fix(controller,xceadmin): fix zero-slot scheduling block, misleading resval logs, byte-unit display

Three bugs found while diagnosing a live controller log, all in the
worker resource-value path:

1. Every host relying on the documented hosts.yaml auto-detect default
   (no max_slot, meaning "use CPU count") got 0 scheduling slots,
   permanently blocking the scheduler from placing jobs on it. mxj is
   UInt32 on the wire and can't carry the schema's -1 sentinel; mapping.py
   worked around this by leaving it unset, which defaults to 0 -- and 0 is
   never < 0, so apply_join_state()'s auto-detect fallback never fired.
   Fixed by encoding the sentinel as 0xFFFFFFFF, which the controller's
   `int mxj` field reinterprets back to -1 via its existing implicit
   uint32_t->int conversion. No C-side or wire schema change needed for
   this part; the fallback itself was already correct but had zero test
   coverage for a negative mxj, now added.

2. update_resvals()/update_resval_list() logged the failure reason via
   PERROR, which reads process-global errno -- but update_resval()'s
   failure paths return raw negative codes directly and never touch
   errno, so the controller log filled with misleading "update_resval:
   Success" / "update_resval: Resource temporarily unavailable" lines
   instead of the real reason. Fixed to decode the actual rc via
   xce_strerror_r and name the failing resource.

3. maxmem is canonically stored/wired as raw bytes but had no unit
   metadata, so resval/workerlist printed it as a bare number that read
   as garbage (e.g. workerlist's fixed-width columns visually smeared a
   multi-GB byte count across the MaxCPU/MaxMem headers). Added an
   optional `unit` field to the Resource/ResourceVal capnp structs (and
   xce_resource_t/xce_resval_t/resources.yaml) so resval and workerlist
   can render a human-readable value (e.g. "30.90 GB") while the stored
   value stays raw bytes -- display-only, every other resource unaffected.

Regenerated the xceadmin golden fixture (fixtures/full/expected.bin)
twice: once for the mxj sentinel encoding change, once for the new
Resource.unit field growing every resource's wire size by one pointer
slot. Both diffs verified byte-for-byte isolated to exactly the expected
change before regenerating.

Verified: 1095/1095 controller_unit_test (stable across repeated runs),
229/229 xceadmin pytest, clean rebuild of lib/controller/xceadmin/xce_test.
Two related findings logged to .wolf/buglog.json but deliberately not
fixed here (out of scope per discussion): a pre-existing flaky segfault
in the combined controller_unit_test binary, and maxswap/maxtmp being
hardcoded stub values on the worker side.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/xceadmin/src/xcecommon/mapping.py

@@ -71,9 +71,13 @@ reason -- never a silent drop.
     runtime (e.g. ``scheduler.c`` copies these three fields straight out
     of the parsed resource). See :data:`_RESOURCE_VALTYPE`,
     :data:`_RESOURCE_ORDTYPE`, and the flag constants below for the exact
-    values. ``idx`` and ``lastReport`` remain unset: ``idx`` has no YAML
-    source at all (controller/runtime-assigned), and ``lastReport`` is a
-    runtime timestamp field (epoch seconds of last report) -- excluded by
+    values. ``unit`` is mapped straight through from YAML when present --
+    a display-only hint (e.g. ``"bytes"``) the controller CLI (``resval``/
+    ``workerlist``) uses to render a human-readable value; the stored
+    value itself is never converted, only its display. ``idx`` and
+    ``lastReport`` remain unset: ``idx`` has no YAML source at all
+    (controller/runtime-assigned), and ``lastReport`` is a runtime
+    timestamp field (epoch seconds of last report) -- excluded by
     Requirement 9.2's "no timestamp" rule. ``resourcemap`` has no
     destination: the capnp fields it would map to (``distributions``,
     ``hostBased``) are commented out of the ``Resource`` struct
@@ -95,13 +99,19 @@ reason -- never a silent drop.
     no corresponding ``QueueConf`` field at all.
 
 ``HostConfig`` (``hosts.yaml`` hosts)
-    ``description`` has no corresponding field. ``mxj`` is set only when
-    YAML ``max_slot >= 0``; the schema's documented ``-1`` ("auto-detect")
-    sentinel is left unmapped because ``mxj`` is ``UInt32`` and cannot
-    represent a negative value (verified: assigning ``-1`` raises
-    ``capnp.KjException`` rather than wrapping) -- shipping ``mxj`` unset
-    (default ``0``) preserves "not sourced" instead of crashing the build
-    or silently wrapping to ``4294967295``.
+    ``description`` has no corresponding field. ``mxj`` is ``UInt32`` on the
+    wire and cannot represent the schema's documented ``-1`` ("auto-detect
+    from CPU count") sentinel directly (verified: assigning ``-1`` raises
+    ``capnp.KjException`` rather than wrapping). When YAML ``max_slot`` is
+    absent or negative, ``mxj`` is instead set to ``HOSTCONFIG_MXJ_AUTO_DETECT``
+    (``0xFFFFFFFF``) -- the controller's ``int mxj`` field receives this via
+    ``capn_read32()``'s implicit ``uint32_t`` -> ``int`` conversion, which
+    reinterprets it back to ``-1`` on this project's (two's-complement)
+    target platforms, so ``apply_join_state()``'s ``if (nslots < 0)``
+    auto-detect fallback fires as intended. Previously this left ``mxj``
+    unset (default ``0``), which is indistinguishable from "explicitly
+    configure 0 slots" -- silently disabling scheduling on every host that
+    relies on auto-detect (bug, fixed).
 
