fix(controller,xceadmin): fix zero-slot scheduling block, misleading resval logs, byte-unit display

Three bugs found while diagnosing a live controller log, all in the
worker resource-value path:

1. Every host relying on the documented hosts.yaml auto-detect default
   (no max_slot, meaning "use CPU count") got 0 scheduling slots,
   permanently blocking the scheduler from placing jobs on it. mxj is
   UInt32 on the wire and can't carry the schema's -1 sentinel; mapping.py
   worked around this by leaving it unset, which defaults to 0 -- and 0 is
   never < 0, so apply_join_state()'s auto-detect fallback never fired.
   Fixed by encoding the sentinel as 0xFFFFFFFF, which the controller's
   `int mxj` field reinterprets back to -1 via its existing implicit
   uint32_t->int conversion. No C-side or wire schema change needed for
   this part; the fallback itself was already correct but had zero test
   coverage for a negative mxj, now added.

2. update_resvals()/update_resval_list() logged the failure reason via
   PERROR, which reads process-global errno -- but update_resval()'s
   failure paths return raw negative codes directly and never touch
   errno, so the controller log filled with misleading "update_resval:
   Success" / "update_resval: Resource temporarily unavailable" lines
   instead of the real reason. Fixed to decode the actual rc via
   xce_strerror_r and name the failing resource.

3. maxmem is canonically stored/wired as raw bytes but had no unit
   metadata, so resval/workerlist printed it as a bare number that read
   as garbage (e.g. workerlist's fixed-width columns visually smeared a
   multi-GB byte count across the MaxCPU/MaxMem headers). Added an
   optional `unit` field to the Resource/ResourceVal capnp structs (and
   xce_resource_t/xce_resval_t/resources.yaml) so resval and workerlist
   can render a human-readable value (e.g. "30.90 GB") while the stored
   value stays raw bytes -- display-only, every other resource unaffected.

Regenerated the xceadmin golden fixture (fixtures/full/expected.bin)
twice: once for the mxj sentinel encoding change, once for the new
Resource.unit field growing every resource's wire size by one pointer
slot. Both diffs verified byte-for-byte isolated to exactly the expected
change before regenerating.

Verified: 1095/1095 controller_unit_test (stable across repeated runs),
229/229 xceadmin pytest, clean rebuild of lib/controller/xceadmin/xce_test.
Two related findings logged to .wolf/buglog.json but deliberately not
fixed here (out of scope per discussion): a pre-existing flaky segfault
in the combined controller_unit_test binary, and maxswap/maxtmp being
hardcoded stub values on the worker side.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/xceadmin/tests/test_mapping.py

@@ -173,6 +173,20 @@ def test_map_list_section_noop_on_empty_or_missing_items(cluster_config):
     assert len(cluster_config.resources) == 0
 
 
+def test_map_list_section_resources_maps_unit_when_present(cluster_config):
+    items = [
+        {"name": "maxmem", "type": "numeric", "unit": "bytes"},
+        {"name": "maxcpus", "type": "numeric"},
+    ]
+    mapping.map_list_section(_spec_for("resources"), items, cluster_config)
+
+    r0, r1 = cluster_config.resources
+    assert r0.unit == "bytes"
+    # Every existing resource has no "unit" key -- must stay unset (empty
+    # Text default), not silently inherit or default to any value.
+    assert r1.unit == ""
+
+
 # ---------------------------------------------------------------------------
 # map_list_section: users.yaml/hosts.yaml -> ugroups/hgroups (named groups)
 # ---------------------------------------------------------------------------
@@ -247,9 +261,11 @@ def test_map_list_section_host_config_full_field_mapping(cluster_config):
     assert h.name == "default"
     assert h.type == "x86_64-linux-gnu"
     assert h.model == "x86_64-linux-gnu"
-    # max_slot == -1 (auto-detect sentinel) cannot be represented by
-    # UInt32 mxj -- deliberately left at default (see module docstring).
-    assert h.mxj == 0
+    # max_slot == -1 (auto-detect sentinel) cannot be represented directly
+    # by UInt32 mxj -- mapped to the 0xFFFFFFFF bit-pattern instead, which
+    # the controller's `int mxj` field reinterprets back to -1 (see module
+    # docstring and HOSTCONFIG_MXJ_AUTO_DETECT).
+    assert h.mxj == mapping.HOSTCONFIG_MXJ_AUTO_DETECT
 
     assert [r.name for r in h.resources] == ["mg", "maxswap"]
     assert h.resources[0].value == ""
@@ -275,6 +291,22 @@ def test_map_list_section_host_config_sets_mxj_when_max_slot_nonnegative(cluster
     assert cluster_config.hostConfigs[0].mxj == 256
 
 
+def test_map_list_section_host_config_sets_mxj_auto_detect_sentinel_when_max_slot_absent(
+    cluster_config,
+):
+    """The production case: a host entry with no `max_slot` key at all
+    (the normal way to request auto-detect, per hosts.schema.json) must
+    NOT silently ship mxj=0 -- that reads to the controller as "explicitly
+    configure 0 slots" and permanently blocks scheduling on that host
+    (worker.c apply_join_state: `if (nslots < 0) nslots = maxcpus;` never
+    fires for 0). It must ship the 0xFFFFFFFF sentinel instead."""
+    items = [{"hostname": "worker3"}]
+    mapping.map_list_section(_spec_for("hostConfigs"), items, cluster_config)
+
+    assert cluster_config.hostConfigs[0].mxj == mapping.HOSTCONFIG_MXJ_AUTO_DETECT
+    assert mapping.HOSTCONFIG_MXJ_AUTO_DETECT != 0
+
+
 def test_time_window_day_prefixed_spec_parses_day_hour_minute(cluster_config):
     items = [
         {