Rework CI floor allocation: bound concurrency to the live container cgroup memory limit, retire the static per_shard scalar

dsl/gunbc/ci_floor_measurement.dag

@@ -24,7 +24,7 @@ data gunbc_ci_floor_per_shard_rss_measurement: PerShardRssPeakMeasurement = PerS
 }
 
 data gunbc_ci_floor_per_shard_rss_source: Disposition = Terminal {
-  reason: "Measured local floor, post-#5860 corpus, main HEAD 6461042c64 at spawn_width=2 (pinned): floor peak VmHWM=6.0GiB => per-shard = VmHWM/width = 6.0GiB/2 = 3.0GiB (3226056704 bytes). Supersedes the stale 2.1GiB@width4 (CI run 27893441091) which the corpus outgrew: at the stale value the formula picked width=3 and 3 concurrent shards exceeded the 8GiB runner cap => exit-137 (run 28296782925). Refreshed to the operating width (2), the conservative per-shard (it is higher at lower width); formula now derives width=2 which fits at 6.0GiB. Finer path / durable fix: auto-measure per_shard each run instead of a committed scalar that lags every corpus bump."
+  reason: "Measured local floor, post-#5860 corpus, main HEAD 6461042c64 at spawn_width=2 (pinned): floor peak VmHWM=6.0GiB => per-shard = VmHWM/width = 6.0GiB/2 = 3.0GiB (3226056704 bytes). Supersedes the stale 2.1GiB@width4 (CI run 27893441091) which the corpus outgrew: at the stale value the formula picked width=3 and 3 concurrent shards exceeded the 8GiB runner cap => exit-137 (run 28296782925). VESTIGIAL IN WIDTH FORMULA as of gunbc_ci_floor_confirmed_safe_width: spawn_width is now min(cpu_bound, confirmed_safe_width), not floor(budget/per_shard). per_shard_committed is retained as (a) width=1 guard (if budget < per_shard, even one shard may not fit) and (b) ResourceEnvelope memory estimate. It is a [calibration] receipt, not a live scheduler input. Durable fix: resource-aware-scheduler Node B/C (docs/plans/resource-aware-scheduler.md)."
 }
 
 fn gunbc_ci_floor_per_shard_peak_rss_bytes() -> ByteSize {
@@ -38,6 +38,17 @@ data gunbc_ci_host_container_memory_cap: ByteSize = byte_size(33578549248)
 
 data gunbc_ci_floor_conservative_fallback_width: Int = 4
 
+data gunbc_ci_floor_confirmed_safe_width: Int = 2
+
+data gunbc_ci_floor_confirmed_safe_width_disposition: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "std.realization_schedule",
+    decl_name: "Runnable",
+    field: WholeDeclaration
+  }
+}
+
 type JobCgroupPeakMeasurement
   = JobCgroupPeakMeasured { cgroup_peak: ByteSize }
   | JobCgroupPeakUnmeasured

dsl/test/claim/ci_floor_measurement_per_shard_test.dag

@@ -7,6 +7,7 @@ import gunbc.ci_floor_measurement {
   gunbc_ci_floor_per_shard_peak_rss_bytes,
   gunbc_ci_floor_per_shard_rss_measurement,
   gunbc_ci_floor_measured_peak,
+  gunbc_ci_floor_confirmed_safe_width,
   PerShardRssPeakMeasurement,
   PerShardRssPeakMeasured,
   PerShardRssPeakUnmeasured,
@@ -42,9 +43,21 @@ fn witness_measured_arm_sample_width_is_two() -> Bool {
   }
 }
 
+fn witness_confirmed_safe_width_is_positive_and_small() -> Bool {
+  gunbc_ci_floor_confirmed_safe_width > 0 && gunbc_ci_floor_confirmed_safe_width <= 4
+}
+
+fn witness_per_shard_fits_within_confirmed_safe_shards() -> Bool {
+  let committed_count = byte_size_count(b: gunbc_ci_floor_per_shard_peak_rss_bytes())
+  let runner_cap_count = 8589934592
+  committed_count * gunbc_ci_floor_confirmed_safe_width <= runner_cap_count
+}
+
 test fn ci_floor_measurement_per_shard_rss_witnesses() -> Bool {
   witness_per_shard_uses_direct_measurement()
     && witness_direct_is_at_most_derived()
     && witness_unmeasured_arm_falls_back_to_derived()
     && witness_measured_arm_sample_width_is_two()
+    && witness_confirmed_safe_width_is_positive_and_small()
+    && witness_per_shard_fits_within_confirmed_safe_shards()
 }

src/v2/test/claim/ci_floor_plan_witness_test.dag

@@ -15,6 +15,8 @@ import v2.workflow.ci_floor_plan {
   witness_floor_width_derived_from_tree_is_positive,
   witness_floor_spawn_width_tight_budget_backs_off,
   witness_floor_spawn_width_zero_budget_falls_back,
+  witness_floor_confirmed_safe_width_bounds_actual_width,
+  witness_floor_ceiling_clamps_stale_per_shard,
 }
 import gunbc.ci_layer_roots { witness_discovery_scan_dirs, witness_layer_roots }
 import v2.std.algebra { length, list_snoc_item }
@@ -153,3 +155,8 @@ test fn ci_floor_spawn_width_live_budget_witnesses() -> Bool {
   witness_floor_spawn_width_tight_budget_backs_off() &&
     witness_floor_spawn_width_zero_budget_falls_back()
 }
+
+test fn ci_floor_confirmed_safe_width_ceiling_witnesses() -> Bool {
+  witness_floor_confirmed_safe_width_bounds_actual_width() &&
+    witness_floor_ceiling_clamps_stale_per_shard()
+}

