@edgehero/pi-dispatch 3.1.0 → 4.0.0

package/src/doctor.mjs

@@ -59,7 +59,7 @@ import { spawn as nodeSpawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER, DEFAULT_VALKEY_URL, accountTempRoot, allowedModelsFrom, defaultLogsDir, defaultSandboxDir, defaultSettingsFile, defaultWorkerName, globalExtensionsEnabled, jobsDirOwnerFix, jobsDirPath, sandboxDirOwnerFix, legacyTempStateDir, logsDirPath, modelEndpointsFilePath, delimitedList, envelopeFilePath, pauseWindowsFilePath, projectsFilePath, safeHomeDir, scopedLimitsFilePath, settingsFilePath, underOsTempDir } from "./config.mjs";
 import { SYSTEMD_HAZARD_SHAPES, decodeEnvFile, envFileHazard, envValueShown, quotedRegions, readEnvAssignments, renderEnvValue, envFileWrapperInternal, wrapperInternalSentence } from "./env-file.mjs";
-import { canonicalScope, danglingProjectRows, dollarRowsBelowJobCap, dollarRowsWithoutCap, isModelScope, isProjectScope, loadScopedLimits, parseScopedLimits } from "./scoped-limits.mjs";
+import { canonicalScope, danglingProjectRows, dollarRowsBelowJobCap, dollarRowsWithoutCap, isModelScope, isProjectScope, loadScopedLimits, parseScopedLimits, scopedLimitsVersionFor } from "./scoped-limits.mjs";
 import { EMPTY_PROJECTS_FINGERPRINT, loadProjects, projectsFingerprint } from "./projects.mjs";
 import { parseModelsJson, stripBom, stripJsonComments } from "./models-json.mjs";
 import { isTransientOverlayRead, overlayProviderProblem } from "./model-catalog.mjs";
@@ -87,7 +87,7 @@ import { ABSENT, ASSERTED, DAEMON_APPLIES_BOUNDS, DEFAULT_BACKEND, DOCKER_ENDPOI
 import { PODMAN_BOOT_REFUSING_CAUSES, PODMAN_FIRST_START_TIMEOUT_MS, PODMAN_INFO_TIMEOUT_MS, PODMAN_JOB_USER_FIX, decidePodmanJobUser, makePodmanInfoReader, observePodman, observeRootlessNetns, podmanConfFix, podmanConfWidening, resolvePodmanImageUser } from "./backend-podman.mjs";
 import { PODMAN_PINNED_FLAGS, buildPodmanRunArgs, containerSpec, podmanArgsFromSpec } from "./docker-run.mjs";
 import { PODMAN_SERVICE_TIMEOUT_MS, PODMAN_SERVICE_UNIT, makePodmanServiceReader, observeHost, observeRootfulConf, readRootfulService, rootfulConfFix, rootfulConfRetries, rootfulConfResidual, rootfulUnreadList } from "./runtime-observations.mjs";
-import { endpointShown, makeDockerEndpointResolver, quotedShown } from "./backend-local.mjs";
+import { JOB_NAME_PREFIX, endpointShown, makeDockerEndpointResolver, quotedShown } from "./backend-local.mjs";
 import { DEFAULT_EGRESS_PROXY, STOPPED_PROXY_STATES, EGRESS_CANARY_NET_PREFIX, EGRESS_CANARY_PROBE_PREFIX, EGRESS_ENDPOINT_PROBE_PREFIX, egressArmed, egressCanaryNetwork, egressCanaryProbe, egressEndpointProbe, egressEnv, egressProxyName, egressProxyUrl, networkEndpoints, removeNetworkOrSay } from "./egress.mjs";
 import { detachBlockedSentence, makeDetachGate, runtimeFromFacts } from "./netns-keeper.mjs";
 import { runLiveProbes } from "./live-probes.mjs";
@@ -95,7 +95,12 @@ import { VALKEY_PASSWORD_KEY, VALKEY_PASSWORD_HOWTO, VALKEY_PORT_KEY, isLoopback
 import { urlShown, valkeyContextFromResolution, valkeyPasswordFor, valkeyUrlProblem } from "./valkey-endpoint.mjs";
 import { SANDBOX_TOMBSTONE_STUCK_MS, isSandboxTombstone, sandboxTombstoneAge } from "./sandbox-store.mjs";
 import { installedUnitPaths, readUnitSeam, readUnitUser } from "./service.mjs";
-import { CONTAINER_HOME, SHIPPED_IMAGE_UID } from "./container-spec.mjs";
+import { CONTAINER_HOME, SHIPPED_IMAGE_UID, SIZE_LABEL_CPU, SIZE_LABEL_MEM } from "./container-spec.mjs";
+import { DEFAULT_JOB_SIZE, cpuCeilingCenti, formatCpus, formatMemory, jobSizeDefaults, resolveJobSize } from "./job-size.mjs";
+import { SUGGEST_WINDOW_DAYS, cpusText, hostCap, refusalWords, sizeRefusal, suggestSize, suggestionCall, suggestionEvidence } from "./size-suggest.mjs";
+import { SIZING_RECORD_MAX_BYTES, readSizingRecords } from "./size-records.mjs";
+import { CGROUP_PARENT, cgroupParentFor, operatorQuotaCommand, readQuota, reservePlan, userQuotaCommand } from "./cpu-reserve.mjs";
+import { HOST_BUDGET_KEYS, computeHostBudget, hostBudgetSettings, largestFit, neverFits, projectBudgetRow, publishedBudget, readUserServiceLimits } from "./host-budget.mjs";
 import { makeImagePreflight, normalizeImageId } from "./image-preflight.mjs";
 import { BOOT_REFUSING_JOB_USER_CAUSES, DAEMON_FACTS_TIMEOUT_MS, JOB_USER_FIX, makeDaemonFactsReader, makeJobUserResolver, relabelsPrivateMounts, resolveImageUser } from "./job-user.mjs";
 import { parseSecretProfiles } from "./secret-profiles.mjs";
@@ -274,6 +279,9 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		// Issue #458 (PR #463 round 2): the clock the keeper's age is judged on, epoch ms. Its own name, not `now`: `--live`
 		// pairs `now` with `delay`, and a clock that does not advance without its `delay` would never reach a deadline.
 		wallClock = Date.now,
+		// Issue #596, phase 3: the run records the size suggestions read, `(nowMs) => records`. A seam so a test decides
+		// the runs; absent, the logs directory's records of the window are read (`readSizingRecords`).
+		readRunRecords,
 		// Issue #448: `systemctl show podman.service`, read only where the local daemon is rootful Podman on this host. A seam
 		// so a test decides what the unit says; absent, it spawns systemctl through `spawn`, as the docker reads do.
 		readPodmanService,
@@ -375,7 +383,7 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 						return { ...(await valkeyAuthState(url, { context, withoutPassword })), passwordSet: Boolean(sent.password), from: sent.from };
 					}
 				: null;
-	const seams = { cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
+	const seams = { cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, ...(readRunRecords ? { readRunRecords } : {}), venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
 	// Issue #471: every other service key, resolved ONCE for the whole run (the fix pass's re-collect and `--live` judge the
 	// same resolution). THE RULE (PR #474's round cap, after three rounds of trust patches): no program doctor starts is
 	// handed anything from `.env`. Every child gets this shell's own environment, the one it had before #471; a `.env`
@@ -587,7 +595,7 @@ export const ENV_FILE_READABLE_KEYS = Object.freeze(["PI_PAUSE_WINDOWS_FILE", "P
 export const GITHUB_SERVICE_KEYS = Object.freeze(["GITHUB_AUTH_SOURCE", "GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY_PATH", "GITHUB_APP_PRIVATE_KEY"]);
 /** Issue #471: the worker's settings doctor judges, which it read from this shell alone while the service read them from
  *  `.env`. TEMP is TMPDIR's twin in the worker's temp root; PI_CODING_AGENT_DIR is where the worker reads auth.json. */
-export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_SECRET_PROFILES", "PI_SECRET_RESOLVER_ROOTS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
+export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_JOB_MEMORY", "PI_JOB_CPUS", "PI_CONCURRENCY", ...Object.values(HOST_BUDGET_KEYS), "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_SECRET_PROFILES", "PI_SECRET_RESOLVER_ROOTS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
 /** Issue #471: the receiver's keys doctor judges its boot by (the receiver's unit reads the same `.env`). */
 export const RECEIVER_SERVICE_KEYS = Object.freeze(["WEBHOOK_SECRET", "RECEIVER_PORT", "GITLAB_TOKEN", "GITLAB_URL", "GITLAB_WEBHOOK_MODE", "GITLAB_WEBHOOK_SECRET", "FORGEJO_URL", "FORGEJO_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_ORG_URL", "AZURE_TOKEN", "AZURE_WEBHOOK_MODE", "AZURE_WEBHOOK_SECRET", "AZURE_WEBHOOK_HEADER"]);
 /**
@@ -1827,9 +1835,58 @@ export async function collectChecks(shellVars, seams) {
 					? { answered: false, reason: "docker-not-found", transient: true }
 					: null);
 	checks.push(...backendChecks(env, { endpoint, daemon, fs: seams.observationFs, unit: jobUser.unit, ...(podman ? { podman: podman.observed } : {}) }));
+	// Issue #596: the default job size, and what this host's runtime says about the bounds a size becomes.
