ultix/questions-v1.md

# questions-v1 — ultix-streaming optimization

Answer inline under each A:. Where I have a recommendation it is marked REC;
"ok" is a sufficient answer. Version the file (v2) for another round.

## Q1. Host audit (required first, blocks host-side numbers)
I cannot ssh from crush (tool policy), so run:
```
ssh root@pfv-tsys5.knel.net 'bash -s' < ~/projects/ultix/host-audit.sh > ~/projects/ultix/host-audit.out
```
then just say "audit done". I read the file and finalize §3 of REPORT.md.
A:

## Q2. CPU upgrade
REC: 2× Xeon X5675 (LGA1366, 6C/12T each, 95W, ~$25 each used) → 24 threads.
Cheaper alt: second E5620 (~$10) → 16 threads. Audit confirms the chassis is
dual-socket before you buy.
A:

## Q3. RAM
REC: populate CPU2 DIMM slots to 192G total, give this VM 128G, ballooning off.
Which DIMMs to order comes from the audit (current population + speed).
A:

## Q4. Root growth to 500G
REC: you run `qm resize <id> scsi0 +80G`, I do the in-guest MBR shuffle
(online except a brief swapoff; backups of fstab + partition table first).
When?
A:

## Q5. GPUs
Models + VRAM of the two incoming cards, and when? PSU wattage on the host
(sticker)? Old card: passthrough to this VM now, or leave for preprod?
Why it matters: no Above-4G-Decoding on this-era BIOS; big-VRAM cards may not
map. UEFI-only vBIOS cards would force the OVMF migration.
A:

## Q6. q35 switch
REC: yes, one offline window, NIC rename expected in guest (tailscale survives).
Needed for clean GPU/USB3 passthrough.
A:

## Q7. Account → slice names
accounts.tsv says: reachableceo, TSGBOD, TSGCOO, TSGCTO, TSGCCO,
reachableceo-offstage, COSRCEO-Personal, COSRCEO-Biz, COSWFO.
/home currently shows: COS-RCEO, COS-TSG, COS-WFO, ... Which 9 login names are
final on THIS host? (I generate one slice + user drop-in per account.)
A:

## Q8. Per-account memory fences
REC interim (48G): each account MemoryHigh 3G / Max 4.5G.
REC post-upgrade (128G): High 10G / Max 12G. CPU: weight 75, no hard quota
(burstable). OK?
A:

## Q9. Desktop
REC: keep KDE, fix the greeter (autologin into a locked session), Sunshine +
Moonlight after the GPU lands (NVENC). XFCE only if Sunshine capture on KDE
Wayland disappoints. OK to apply the autologin+lock config?
A:

## Q10. Metrics/pressure wiring
REC: node_exporter as a compose service (house-style, digest-pinned) scraped
by your existing mopac-harness prometheus; PSI textfile script for per-slice
pressure; gateway polls node_exporter directly in its 30s tick (option A, no
new dependency). Keep beszel for the human dashboard. Where does the beszel
hub live?
A:

## Q11. k8s
Control plane: where/what (k3s? existing cluster?)? REC: join AFTER host
upgrade, worker-only, low PriorityClass for burst workloads, kubelet eviction
thresholds, kubelet+containerd fenced to CPUWeight 20 + MemoryHigh. OK?
A:

## Q12. Proxmox control scope
REC: dedicated API token (ukrrs-infra@pam harness) scoped to a preprod pool
only. Which VMIDs may the harness stand down/snapshot, and which are
PROTECTED (this VM certainly)? I hard-code the PROTECTED list into
proxmox-ctl.sh.
A:

## Q13. SDRs
REC: passthrough both PCI USB3 controller cards whole (never per-device),
SDR processes pinned to the rt CPU pool. Confirm: both cards → THIS VM,
always-on? Any latency budget I should know about?
A:

## Q14. Day/night windows
REC: OS night profile 22:00-05:00 local; gateway z.ai peak ladder stays
01:00-05:00 CST as configured. Confirm 22:00-05:00 (vs your words "2200 to
0500") and the timezone the guest should key off (it currently sees system TZ).
A:

## Q15. Agent Zero
Which accounts host it, expected concurrent agents, docker-based? REC:
background agents → ukrrs-batch.slice, interactive ones → their account slice.
A:

## Q16. TCP BBR
REC: load tcp_bbr module + bbr/fq for the long provider streams. If you
prefer stock cubic, say so and I drop two lines.
A:

## Audit update 2026-08-31 (host-audit.out parsed; details in REPORT.md section 8)
- Q1 DONE. Q2 upgraded to URGENT: CPU2 socket confirmed empty; one E5620
  serves 24 running VMs. 2× X5675 triples threads. (DMI claims LGA771, a Dell
  string quirk; E5620 is LGA1366; verify visually before ordering.)
- Q3 refined: 6× 16GB DDR3 already fill all CPU1 slots; order 6 more 16GB.
- Q5 verdict: skip Quadro 4000 passthrough (Fermi: no NVENC, no modern CUDA
  driver). Still need: new GPU models/VRAM + PSU wattage sticker.
- Q13 wrinkle: only ONE USB3 card visible on the host. Where is the second?
- Q11 wrinkle: VM 500 pfv-k8s-wnode-tsys5 already exists here: join or
  consolidate?
- IOMMU groups are clean (no ACS override needed). No cpufreq driver exists
  anywhere, so day/night stays pure cgroup (already the design).

## Q17. VM 5111 auto-start
Audit shows onboot unset: after any host reboot your workstation stays DOWN
until manually started. OK to set onboot=1 with startup order 10?
A:

## Q18. Remote-desktop matrix (audit correction: xrdp IS running, sesman too)
Confirmed live: xrdp + xrdp-sesman = your Jump RDP path (my earlier "no xrdp"
was a bad probe, my error). Sunshine installed but not running. Two human
accounts, both with always-alive KDE (reachableceo 1001, -offstage 1010).
REC: keep xrdp for iPad quick-attach (verify /etc/xrdp/sesman.ini
KillDisconnected=false so sessions persist); start Sunshine only after the
compute GPUs land and use Moonlight for the video/audio editing sessions
(NVENC + proper audio); sddm autologin keeps a warm console session for that.
Confirm? And which account hosts the media-editing workload?
A:

## Q11 partial (2026-08-31): consolidation decided
VM 500 pfv-k8s-wnode-tsys5 removed; ultix-streaming will be THE k8s worker on
this host. Still open: control plane location/type (k3s?), and timing (rec:
join after Friday's CPU/RAM resize, worker-only, kubelet+containerd fenced at
CPUWeight 20 + MemoryHigh, low PriorityClass + eviction thresholds per REPORT
5.3).
A (control plane + timing):