 ``GroupConfig`` used as an embedded ``Membership`` (``QueueConf.users``/
 ``.hosts``, ``LimitConfig.users``/``.queues``/``.projects``/``.hosts``)
@@ -318,6 +328,8 @@ def _build_resource(item: dict, target: "capnp._DynamicStructBuilder") -> None:
     if item.get("release"):
         flags |= _RESOURCE_FLAG_RELEASE
     target.flags = flags
+    if "unit" in item:
+        target.unit = item["unit"]
 
 
 def _build_queue(item: dict, target: "capnp._DynamicStructBuilder") -> None:
@@ -341,6 +353,20 @@ def _build_queue(item: dict, target: "capnp._DynamicStructBuilder") -> None:
     _build_time_window(item.get("run_window"), target.runWindow)
 
 
+HOSTCONFIG_MXJ_AUTO_DETECT = 0xFFFFFFFF
+"""Wire bit-pattern for the ``max_slot: -1`` ("auto-detect from CPU count")
+sentinel. ``mxj`` is ``UInt32`` on the wire, so the negative sentinel itself
+cannot be assigned directly (pycapnp raises ``capnp.KjException`` for a
+negative value) -- but ``0xFFFFFFFF`` is a valid in-range ``UInt32`` value
+that the controller's ``int mxj`` field (``xce/types.h``) receives via
+``capn_read32()``'s implicit ``uint32_t`` -> ``int`` conversion, which on
+this project's target platforms (two's-complement) reinterprets it back to
+``-1`` -- reconstructing the sentinel losslessly end-to-end. See module
+docstring, ``HostConfig``, for why this is unset-vs-sentinel and not a
+schema change.
+"""
+
+
 def _build_host_config(item: dict, target: "capnp._DynamicStructBuilder") -> None:
     """Populate one ``HostConfig`` list item from a ``hosts.yaml`` ``hosts``
     entry. See module docstring, ``HostConfig``, for what is intentionally
@@ -354,6 +380,8 @@ def _build_host_config(item: dict, target: "capnp._DynamicStructBuilder") -> Non
     max_slot = item.get("max_slot")
     if max_slot is not None and max_slot >= 0:
         target.mxj = max_slot
+    else:
+        target.mxj = HOSTCONFIG_MXJ_AUTO_DETECT
     _build_config_var_list(item.get("resource"), target)
     _build_threshold_list(item.get("sched_stop"), target, "thresholds")
     _build_time_window(item.get("dispatch_window"), target.dispatchwindows)

src/xceadmin/tests/test_mapping.py

@@ -173,6 +173,20 @@ def test_map_list_section_noop_on_empty_or_missing_items(cluster_config):
     assert len(cluster_config.resources) == 0
 
 
+def test_map_list_section_resources_maps_unit_when_present(cluster_config):
+    items = [
+        {"name": "maxmem", "type": "numeric", "unit": "bytes"},
+        {"name": "maxcpus", "type": "numeric"},
+    ]
+    mapping.map_list_section(_spec_for("resources"), items, cluster_config)
+
+    r0, r1 = cluster_config.resources
+    assert r0.unit == "bytes"
+    # Every existing resource has no "unit" key -- must stay unset (empty
+    # Text default), not silently inherit or default to any value.
+    assert r1.unit == ""
+
+
 # ---------------------------------------------------------------------------
 # map_list_section: users.yaml/hosts.yaml -> ugroups/hgroups (named groups)
 # ---------------------------------------------------------------------------
@@ -247,9 +261,11 @@ def test_map_list_section_host_config_full_field_mapping(cluster_config):
     assert h.name == "default"
     assert h.type == "x86_64-linux-gnu"
     assert h.model == "x86_64-linux-gnu"
-    # max_slot == -1 (auto-detect sentinel) cannot be represented by
-    # UInt32 mxj -- deliberately left at default (see module docstring).
-    assert h.mxj == 0
+    # max_slot == -1 (auto-detect sentinel) cannot be represented directly
+    # by UInt32 mxj -- mapped to the 0xFFFFFFFF bit-pattern instead, which
+    # the controller's `int mxj` field reinterprets back to -1 (see module
+    # docstring and HOSTCONFIG_MXJ_AUTO_DETECT).
+    assert h.mxj == mapping.HOSTCONFIG_MXJ_AUTO_DETECT
 
     assert [r.name for r in h.resources] == ["mg", "maxswap"]
     assert h.resources[0].value == ""
@@ -275,6 +291,22 @@ def test_map_list_section_host_config_sets_mxj_when_max_slot_nonnegative(cluster
     assert cluster_config.hostConfigs[0].mxj == 256
 
 
+def test_map_list_section_host_config_sets_mxj_auto_detect_sentinel_when_max_slot_absent(
+    cluster_config,
+):
+    """The production case: a host entry with no `max_slot` key at all
+    (the normal way to request auto-detect, per hosts.schema.json) must
+    NOT silently ship mxj=0 -- that reads to the controller as "explicitly
+    configure 0 slots" and permanently blocks scheduling on that host
+    (worker.c apply_join_state: `if (nslots < 0) nslots = maxcpus;` never
+    fires for 0). It must ship the 0xFFFFFFFF sentinel instead."""
+    items = [{"hostname": "worker3"}]
+    mapping.map_list_section(_spec_for("hostConfigs"), items, cluster_config)
+
+    assert cluster_config.hostConfigs[0].mxj == mapping.HOSTCONFIG_MXJ_AUTO_DETECT
+    assert mapping.HOSTCONFIG_MXJ_AUTO_DETECT != 0
+
+
 def test_time_window_day_prefixed_spec_parses_day_hour_minute(cluster_config):
     items = [
         {