Place T3 control and workload processes in verified CPU roles

apps/server/package.json

@@ -16,10 +16,11 @@
   "type": "module",
   "scripts": {
     "dev": "node --watch src/bin.ts",
-    "build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean",
+    "build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean && node ../../native/process-placement/build.mjs",
     "start": "node dist/bin.mjs",
     "typecheck": "tsgo --noEmit",
-    "test": "vp test run"
+    "test": "vp test run",
+    "test:placement-build": "node --test ../../native/process-placement/build.test.mjs"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.170",

apps/server/src/cloud/bootService.test.ts

@@ -719,3 +719,111 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
     }),
   );
 });
+
+it("places the stable launcher before execution and leaves server priority to its child", () => {
+  const unit = BootService.renderBootServiceUnit({
+    nodePath: "/usr/bin/node",
+    launcherPath: "/home/user/.t3/runtime/service-launcher.mjs",
+    baseDir: "/home/user/.t3",
+    logPath: "/home/user/.t3/logs/service.log",
+    unitPath: "/home/user/.config/systemd/user/t3code.service",
+    processPlacement: {
+      version: 1,
+      helperPath: "/opt/t3/process-placement",
+      helperSha256: "a".repeat(64),
+      helperDevice: "1",
+      helperInode: "10",
+      control: { path: "/sys/fs/cgroup/t3/control", device: "1", inode: "2" },
+      workload: { path: "/sys/fs/cgroup/t3/workload", device: "1", inode: "3" },
+      serverPriority: { nice: -15, resetOnFork: true },
+    },
+  });
+  expect(unit).toContain(
+    `ExecStart=:/opt/t3/process-placement --helper-path /opt/t3/process-placement --helper-sha256 ${"a".repeat(64)} --helper-device 1 --helper-inode 10 --role control --cgroup /sys/fs/cgroup/t3/control --device 1 --inode 2 -- /usr/bin/node /home/user/.t3/runtime/service-launcher.mjs`,
+  );
+  expect(unit).toContain("Environment=T3_PROCESS_PLACEMENT=");
+  expect(unit.split("\n").find((line) => line.startsWith("ExecStart="))).not.toContain(
+    "--server-priority",
+  );
+});
+
+it("boots through an explicitly bound external producer before starting the stable launcher", () => {
+  const unit = BootService.renderBootServiceUnit({
+    nodePath: "/usr/bin/node",
+    launcherPath: "/home/user/.t3/runtime/service-launcher.mjs",
+    baseDir: "/home/user/.t3",
+    logPath: "/home/user/.t3/logs/service.log",
+    unitPath: "/home/user/.config/systemd/user/t3code.service",
+    processPlacementBootstrap: {
+      version: 1,
+      executablePath: "/usr/bin/python3.13",
+      executableSha256: "a".repeat(64),
+      scriptPath: "/opt/t3/bootstrap.py",
+      scriptSha256: "b".repeat(64),
+      policyPath: "/opt/t3/policy.json",
+      policySha256: "c".repeat(64),
+      helperPath: "/opt/t3/process-placement",
+      helperSha256: "d".repeat(64),
+    },
+  });
+  expect(unit).toContain("Delegate=cpu memory pids");
+  expect(unit).toContain("Environment=T3_PROCESS_PLACEMENT_BOOTSTRAP=");
+  expect(unit).toContain(
+    `ExecStart=:/usr/bin/python3.13 /opt/t3/bootstrap.py --script-sha256 ${"b".repeat(64)} --policy /opt/t3/policy.json --policy-sha256 ${"c".repeat(64)} --helper /opt/t3/process-placement --helper-sha256 ${"d".repeat(64)} -- /usr/bin/node /home/user/.t3/runtime/service-launcher.mjs`,
+  );
+  expect(unit).not.toContain("Environment=T3_PROCESS_PLACEMENT=");
+});
+
+it("preserves literal systemd dollar and percent characters in placement paths", () => {
+  const unit = BootService.renderBootServiceUnit({
+    nodePath: "/opt/${version}/node",
+    launcherPath: "/home/user/.t3/launcher.mjs",
+    baseDir: "/home/user/.t3",
+    logPath: "/home/user/.t3/logs/service.log",
+    unitPath: "/home/user/.config/systemd/user/t3code.service",
+    processPlacement: {
+      version: 1,
+      helperPath: "/opt/t3%name/${helper}",
+      helperSha256: "a".repeat(64),
+      helperDevice: "1",
+      helperInode: "10",
+      control: { path: "/sys/fs/cgroup/t3/control", device: "1", inode: "2" },
+      workload: { path: "/sys/fs/cgroup/t3/workload", device: "1", inode: "3" },
+    },
+  });
+  expect(unit).toContain(
+    "ExecStart=:/opt/t3%%name/${helper} --helper-path /opt/t3%%name/${helper}",
+  );
+  expect(unit).toContain("-- /opt/${version}/node /home/user/.t3/launcher.mjs");
+  expect(
+    JSON.parse(BootService.placementEnvironmentFromUnit(unit).T3_PROCESS_PLACEMENT!).helperPath,
+  ).toBe("/opt/t3%name/${helper}");
+});
+
+it("recovers required placement from its persisted systemd unit without silently dropping it", () => {
+  const binding = {
+    version: 1 as const,
+    helperPath: "/opt/t3/helper%$literal",
+    helperSha256: "a".repeat(64),
+    helperDevice: "1",
+    helperInode: "10",
+    control: { path: "/sys/fs/cgroup/t3/control", device: "1", inode: "2" },
+    workload: { path: "/sys/fs/cgroup/t3/workload", device: "1", inode: "3" },
+  };
+  const unit = BootService.renderBootServiceUnit({ ...macPlan, processPlacement: binding });
+  const recovered = BootService.placementEnvironmentFromUnit(unit);
+  expect(JSON.parse(recovered.T3_PROCESS_PLACEMENT!)).toEqual(binding);
+  expect(() =>
+    BootService.placementEnvironmentFromUnit(
+      `${unit}\nEnvironment=T3_PROCESS_PLACEMENT="duplicate"`,
+    ),
+  ).toThrow("duplicate");
+  expect(() =>
+    BootService.placementEnvironmentFromUnit('Environment="T3_PROCESS_PLACEMENT=bad"'),
+  ).toThrow("unsupported");
+  expect(() =>
+    BootService.placementEnvironmentFromUnit(
+      `${unit}\nEnvironment=T3_PROCESS_PLACEMENT_BOOTSTRAP="{}"`,
+    ),
+  ).toThrow("ambiguous");
+});