proto(hostfit): size the ollama VRAM budget on free memory, not the card's total (#69)

[gen16k]

The engine sizes placement against free VRAM — ollama 0.31.1's availableMemoryForLoad sums gpu.FreeMemory — while this repo sized its budget against the total. docs/knowledges/20260727/1830-ollama-multi-gpu-placement.md recorded the mismatch when it read the pinned engine, verbatim:

スケジューラが見るのは free メモリ、こちらが合算するのは total。1 枚のときからある差だが、枚数分だけ拡大する（#69）。しかも bestGPUGroupByAvailableMemory には bestSingleGPUFit のような 80% の割引がない。

A card that is also driving a display is therefore valued at more than it can lend. The model and its context get chosen optimistically, the load spills, and #621's post-load verify shrinks the window and restarts the engine. The selection is never corrected — that verify can only move the window, not un-pick a model.

This is the contract half, on its own, as docs/decisions/20260719/0000-concurrent-proto-development.md §2 requires. The settled field table is on #69.

Measured before designing

Three premises in the issue were stale, and the arithmetic had moved into proto/hostfit since it was written. Two things that reading turned up changed the design:

The floor would have swallowed the whole fix. OllamaVRAMBudgetMB clamps at the single-device figure. A one-card host — the shape #69 actually reports, an 8 GB card driving a display — has VRAMPoolMB == 0, so the budget falls through to EffectiveVRAMMB and a free reading never enters the arithmetic at all. De-rating only inside the pool would have been a no-op on the reported case.

A live reading would spiral. The hardware profile is re-sampled on a TTL, including after our own engine loads a model. A free figure taken then excludes our own weights, so each re-tune would see less memory and shrink further. RAMAvailableGB already names this hazard in the same words (#568):

It is measured ONCE per install/upgrade, while no engine or model is resident, and persisted — never a live reading. … A live figure would move with every resample and would count a resident model against the very host that serves it.

So the field's contract is "measured once, while nothing of ours is resident, persisted" — not a gauge.

What lands

• signer.HardwareGPUSummary.VRAMFreeMB (vram_free_mb,omitempty), gated behind a new CapabilityVRAMFreeV1. The gate is not a formality: the field is agent-reported and rides the signed NetworkMap on every peer entry, so an agent that does not know it drops the key on canonical re-marshal and fails verification. CapabilityRAMAvailableV1 exists for exactly this shape. My first field table said no capability was needed — that was wrong, and inference: Ollama VRAM budget uses total VRAM, not runtime-free VRAM, on discrete desktop GPUs #69 carries the correction.
• hostfit.Device.VRAMAvailableMB and hostfit.Host.VRAMAvailable0MB, with Device.lendableMB() and Host.ollamaSingleDeviceMB() applying the de-rate per device, before the sum — which is what hostfit: the ollama VRAM budget is the first GPU only, so a multi-GPU host is judged as if the extra cards were not there #264's record asked inference: Ollama VRAM budget uses total VRAM, not runtime-free VRAM, on discrete desktop GPUs #69 to do rather than compensating on the pooling side.

Three deliberate non-changes:

• EffectiveVRAMMB does not move. min_vram_mb, engine selection and vLLM's TP=1 fallback were authored against a whole card; the pool decision already settled that widening or narrowing it moves all three.
• Unified-memory hosts are untouched. UsableVRAMMB is already the honest bound on a shared pool, and no shipped detector reports free memory for one — there is nothing to improve and a fallback to guess at.
• A reading at or above the total is ignored. A bogus figure can only ever de-rate a device that was measured, never inflate one.

This PR is behaviourally inert

0 means "no free reading" and falls back to the total at every level. Nothing produces a non-zero value until the reader lands, so today's fleet and any driver that will not answer keep exactly today's budget. That is what lets the contract be published and tagged without waiting on the reader, while the ratchet points only at a settled surface.

Test inversion — declared, per §Test discipline

TestOllamaBudgetNeverShrinksTheHost asserted OllamaVRAMBudgetMB() >= EffectiveVRAMMB() over an exhaustive sweep. That invariant is intentionally given up here and split in two:

• TestOllamaBudgetNeverShrinksAHostItDidNotMeasure — the half that still holds, and the important one: an unmeasured host may never be de-rated.
• TestOllamaBudgetNeverFallsBelowWhatWasMeasured — the replacement: the budget may de-rate to what the driver reported, never past it.

The floor did not disappear; it changed what it is measured against. That is a revision of §4 only of the pool decision, recorded in docs/decisions/20260813/1120-ollama-budget-sized-on-free-vram.md with links both ways. 20260727/1830 stays accepted — §1–§3 are untouched — and its ## Status says which part moved.

The producer debt is declared in three places, not hidden

Two CI guards caught this PR publishing a contract with no writer, which is the #180/#251 shape:

• TestHardwareSummaryFor_PublishesEveryWireField → an entry in notPublishedByAgent
• protoconsumer → two entries in exemptions.go

The reader PR deletes all three — protoconsumer fails with "something under cmd/, internal/ now writes it — delete the entry" the moment a producer appears, so the debt cannot be quietly left standing.

One naming note: hostfit's field is spelled VRAMAvailableMB, not VRAMFreeMB, partly to keep protoconsumer honest. That guard matches producers by field name, so a Device.VRAMFreeMB assigned in FromHardwareSummary would have read as a proto-internal producer for the wire field of the same name and the debt would never have been visible in its table at all. LocalModelChoiceAt (#647) was named for the same consideration. The driver's own word stays on the wire, where nvidia-smi's memory.free is what it reports; available matches Host.RAMAvailableGB for the same quantity.

Verification

Full local gate, all green:

• scripts/dev/ci-lint-local.sh — 20 of 20
• proto-additive-guard.sh — OK (all published API intact, additions are omitempty); it initially rejected Device.VRAMAvailableMB for lacking an explicit tag, which is why it carries json:"-"
• protoconsumer — OK (292 exported proto fields, 227 with a producer, 65 declared)
• decision-log-guard.py — decision log OK: 73 件
• gofmt -l clean · go vet ./... clean (both modules) · golangci-lint run (v2.12.2, after cache clean) → 0 issues
• go test ./... root and proto/ — pass · go build -tags prod ./... · make verify-cross — exit 0

Byte-identity is pinned by TestHardwareSummary_VRAMFree_CanonicalJSON: an unmeasured device encodes byte-for-byte as it did before this PR, a measured one places the key between vram_total_mb and compute_cap, and a pre-addition payload parses with the field zero.

Rebased onto 09442ae.

Follow-up, in order

1. Tag proto/v0.2.46 (automated per proto merge).
2. Reader PR — the per-OS free-VRAM reader, the two adapters, and deletion of all three debt entries. Windows is nearly free: gpu_nvidia_windows.go:170-172 already reads NVML's {total, free, used} and discards free.
3. CP bump in the private repo — including the strip for pollers that have not declared vram-free-v1.

docs-not-needed: wire contract and fit arithmetic only; no user-visible surface changes, and the change is inert until a producer lands.

Refs #69, #264, #568