Memory-aware worker starts: wait while the shared machine's memory is over the ceiling

.github/workflows/test.yml

@@ -14,6 +14,11 @@ jobs:
         node: [18, 20, 22, 24]
         part: [chain, rest]
     runs-on: ubuntu-latest
+    # the kit won't start a worker while the machine's memory is over its ceiling: the tests read a
+    # machine of their own (or none), never the runner's
+    env:
+      DEVTEAM_CGROUP: /nonexistent/devteam-cgroup
+      DEVTEAM_MEMINFO: /nonexistent/devteam-meminfo
     # a hung test should fail the job, not hold it for hours
     timeout-minutes: 30
     steps:

docs/devteam/process/supervisor.md

@@ -116,12 +116,13 @@ Production is watched by **sensors**, and they are yours: you add, change and st
 | PR head differs from the last phase line's `sha` | stale liveness | message the worker to run `phase` |
 | owner answer relayed, not in the spec or plan after the next commit | answer not recorded | message the worker |
 | ticket ready, no worker, under caps | idle capacity | schedule it, or hold it with the reason |
+| ticket ready or a goal unplanned, but the machine's memory at `machine_memory_ceiling` | memory full | start nothing new until sessions finish (resumes are fine); lower your `max_active_tickets` if it keeps happening (§5) |
 | goal fully defined (or its current milestone unplanned), no planner, under `max_active_planners` (no cap by default) | idle planning | start a planner for it now: every goal plans in parallel. The one exception is a goal whose design depends on another goal's design; record it (`goal set <id> --plan-after <g-id> --reason "…"`, shown to the owner on the goal) and start it once that one is approved |
 | superseded ticket with a live worker | re-plan not propagated | park it with a ruling |
 
 ## 5. Scheduling and merging
 
-- `devteam.mjs ready` lists tickets whose dependencies are merged and that have no worker; `--plan-ahead` adds those that can spec and plan now. To keep a ready ticket unscheduled on purpose (it may duplicate other work, it waits on the owner), `ticket set <id> --json '{"held": "<why>"}'`; `ready` and the idle-capacity finding then leave it out, and `{"held": null}` releases it. Caps: `max_active_tickets` (your review capacity is the real limit) and `max_active_per_component`. Prefer the critical path, then contract tickets, then tickets that close a story.
+- `devteam.mjs ready` lists tickets whose dependencies are merged and that have no worker; `--plan-ahead` adds those that can spec and plan now. To keep a ready ticket unscheduled on purpose (it may duplicate other work, it waits on the owner), `ticket set <id> --json '{"held": "<why>"}'`; `ready` and the idle-capacity finding then leave it out, and `{"held": null}` releases it. Caps: `max_active_tickets` (your review capacity is the real limit) and `max_active_per_component`. The machine is shared with other projects' fleets, so a new worker or planner doesn't start while the machine's memory is at `machine_memory_ceiling` (default 0.8 of its cap, from 0.5 to 0.95); a resume of a session that already ran always starts (`--resume` on one that never ran is a new start). When a start is refused for memory, or the `memory-full` finding shows in place of idle capacity, wait for sessions to finish rather than passing `--force`: forcing it is how the box runs out and restarts every fleet on it. If you keep hitting the ceiling, lower your own `max_active_tickets`; it is your setting, not a question for the owner. Prefer the critical path, then contract tickets, then tickets that close a story.
 - `devteam.mjs worker <id>`; `worker <id> --resume` relaunches a crashed one in the same window and worktree with `resume_command`.
 - **Merging.** A `merge-request` message names the exact head. Read the diff, the final review record and `verification.md` yourself, then `devteam.mjs merge <id>`. It runs `check-ticket` at that head, the log rule, and every gate in the settings in a clean worktree at that head, merges with `--match-head-commit` (or, with `forge: "git"`, merges that sha and pushes), and logs the act. `--dry-run` does everything but the merge (and works on a branch with no PR yet). A ticket you added since the log last landed fails the forge's checks (`project/tickets/<id>/ has no ticket`) until its line is on main, because the forge reads only the landed log: land the log first (`log-sync`, then `merge --chore log`) and rerun them. If anything fails it says what; reply to the worker with `--kind ruling --re <message-id>`. A head that moved after the request is a new request. You never merge any other way, and workers never merge.
 - **Other repos.** `merge` works per repo; the ticket says which (its component's `link`). `fleet status` lists each repo link with its path, and a sibling whose origin it can't fetch is a blocker. A ticket whose repo has no checkout on this machine waits as "repo unreachable"; `link-unreachable` says what to clone where.