[nikhilunni]

Summary

Symptom. A host whose parked VMs had reserved its RAM held every park while a resume queued. The park reaper divided the host's allocatable_mib by its total RAM and ignored the budgets reserved on it; the host adds a resident VM's memory back into allocatable_mib, so the host read as roomy to the reaper and as full to placement. The queued resume never placed and no park descended.

A park holds until a queued session has no room. A parked VM keeps its RAM and its reservation, so a park costs nothing until a session needs that room. The gate (ParkView in idle_evictor.rs) reads demand, not a percentage:

• A session parks, and a park holds, while every queued session fits on some host placement ranks.
• When a queued session fits nowhere, one park per host yields per reaper pass: the oldest park, on the host with the most unreserved RAM (the nearest to a fit), and none on a host where an eviction already runs. One running eviction counts for one waiting session, so the reaper does not descend more parks than the queue needs.
• A host reserved beyond the RAM it measures yields a park.
• A session that goes idle while a queued session has no room does not park.
• An unmeasured host does not park.

ENGRAM_PARK_HEADROOM_FLOOR_PCT is gone. A percentage of unreserved RAM refuses every park on a packed host while nothing waits for the RAM.

The reaper reads the fleet once per pass, not once per parked session. A failed read holds the parks: a descent is a full capture that cannot be undone.

One definition. engram_core::types::host::HostHeadroom { allocatable_mib, cpu_budget, reserved } with free_mib, free_vcpus and fits. Free RAM is allocatable less reserved; a parked VM keeps its reservation until it descends, so it is not free. Every decision that asks "is there room on this host" reads it: placement (create, resume, queue, capture, teleport), the host view, the fleet autoscaling signal, and the park gate.

Deleted copies.

• engram-postgres: HostFit; three copies of the reservation SQL (pick_host_2d, per_host_reserved, placement_no_fit_details) → reserved_by_host_sql; two fit-map loops → headroom_map.
• engram-sim: the fit arithmetic in pick_host_2d and placement_no_fit_details.
• engram-coordinator: the arithmetic in pick_from, placement_preview, fleet_snapshot, HostView::from_row, and the reaper's raw-RAM percent.

Sim drift fixed. The simulator gated placement on CPU when a host reported no cores; Postgres does not. Both now read HostHeadroom::fits, and a conformance scenario pins it.

Behaviour changes.

• The park gate, as above. The reaper's raw mem_total − mem_used fallback for a host without a RAM ledger is gone.
• A deployment that set ENGRAM_PARK_HEADROOM_FLOOR_PCT (for example to turn parking off) loses that switch.
• The placement fit rule is unchanged: unmeasured RAM or an unreported core count does not gate placement.

ADR 0074's divergence log records the change.

Test plan

• cargo clippy -p engram-core -p engram-coordinator --all-targets -- -D warnings: clean
• New tests: headroom_tests in engram-core; in the coordinator, a park yields to a queued session with no room, a full host holds its parks while nothing waits, a session does not park while a queued session has no room, an unmeasured host does not park, a failed read holds the park, and three unit tests of ParkView::yields; the conformance scenario a_host_without_reported_cores_has_no_cpu_gate
• CI Gate

🤖 Generated with Claude Code

https://claude.ai/code/session_017XkqDqWbQdPXdy94AdFV5e