ultix perf/ops workbench: complete 2026-08-31 optimization pass for VM 5111

Everything for the ultix-streaming (VM 5111, pfv-tsys5) performance pass: full report + host audit results, staged/gated configs, guest prep + host one-shot + post-reboot-fix + netcheck lifecycle scripts, grow-root manual runbook, rolling tracking HUD, questions v1, and the gateway boot-race hardening units. Applied and verified live 2026-08-31; open work is tracked in Redmine project 55 as #601-#607. [#602] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-31 16:46:13 -05:00
commit cba2a64d67
43 changed files with 3137 additions and 0 deletions
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# UKRRS: create one account lane = cgroup slice + matching user-slice drop-in.
+# usage: mkacct.sh <account> <uid> [mem_high] [mem_max] [allowed_cpus] [tier]
+#
+#   tier=agent (default): CPUWeight=75, pinned to a CPU pool — the 9 PMO/worker
+#     lanes. interim rec: 3G 4.5G 0-5   post-upgrade: 10G 12G 0-15
+#   tier=human: CPUWeight=600, NO cpu restriction, generous memory — the two
+#     human interactive accounts (KDE/CAD/EDA/video via xrdp live in these).
+#     interim rec: 12G 16G all   post-upgrade: 32G 40G all
+#
+# Examples (uids verified 2026-08-31):
+#   sudo RUN=1 ./mkacct.sh reachableceo 1001 12G 16G all human
+#   sudo RUN=1 ./mkacct.sh reachableceo-offstage 1010 12G 16G all human
+#   sudo RUN=1 ./mkacct.sh TSGBOD <uid> 3G 4.5G 0-5 agent
+#
+# RUN=1 installs (needs root); default prints the plan + snippets only.
+set -euo pipefail
+acct=${1:?account}; uid=${2:?uid}
+high=${3:-3G}; max=${4:-4.5G}; cpus=${5:-0-5}; tier=${6:-agent}
+RUN=${RUN:-0}
+
+case "$tier" in
+  human) weight=600; cpuline="" ;;
+  agent) weight=75;  cpuline="AllowedCPUs=$cpus" ;;
+  *) echo "tier must be human or agent" >&2; exit 2 ;;
+esac
+
+slice="/etc/systemd/system/ukrrs-acct-$acct.slice"
+userdrop="/etc/systemd/system/user-$uid.slice.d/50-ukrrs.conf"
+
+cat <<EOF
+plan ($tier tier):
+  $slice
+      CPUWeight=$weight ${cpuline:+$cpuline }MemoryHigh=$high MemoryMax=$max TasksMax=4096
+  $userdrop
+      CPUWeight=$weight MemoryHigh=$high
+
+compose snippet (this account's agent projects):
+  x-ukrrs-acct: &ukrrs_acct
+    cgroup_parent: ukrrs-acct-$acct.slice
+  services:
+    anything: { <<: *ukrrs_acct }
+
+dev.sh one-shot builders belong in the batch pool, not the account slice:
+  docker run --rm --cgroup-parent ukrrs-batch.slice --cpus 4 --memory 4g ...
+EOF
+
+if [ "$RUN" = 1 ]; then
+  [ "$(id -u)" = 0 ] || { echo "RUN=1 needs root" >&2; exit 1; }
+  cat > "$slice" <<EOF
+[Unit]
+Description=UKRRS account lane ($tier): $acct
+Documentation=file:///home/reachableceo/optimize/REPORT.md
+
+[Slice]
+CPUWeight=$weight
+${cpuline}
+MemoryHigh=$high
+MemoryMax=$max
+TasksMax=4096
+EOF
+  mkdir -p "$(dirname "$userdrop")"
+  cat > "$userdrop" <<EOF
+[Slice]
+CPUWeight=$weight
+MemoryHigh=$high
+EOF
+  systemctl daemon-reload
+  # push live: drop-ins alone don't re-apply to already-existing user slices
+  systemctl set-property "user-$uid.slice" CPUWeight="$weight" MemoryHigh="$high"
+  echo "installed + daemon-reload + live-applied ok: $acct ($tier)"
+fi