Fleet runner deployment process: idempotent host-self-selecting fleet-converge emit + swap/no-oomd memory model (8G-RAM standalone contract) + per-host systemd-timer upsert. COORDINATE with cool-swift-127 (srv1 deploy script); full brief from snappy-tern-720.

.githooks/pre-push

@@ -40,6 +40,7 @@ fresh_artifact_path() {
     DESIGN.md*) return 0 ;;
     .githooks/pre-push*) return 0 ;;
     .github/fleet-converge.sh*) return 0 ;;
+    .github/fleet-converge-timer-upsert.sh*) return 0 ;;
     docs/plans/idea-machine.md*) return 0 ;;
     docs/plans/algebraic-rewrite-optimization.md*) return 0 ;;
     docs/plans/dsl-v2-defork-audit.md*) return 0 ;;

.github/fleet-converge-timer-upsert.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# GENERATED by dsl/gunbc/fleet_converge_timer_emit.dag (gunbc.fleet_converge_timer_emit). DO NOT HAND-EDIT.
+# Idempotent per-host upsert: write service+timer units, daemon-reload, enable timer.
+# The converge script self-selects via $(hostname -s); no SSH star required for steady-state.
+
+svc_path="/etc/systemd/system/gunbc-fleet-converge.service"
+timer_path="/etc/systemd/system/gunbc-fleet-converge.timer"
+mkdir -p "$(dirname "$svc_path")"
+
+cat > "$svc_path" <<'GUNBC_FLEET_CONVERGE_SERVICE_EOF'
+[Unit]
+Description=gunbc fleet converge (host-self-selecting reconcile)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=briansrls
+ExecStart=/usr/bin/bash /home/briansrls/ctrl/third_party/gunbc/.github/fleet-converge.sh
+RemainAfterExit=no
+GUNBC_FLEET_CONVERGE_SERVICE_EOF
+
+cat > "$timer_path" <<'GUNBC_FLEET_CONVERGE_TIMER_EOF'
+[Unit]
+Description=gunbc fleet converge periodic reconcile
+
+[Timer]
+OnBootSec=120s
+OnUnitActiveSec=600s
+Unit=gunbc-fleet-converge.service
+
+[Install]
+WantedBy=timers.target
+GUNBC_FLEET_CONVERGE_TIMER_EOF
+
+systemctl daemon-reload
+systemctl enable --now gunbc-fleet-converge.timer
+printf 'fleet-converge-timer-receipt host=%s verdict=converged\n' "$(hostname -s 2>/dev/null || echo unknown)"