+	// Each venue this deployment runs, from that venue's own read: `undefined` leaves a venue out, null is "not read".
+	// Issue #596, phase 2: the host budget a worker started now would compute, from the same two reads, and what it means
+	// beside PI_CONCURRENCY and the project sizes in the scoped-limits file (a file that does not load adds no project).
+	// Computed first, because its CPU budget is every job's `--cpus` and the size lines say so.
+	const budgetView = doctorHostBudget(env, { daemon: localUsed ? (daemon ?? null) : undefined, podman: podman?.observed?.read ?? undefined, readFile: (path) => (seams.observationFs ?? { readFileSync }).readFileSync(path, "utf8"), euid: seams.jobUserIdentity?.euid ?? null });
+	checks.push(...jobSizeChecks(env, { daemon: localUsed ? (daemon ?? null) : undefined, podman: podman?.observed?.read !== undefined && podman?.observed?.read !== null ? podman.observed.read : undefined, cpuBudgetCenti: Number.isSafeInteger(budgetView.cpuCenti) ? budgetView.cpuCenti : null }));
+	const concurrencyHere = /^[1-9][0-9]{0,5}$/.test(String(env.PI_CONCURRENCY ?? "").trim()) ? Number(String(env.PI_CONCURRENCY).trim()) : 3;
+	// Said again once the registry is read (below), in this place, when a worker that declares no fleet has peers.
+	const budgetChecksArgs = { concurrency: concurrencyHere, limits: scopedLimitFacts.parseError === null ? scopedLimitFacts.limits : [], env };
+	const budgetChecksAt = checks.length;
+	const budgetChecksHere = hostBudgetChecks(budgetView, budgetChecksArgs);
+	checks.push(...budgetChecksHere);
+	// Issue #596, phase 3: one line per project with its size and what its recent runs suggest, capped at what this host
+	// offers. The records are read only when there is a project to suggest for, and not at all when the scoped-limits
+	// file does not load: every size read without it would be the default, not the project's, and a project that has a
+	// row would be told to `dispatch_limit_add` one.
+	const sizingProjects = readProjectFacts(env, fileExists).projects;
+	if (sizingProjects.length > 0 && !budgetView.error) {
+		if (scopedLimitFacts.parseError !== null) {
+			checks.push({ ok: true, label: "size suggestions: off until the scoped-limits file loads (a size read without it would be the default, not the project's)" });
+		} else {
+			const nowMs = (typeof seams.wallClock === "function" ? seams.wallClock : Date.now)();
+			const read = typeof seams.readRunRecords === "function" ? { records: seams.readRunRecords(nowMs), skipped: 0 } : readSizingRecords(logsDirPath(env, home), { nowMs });
+			const f = budgetView.facts ?? {};
+			const least = (...vs) => {
+				const known = vs.filter((v) => Number.isSafeInteger(v) && v > 0);
+				return known.length === 0 ? null : Math.min(...known);
+			};
+			const total = { memMiB: least(f.memTotalMiB, f.userMemMiB), cpuCenti: least(Number.isSafeInteger(f.hostCpus) ? f.hostCpus * 100 : null, f.userCpuCenti) };
+			checks.push(...sizeSuggestionChecks({ projects: sizingProjects, limits: budgetChecksArgs.limits, env, records: read.records, budget: { memMiB: budgetView.memMiB, cpuCenti: budgetView.cpuCenti }, total, nowMs }));
+			if (read.skipped > 0) checks.push({ ok: true, label: `size suggestions: ${read.skipped} run record${read.skipped === 1 ? "" : "s"} over ${SIZING_RECORD_MAX_BYTES / 1024} KiB skipped, not read` });
+		}
+	}
+	// Issue #596, phase 2: the aggregate CPU reserve per venue, read (never written) the way the worker reads it.
+	if (!budgetView.error) {
+		const reserveReads = await doctorCpuReserve({
+			daemon: localUsed ? (daemon ?? null) : undefined,
+			podman: podman?.observed?.read ?? undefined,
+			endpointLocal: endpoint?.local === true,
+			platform: seams.jobUserIdentity?.platform ?? seams.platform ?? process.platform,
+			run: (bin, args, { timeoutMs }) => dockerRunVia(spawn, timeoutMs, { bin })(args),
+			image: jobImage,
+			imagePresent: imageCode === 0,
+		});
+		checks.push(...cpuReserveChecks(reserveReads, budgetView.cpuCenti));
+	}
 	checks.push(...jobUser.checks);
 	if (podman) checks.push(...podman.checks);
 	if (facts) facts.jobUser = jobUser.forLive;
+	// Issue #596, phase 2: the CPU budget the parent's quota is read back against by `--live`.
+	if (facts) facts.cpuBudgetCenti = budgetView.cpuCenti ?? null;
 	// Issue #355: the same answer, kept for `--live`, which decides from it whether its probes' own mounts carry `:Z`.
 	if (facts) facts.daemon = jobUser.daemon;
 	// Issue #354: which read-backs `--live` runs, and the podman venue's facts for its own.
@@ -2399,6 +2456,33 @@ export async function collectChecks(shellVars, seams) {
 	// Valkey doctor reads, a host row is another party's text, and a control byte in a name or zone must not reach the
 	// terminal. The registry's own charset already refuses them at the source; this is the reader not relying on it.
 	const peers = (fleet.hosts ?? []).map((h) => ({ ...h, name: printable(h.name), tz: h.tz ? printable(h.tz) : h.tz })).filter((h) => h.name !== workerNameOf(declaredWorkerName));
+	if (!env.PI_WORKER_NAME && peers.length > 0) checks.splice(budgetChecksAt, budgetChecksHere.length, ...hostBudgetChecks(budgetView, { ...budgetChecksArgs, peers: true }));
+	// Issue #596, phase 2: this host's own row, when its worker runs and publishes one. Its host budget ledger is held
+	// against the size labels of the job containers each venue's runtime lists, read only when the row carries the ledger.
+	const selfRow = (fleet.hosts ?? []).find((h) => printable(h.name) === workerNameOf(declaredWorkerName)) ?? null;
+	// a worker that has not read its boot listing of the job containers left from before it started admits nothing
+	// on that venue. Per venue since gate round 2 of phase 2: `unlisted:<venue>[,<venue>]`, each a backend name;
+	// a bare `unlisted` (a worker of this round's first draft) is the whole host.
+	const seedField = typeof selfRow?.budgetSeed === "string" ? selfRow.budgetSeed : "";
+	if (seedField === "unlisted" || seedField.startsWith("unlisted:")) {
+		const unread = seedField
+			.slice("unlisted:".length)
+			.split(",")
+			.filter((v) => /^[a-z][a-z0-9-]{0,31}$/.test(v));
+		const bins = unread.map((v) => (v === "podman" ? "`podman ps -a`" : "`docker ps -a`"));
+		const where = unread.length === 0 ? "NO job" : `NO job on the ${unread.join(" and ")} venue${unread.length === 1 ? "" : "s"} (the other venues' jobs still run)`;
+		checks.push({ ok: false, warn: true, label: `this host's worker admits ${where}: it could not list the job containers left from before it started there, so it cannot count what they hold (host_budget_seed_unread)`, fix: `make the runtime answer for the worker's account (${bins.length > 0 ? [...new Set(bins)].join(", ") : "`docker ps -a`, `podman ps -a`"}); the worker asks again every few seconds and starts admitting once it reads the listing` });
+	}
+	if (selfRow && typeof selfRow.usedMemMiB === "string" && selfRow.usedMemMiB !== "") {
+		const listed = [];
+		let listedAll = true;
+		for (const bin of [...(localUsed ? ["docker"] : []), ...(podmanUsed ? ["podman"] : [])]) {
+			const ps = await runCmdCapture(spawn, bin, [...SIZE_LABEL_PS_ARGS], { stdoutOnly: true });
+			if (ps.code !== 0) listedAll = false;
+			else listed.push(...parseSizeLabels(ps.output));
+		}
+		if (listedAll) checks.push(...budgetLedgerChecks({ ...selfRow }, listed));
+	}
 	// The applied split (issue #504 part B): one GET whenever this command may talk to the Valkey, so a single host with
 	// no envelope that refuses every job is told why. `{ digest }`, `{ undecodable: true }` for a key that exists and does
 	// not decode (the worker's EXISTS still counts it as governed), or null (no split, or no answer: nothing is said).
@@ -2494,6 +2578,13 @@ export async function collectChecks(shellVars, seams) {
 		// "no projects" against healthy peers would send the operator to the wrong host.
 		const projectFactsHere = readProjectFacts(env, fileExists);
 		if (projectFactsHere.parseError === null) checks.push(...fleetProjectsChecks(projectsFingerprint(projectFactsHere.projects), peers));
+		// Issue #596: a peer that predates version 3 keeps its last good scoped-limits file once this one is version 3, so
+		// no edit to the file applies on it. Judged on the DECLARED version, or the derived one if that is higher (gate
+		// round 2). SKIPPED when this host's file does not load.
+		if (scopedLimitFacts.parseError === null) checks.push(...fleetSizeChecks(Math.max(Number(scopedLimitFacts.declaredVersion) || 0, scopedLimitsVersionFor(scopedLimitFacts.limits)), peers));
+		// Issue #596, phase 2: each host's budget and use, and which hosts each project's size fits on, from every row that
+		// publishes a budget (this host's own included). SKIPPED when this host's scoped-limits file does not load.
