Context
ci-runner-alignment audit finding D4 (walkthrough disposition: widen grace, keep hard fault). See docs/topics/ci-runner-alignment/REPORT.md @ 9f195b7 — D4 and the dispositions section.
The doctor's listener-health grace window is derived: request timeout + 2 × reconcile interval = 80 s. Observed benign busy-fleet acknowledgement lag reached 2 m 9 s (~1.6× grace) and degraded the doctor exit code. The upstream scale-set protocol never acknowledges capacity back at all — the signal is this controller's own convergence check — and protocol-level analysis frames busy-fleet lag as expected-transient.
Ask
Recalibrate the derived window (more reconcile intervals, or load-scaled) so known-benign busy-fleet lag sits inside it, while sustained beyond-grace lag remains a non-advisory hard fault. The check keeps its defect-signal value (a wedged listener shows sustained, monotonically growing non-ack); the current calibration fires on a known-benign state, which is alarm-fatigue territory.
Sizing needs validation under real load — pick the new derivation against observed busy-fleet lag distributions, not a guess.
Context
ci-runner-alignment audit finding D4 (walkthrough disposition: widen grace, keep hard fault). See
docs/topics/ci-runner-alignment/REPORT.md@ 9f195b7 — D4 and the dispositions section.The doctor's listener-health grace window is derived: request timeout + 2 × reconcile interval = 80 s. Observed benign busy-fleet acknowledgement lag reached 2 m 9 s (~1.6× grace) and degraded the doctor exit code. The upstream scale-set protocol never acknowledges capacity back at all — the signal is this controller's own convergence check — and protocol-level analysis frames busy-fleet lag as expected-transient.
Ask
Recalibrate the derived window (more reconcile intervals, or load-scaled) so known-benign busy-fleet lag sits inside it, while sustained beyond-grace lag remains a non-advisory hard fault. The check keeps its defect-signal value (a wedged listener shows sustained, monotonically growing non-ack); the current calibration fires on a known-benign state, which is alarm-fatigue territory.
Sizing needs validation under real load — pick the new derivation against observed busy-fleet lag distributions, not a guess.