src/v2/workflow/ci_floor_plan.dag

@@ -16,17 +16,17 @@ import std.types { ContentHash, Int }
 import std.disposition { Disposition, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.measure { HardwareThreadCount, hardware_thread_count, hardware_thread_count_value, byte_size, ByteSize, byte_size_count }
-import std.realization_width { width_fold_objective_goals, memory_aware_spawn_width, bounded_host_spawn_width }
+import std.realization_width { width_fold_objective_goals, bounded_host_spawn_width, int_min }
 import product.compute_fabric {
   ResourceEnvelope,
-  parallel_run_demand_envelope_from_budget,
   parallel_run_demand_envelope,
   demand_envelope_thread_count,
   demand_envelope_fits_budget
 }
 import gunbc.ci_floor_measurement {
   gunbc_ci_floor_per_shard_peak_rss_bytes,
-  gunbc_ci_floor_conservative_fallback_width
+  gunbc_ci_floor_conservative_fallback_width,
+  gunbc_ci_floor_confirmed_safe_width
 }
 import gunbc.ci_budget_tree { srv1_floor_memory_budget }
 import extdeps.cpu.ampere { altra_max_m12830_catalog }
@@ -278,13 +278,18 @@ fn gunbc_ci_floor_hardware_threads() -> HardwareThreadCount {
 }
 
 fn gunbc_ci_floor_spawn_width_for_budget(memory_budget: ByteSize) -> HardwareThreadCount {
-  memory_aware_spawn_width(
-    shard_count: gunbc_ci_floor_breadth(),
-    hardware_threads: gunbc_ci_floor_hardware_threads(),
-    memory_budget: memory_budget,
-    per_shard_peak: gunbc_ci_floor_per_shard_peak_rss_bytes(),
-    conservative_fallback_width: gunbc_ci_floor_conservative_fallback_width
-  )
+  let budget_count = byte_size_count(b: memory_budget)
+  if budget_count <= 0 {
+    hardware_thread_count(count: gunbc_ci_floor_conservative_fallback_width)
+  } else if budget_count < byte_size_count(b: gunbc_ci_floor_per_shard_peak_rss_bytes()) {
+    hardware_thread_count(count: 1)
+  } else {
+    let cpu_bound = hardware_thread_count_value(t: bounded_host_spawn_width(
+      shard_count: gunbc_ci_floor_breadth(),
+      hardware_threads: gunbc_ci_floor_hardware_threads()
+    ))
+    hardware_thread_count(count: int_min(a: cpu_bound, b: gunbc_ci_floor_confirmed_safe_width))
+  }
 }
 
 fn gunbc_ci_floor_spawn_width_from_tree() -> HardwareThreadCount {
@@ -296,12 +301,9 @@ fn gunbc_ci_floor_spawn_width(memory_budget_bytes: Int) -> HardwareThreadCount {
 }
 
 fn gunbc_ci_floor_run_envelope(memory_budget_bytes: Int) -> ResourceEnvelope {
-  parallel_run_demand_envelope_from_budget(
-    shard_count: gunbc_ci_floor_breadth(),
-    hardware_threads: gunbc_ci_floor_hardware_threads(),
-    memory_budget: byte_size(memory_budget_bytes),
-    per_shard_peak: gunbc_ci_floor_per_shard_peak_rss_bytes(),
-    conservative_fallback_width: gunbc_ci_floor_conservative_fallback_width
+  parallel_run_demand_envelope(
+    width: gunbc_ci_floor_spawn_width_for_budget(memory_budget: byte_size(memory_budget_bytes)),
+    per_shard_peak: gunbc_ci_floor_per_shard_peak_rss_bytes()
   )
 }
 
@@ -383,3 +385,18 @@ fn gunbc_ci_floor_plan_co_runs_heavy_without_serialization() -> Bool {
     dependencies: floor_dependencies_with(spec: gunbc_ci_spec, serialize_heavy: false)
   ) == false
 }
+
+fn witness_floor_confirmed_safe_width_bounds_actual_width() -> Bool {
+  let cap_budget = 8589934592
+  let actual_width = hardware_thread_count_value(t: gunbc_ci_floor_spawn_width(memory_budget_bytes: cap_budget))
+  actual_width <= gunbc_ci_floor_confirmed_safe_width
+}
+
+fn witness_floor_ceiling_clamps_stale_per_shard() -> Bool {
+  let runner_cap_bytes = 8589934592
+  let stale_bytes = 2254857830
+  let confirmed_safe = gunbc_ci_floor_confirmed_safe_width
+  let raw_width_without_ceiling = runner_cap_bytes / stale_bytes
+  let capped_width = if raw_width_without_ceiling <= confirmed_safe { raw_width_without_ceiling } else { confirmed_safe }
+  raw_width_without_ceiling > confirmed_safe && capped_width <= confirmed_safe
+}