+		if (scopedLimitFacts.parseError === null) checks.push(...fleetBudgetChecks((fleet.hosts ?? []).map((h) => ({ ...h, name: printable(h.name) })), { limits: scopedLimitFacts.limits, env }));
 		// Issue #504 part B: one applied split, judged on every host against its own envelope. A host whose envelope digest
 		// differs refuses every governed job as `envelope-mismatch`. SKIPPED when this host's file does not load, for the
 		// projects check's reason above.
@@ -4470,7 +4561,12 @@ function readScopedLimitFacts(env, fileExists) {
 		// guarded read was ever reached. `readFileSync` is synchronous, so no test timeout can interrupt it
 		// -- the failure mode is a job that never ends rather than one that goes red.
 		if (!statSync(path).isFile()) return { limits: [], parseError: `scoped-limits file is not a regular file: ${path}`, path };
-		return { limits: parseScopedLimits(readFileSync(path, "utf8"), path), parseError: null, path };
+		const text = readFileSync(path, "utf8");
+		const limits = parseScopedLimits(text, path);
+		// Issue #596, gate round 2: the version the file DECLARES, beside the rows. An older worker refuses by the declared
+		// number, so a hand-written `"version": 3` with no size field is as unreadable to it as one with a size. The parse
+		// above already accepted this text, so this one cannot throw.
+		return { limits, declaredVersion: JSON.parse(text).version, parseError: null, path };
 	} catch (e) {
 		return { limits: [], parseError: e?.message ?? String(e), path };
 	}
@@ -4847,6 +4943,25 @@ export async function fleetDollarChecks(mine, peers, { dollarKeysExist = async (
  * Hosts are named, never a project's members or name: the registry carries a digest, so "different" is all a reader
  * can know.
  */
+/**
+ * The fleet's job sizes (issue #596): WARNS when this host's scoped-limits file is version 3 (it declares 3, or a row
+ * carries a size) and a peer publishes no `limitsVersion` of 3 or more. Such a worker refuses the file only when it
+ * LOADS it, at boot; a running one keeps its LAST GOOD file on reload (`scoped_limits_reload_invalid`), so the size and
+ * every later edit to the file (job counts, `concurrent`, dollar caps) do not apply on it until it is upgraded and
+ * restarted, with nothing on its jobs saying so. Nothing is said while the file is version 1 or 2.
+ */
+export function fleetSizeChecks(fileVersion, peers) {
+	if (fileVersion < 3) return [];
+	const old = peers.filter((h) => !(Number(h.limitsVersion) >= 3));
+	if (old.length === 0) return [];
+	return [{
+		ok: false,
+		warn: true,
+		label: `${old.map((h) => h.name).join(", ")} ${old.length === 1 ? "predates" : "predate"} job sizes (scoped-limits version 3), while this host's file is version 3: a running worker from before keeps its last good file, so neither the size nor any later edit to the file (job counts, concurrent, dollar caps) applies on it until it is upgraded and restarted, and it refuses the file at its next start`,
+		fix: "upgrade and restart every worker on this Valkey before scoped-limits.json is written as version 3",
+	}];
+}
+
 export function fleetProjectsChecks(mine, peers) {
 	const checks = [];
 	const opinions = peers.filter((h) => typeof h.fpProjects === "string" && h.fpProjects !== "");
@@ -6173,7 +6288,7 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
  * then replaced by none; `CANARY_NO_WORKSPACE` is a path nothing creates, so if a later edit ever kept the mount, the
  * run would fail on a missing source rather than bind a real directory.
  */
-export function egressCanaryProbeArgs({ bin = "docker", slug, pid, network, proxy, image, url, user = null, script = egressCanaryScript(url), name = egressCanaryProbe(slug, pid), httpProxy = false }) {
+export function egressCanaryProbeArgs({ bin = "docker", slug, pid, network, proxy, image, url, user = null, script = egressCanaryScript(url), name = egressCanaryProbe(slug, pid), httpProxy = false, size = DEFAULT_JOB_SIZE, hostCpus = null }) {
 	if (bin !== "podman") {
 		return [
 			"run",
@@ -6203,7 +6318,9 @@ export function egressCanaryProbeArgs({ bin = "docker", slug, pid, network, prox
 	// HOME as a podman job gets it (`resolvePodmanImageUser` always answers CONTAINER_HOME): under keep-id the job user's
 	// passwd entry otherwise names this host's home path, which does not exist in the image, and the canary loads pi as
 	// that user. No credential rides along: the canary proves the route, and a 401 from the provider is its success.
-	const { mounts: _placeholder, ...spec } = containerSpec({ image, name, env: { HOME: CONTAINER_HOME, ...egressEnv({ proxy, armed: true }) }, workspace: CANARY_NO_WORKSPACE, network, user, userns: "keep-id", extraFlags: ["--entrypoint", "node"] });
+	// Issue #596: at a job's size (the deployment's default, which doctor reads from the same settings the worker does) and
+	// under the same `--cpus` ceiling, so the canary's container is a job's in its bounds as well as its flags.
+	const { mounts: _placeholder, ...spec } = containerSpec({ image, name, env: { HOME: CONTAINER_HOME, ...egressEnv({ proxy, armed: true }) }, workspace: CANARY_NO_WORKSPACE, network, user, userns: "keep-id", extraFlags: ["--entrypoint", "node"], size, hostCpus });
 	return [...podmanArgsFromSpec({ ...spec, mounts: [] }), "-e", script];
 }
 
@@ -6233,7 +6350,7 @@ const CANARY_NO_WORKSPACE = "/nonexistent/pi-dispatch-egress-canary-mounts-nothi
  * `endpoints` (issue #503) are the declared model endpoints to prove on the same network after the three
  * (`runEndpointProbes`), `[]` by default, so the conformance script and a deployment with none run exactly the three.
  */
-export async function runEgressCanary({ run, bin = "docker", proxy, image, pid = process.pid, user = null, probeRun = null, endpoints = [], gate = makeDetachGate((args, opts) => run(args, { timeoutMs: opts?.timeoutMs ?? CANARY_STEP_TIMEOUT_MS }), { bin }) }) {
+export async function runEgressCanary({ run, bin = "docker", proxy, image, pid = process.pid, user = null, probeRun = null, endpoints = [], size = DEFAULT_JOB_SIZE, hostCpus = null, gate = makeDetachGate((args, opts) => run(args, { timeoutMs: opts?.timeoutMs ?? CANARY_STEP_TIMEOUT_MS }), { bin }) }) {
 	const venue = canaryVenueFor(bin);
 	const probe = probeRun ?? ((args) => run(args, { timeoutMs: bin === "podman" ? PODMAN_FIRST_START_TIMEOUT_MS : RUN_TIMEOUTS.cmd }));
 	const checks = [];
@@ -6312,7 +6429,7 @@ export async function runEgressCanary({ run, bin = "docker", proxy, image, pid =
 			[CANARY_PROBE_SLUGS[1], "an unlisted host", "https://example.com/", false],
 			[CANARY_PROBE_SLUGS[2], "plain HTTP to a listed host off port 80", "http://api.anthropic.com:443/", false, egressCanaryPlainScript("http://api.anthropic.com:443/", { proxyUrl: egressProxyUrl(proxy) })],
 		]) {
-			const answer = await probe(egressCanaryProbeArgs({ bin, slug, pid, network: net, proxy, image, url, user, ...(script ? { script } : {}) }));
+			const answer = await probe(egressCanaryProbeArgs({ bin, slug, pid, network: net, proxy, image, url, user, size, hostCpus, ...(script ? { script } : {}) }));
 			// The script exits 0 (reached) or 3 (blocked). Anything else is the container not running it -- a name clash,
 			// the image, the daemon -- which is no reading at all, and must not pass for a deny.
 			// `code === null` is the ONE case where a container may still be RUNNING under a name we chose: the
@@ -6388,7 +6505,7 @@ export async function runEgressCanary({ run, bin = "docker", proxy, image, pid =
 			if (staleRunner) {
 				checks.push({ ok: false, warn: true, label: `${venue.prefix}Model endpoints: not probed, because the job image has no runner module (above), and their probes take the runner's route`, fix: "use a job image built after issue #427, then re-run doctor" });
 			} else {
-				checks.push(...(await runEndpointProbes({ probe, bin, pid, network: net, proxy, image, user, endpoints, venue, unfinished })));
+				checks.push(...(await runEndpointProbes({ probe, bin, pid, network: net, proxy, image, user, endpoints, venue, unfinished, size, hostCpus })));
 			}
 		}
 	} finally {
@@ -6604,7 +6721,7 @@ export function undeclaredPortNear(endpoint, endpoints) {
  * variable as well on docker: the runner's dispatcher sends an `http://` origin to HTTP_PROXY, which docker's canary
  * argv does not otherwise carry (podman's is a job's environment and has it).