.github/fleet-converge.sh

@@ -273,10 +273,12 @@ emit_sessions_membership() {
 }
 
 host_begin "srv1"
-converge_gunbc_pinned_tree "srv1" "gunbc" "pinned_tree_sha" "existing_host_quiescent" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "$HOME/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "$HOME/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
-converge_slice_property "srv1" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "85899345920" "85899345920" "85899345920"
-converge_per_slot_cap "srv1" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv1-*.service" "MemoryMax" "8589934592"
-converge_per_slot_cap "srv1" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv1-*.service" "MemorySwapMax" "0"
+converge_gunbc_pinned_tree "srv1" "gunbc" "pinned_tree_sha" "existing_host_quiescent" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "/home/briansrls/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "/home/briansrls/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
+converge_slice_property "srv1" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "111669149696" "111669149696" "111669149696"
+converge_per_slot_cap "srv1" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv1-*.service" "MemoryMax" "25769803776"
+converge_per_slot_cap "srv1" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv1-*.service" "MemorySwapMax" "8589934592"
+converge_per_slot_cap "srv1" "runner" "per_slot_memory_high_bytes" "/etc/systemd/system/actions-runner@.service.d/40-fleet-high.conf" "actions-runner@srv1-*.service" "MemoryHigh" "15032385536"
+converge_slice_property "srv1" "runner" "oom_pressure_auto" "system-actions-runner.slice" "ManagedOOMMemoryPressure" "auto" "auto" "true"
 converge_slice_property "srv1" "runner" "cpu_weight" "system-actions-runner.slice" "CPUWeight" "100" "100" "100"
 converge_jobserver_tokens "srv1" "runner" "build_tokens" "/etc/default/ctrl-jobserver" "CTRL_JOBSERVER_TOKENS" "ctrl-jobserver.service" "128"
 converge_runner_width "srv1" "runner" "runner_count" "actions-runner@srv1-*.service" "10"
@@ -288,10 +290,12 @@ converge_slice_property "srv1" "sessions" "cpu_weight" "sessions.slice" "CPUWeig
 emit_sessions_membership "srv1" "/sys/fs/cgroup/sessions.slice" "/sys/fs/cgroup/system.slice"
 host_summary "srv1"
 host_begin "srv2"
-converge_gunbc_pinned_tree "srv2" "gunbc" "pinned_tree_sha" "existing_host_quiescent" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "$HOME/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "$HOME/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
-converge_slice_property "srv2" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "85899345920" "85899345920" "85899345920"
-converge_per_slot_cap "srv2" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv2-*.service" "MemoryMax" "8589934592"
-converge_per_slot_cap "srv2" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv2-*.service" "MemorySwapMax" "0"
+converge_gunbc_pinned_tree "srv2" "gunbc" "pinned_tree_sha" "existing_host_quiescent" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "/home/briansrls/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "/home/briansrls/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
+converge_slice_property "srv2" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "111669149696" "111669149696" "111669149696"
+converge_per_slot_cap "srv2" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv2-*.service" "MemoryMax" "25769803776"
+converge_per_slot_cap "srv2" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv2-*.service" "MemorySwapMax" "8589934592"
+converge_per_slot_cap "srv2" "runner" "per_slot_memory_high_bytes" "/etc/systemd/system/actions-runner@.service.d/40-fleet-high.conf" "actions-runner@srv2-*.service" "MemoryHigh" "15032385536"
+converge_slice_property "srv2" "runner" "oom_pressure_auto" "system-actions-runner.slice" "ManagedOOMMemoryPressure" "auto" "auto" "true"
 converge_slice_property "srv2" "runner" "cpu_weight" "system-actions-runner.slice" "CPUWeight" "100" "100" "100"
 converge_jobserver_tokens "srv2" "runner" "build_tokens" "/etc/default/ctrl-jobserver" "CTRL_JOBSERVER_TOKENS" "ctrl-jobserver.service" "128"
 converge_runner_width "srv2" "runner" "runner_count" "actions-runner@srv2-*.service" "10"
@@ -303,10 +307,12 @@ converge_slice_property "srv2" "sessions" "cpu_weight" "sessions.slice" "CPUWeig
 emit_sessions_membership "srv2" "/sys/fs/cgroup/sessions.slice" "/sys/fs/cgroup/system.slice"
 host_summary "srv2"
 host_begin "srv3"
-converge_gunbc_pinned_tree "srv3" "gunbc" "pinned_tree_sha" "fresh_standup" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "$HOME/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "$HOME/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
-converge_slice_property "srv3" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "85899345920" "85899345920" "85899345920"
-converge_per_slot_cap "srv3" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv3-*.service" "MemoryMax" "8589934592"
-converge_per_slot_cap "srv3" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv3-*.service" "MemorySwapMax" "0"
+converge_gunbc_pinned_tree "srv3" "gunbc" "pinned_tree_sha" "fresh_standup" "skip_process_pin_coherent_and_marker" "GUNBC_ROOT" "/home/briansrls/.local/share/gunbc/pinned" "defer_submodule" "third_party/gunbc" "/home/briansrls/ctrl" "ghcr.io/gunb-ai/gunbc/bootstrap" "sha256:BOOTSTRAP_DIGEST_PLACEHOLDER" "gunbc" "scripts/session-dashboard/container/read-gunbc-pin.sh" ".dashboard/converge-green-place.marker" "pin=" "first_green_at=" "scripts/session-dashboard/bin/gunbc-pin-quiescent-reload.mjs"
+converge_slice_property "srv3" "runner" "runner_slice_cap_bytes" "system-actions-runner.slice" "MemoryMax" "111669149696" "111669149696" "111669149696"
+converge_per_slot_cap "srv3" "runner" "per_slot_memory_max_bytes" "/etc/systemd/system/actions-runner@.service.d/20-fleet-width.conf" "actions-runner@srv3-*.service" "MemoryMax" "25769803776"
+converge_per_slot_cap "srv3" "runner" "per_slot_memory_swap_max_bytes" "/etc/systemd/system/actions-runner@.service.d/30-fleet-swap.conf" "actions-runner@srv3-*.service" "MemorySwapMax" "8589934592"
+converge_per_slot_cap "srv3" "runner" "per_slot_memory_high_bytes" "/etc/systemd/system/actions-runner@.service.d/40-fleet-high.conf" "actions-runner@srv3-*.service" "MemoryHigh" "15032385536"
+converge_slice_property "srv3" "runner" "oom_pressure_auto" "system-actions-runner.slice" "ManagedOOMMemoryPressure" "auto" "auto" "true"
 converge_slice_property "srv3" "runner" "cpu_weight" "system-actions-runner.slice" "CPUWeight" "100" "100" "100"
 converge_jobserver_tokens "srv3" "runner" "build_tokens" "/etc/default/ctrl-jobserver" "CTRL_JOBSERVER_TOKENS" "ctrl-jobserver.service" "128"
 converge_runner_width "srv3" "runner" "runner_count" "actions-runner@srv3-*.service" "10"

dsl/extdeps/os/systemd.dag

@@ -30,6 +30,8 @@ data systemd_memory_max_property: NonEmptyStr = "MemoryMax"
 
 data systemd_memory_swap_max_property: NonEmptyStr = "MemorySwapMax"
 
