feat(scheduler): the power axis — the scheduler refuses work it cannot power (bp-154)

[ascalva]

Implements bp-154 — dn-supervision-and-liveness Amendment A1, the power axis. The
supervisor could see memory and could see the owner; it could not see the battery. Now it can.

closes #12

Why (the warrant, glossed inline)

Issue #12 (energy: the scheduler cannot see the battery, migrated from frozen
docs/findings/finding-0279.md) records three measured emergencies, not the two its title
names: Jul 24 — drained to 1% during the v1.18.0 deploy night, the embedder starved under
critical-battery throttle, code_sync wedged, and the daemon died unwitnessed and stayed dead three
days; Jul 28 — 100%→8% in 2h40m during the revival's backlog drain, caught at the wire; Aug 1
— fatal, the machine died mid-run and run #39 came up in recovery.

The battery hardware is healthy and stays healthy: Condition Normal, 95% maximum capacity, 128
cycles, re-measured 2026-08-05. The drain is load, not degradation. The scheduler was the defect.

§2.7 had given the supervisor exactly one resource axis to refuse on — memory (non-negotiable #8,
"the scheduler refuses breaching work"). That principle was never memory-specific; it had simply
never been given a second axis.

What changed

file	what
scheduler/power.py (new)	the sensor: an injectable probe over pmset -g batt, a ~20% floor, assume_discharging_when_unknown = True
scheduler/supervisor.py	power: Power field (defaulted), power_blocked_tiers(), the floor branch in tick, one term added to the union at the claim site
tests/unit/test_power.py (new)	22 sensor tests, every probe injected — no pmset subprocess runs
tests/fixtures/power.py (new)	on_ac() / on_battery() / unreadable(), one home for the doubles
tests/integration/test_supervisor.py	the predicate, composition, floor and hold tests
tests/integration/test_cron.py, test_research_cron.py, test_chat_sensor_wiring.py, tests/e2e/test_scheduler_live.py	inject an on-AC sensor at each real-Supervisor construction site

Five commits, one per plan item, deliberately reviewable in isolation.

⚑ The one hard pin held: three predicates, three questions

The power rule is its own predicate, never folded into blocked_tiers(). That method's own
docstring already gave the reason about the single-model rule — "two different reasons to refuse a
tier, conflated into one predicate, is how a reader later cannot tell which rule refused a job" —
and a power refusal answers a different question ("is there energy?") from a presence refusal ("is
the owner here?"). model_blocked_tiers() was the precedent for a sibling; this is the third. Each
now points at the other two. They compose only at the ONE claim site, by union.

HEAVY_TIERS is read, never reshaped — one shed vocabulary, not two. The tripwire
(tests/integrity/test_shadow_isolation.py, which imports it and is deliberately out of scope) is
untouched and green.

⚑ Fail closed, and one named asymmetry

None is an ordinary state here, not a theoretical one: an absent pmset, a failed or hung exec,
unreadable output, or a probe that raises. All four funnel to "discharging", because the failure
being designed against is the machine dying and a sensor that failed open would re-create it exactly
when the system is least healthy.

The one asymmetry is named and defaulted off rather than left implicit: an unknown percentage
does not put the sensor below the floor. Fail-closed on the discharging question costs the heavy
lanes; fail-closed on the floor refuses every tier, so a host with no battery to read (a desktop,
CI, any non-macOS worker) would dispatch nothing ever — the guard against an outage would be the
outage. halt_when_percent_unknown exists, off, asserted in both positions.

The floor: refuse before claim, and that is the clean close

Below ~20% while discharging, tick returns before queue.claim. No running row is minted, so
nothing is stranded for a machine that may not survive to close it, and a following run's
sweep_orphans finds nothing to reclaim or strand-fail — asserted, because the falsifier is the Aug
1 shape. The hold for AC is the absence of dispatch: run() returns 0, the launcher's existing
conditional sleep is the duty cycle, and the next tick re-reads the battery. Nothing in the diff kills
an in-flight job.