  */
-async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user, endpoints, venue, unfinished }) {
+async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user, endpoints, venue, unfinished, size = DEFAULT_JOB_SIZE, hostCpus = null }) {
 	const checks = [];
 	for (const endpoint of endpointsById(endpoints)) {
 		const next = undeclaredPortNear(endpoint, endpoints);
@@ -6617,7 +6734,7 @@ async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user,
 		];
 		for (const [slug, url, script] of runs) {
 			const name = egressEndpointProbe(slug, endpoint.id, pid);
-			const answer = await probe(egressCanaryProbeArgs({ bin, slug, name, pid, network, proxy, image, url, user, script, httpProxy: true }));
+			const answer = await probe(egressCanaryProbeArgs({ bin, slug, name, pid, network, proxy, image, url, user, script, httpProxy: true, size, hostCpus }));
 			if (answer?.code === null && answer.ended !== "error") unfinished.push(name);
 			checks.push(endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next }));
 		}
@@ -7359,6 +7476,451 @@ async function defaultProbeValkey(url) {
 	}
 }
 
+/**
+ * The deployment's default job size as doctor reads it (issue #596): `PI_JOB_MEMORY` and `PI_JOB_CPUS` through the
+ * worker's own rule (`jobSizeDefaults`), or the built-in 4g and 2 when they do not parse (`jobSizeChecks` reports that as
+ * the boot refusal it is, and the read-backs then probe the size a fixed configuration would get).
+ */
+export function doctorJobSize(env) {
+	try {
+		const d = jobSizeDefaults(env);
+		return { memMiB: d.memMiB, cpuCenti: d.cpuCenti, source: d.memSet || d.cpuSet ? "env" : "default" };
+	} catch {
+		return DEFAULT_JOB_SIZE;
+	}
+}
+
+/**
+ * The job size lines (issue #596): the default size every job without a project size gets, the `--cpus` ceiling each
+ * venue's runtime gives every job, and WARNINGS where a bound will not hold: the ceiling is unknown (the runtime did
+ * not answer, or gave no CPU count, so jobs run with no `--cpus`, the worker's `cpu_ceiling_unknown`), or the Docker
+ * daemon reports `SwapLimit` or `CPUShares` false (it drops `--memory-swap` or `--cpu-shares` with a client warning
+ * only, the worker's `size_bound_unenforced`). A setting that does not parse is a FAILURE: the worker refuses to start
+ * on it (`loadConfig`).
+ * `daemon` is the local venue's one `docker info` answer (null where it was not read), `undefined` where this
+ * deployment does not run `local`; `podman` is the podman venue's one `podman info` read the same way.
+ */
+export function jobSizeChecks(env, { daemon = undefined, podman = undefined, cpuBudgetCenti = null } = {}) {
+	let d;
+	try {
+		d = jobSizeDefaults(env);
+	} catch (error) {
+		return [{ ok: false, label: `job size does not parse: ${error.message}, so the worker REFUSES TO START`, fix: "set PI_JOB_MEMORY like 512m, 1536m or 4g and PI_JOB_CPUS like 0.5 or 2 (or unset them for 4g and 2), then re-run doctor" }];
+	}
+	const where = d.memSet || d.cpuSet ? "PI_JOB_MEMORY and PI_JOB_CPUS" : "the built-in default";
+	const checks = [{ ok: true, label: `Job size: ${formatMemory(d.memMiB)} of memory with no swap beyond it, and the CPU weight of ${formatCpus(d.cpuCenti)} CPUs, per job (${where}; a project row's memory and cpus override it, docs/scoped-limits.md)` }];
+	const venues = [];
+	// `reason` is the reader's own token (`timeout`, `unparseable`, ...), never the runtime's text.
+	const reasonOf = (read) => (typeof read?.reason === "string" && /^[a-z0-9-]{1,40}$/.test(read.reason) ? read.reason : "not read");
+	if (daemon !== undefined) venues.push({ venue: "local", answered: daemon?.answered === true, reason: reasonOf(daemon), hostCpus: daemon?.answered === true ? daemon.facts?.hostCpus : null, cmd: "docker info" });
+	if (podman !== undefined) venues.push({ venue: "podman", answered: podman?.answered === true, reason: reasonOf(podman), hostCpus: podman?.answered === true ? podman.info?.hostCpus : null, cmd: "podman info" });
+	for (const v of venues) {
+		// Issue #596, phase 2: the host's CPU budget is every job's `--cpus` (capped at the runtime's count) once it is known.
+		const ceilingCenti = Number.isSafeInteger(v.hostCpus) ? cpuCeilingCenti(v.hostCpus, cpuBudgetCenti) : null;
+		const ceiling = ceilingCenti === null ? null : formatCpus(ceilingCenti);
+		if (ceiling !== null) {
+			// "any ONE job": each container's quota is its own and they do not sum, so busy jobs together can still use
+			// every core (measured, issue #596); the host budget's ledger bounds the jobs' CPU SIZES together, and a reserve
+			// that holds across their USE is the parent cgroup the lab is measuring.
+			checks.push({ ok: true, label: `${v.venue}: any one job may use at most ${ceiling} of this runtime's ${v.hostCpus} CPUs (--cpus); under contention a larger size gets more CPU than a smaller one (--cpu-shares)` });
+		} else {
+			checks.push({ ok: false, warn: true, label: `${v.venue}: ${v.answered ? `\`${v.cmd}\` gave no CPU count` : `\`${v.cmd}\` gave no answer that says its CPU count (${v.reason})`}, so the CPU ceiling is unknown and a job that runs gets no --cpus: it may use every core of the host (cpu_ceiling_unknown)`, fix: `make \`${v.cmd}\` answer for the worker's account with its CPU count, then re-run doctor; the worker reads it with every job's user` });
+		}
+	}
+	const facts = daemon?.answered === true ? daemon.facts : null;
+	if (facts?.swapLimit === false) {
+		checks.push({ ok: false, warn: true, label: "local: the Docker daemon reports SwapLimit false, so it drops --memory-swap and a job may swap beyond its memory (size_bound_unenforced)", fix: "enable swap accounting in the kernel (cgroup v2, or swapaccount=1 on cgroup v1), restart Docker, then re-run doctor" });
+	}
+	if (facts?.cpuShares === false) {
+		checks.push({ ok: false, warn: true, label: "local: the Docker daemon reports CPUShares false, so it drops --cpu-shares and jobs get no CPU weight by size (size_bound_unenforced)", fix: "enable the cpu cgroup controller for Docker (cgroup v2 with cpu delegated), restart Docker, then re-run doctor" });
+	}
+	return checks;
+}
+
+/**
+ * The host budget as doctor computes it (issue #596, phase 2, DES-HOST-BUDGET), by the worker's own functions from the
+ * same reads the size lines use: `{ settings, jobDefault, facts, memMiB, cpuCenti, detail }`, or `{ error, jobDefault }`
+ * when a setting does not parse (the worker refuses to start on it). `daemon` is the local venue's `docker info` answer
+ * and `podman` the podman venue's `podman info` read, either absent; on rootless Podman the user service's `memory.max`
+ * and `cpu.max` are read beside them (`readFile`, the observation seam), as the worker reads them. Doctor answers for the
+ * CONFIGURATION, so this is the budget a worker started now would compute; the registry row says what a running one has.
+ */
+export function doctorHostBudget(env, { daemon = undefined, podman = undefined, readFile = null, euid = null } = {}) {
+	let jobDefault;
+	try {
+		const d = jobSizeDefaults(env);
+		jobDefault = { memMiB: d.memMiB, cpuCenti: d.cpuCenti };
+	} catch {
+		jobDefault = { memMiB: DEFAULT_JOB_SIZE.memMiB, cpuCenti: DEFAULT_JOB_SIZE.cpuCenti };
+	}
+	let settings;
+	try {
+		settings = hostBudgetSettings(env, jobDefault);
+	} catch (error) {
+		return { error: error.message, jobDefault };
+	}
+	const views = [];
+	let user = {};
+	if (daemon?.answered === true) views.push(daemon.facts);
+	if (podman?.answered === true) {
+		views.push(podman.info);
+		if (podman.info?.rootless === true && typeof readFile === "function") user = readUserServiceLimits({ uid: euid, readFile });
+	}
+	const least = (key) => {
+		const known = views.map((v) => v?.[key]).filter((v) => Number.isSafeInteger(v));
+		return known.length > 0 ? Math.min(...known) : null;
+	};
+	const facts = { memTotalMiB: least("memTotalMiB"), hostCpus: least("hostCpus"), ...user };
+	return { settings, jobDefault, facts, ...computeHostBudget(settings, facts, jobDefault) };
+}
+
+/**
+ * The aggregate CPU reserve's reads for doctor (issue #596, phase 2): per venue this deployment runs, its `reservePlan`
+ * from the same facts the size lines use and, where a method exists, the parent's quota read the way the worker reads it
+ * (`readQuota`: `systemctl show`, or on Docker's cgroupfs driver a read-only one-shot helper of the job image, run only
+ * when that image is present). Doctor never WRITES a quota; the worker does at boot where it may.
+ * `run(bin, args, { timeoutMs })` resolves `{ code, stdout, error }`.
