Host soundness is now declared-math conservation:
host_total ≥ runner_pool + session_pool + fixed_overhead + headroom (node_conserves).

• runner_pool_budget = 80 GiB, per_runner_memory_cap = 8 GiB → declared_runner_count = 10.
• session_container_memory = 1 GiB uniform demand class (shared with the ctrl session dashboard — reconciled as another capacity term in the same budget).

This rips out the 5-gate fail-closed cascade (RunnerSlotUnenforced chicken-and-egg, OomdUnverified, CtrlJobserverAbsent, HostFixedOverheadUnmeasured, headroom) that refused to derive a plan premised on a cap not yet live — the lock that meant nothing took effect. "Is the cap live on the host" is now a converge-receipt question (verdict=converged/drifted/absent), not a plan-soundness one.

2. Sound converge script with the swap-off safety knob

The live converge now emits a sound .github/fleet-converge.sh for srv1+srv2:

• 80 GiB runner slice MemoryMax
• 8 GiB per-slot MemoryMax
• MemorySwapMax = 0 — converts host livelock (swap-thrash → reboot) into a scoped cgroup OOM-kill
• runner_count = 10

FleetConvergeArtifact flipped to CommitRequired { consumer: HostReconciler }: the script is committed and drift-gated — edit the .dag, the committed script must regenerate to match or CI reds. That is the "changes actually take effect" reconciler (the gate is the change-detector; ssh-apply is the action).

3. Heal pre-existing ROADMAP.md drift (was reding main CI)

The committed ROADMAP carried newer scheduler/cache profiling status hand-edited without modeling into roadmap_authority.dag (#5745/#5813-class). Healed by modeling that content INTO the authority — no revert.

Verification

All green by execution (interpreter, sccache-independent): drift gate ExitSuccess; runner-placement, fleet-converge-emit, host-allocation-conservation, fleet-host-budget, and all roadmap witnesses pass.

To apply on a host

scp .github/fleet-converge.sh srv1: && ssh srv1 'sudo bash fleet-converge.sh' — emits converge-receipt lines (verdict per knob); idempotent.

[gunbai-bot]

Thanks for the review. Addressing all three:

Finding 1 (measure-native arithmetic) — fixed in 10f1c91. session_pool_bytes now uses measure_scale_fraction_floor(m, num, den) and declared_runner_count / max_concurrent_sessions use measure_fit_count_floor(capacity, each), so the magnitudes stay inside the ByteSize carrier instead of unwrap→arith→rewrap. The Nat results coerce at the Int return boundary exactly as the prior division did, so no consumer churn. You were right that this PR is the moment to consume the dissolved family rather than repeat it.

Finding 2 (session_pool: byte_size(0) on the live path) — intentional, follow-up confirmed. The runner-placement plan reserves the full declared runner_pool (80 GiB) and checks conservation against it; session pressure is bounded by the separate sessions.slice cap (its own live term in the converge), not by the runner-count derivation, so charging it here would double-count. The active-session count also isn't known at plan-derivation time — it's a live ctrl signal. Wiring a real session_pool term here is exactly the ctrl session-envelope integration (the next phase, coordinating with keen-dove-772): the host_allocation_conserves algebra already accepts the term and sessions_subtract_from_the_same_budget proves it bites, so the seam is ready for that consumer. byte_size(0) is the conservative-correct value until then (full runner pool reserved; sessions live under their own cap in headroom).

Finding 3 (converge_runner_width advisory stderr on increase) — by design. The receipt verdict is the authority: an increase yields effective < desired → drifted → host_failed=1, the fail-closed signal. The stderr line is operator-facing UX only (a runner increase needs the registration/install path, not set-property), which is why it's advisory and the receipt carries the truth — consistent with the "EMIT is the single authority" header (the knobs and receipts are what the model emits). The script is generated, so this is a model-level choice, not a hand-edit; not a defect, no change.

— sent from calm-carp-204

[gunbai-bot]

Thanks — confirming the one follow-up so it isn't lost: the live session_pool: byte_size(0) on the runner-placement path is intentional (the runner plan reserves the full declared runner_pool; sessions are bounded by their own sessions.slice cap and the active count is a live ctrl signal not known at plan-derivation time). The host_allocation_conserves algebra already accepts the term and sessions_subtract_from_the_same_budget proves it bites, so the seam is ready for the ctrl session-envelope wiring (next phase, with keen-dove-772). Detail in my earlier reply on the first review. No code change needed for the APPROVE findings.

— sent from calm-carp-204