How it was verified — the falsifiers were executed, not asserted

• Deleting | self.power_blocked_tiers() from the union reds exactly one test —
  test_a_heavy_job_is_NOT_claimed_while_discharging_and_IS_once_back_on_AC (1 failed, 52 passed) —
  while every sensor and predicate test stays green. That is the finding-0187 shape caught in the act
  (deleting bp-105's sweep call once left 85/85 green), and it is why Items 2 and 3 are separate
  commits: Item 2 lands the predicate inert, Item 3's whole content is "and now it is consumed".
• Deleting the floor branch reds four tests. The floor test enqueues a light-tier job on
  purpose, so the discharging shed provably does not cover it — the test cannot pass on the shed's
  behaviour.
• "The hold must not spin hot" is executable: a counting probe proves a ten-tick drain request
  costs exactly ONE battery reading.
• The test repairs are proven necessary, not assumed: with the probe forced unreadable to
  simulate the CI runner (ubuntu-latest, no pmset),
  test_cron_jobs_are_gated_during_foreground_then_run_in_a_trough fails assert trough.run() == 2
  with 0. With the injections in place under the same simulation the whole model-free tier is green
  but for three known-red worktree tests.

The local gate, each leg run separately, counts exactly as observed

leg	result
uv run ruff check .	exit 0 — All checks passed
uv run scripts/check_imports.py	exit 0 — I2 OK, worker boundary OK
uv run mypy core agents eval ops scheduler scripts	exit 0 — no issues in 263 source files
uv run mypy (argless)	exit 1 — 69 errors in 20 files, the expected baseline; none in the new files
uv run python -m ops.type_gate	exit 0 — membership OK, bare-ignore OK, one pre-existing parked psutil report
uv run pytest -q	exit 1 — 5 failed, 2463 passed, 15 skipped in 278 s

The five reds are the three known-red-locally classes and nothing else: the finding-0103
core-self-containment ratchet, tests/e2e/test_dream_v2_live.py, and three
tests/integration/test_worktree_enforcement.py cases (#13 — green in CI).
tests/e2e/test_scheduler_live.py (the known flake, and in this plan's write scope) passed in
the gate run; an earlier full run failed it on assert captured["text"].strip() with run() == 1
and state == DONE already passing — the job dispatched and the live model returned an empty string,
which a power refusal cannot cause (a refusal fails one assertion earlier).

For the reviewer to rule on

1. Write-scope overrun, flagged not hidden. tests/integration/test_cron.py,
   test_research_cron.py and test_chat_sensor_wiring.py are not in bp-154 §5's list. §5
   anticipated exactly this repair class — "may observe a supervisor constructed without a power
   sensor; carried so a default-construction change can be repaired in-session" — but enumerated
   three files where the real set of real-Supervisor construction sites in tests is six. The
   repairs are one line each and are proven necessary above.
2. A documented deviation from a parked default, filed as the power floor holds by NOT dispatching; the process-level clean stop is deliberately unwired #40. A1's parked hold-for-AC decision
   records "stop cleanly; launchd KeepAlive restarts and re-evaluates". This PR holds by not
   dispatching instead, because ThrottleInterval is 10 s and every respawn pays preflight's
   uncosted ~120 s Ollama probe (frozen finding-0195) — a restart loop at the floor would spend the
   reserve the floor exists to protect. ops/lifecycle/launcher.py is also outside this plan's
   write_scope. Consequence stated honestly: the queue ledger is clean, the run ledger is
   unchanged, so a death at 0% still produces a recovery run — with no stranded jobs in it.
3. Enforcement tier, claimed honestly: tier 5 with a tier-4 test, deliberately identical to what
   §2.7 claims for the memory ceiling. Power is a sampled reading of the physical world, so tier 1 is
   unreachable and claiming it would be the overclaim §0's ladder names as the foot-gun.
4. The honest limit, recorded not hidden (A1.4): this bounds what is started, never what is
   already running — Jul 24's code_backfill was in flight when the throttle hit, so this would not
   have prevented that emergency outright. In-flight bounding is finding-0178's machinery.

Ready to deskcheck on real hardware: unplug and watch a synthesis-tier job stay QUEUED while the
light lanes drain, then plug in and watch it go. The code path is what the tests exercise; the
deskcheck is what proves the probe reads what we think it reads on the live daemon. (Checked by
reading rather than executing: /usr/bin/pmset is -rwxr-xr-x root:wheel, -g batt needs no
privilege, and neither plist overrides PATH — so launchd's default PATH reaches it.)

Context: #40 (parked, route:orchestrator), #13 (the locally-red enforcement suite),
bp-153 — this plan is cheap insurance for that rebuild, whose Jul 24 wedge was itself caused by
a battery drain.

🤖 Generated with Claude Code

https://claude.ai/code/session_011LZZQPyGsoeGL73cbbEp3U