+ */
+export async function doctorCpuReserve({ daemon = undefined, podman = undefined, endpointLocal = false, platform = process.platform, run, image, imagePresent = false }) {
+	const venues = [];
+	if (daemon !== undefined && daemon?.answered === true) venues.push({ venue: "local", facts: daemon.facts, endpointLocal });
+	if (podman !== undefined && podman?.answered === true) venues.push({ venue: "podman", facts: podman.info, endpointLocal: podman.info?.serviceIsRemote === false });
+	const out = [];
+	for (const v of venues) {
+		const plan = reservePlan({ ...v, platform });
+		let read = null;
+		if (plan.parent && plan.method === "helper" && !imagePresent) read = { ok: false, reason: "job-image-absent" };
+		else if (plan.parent && plan.method) read = await readQuota(plan, { run, image });
+		out.push({ plan, read, cgroupManager: v.facts?.cgroupDriver ?? v.facts?.cgroupManager ?? null });
+	}
+	return out;
+}
+
+/** What each method means for an operator, said once per held line. */
+const RESERVE_METHOD_SAID = Object.freeze({
+	"user-systemd": "set by the worker through this account's systemd user manager when it starts, and kept across reboots",
+	helper: "written by the worker when it starts through a one-shot helper container of the job image; a Docker Desktop restart drops it and the worker writes it again within ten minutes",
+	"system-systemd": "set by the operator with systemctl, and kept across reboots",
+});
+
+/** Why a venue keeps no quota, said in the warning, with the fix beside it. `N` is the budget's percentage. */
+function reserveUnmanaged(why, want) {
+	const pct = want === null ? "CPUQuota=" : `CPUQuota=${want}%`;
+	const table = {
+		"cgroup-v1": ["the host runs cgroup v1, where the worker keeps no quota (every venue measured is cgroup v2)", `move the host to cgroup v2, or set the parent's quota yourself: \`sudo systemctl set-property ${CGROUP_PARENT} ${pct}\``],
+		"remote-daemon": ["the Docker daemon uses the systemd driver and is not observed on this host, so its slice cannot be read from here", `on the daemon's host, run once as root: \`sudo systemctl set-property ${CGROUP_PARENT} ${pct}\``],
+		"rootless-docker": ["rootless Docker's slice is its own account's, which the worker does not manage", `as the daemon's account: \`systemctl --user set-property ${CGROUP_PARENT} ${pct}\``],
+		"driver-unknown": ["the runtime did not say which cgroup driver it uses", "make `docker info` report its CgroupDriver, then re-run doctor"],
+		"podman-rootful-remote": ["this Podman is rootful or remote, whose slice the worker does not manage", `on Podman's host, run once as root: \`sudo systemctl set-property ${CGROUP_PARENT} ${pct}\``],
+	};
+	return table[why] ?? ["the worker keeps no quota on this venue", `set it yourself: \`sudo systemctl set-property ${CGROUP_PARENT} ${pct}\``];
+}
+
+/**
+ * The CPU reserve lines (issue #596, phase 2): per venue, whether every job runs under the one parent cgroup and whether
+ * its quota is the host's CPU budget, so all jobs TOGETHER leave the reserve free. WARNINGS, never failures: without the
+ * quota jobs still share the parent (which already keeps a large job from starving the egress proxy and Valkey), and on
+ * a systemd host only root can set it, so the line prints the one command. `reads` is `doctorCpuReserve`'s answer and
+ * `cpuCenti` the budget doctor computed (an integer, `Infinity` for off, null for unknown).
+ */
+export function cpuReserveChecks(reads, cpuCenti) {
+	const checks = [];
+	for (const { plan, read, cgroupManager } of reads) {
+		const v = plan.venue;
+		if (!plan.parent) {
+			checks.push({ ok: false, warn: true, label: `${v}: jobs run without the ${CGROUP_PARENT} parent cgroup (Podman uses the ${cgroupManager ?? "unknown"} cgroup manager here), so each job's CPU weight is capped at 1024: the egress proxy and Valkey get a fair share of the CPU, not a reserve`, fix: "run the worker as a systemd user service with linger on, so Podman uses the systemd cgroup manager, then re-run doctor" });
+			continue;
+		}
+		if (cpuCenti === null || cpuCenti === undefined) {
+			checks.push({ ok: false, warn: true, label: `${v}: no host CPU reserve across jobs yet: the CPU budget is unknown, so no quota is kept on ${CGROUP_PARENT} until it is (jobs still share the parent)`, fix: "see the host budget line above" });
+			continue;
+		}
+		const want = cpuCenti === Infinity ? null : cpuCenti;
+		const pct = want === null ? "none" : `${formatCpus(want)} CPUs`;
+		if (!plan.method) {
+			const [why, fix] = reserveUnmanaged(plan.why, want);
+			if (want === null) checks.push({ ok: true, label: `${v}: the CPU budget is off (PI_HOST_CPU_BUDGET=off), so no quota is set on ${CGROUP_PARENT}; ${why}` });
+			else checks.push({ ok: false, warn: true, label: `${v}: no host CPU reserve across jobs: every job runs under ${CGROUP_PARENT}, but ${why}`, fix });
+			continue;
+		}
+		const fixFor = (target) =>
+			plan.method === "system-systemd"
+				? `run once, as root (persistent across reboots): \`${operatorQuotaCommand(target)}\``
+				: plan.method === "user-systemd"
+					? `the worker sets it when it starts; start or restart it, or run as the worker's account: \`${userQuotaCommand(target)}\``
+					: "the worker writes it when it starts and re-checks it every ten minutes; start or restart the worker";
+		if (!read?.ok) {
+			checks.push({ ok: false, warn: true, label: `${v}: no host CPU reserve across jobs could be confirmed: the quota of ${CGROUP_PARENT} was not readable (${read?.reason ?? "not read"})`, fix: fixFor(want) });
+			continue;
+		}
+		const has = read.cpuCenti === null ? "no CPU quota" : `a quota of ${formatCpus(read.cpuCenti)} CPUs`;
+		if (read.cpuCenti === want) {
+			if (want === null) checks.push({ ok: true, label: `${v}: the CPU budget is off (PI_HOST_CPU_BUDGET=off), so no quota is set on ${CGROUP_PARENT}: jobs share the parent and together may use every core` });
+			else checks.push({ ok: true, label: `${v}: every job runs under ${CGROUP_PARENT}, whose quota is ${pct}, the host's CPU budget, so all jobs together leave the reserve free (${RESERVE_METHOD_SAID[plan.method]})` });
+			continue;
+		}
+		if (want === null) checks.push({ ok: false, warn: true, label: `${v}: the CPU budget is off, but ${CGROUP_PARENT} still has ${has}, so jobs together are held to it`, fix: fixFor(null) });
+		else checks.push({ ok: false, warn: true, label: `${v}: no host CPU reserve across jobs: ${CGROUP_PARENT} has ${has}, not the CPU budget of ${pct}`, fix: fixFor(want) });
+	}
+	return checks;
+}
+
+/** A memory budget or size for a line: `28g`, `7936m`, `off`, or `unknown`. */
+function budgetMemShown(memMiB) {
+	return memMiB === Infinity ? "off" : Number.isSafeInteger(memMiB) ? formatMemory(memMiB) : "unknown";
+}
+/** A CPU budget or size for a line: `7`, `3.5`, `off`, or `unknown`. */
+function budgetCpuShown(cpuCenti) {
+	return cpuCenti === Infinity ? "off" : Number.isSafeInteger(cpuCenti) ? formatCpus(cpuCenti) : "unknown";
+}
+
+/**
+ * Every project row's size, as `[{ id, size, hostShare, minJobs }]` in file order: the project rows of the limits that
+ * set `memory` or `cpus`, each resolved by the worker's own function (the deployment's settings fill a field the row
+ * leaves out). A project whose row sets no size runs at the default and is not listed.
+ */
+export function projectSizes(limits, env) {
+	const rows = (Array.isArray(limits) ? limits : []).filter((l) => isProjectScope(l?.scope) && (typeof l.memory === "string" || (l.cpus !== null && l.cpus !== undefined)));
+	const sizes = [];
+	for (const row of rows) {
+		const id = row.scope.slice("project:".length);
+		try {
+			const size = resolveJobSize({ project: id, limits, env });
+			sizes.push({ id, size, ...projectBudgetRow(limits, id) });
+		} catch {
+			// A size the worker refuses is reported by the scoped-limits lines; it fits nowhere and is left out here.
+		}
+	}
+	return sizes;
+}
+
+/**
+ * The host budget lines (issue #596, phase 2): the budget and where each half comes from, which of it and
+ * `PI_CONCURRENCY` binds first, and WARNINGS for what the budget will refuse or cannot keep: a project size larger than
+ * the budget (`job-size-exceeds-host` on this host's own queue) or than its `hostShare` of it (`job-size-exceeds-share`), a project whose
+ * `minJobs` times its size is more than its `hostShare` of the budget, and all projects' minimums together above the
+ * budget. Warnings, never failures: the budget is per host, and on a fleet a forge job waits for a host it fits on. A
+ * setting that does not parse is a FAILURE, because the worker refuses to start on it.
+ */
+export function hostBudgetChecks(view, { concurrency = 3, limits = [], env = {}, peers = false } = {}) {
+	if (view.error) return [{ ok: false, label: `host budget does not parse: ${view.error}, so the worker REFUSES TO START`, fix: "set PI_HOST_MEMORY_BUDGET and PI_HOST_CPU_BUDGET to auto, off or a value such as 64g or 12, and PI_HOST_RESERVE_MEMORY and PI_HOST_RESERVE_CPUS to auto or a value (or unset all four for auto), then re-run doctor" }];
+	const { memMiB, cpuCenti, detail, settings } = view;
+	// a worker without PI_WORKER_NAME drains no host queue and declares no fleet, so it refuses every never-fits job.
+	const multiHost = Boolean(env?.PI_WORKER_NAME);
+	// Why such a worker refuses: alone, there is no other host; beside peers in the registry, it simply declares no fleet.
