host_converge_slice1: generalize per-slot MemoryMax convergence from srv1 to srv3 (multi-unit)

[briansrls]

Summary

Generalizes gunbc.host_converge_slice1's per_slot_memory_max_bytes cgroup-knob convergence (systemd MemoryMax, live systemctl show/set-property, independent read-back + reapply-noop proof) from srv1's single hardcoded probe unit to srv3's full runner set. srv3 units are live-enumerated (systemctl list-units over runner_instance_glob, never a guessed/hardcoded unit list) and cross-checked against declared_runner_count() — a mismatch refuses typed rather than silently converging a subset. Per-unit outcomes are independent (one unit's refusal never blocks its siblings, per DESIGN §5's per-cause-typed-refusal/siblings-continue discipline), and a pre-apply MemoryCurrent usage guard refuses per-unit (typed, retryable) rather than applying a cap below live usage, so this can never SIGKILL an in-flight job. gunbc converge --host srv3 now actually routes into this machinery via the CLI (see Review fixes below) — it was not reachable at all in the initial revision.

Fixes fleet incident adhoc-2f4ea1c1-548's root cause. #7002 (merged, incident-closing receipt: CI run 29848758856 on main — memory governor stayed within the 17.2GB cap, 16.1GB peak, zero eviction storm, zero exit-137, fix proven by execution) was the symptom mitigation — it stopped read_host_budget_bytes() from re-sampling a noisy MemAvailable fallback on every cache eviction. That fallback was only reachable because srv3 runners had no discoverable private cgroup for read_host_budget_bytes() to resolve via cgroup memory.max/memory.high — this PR is that missing convergence, and its own displaced-cost citation is that same incident-closing receipt: once srv3 runners carry the same slice1 cgroup knobs srv1 already has, the host budget resolves through the real cgroup signal there too, and #7002's [floor-drain] degraded_budget_source diagnostic line should stop appearing on srv3.

Also fixed, in passing: a genuine .dag lexer defect this file tripped over (a { immediately followed by non-whitespace containing a bare $-word inside an awk string literal triggered the string-interpolation fast-path and produced a parser panic never caught because the file had never actually been compiled before this change) — worked around with a one-character space fix; not previously reported as a toolchain issue.

First-execution safety

The apply arm (systemctl set-property) is unreachable except via host_converge_slice1_converge_unit's own control flow: live enumeration + cross-check must succeed before any unit is attempted, and per-unit the live MemoryMax read + Drifted verdict + host_converge_slice1_usage_guard's own live MemoryCurrent read (returning Safe) must all succeed before set-property fires. So the first live invocation against srv3 is necessarily read-only up through several fail-closed gates before any write is reachable — no separate wet witness step is required by construction. Documented in the module's scope disposition.

Review fixes (review 40879, cursor/composer-2.5)

• srv3 unreachable from CLI — confirmed valid; gunbc converge --host srv3 previously fell through to the old generic converge_apply_for_host path, so the entire multi-unit machinery in this PR was dead code. Fixed: converge_cli_routes_to_slice1 now matches srv1 and srv3, dispatching srv3 to a new converge_cli_slice1_srv3_receipt() that calls host_converge_slice1_converge_srv3() and aggregates its per-unit outcomes into a ConvergeCliReceipt.
• Int vs ByteSize fork — confirmed valid; HostConvergeSlice1UsageGuardOutcome/HostConvergeSlice1UnitUsageGuardRefused carried bare Int and re-derived the current-vs-target comparison instead of reusing runner_unit_live_read.runner_unit_usage_exceeds_bytes. Fixed: fields are now std.measure.ByteSize, and host_converge_slice1_usage_guard delegates the comparison to that existing typed authority.
• Empty enumeration conflated with absent read — confirmed valid; a successful list-units read with zero active units collapsed to none, same as a transport failure, so a real zero-unit state never reached the typed HostEnumerationMismatch. Fixed: host_converge_slice1_enumerate_units now returns Present { value: [] } on a successful empty read, reserving none for genuine transport failure.

Test plan

• claim_batch --source-root dag --source-root src/v2 --entry dag/gunbc/host_converge_slice1.dag --functions host_converge_slice1_fixture_receipt,host_converge_slice1_receipt_is_valid,host_converge_slice1_cross_check_enumeration,host_converge_slice1_usage_guard — whole-tree resolve of the full ~285-module import closure, zero parse/type errors.
• claim_batch ... --entry dag/test/claim/host_converge_slice1_witness_test.dag --functions host_converge_slice1_wires_srv1_memory_cap,host_converge_slice1_wires_srv3_multi_unit_generalization — PASS on both, including hermetic fixture-based witnesses for the srv3 paths: read-only enumerate_units script shape, cross-check mismatch/match routing against declared_runner_count(), and usage-guard-refusal → typed-retryable-reason routing (now ByteSize-typed).
• claim_batch ... --entry dag/test/claim/fleet_converge_cli_witness_test.dag --functions fleet_converge_cli_witness_holds — PASS, including new witness_converge_cli_srv3_routes_to_slice1_not_realize_frontier.
• Success criterion (post-merge, live): the [floor-drain] degraded_budget_source line stops appearing on srv3 runners — will report once observed.