+data systemd_memory_high_property: NonEmptyStr = "MemoryHigh"
+
 data systemd_cpu_weight_property: NonEmptyStr = "CPUWeight"
 
 fn parse_systemd_unit_active_state(raw: String) -> SystemdUnitActiveState? {

dsl/gunbc/bmc_onboarding.dag

@@ -3,8 +3,16 @@ module gunbc.bmc_onboarding
 import std.bmc { BmcEndpoint, Redfish }
 import std.credentials { FactoryLogin, CredentialFlow, Stored }
 import std.os.types { OperatingSystemProduct, UbuntuOs, NobleNumbat2404Lts }
-import std.types { NonEmptyStr, Int, List }
+import std.types { NonEmptyStr, Int, List, Map }
 import std.logic { Bool }
+import std.disposition { Disposition, Scaffold, SingleAuthority, Terminal }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import product.placement_supply { HostIdentity }
+import gunbc.fleet_intent_network {
+  operator_host_srv1,
+  operator_host_srv2,
+  operator_host_srv3,
+}
 import extdeps.bmc.types { RedfishBootSourceOverrideTarget, BootTargetPxe, RedfishAccountRole, AccountRoleAdministrator }
 import extdeps.bmc.openbmc { openbmc_factory_login }
 import extdeps.boards.asrock_rack { asrock_altrad8ud_redfish_system_id }
@@ -232,3 +240,58 @@ fn bmc_credential_probe_to_phase(probe: BmcCredentialProbeResult) -> BmcOnboardi
     CredentialStateUnknown { reason: _ } => Absent
   }
 }
+
+type HostOnboardingLifecycleRow {
+  identity: HostIdentity
+  phase: BmcOnboardingPhase
+}
+
+data fleet_host_onboarding_lifecycle_disposition: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "gunbc.bmc_onboarding",
+    decl_name: "fleet_host_onboarding_lifecycle",
+    field: WholeDeclaration
+  }
+}
+
+data srv1_bmc_lifecycle_phase: BmcOnboardingPhase = OsInstalled
+
+data srv2_bmc_lifecycle_phase: BmcOnboardingPhase = OsInstalled
+
+data srv3_bmc_lifecycle_phase: BmcOnboardingPhase = CredentialsRotated
+
+data fleet_host_onboarding_lifecycle: List<HostOnboardingLifecycleRow> = [
+  HostOnboardingLifecycleRow { identity: operator_host_srv1, phase: srv1_bmc_lifecycle_phase },
+  HostOnboardingLifecycleRow { identity: operator_host_srv2, phase: srv2_bmc_lifecycle_phase },
+  HostOnboardingLifecycleRow { identity: operator_host_srv3, phase: srv3_bmc_lifecycle_phase },
+]
+
+fn fleet_host_lifecycle_phase_map_derived(rows: List<HostOnboardingLifecycleRow>) -> Map<String, BmcOnboardingPhase> {
+  rows |> fold(init: empty_map(), f: (acc, row) => map_insert(acc, row.identity, row.phase))
+}
+
+fn host_onboarding_lifecycle_row(host: HostIdentity) -> HostOnboardingLifecycleRow? {
+  match map_get(fleet_host_lifecycle_phase_map_derived(rows: fleet_host_onboarding_lifecycle), host) {
+    Present { value: phase } =>
+      Present { value: HostOnboardingLifecycleRow { identity: host, phase: phase } }
+    Absent => Absent
+  }
+}
+
+fn host_onboarding_lifecycle_phase(host: HostIdentity) -> BmcOnboardingPhase? {
+  map_get(fleet_host_lifecycle_phase_map_derived(rows: fleet_host_onboarding_lifecycle), host)
+}
+
+data bmc_phase_is_pre_os_installed_disposition: Disposition = Terminal {
+  reason: "Canonical exhaustive partition on closed BmcOnboardingPhase ladder: FactoryDefault|CredentialsRotated are pre-OsInstalled; OsInstalled|FabricJoined are installed+. FreshStandup apply boundary in host_converge.gunbc_apply_mode_for_host mirrors this match — not a nickname predicate."
+}
+
+fn bmc_phase_is_pre_os_installed(phase: BmcOnboardingPhase) -> Bool {
+  match phase {
+    FactoryDefault => true
+    CredentialsRotated => true
+    OsInstalled => false
+    FabricJoined => false
+  }
+}

dsl/gunbc/ci_deploy_access.dag

@@ -18,7 +18,13 @@ type DeployAccess {
 
 data gunbc_deploy_sudoers_dropin: NonEmptyStr = "/etc/sudoers.d/gunbc-deploy"
 
-data ci_deploy_runner_principal: NonEmptyStr = "runner"
+data gunbc_deploy_runner_principal: NonEmptyStr = "gunbc-deploy"
+
+data ci_deploy_runner_principal: NonEmptyStr = gunbc_deploy_runner_principal
+
+fn deploy_access_command_paths(access: DeployAccess) -> List<NonEmptyStr> {
+  map(access.privileged_commands, cmd => cmd.path)
+}
 
 fn srv1_live_deploy_privileged_commands() -> List<PrivilegedCommand> {
   [