+	const noFleet = (code) => `every job of it is refused before anything is spent (${code}): ${peers ? "this worker declares no fleet (no PI_WORKER_NAME), so it refuses jobs a bigger peer could run" : "with no PI_WORKER_NAME this host declares no fleet, so there is no other host to wait for"}`;
+	const nameFix = peers ? ", or set PI_WORKER_NAME on this worker so a job of it on the shared queue waits for a peer it fits on" : "";
+	const memWhy = settings.memory.mode === "off" ? "off: PI_HOST_MEMORY_BUDGET" : settings.memory.mode === "value" ? "PI_HOST_MEMORY_BUDGET" : detail.memTotalMiB === null ? "auto" : `auto: ${formatMemory(detail.memTotalMiB)} here, ${formatMemory(detail.memReserveMiB)} kept for the host${detail.memFloored ? ", raised to one job of the default size" : ""}`;
+	const cpuWhy = settings.cpus.mode === "off" ? "off: PI_HOST_CPU_BUDGET" : settings.cpus.mode === "value" ? "PI_HOST_CPU_BUDGET" : detail.cpuTotalCenti === null ? "auto" : `auto: ${formatCpus(detail.cpuTotalCenti)} here, ${formatCpus(detail.cpuReserveCenti)} kept for the host${detail.cpuFloored ? ", raised to one job of the default size" : ""}`;
+	const checks = [{ ok: true, label: `Host budget: memory ${budgetMemShown(memMiB)} (${memWhy}), CPUs ${budgetCpuShown(cpuCenti)} (${cpuWhy}); a job starts only when its size fits beside what already runs on this host` }];
+	// the CPU half is a reservation in the budget's arithmetic and a weight at the runtime, and an operator
+	// sizing a project by "it only needs the cores when it is busy" must know the budget does not see it that way.
+	if (cpuCenti !== Infinity) checks.push({ ok: true, label: "The budget counts each job's cpus as CPU reserved for it, although the runtime uses them as a weight (a busy job may use idle cores beyond them): so a job's cpus must fit the CPU budget beside what runs, even on an idle host" });
+	const unknown = [memMiB === null ? "memory" : null, cpuCenti === null ? "CPU count" : null].filter(Boolean);
+	if (unknown.length > 0) {
+		checks.push({ ok: false, warn: true, label: `host budget: the runtime gave no ${unknown.join(" or ")}, so a worker holds no job back on ${unknown.length === 2 ? "either" : "it"} until it does (host_budget_unknown)`, fix: "make the runtime's info answer for the worker's account (`docker info`, `podman info`), or set PI_HOST_MEMORY_BUDGET and PI_HOST_CPU_BUDGET to values, then re-run doctor" });
+	}
+	// How many jobs of the DEFAULT size the budget holds at once, against PI_CONCURRENCY: whichever is smaller binds.
+	const per = (budget, size) => (budget === null || budget === Infinity ? Infinity : Math.floor(budget / size));
+	const fitDefault = Math.min(per(memMiB, view.jobDefault.memMiB), per(cpuCenti, view.jobDefault.cpuCenti));
+	if (fitDefault === Infinity) checks.push({ ok: true, label: `PI_CONCURRENCY (${concurrency}) is the only bound on how many jobs run at once here: the budget is ${unknown.length > 0 ? "not known yet" : "off"}` });
+	else if (concurrency <= fitDefault) checks.push({ ok: true, label: `PI_CONCURRENCY (${concurrency}) binds first: the budget holds ${fitDefault} job${fitDefault === 1 ? "" : "s"} of the default size (${formatMemory(view.jobDefault.memMiB)}, ${formatCpus(view.jobDefault.cpuCenti)} CPUs) at once` });
+	else checks.push({ ok: true, label: `The host budget binds first: it holds ${fitDefault} job${fitDefault === 1 ? "" : "s"} of the default size (${formatMemory(view.jobDefault.memMiB)}, ${formatCpus(view.jobDefault.cpuCenti)} CPUs) at once, fewer than PI_CONCURRENCY (${concurrency}); bigger sizes fit fewer` });
+	const budget = { memMiB, cpuCenti };
+	const sizes = projectSizes(limits, env);
+	let minMem = 0;
+	let minCpu = 0;
+	for (const p of sizes) {
+		const shown = `${formatMemory(p.size.memMiB)}, ${formatCpus(p.size.cpuCenti)} CPUs`;
+		const misfit = neverFits(p.size, budget, p.hostShare);
+		if (misfit === "host") {
+			checks.push({ ok: false, warn: true, label: `project ${p.id}: its job size (${shown}) is larger than this host's budget (${budgetMemShown(memMiB)}, ${budgetCpuShown(cpuCenti)} CPUs), so ${multiHost ? "a job of it on this host's own queue is refused before anything is spent (job-size-exceeds-host), and one on the shared queue waits for a host it fits on" : noFleet("job-size-exceeds-host")}`, fix: `lower project:${p.id}'s memory or cpus in scoped-limits.json, or raise this host's budget${nameFix}` });
+		} else if (misfit === "share") {
+			checks.push({ ok: false, warn: true, label: `project ${p.id}: its job size (${shown}) is larger than its hostShare (${p.hostShare}%) of this host's budget, so ${multiHost ? "a job of it on this host's own queue is refused before anything is spent (job-size-exceeds-share), and one on the shared queue waits for a host it fits on" : noFleet("job-size-exceeds-share")}`, fix: `raise project:${p.id}'s hostShare or lower its size in scoped-limits.json${nameFix}` });
+		}
+		if (p.minJobs > 0) {
+			minMem += p.minJobs * p.size.memMiB;
+			minCpu += p.minJobs * p.size.cpuCenti;
+			const share = p.hostShare ?? 100;
+			const room = largestFit(budget, share);
+			const over = (need, cap) => Number.isSafeInteger(cap) && need > cap;
+			if (misfit === null && (over(p.minJobs * p.size.memMiB, room.memMiB) || over(p.minJobs * p.size.cpuCenti, room.cpuCenti))) {
+				checks.push({ ok: false, warn: true, label: `project ${p.id}: minJobs ${p.minJobs} of its size (${shown}) is more than its hostShare (${share}%) of this host's budget, so this host can never keep room for all of them at once`, fix: `lower project:${p.id}'s minJobs or size, or raise its hostShare or this host's budget` });
+			}
+		}
+	}
+	const overAll = (need, cap) => Number.isSafeInteger(cap) && need > cap;
+	if (overAll(minMem, memMiB) || overAll(minCpu, cpuCenti)) {
+		checks.push({ ok: false, warn: true, label: `the projects' minJobs together (${formatMemory(minMem)}, ${formatCpus(minCpu)} CPUs) are more than this host's budget (${budgetMemShown(memMiB)}, ${budgetCpuShown(cpuCenti)} CPUs), so this host cannot keep every minimum at once: the oldest waiting jobs are served first`, fix: "lower some projects' minJobs in scoped-limits.json, or raise this host's budget" });
+	}
+	return checks;
+}
+
+/**
+ * The fleet's budgets (issue #596, phase 2), from the registry rows (this host's own included): one line per host that
+ * publishes a budget (its budget, what its jobs hold, what its holds keep, and the largest project size that fits it),
+ * one line per sized project naming the hosts it fits on (a WARNING when none does: its jobs on the shared queue wait,
+ * never refused, until a host it fits on is live; a host restarting is missing from the registry for that while), and a
+ * WARNING per host whose budget is below the projects' minJobs
+ * together. Nothing when no host publishes a budget (workers from before it).
+ */
+export function fleetBudgetChecks(rows, { limits = [], env = {} } = {}) {
+	const hosts = (Array.isArray(rows) ? rows : []).map((row) => ({ name: row.name, budget: publishedBudget(row), row })).filter((h) => h.budget.memMiB !== null && h.budget.cpuCenti !== null);
+	if (hosts.length === 0) return [];
+	const sizes = projectSizes(limits, env);
+	const checks = [];
+	const int = (v) => (typeof v === "string" && /^[0-9]{1,15}$/.test(v) ? Number(v) : null);
+	for (const h of hosts) {
+		const fitting = sizes.filter((p) => neverFits(p.size, h.budget, p.hostShare) === null).sort((a, b) => b.size.memMiB - a.size.memMiB || b.size.cpuCenti - a.size.cpuCenti);
+		const largest = fitting.length > 0 ? `largest project size that fits: ${formatMemory(fitting[0].size.memMiB)}, ${formatCpus(fitting[0].size.cpuCenti)} CPUs (${fitting[0].id})` : sizes.length > 0 ? "no project's size fits" : "no project sets a size";
+		const usedMem = int(h.row.usedMemMiB);
+		const usedCpu = int(h.row.usedCpuCenti);
+		const used = usedMem !== null && usedCpu !== null ? `, in use ${usedMem === 0 ? "0" : formatMemory(usedMem)} and ${formatCpus(usedCpu)} CPUs` : "";
+		checks.push({ ok: true, label: `Host ${h.name}: budget ${budgetMemShown(h.budget.memMiB)} and ${budgetCpuShown(h.budget.cpuCenti)} CPUs${used}; ${largest}` });
+		let minMem = 0;
+		let minCpu = 0;
+		for (const p of sizes) {
+			minMem += p.minJobs * p.size.memMiB;
+			minCpu += p.minJobs * p.size.cpuCenti;
+		}
+		const over = (need, cap) => Number.isSafeInteger(cap) && need > cap;
+		if (over(minMem, h.budget.memMiB) || over(minCpu, h.budget.cpuCenti)) {
+			checks.push({ ok: false, warn: true, label: `Host ${h.name}: the projects' minJobs together (${formatMemory(minMem)}, ${formatCpus(minCpu)} CPUs) are more than its budget, so it cannot keep every minimum at once`, fix: "lower some projects' minJobs, or raise that host's budget" });
+		}
+	}
+	for (const p of sizes) {
+		const on = hosts.filter((h) => neverFits(p.size, h.budget, p.hostShare) === null).map((h) => h.name);
+		if (on.length > 0) checks.push({ ok: true, label: `Project ${p.id} (${formatMemory(p.size.memMiB)}, ${formatCpus(p.size.cpuCenti)} CPUs) fits on: ${on.join(", ")}` });
+		else checks.push({ ok: false, warn: true, label: `Project ${p.id} (${formatMemory(p.size.memMiB)}, ${formatCpus(p.size.cpuCenti)} CPUs) fits on no live host's budget, so its jobs on the shared queue wait (they are never refused for it) until a host it fits on is live`, fix: `if a host it fits on is restarting, wait for it; else lower project:${p.id}'s size, or raise a host's budget` });
+	}
+	return checks;
+}
+
+/**
+ * One line per project in projects.json with its job size and what its recent runs suggest (issue #596, phase 3,
+ * DES-SIZE-SUGGESTIONS), from the one pure `suggestSize` the panel and the insights page also call: "fits", "not enough
+ * runs", or a suggestion naming the exact `dispatch_limit_edit` call (`dispatch_limit_add` for a project with no row)
+ * that applies it. A RAISE is a warning with the call as its fix; a lowering is a fact line carrying the call.