Closes incident adhoc-2f4ea1c1-548.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed all three findings from review 40879 (cursor/composer-2.5) with code fixes, commits e8b68e1/df7f88f/51a8e32 on this branch:

Finding 1 (srv3 unreachable from CLI) — confirmed valid. gunbc converge --host srv3 now routes through a new converge_cli_slice1_srv3_receipt() in fleet_converge_cli.dag, which calls host_converge_slice1_converge_srv3() and aggregates its per-unit outcomes (via new host_converge_slice1_host_result_applied_count/_all_valid/_refusal_reason helpers in host_converge_slice1.dag) into a ConvergeCliReceipt. converge_cli_routes_to_slice1 now matches both srv1 and srv3, dispatching to the right receipt builder. Added witness_converge_cli_srv3_routes_to_slice1_not_realize_frontier to fleet_converge_cli_witness_test.dag.

Finding 2 (Int vs ByteSize fork) — confirmed valid. HostConvergeSlice1UsageGuardOutcome's current_bytes/target_cap_bytes and HostConvergeSlice1UnitUsageGuardRefused's matching fields are now std.measure.ByteSize, not bare Int. host_converge_slice1_usage_guard now builds a minimal RunnerUnitMemoryLiveRead from the live MemoryCurrent read and delegates the actual current-vs-target comparison to runner_unit_live_read.runner_unit_usage_exceeds_bytes instead of re-deriving it via byte_size_count → Int.

Finding 3 (empty enumeration conflated with absent read) — confirmed valid. host_converge_slice1_enumerate_units now returns Present { value: [] } on a successful list-units read with zero matching lines, reserving none for genuine transport failure (result.success == false). A real zero-active-units state now reaches host_converge_slice1_cross_check_enumeration and produces the typed HostConvergeSlice1HostEnumerationMismatch (carrying declared_count and the empty observed_units) instead of the generic HostRefused.

Full-tree claim_batch closure (283-285 modules, ~6300 resolved items) is green across both touched witness suites after the fixes.

— sent from royal-dove-562

[gunbai-bot]

Addressed the naming note from review 40904: renamed HostConvergeSlice1HostConverged → HostConvergeSlice1HostEnumerated in dag/gunbc/host_converge_slice1.dag. The variant only carries the enumerated per-unit outcome list — actual convergence is decided downstream by host_converge_slice1_host_result_all_valid — so the old name asserted a verdict the type didn't itself guarantee. All 5 in-tree usage sites were contained to that one file; rebuilt and reran both host_converge_slice1_witness_test.dag witnesses green after the rename.

reviews 40887, 40895, 40901 raised no actionable findings (their "considered and dropped" notes were already consistent with the current design), so no further action was needed for those.

— sent from royal-dove-562

[gunbai-bot]

CI failure at f565bee root-caused: doc_graph_has_no_orphan_docs failed on docs/probes/emitter_residual_site_map_2026-07-21.md — a probe doc that landed on main via #7023 with no doc-graph link (bind: row). This is a pre-existing main-red, not introduced by this PR's own diff: main itself is failing CI at both 50bb7e9d (the #7023 commit) and the current tip d36515b6, confirmed via gh run list --branch main. It only surfaced here because this branch merged main.

Fixed in 29bbcdd58a — added a bind: docs/probes/emitter_residual_site_map_2026-07-21.md provenance row in dag/tools/self_host_curated_probe_cargo.dag, mirroring the existing pattern for the sibling curated_cargo_frontier_probe_report.md bind row in the same file. Verified locally: reimplemented the doc-graph reachability walk and confirmed 0 orphans, then ran the actual witness via claim_batch — doc_graph_has_no_orphan_docs, doc_graph_has_no_dangling_links, doc_graph_universe_is_nonempty all PASS.

— sent from royal-dove-562

[gunbai-bot]

review 41089's finding is valid: host_converge_slice1_cross_check_enumeration's host param only labels the HostConvergeSlice1EnumerationMismatch record — the comparison itself goes through declared_runner_count(), which is fleet-wide (gunbc_runner_pool_budget is one global ByteSize, no per-host budget exists in the model today).

I didn't build a per-host declared-count model for this, though — every fleet host today shares one declared count, so that would be speculative modeling ahead of a real second-host divergence (DESIGN §6: don't build for a host that doesn't yet diverge). Instead I landed the gap as a named, triggered note on the scope-disposition Terminal doc string in dag/gunbc/host_converge_slice1.dag (commit 2ac9512f98): the day a second host's declared runner count genuinely differs from srv3's, declared_runner_count gets a host/HostIdentity param backed by a real per-host budget row, and this cross-check wires straight to it. Verified green via claim_batch on both host_converge_slice1_witness_test.dag entries.

— sent from royal-dove-562