CAPTURE (docs + roadmap, model-before-implement — do NOT implement the scheduler types; this is the design record): author the operator-signed 'bounded-input / cost-envelope scheduling' design. WORK OFF FRESH origin/main (post dsl->dag rename: the roadmap authority is dag/gunbc/roadmap_authority.dag

.githooks/pre-push

@@ -75,6 +75,7 @@ fresh_artifact_path() {
     docs/plans/ci-selection-vs-scheduling.md*) return 0 ;;
     docs/plans/ci-process-end-to-end.md*) return 0 ;;
     docs/plans/ci-oom-reclassification.md*) return 0 ;;
+    docs/plans/bounded-input-cost-envelope-scheduling.md*) return 0 ;;
     docs/plans/ci-humming.md*) return 0 ;;
     docs/plans/edge-b-rust-dag-provenance-brief.md*) return 0 ;;
     docs/plans/resolver-type-name-collision-wall.md*) return 0 ;;

ROADMAP.md

@@ -58,7 +58,8 @@ State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (
 - [x] **resolver pathology A — profile receipt only** — the 518s resolve: reproducible `scripts/profile-cold-resolve.sh`; top-N entry offenders; pair `budget_roster_completeness_test` vs `fold_list_generic_instantiation` (34.7× cold wall); hypothesis: `typecheck_module` in `reconcile_with_typed_cache`. — ✓ signed off: operator
   - [ ] **resolver pathology B — fix one confirmed pathology** — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.
 - [ ] **G5 rust-gate selection** — rust fmt/clippy/run-all is all-or-nothing on `.rs` PRs (the ~530s hot spot); no affected-set, while the `.dag` floor already has one. Matters until v1 is gone. [plan](docs/plans/ci-selection-vs-scheduling.md)
-- [ ] **floor runs the right things** — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. [plan](docs/plans/ci-selection-vs-scheduling.md)
+- [ ] **floor runs the right things** — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: [bounded-input / cost-envelope design](docs/plans/bounded-input-cost-envelope-scheduling.md). [plan](docs/plans/ci-selection-vs-scheduling.md)
+- [x] **bounded-input / cost-envelope scheduling — operator-signed design** *(2026-07-02 capture)* — unified design record: `InputEnvelope` (data ceiling) → `CostEnvelope` (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture). [plan](docs/plans/bounded-input-cost-envelope-scheduling.md) — ✓ signed off: operator
 - [ ] **resolve-cache default-on** — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
 - [ ] **G4 dispatch dup** — `workflow_dispatch`+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger `in_progress` for 12–37min — audit cancel-in-progress coverage; leaked runner minutes. [decision record](docs/plans/ci-merge-freshness.md)
 
@@ -86,6 +87,11 @@ Receipts + adjacent levers: [fractal Gantt](docs/plans/ci-floor-fractal-gantt.md
       - [ ] **slice 2 — fleet_converge emit** — `fleet_converge_emit` → committed `.github/fleet-converge.sh`; the emit half of the re-land [plan](docs/plans/shell-emission-model.md)
 - [ ] **`apply()` Phases B–F** — B `host_exec`→`apply()` (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756). [plan](docs/plans/host-effect-orchestration.md)
 - [ ] **srv3 → OsInstalled** — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end. [plan](docs/plans/srv3-webui-kvm-virtual-media.md)
+  - [ ] **resource-namespace-upsert-a — vocabulary only** *(#6134 srv3 bringup follow-up, operator 2026-07-02)* — FileNamespace/ToolNamespace/ProcessNamespace/SecretFileNamespace; shared verdicts Converged|Absent|Stale|Conflict|Inaccessible|UnknownRefused; plans Noop|Create|UpsertAccess|DrainThenStart|Refuse. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; stale seeded ISO ≠ AlreadyPresent. Non-goal: live srv3 mutation.
+  - [ ] **install-media-generic-layer — extract Ubuntu flavor from process** — split `extdeps/os/install_media.dag` generic shapes (fetch/remaster/serve verdicts) from `ubuntu_*` flavor rows; move `.gunbc-content-hash` sidecar + remaster policy to `gunbc/install_media_*`; mandatory before second OS/distro. Post-#6134.
+  - [ ] **nbd-serve-held-session-lease** — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classify RunningExpected|RunningStaleExpected|PortOccupiedForeign|TokenMissing|IsoMismatch|Absent; plan Noop|DrainThenStart|Refuse. RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.
+  - [ ] **srv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine** — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.
+  - [ ] **os-install generic naming cleanup** — rename generic behavior tests/modules away from `srv3_*` where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (`srv3_pre_install_lease_table`, `srv3_seeded_install_media_artifact`). Post-#6134.
 
 **Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler):**
 
@@ -101,7 +107,7 @@ Receipts + adjacent levers: [fractal Gantt](docs/plans/ci-floor-fractal-gantt.md
 - [ ] **the return happened ungated** — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return *should* have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
   - [ ] **SessionSliceEnforcement + verified-effective caps** — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
   - [ ] **OOM classification consumer** — `ClusteredOutOfMemoryKill` is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped. [plan](docs/plans/ci-oom-reclassification.md)
-- [ ] **resource-aware scheduler** — width derived from per-`Runnable` measured cost, self-calibrating: (A) per-shard peak-RSS plumbing → (B) `CostEstimate.space` on `Runnable` → (C) scheduler reads cost, static side-channel deleted → (D) calibration loop retires the data rows (instrument landed #5431). Construction invariant: more memory → more width → more throughput, no `.dag` edits. [plan](docs/plans/resource-aware-scheduler.md)
+- [ ] **resource-aware scheduler (implementation)** — implements the signed [bounded-input / cost-envelope scheduling](docs/plans/bounded-input-cost-envelope-scheduling.md) design: (A) per-shard peak-RSS plumbing → (B) `Runnable.cost` with Predicted `CostEnvelope` → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no `.dag` edits. [tracker](docs/plans/resource-aware-scheduler.md)
 - [ ] **resource budget tree** — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup `memory.max`, operator-fenced). [carrier](dag/product/budget_tree.dag) [grounding](docs/plans/budget-tree.md)
 - [ ] **one Placement authority** — jobs (GitHub) · threads (`spawn_width`) · sessions (ctrl capacity) are 3 forks of "put work on a host"; `Placement`/`Materialization` are modeled but inert — CI consuming them is the lane's real deliverable.
 

dag/gunbc/plan_registry_batch_f.dag

@@ -9,6 +9,7 @@ import gunbc.plans.input_envelope_roadmap { input_envelope_roadmap_plan }
 import gunbc.plans.ci_selection_vs_scheduling { ci_selection_vs_scheduling_plan }
 import gunbc.plans.ci_process_end_to_end { ci_process_end_to_end_plan }
 import gunbc.plans.ci_oom_reclassification { ci_oom_reclassification_plan }
+import gunbc.plans.bounded_input_cost_envelope_scheduling { bounded_input_cost_envelope_scheduling_plan }
 
 data batch_f_plans: List<Plan> = [
   self_applying_lenses_plan,
@@ -18,5 +19,6 @@ data batch_f_plans: List<Plan> = [
   input_envelope_roadmap_plan,
   ci_selection_vs_scheduling_plan,
   ci_process_end_to_end_plan,
-  ci_oom_reclassification_plan
+  ci_oom_reclassification_plan,
+  bounded_input_cost_envelope_scheduling_plan
 ]