+ *
+ * Every raise is CAPPED at what this host offers the project (`hostCap`: its budget per dimension, the project's
+ * `hostShare` of it where the row has one, or with the budget off or unknown the runtime's memory and CPU count, `total`): where the cap binds the line says the project's runs need more than
+ * this host offers, and where the size already is the cap it says so and offers no call. Nothing here advises growing
+ * the host's budget: that budget is what the host promised every other project. The call is offered exactly when this
+ * host's admission would accept the suggested pair (`sizeRefusal`, the one rule the panel and the insights page also
+ * use): a pair it would refuse for ever is flagged, naming the dimension that does not fit, and carries NO call
+ * (applying it would trade one refusal for the same refusal); with the budget off or unknown nothing is refused, so a
+ * size above the runtime's own memory or CPU count is only noted beside its call. Facts (memory pressure at the limit, the
+ * host's CPU ceiling) ride along as information, with no call. Nothing here applies a size: the numbers come from
+ * inside the jobs' containers, and an operator confirms the call.
+ */
+export function sizeSuggestionChecks({ projects = [], limits = [], env = {}, records = [], budget = null, total = null, nowMs }) {
+	const checks = [];
+	for (const project of Array.isArray(projects) ? projects : []) {
+		const id = project?.id;
+		// the project's hostShare of an integer budget: a job above it is refused here (`job-size-exceeds-share`), so a
+		// raise is capped at the share, never at the whole budget, or the line would offer a call to a size that never runs.
+		const share = projectBudgetRow(limits, id).hostShare;
+		const cap = hostCap(budget, total, share);
+		let current;
+		try {
+			current = resolveJobSize({ project: id, limits, env });
+		} catch {
+			continue; // a refused PI_JOB_MEMORY or PI_JOB_CPUS fails the size lines above; the worker does not start
+		}
+		const s = suggestSize({ project: id, records, current, cap, now: nowMs });
+		const words = suggestionEvidence(s);
+		const size = `${formatMemory(current.memMiB)}, ${cpusText(current.cpuCenti)}`;
+		const call = suggestionCall(s, limits);
+		const facts = [words.memoryFact, words.cpuFact].filter(Boolean);
+		const factTail = facts.length > 0 ? `; ${facts.join("; ")}` : "";
+		const held = s.memory.suggested === null && s.memory.held !== null;
+		if (call === null && !held) {
+			const both = s.memory.reason === "not-enough-runs" && s.cpu.reason === "not-enough-runs";
+			const why = both ? `not enough runs to suggest a size yet (${words.memory} in the last ${SUGGEST_WINDOW_DAYS} days)` : `fits its runs (memory: ${s.memory.reason === "fits" ? words.memory : `${s.memory.reason}, ${words.memory}`}; CPUs: ${s.cpu.reason === "fits" ? words.cpu : `${s.cpu.reason}, ${words.cpu}`})`;
+			checks.push({ ok: true, label: `project ${id}: size ${size}${both ? ": " : " "}${why}${factTail}` });
+			continue;
+		}
+		const parts = [];
+		if (s.memory.suggested) parts.push(`memory ${formatMemory(s.memory.suggested)} (${s.memory.reason}: ${words.memory}${s.memory.held === "cap" ? `; ${words.memoryHeld}` : ""})`);
+		if (s.cpu.suggested) parts.push(`${cpusText(s.cpu.suggested)} (${s.cpu.reason}: ${words.cpu})`);
+		const heldText = held ? `${words.memory}; ${words.memoryHeld}` : "";
+		// THE ONE RULE (`sizeRefusal`, shared with the panel and the insights page): the call is withheld exactly when this
+		// host's admission would refuse the suggested pair for ever (job-size-exceeds-host or -share), whichever dimension
+		// does it. With the budget off or unknown admission refuses nothing, so the call is offered, and a size above the
+		// runtime's own memory or CPU count is only flagged.
+		const pair = { memMiB: s.memory.suggested ?? current.memMiB, cpuCenti: s.cpu.suggested ?? current.cpuCenti };
+		const refusal = call === null ? null : sizeRefusal(pair, [budget], share);
+		const totals = refusal !== null ? [] : [s.memory.overBudget ? `memory ${formatMemory(s.memory.suggested)} is above ${formatMemory(cap.memMiB)}, this host's own memory` : null, s.cpu.overBudget ? `${cpusText(s.cpu.suggested)} ${s.cpu.suggested === 100 ? "is" : "are"} above ${cpusText(cap.cpuCenti)}, this host's own CPU count` : null].filter(Boolean);
+		const over = refusal !== null ? [refusalWords(refusal, s, share, budget)] : [];
+		const note = totals.length > 0 ? ` (note: ${totals.join(" and ")}; its budget is off or unknown, so the worker admits it)` : "";
+		const raise = (s.memory.suggested ?? 0) > current.memMiB || (s.cpu.suggested ?? 0) > current.cpuCenti;
+		const suggests = parts.length > 0 ? `its runs in the last ${SUGGEST_WINDOW_DAYS} days suggest ${parts.join(" and ")}` : "";
+		const label = `project ${id}: size ${size}; ${[heldText ? `in the last ${SUGGEST_WINDOW_DAYS} days ${heldText}` : "", suggests].filter(Boolean).join("; ")}${over.length > 0 ? `, but ${over.join(" and ")}, so a job of it would never fit this host` : ""}${note}${factTail}`;
+		// a size that would never fit is never offered as a call: applying it would turn a refusal into the same refusal.
+		const apply = call === null ? "" : over.length > 0 ? "" : `apply it in the admin panel with ${call} (an operator confirms it; nothing applies a size by itself)`;
+		const never = over.length > 0 ? "no call is offered: a job of that size would never fit this host" : "";
+		if (held) {
+			const above = Number.isSafeInteger(s.memory.cap) && current.memMiB > s.memory.cap;
+			const none = s.memory.held === "largest" ? (above ? "no larger memory is offered: the size is already above what this host offers" : "no larger memory is offered: no larger size fits this host") : "no memory call is offered while the largest size this host offers is unknown (its budget is off or unknown and its runtime's memory was not read)";
+			checks.push({ ok: false, warn: true, label, fix: apply ? `${none}; for the rest, ${apply}` : never ? `${none}; ${never}` : none });
+		} else if (raise || over.length > 0 || totals.length > 0) {
+			checks.push({ ok: false, warn: true, label, fix: apply || never });
+		} else {
+			checks.push({ ok: true, label: `${label}; ${apply.replace(/ \(an operator confirms it; nothing applies a size by itself\)$/, "")}` });
+		}
+	}
+	return checks;
+}
+
+/** The `ps` that lists this runtime's job containers with their two size labels (issue #596, phase 2). */
+export const SIZE_LABEL_PS_ARGS = Object.freeze(["ps", "--filter", `name=${JOB_NAME_PREFIX}`, "--format", `{{.Names}}\t{{.Label "${SIZE_LABEL_MEM}"}}\t{{.Label "${SIZE_LABEL_CPU}"}}`]);
+
+/**
+ * The running job containers' size labels, from `SIZE_LABEL_PS_ARGS`' output: `[{ name, memMiB, cpuCenti }]`, a label
+ * that is absent or not an integer read as null. Only names in the job namespace (the filter is a substring match).
+ */
+export function parseSizeLabels(stdout) {
+	const int = (v) => (/^[1-9][0-9]{0,8}$/.test(v ?? "") ? Number(v) : null);
+	return String(stdout ?? "")
+		.split("\n")
+		.map((line) => line.split("\t"))
+		.filter(([name]) => typeof name === "string" && name.startsWith(JOB_NAME_PREFIX))
+		.map(([name, mem, cpu]) => ({ name, memMiB: int(mem?.trim()), cpuCenti: int(cpu?.trim()) }));
+}
+
+/**
+ * The ledger held against what runs (issue #596, phase 2): this host's registry row says what its worker's budget
+ * counts (`usedMemMiB`, `usedCpuCenti`, orphans included); the job containers' labels say what runs. A WARNING when they
+ * differ (a job starting or ending between the two reads differs for a moment, so the fix says to re-run first), and
+ * when a job container carries no size label (one started by a worker from before the labels). Nothing without a row
+ * that publishes the two fields.
+ */
+export function budgetLedgerChecks(selfRow, containers) {
+	const int = (v) => (typeof v === "string" && /^[0-9]{1,15}$/.test(v) ? Number(v) : null);
+	const usedMem = int(selfRow?.usedMemMiB);
+	const usedCpu = int(selfRow?.usedCpuCenti);
+	if (usedMem === null || usedCpu === null || !Array.isArray(containers)) return [];
+	const labelled = containers.filter((c) => c.memMiB !== null && c.cpuCenti !== null);
+	const unlabelled = containers.length - labelled.length;
+	const mem = labelled.reduce((sum, c) => sum + c.memMiB, 0);
+	const cpu = labelled.reduce((sum, c) => sum + c.cpuCenti, 0);
+	const checks = [];
+	if (mem === usedMem && cpu === usedCpu) {
+		checks.push({ ok: true, label: `Host budget ledger matches the running job containers (${containers.length} running, ${mem === 0 ? "0" : formatMemory(mem)} and ${formatCpus(cpu)} CPUs)` });
+	} else {
+		checks.push({ ok: false, warn: true, label: `Host budget ledger holds ${usedMem === 0 ? "0" : formatMemory(usedMem)} and ${formatCpus(usedCpu)} CPUs, while the running job containers are labelled ${mem === 0 ? "0" : formatMemory(mem)} and ${formatCpus(cpu)} CPUs`, fix: "re-run doctor: a job starting or ending between the two reads differs for a moment. A difference that stays is a container the worker does not count, or one whose stop failed (it keeps its hold until the runtime says it is gone)" });
+	}
+	// NAMED, so an operator can find each one (`pi-job-<id>`, a job id and never payload text). A worker that
+	// started beside one counts it at the largest size a project row or the default could have started it at, capped
+	// at the budget, so the ledger line above differs while it runs.
+	if (unlabelled > 0) {
+		const names = containers.filter((c) => c.memMiB === null || c.cpuCenti === null).map((c) => c.name);
+		const shown = names.length > 5 ? `${names.slice(0, 5).join(", ")} and ${names.length - 5} more` : names.join(", ");
+		checks.push({ ok: false, warn: true, label: `${unlabelled} running job container${unlabelled === 1 ? " carries" : "s carry"} no size label (${shown}), so the ledger cannot be checked against ${unlabelled === 1 ? "it" : "them"} (started by a worker from before the host budget); a worker that found ${unlabelled === 1 ? "it" : "them"} at its start counts each at the largest size a project may run at, capped at the budget, until ${unlabelled === 1 ? "it is" : "they are"} gone`, fix: "nothing to do: the label is on every container a current worker starts; stop one early with `docker stop <name>` (or `podman stop`) to give its room back sooner" });
+	}
+	return checks;
+}
+
 /**
  * WHERE this deployment's jobs run, and what that place actually guarantees (issue #227).
  *
@@ -8333,6 +8895,12 @@ export async function liveChecks(env, seams, facts) {
 	const relabel = relabelsPrivateMounts(facts.daemon?.answered ? facts.daemon.facts : null, facts.endpoint, ids.platform ?? seams.platform);
 	const result = await runLiveProbes({
 		image: facts.jobImage ?? jobImageOf(env).image,
+		// Issue #596: the deployment's default size, and the `--cpus` ceiling from the same `docker info` answer, so the
+		// probe is built at the size a job gets and reads back memory, swap, weight and ceiling against it.
+		size: doctorJobSize(env),
+		hostCpus: facts.daemon?.answered ? (facts.daemon.facts?.hostCpus ?? null) : null,
+		// Issue #596, phase 2: the parent's quota is read back against the CPU budget doctor computed above.
+		cpuBudgetCenti: facts.cpuBudgetCenti ?? null,
 		endpoint: facts.endpoint,
 		// Asked again right before the first probe command, through the same resolver as the collection's read.
 		resolveEndpoint: makeDockerEndpointResolver({ run: dockerRunVia(spawn) }),
@@ -8411,6 +8979,14 @@ function readBackChecks({ venue, bin, result, user, ids, relabel, facts, userFix
 			return { ok: false, label: `${prefix}: ${v.property} does NOT hold -- declared ${declared}, observed: ${v.detail}`, fix };
 		}),
 	);
+	// Issue #596, phase 2: where the runtime put the probe (the jobs' parent cgroup) and, where readable, the parent's
+	// quota against the CPU budget. A line of its own: the reserve is not one of the declared properties.
+	const parent = result.cgroupParent;
+	if (parent) {
+		if (!parent.ok && !parent.warn) checks.push({ ok: false, label: `${prefix}: cgroup parent does NOT hold -- ${parent.detail}`, fix: `the worker builds every job under the ${CGROUP_PARENT} parent (--cgroup-parent); a runtime that records another parent or places the container elsewhere keeps no CPU reserve across jobs: check the runtime's cgroup driver (\`${bin} info\`) and re-run \`pi-dispatch doctor --live\`` });
+		else if (parent.warn) checks.push({ ok: false, warn: true, label: `${prefix}: cgroup parent: ${parent.detail}`, fix: "see the CPU reserve lines above for what keeps the host's reserve on this venue" });
+		else checks.push({ ok: true, label: `${prefix}: cgroup parent holds (${parent.detail})` });
+	}
 	checks.push(...noteChecks());
 	// What a green read-back does NOT mean, on a line of its own so a row of ✓ is never read as more than it is.
 	// Each sentence says only what DID happen: a probe that was not read back has its own line above saying why, and
@@ -8470,10 +9046,17 @@ export async function podmanLiveChecks(env, seams, facts) {
 	const readInfo = makePodmanInfoReader({ run: dockerRunVia(spawn, PODMAN_INFO_TIMEOUT_MS, { bin: "podman" }) });
 	const run = liveRunVia(spawn, { bin: "podman" });
 	const image = facts.jobImage ?? jobImageOf(env).image;
-	const canary = await podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive, announce: (line) => out(`\nread back on podman: ${line}\n`) });
+	const canary = await podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive, size: doctorJobSize(env), announce: (line) => out(`\nread back on podman: ${line}\n`) });
 	const egress = { armed: podman.egress.armed, results: canary.results, proxy: podman.egress.proxy, proxyRunning: podman.egress.proxyRunning, keeperBlocked: podman.egress.keeperBlocked ?? null };
 	const result = await runLiveProbes({
 		image,
+		// Issue #596: as the docker read-back, from this account's own `podman info`.
+		size: doctorJobSize(env),
+		hostCpus: podman.info?.hostCpus ?? null,
+		// Issue #596, phase 2: the parent as this venue's jobs get it (none where Podman's cgroup manager is not systemd),
+		// and its quota against the CPU budget doctor computed above.
+		cgroupParent: cgroupParentFor({ podman: true, cgroupManager: podman.info?.cgroupManager ?? null }),
+		cpuBudgetCenti: facts.cpuBudgetCenti ?? null,
 		endpoint: podman.info,
 		resolveEndpoint: async () => {
 			const again = await readInfo();
@@ -8533,7 +9116,7 @@ export async function podmanLiveChecks(env, seams, facts) {
  * judges a pid against THIS process table and the canary's containers must start where the section looked, and both of
  * those are false the moment CONTAINER_HOST points elsewhere. The re-ask costs one spawn and only with egress armed.
  */
-async function podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive, announce = () => {} }) {
+async function podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive, size = DEFAULT_JOB_SIZE, announce = () => {} }) {
 	const none = { checks: [], results: [] };
 	if (podman.egress?.armed === false) return none;
 	// Issue #458: on Podman 4.x without the keeper, the canary's own teardown (and the stale sweep's detach) is the step
@@ -8559,7 +9142,7 @@ async function podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive,
 	const endpoints = podman.egress.endpoints ?? [];
 	const more = endpoints.length > 0 ? `; then three per declared model endpoint (${endpointsById(endpoints).map((e) => e.id).join(", ")}), named ${EGRESS_ENDPOINT_PROBE_PREFIX}<probe>-<id>-${pid}, removed the same way` : "";
 	announce(`starting ${probes.slice(0, -1).join(", ")} and ${probes.at(-1)} from ${image} (as the job user ${podman.user}) on the --internal network ${egressCanaryNetwork(pid)}, with ${podman.egress.proxy} attached, to read the egress allowlist back; all three are removed when the canary ends${more}`);
-	const canary = await runEgressCanary({ run, bin: "podman", proxy: podman.egress.proxy, image, pid, user: podman.user, gate, endpoints });
+	const canary = await runEgressCanary({ run, bin: "podman", proxy: podman.egress.proxy, image, pid, user: podman.user, gate, endpoints, size, hostCpus: again.info?.hostCpus ?? null });
 	return { checks: [...checks, ...canary.checks], results: canary.results };
 }