ironclaw/scripts/ci/composition-budget.toml

# Composition mass budget — ratchet gate for the ironclaw_composition crate.
#
# Enforced by scripts/ci/check-composition-budget.sh (CI: .github/workflows/code_style.yml;
# local: scripts/pre-commit-safety.sh when composition files are staged).
#
# WHY THIS EXISTS
#   ironclaw_composition's charter is service-graph *assembly*
#   (build_*/with_* wiring) — see .claude/skills/ironclaw-reborn-architecture-review.
#   In practice it has accreted behavior (slack delivery, product_auth, extension
#   lifecycle, projections) and is now ~27% of ALL production crate code. The
#   dependency-boundary tests police edges *between* crates; they are blind to
#   mass piling up *inside* one crate. This gate is that missing guard.
#
# THE METRIC
#   observed_bp = 10000 * (LOC of crates/ironclaw_composition/src/**.rs)
#                       / (LOC of all crates/*/src/**.rs)
#   Production src only, in basis points (1 bp = 0.01 percentage point).
#   Test-only FILES are excluded from both numerator and denominator (basenames
#   tests.rs/test.rs/test_*.rs/*_test.rs/*_tests.rs, and any /tests/ dir — see
#   TEST_FILE_RE in check-composition-budget.sh). Inline `#[cfg(test)]` modules
#   inside otherwise-production files are still counted (a line-counter cannot
#   parse them); this residual is symmetric across numerator and denominator, so
#   it does not bias the share. Splitting inline test modules into their own
#   files (carve-out Phase 0) therefore also lowers the number honestly.
#
# HOW IT RATCHETS
#   The gate FAILS when observed_bp > ceiling_bp + tolerance_bp. It is
#   one-directional: it only trips on *growth* past the ceiling. As behavior is
#   carved out of composition into owning crates and the share drops, lower
#   ceiling_bp here to lock the improvement in (the gate prints a NUDGE when
#   slack exceeds ~1pp). Raising ceiling_bp is allowed but must carry a one-line
#   rationale in the PR — it is a visible, reviewed decision, not a silent drift.
#
# WHY THERE IS ALSO AN ABSOLUTE LOC CEILING (#7151)
#   The share metric has a POISONED DENOMINATOR. It is composition's fraction of
#   *all* production crate code, so feature inflow anywhere else in the workspace
#   improves composition's score while composition's own mass grows. That is not
#   theoretical: between 2026-08-02 and 2026-08-04 composition took +619 lines of
#   feature inflow, against -23 lines removed by an entire eviction wave, and the
#   share still fell (658 bp -> 634 bp) because the denominator grew faster. The
#   gate was also inert in absolute terms: 634 bp observed against a 2398 bp
#   ceiling is ~17.4pp of slack — composition could roughly QUADRUPLE and the
#   mass metric would never fire. CHECKLIST WS0 records that slack itself.
#   So `loc_ceiling` below bounds composition's production `.rs` LOC directly, on
#   the same numerator the share metric already computes (one definition, two
#   bounds). It is the metric that actually constrains; the share stays as the
#   relative view and as the WS0 continuity record.

[gate]
# false = DRY-RUN (prints "[dry-run, would FAIL]" but never fails the build).
# true  = ENFORCING (a breach exits non-zero and fails CI / the hook).
enforce = true

# Ceiling on composition's share of production crate code, in basis points.
# 658 bp = 6.58%. Unlike the sibling metrics this ceiling is deliberately NOT
# re-set to the current observation: reborn_restructure_baselines.rs asserts the
# WS0 share record (658 bp) stays <= ceiling_bp + tolerance_bp, so the WS0
# record is this ceiling's floor. tolerance_bp gives working slack for
# in-flight PRs.
# 2026-08-05 (program closure): 2398 -> 658 — locked to the WS0 baseline share
# exactly (the arch-test WS0 record is this ceiling's floor by assertion;
# observed today is 578 bp, inside the nudge window).
ceiling_bp = 658
tolerance_bp = 30

# Informational — the observed share when this file was last updated. Lets a
# reviewer see the baseline and lets the gate emit a down-ratchet nudge. Not
# consulted for the pass/fail decision.
observed_bp = 572
observed_date = "2026-08-08"

# --- Absolute mass (production LOC) ---------------------------------------
# The BINDING mass bound. Same numerator as the share metric — production `.rs`
# LOC under the composition crate's src tree, test-only files excluded — but no
# denominator, so nobody else's feature work can buy composition headroom.
#
# 44021 was the count on origin/main @ 676d86ce02 (2026-08-04), cross-checked
# two ways that agree exactly: the gate's own `find`-based counter, and a
# git-tracked-only count (`git ls-files … | xargs cat | wc -l`) so a stray
# untracked file in a working tree cannot be what set the baseline. Set to
# current, not padded — a true ratchet.
#
# Re-seeded 44021 -> 44392 on 2026-08-04 after merging main @ be33ae138f into
# this branch: #7062 (workspace/memory view scoping) landed +371 production LOC
# of composition wiring between this gate's seeding and its merge, and the gate
# correctly went red against its own merge context. Re-measured with
# `bash scripts/ci/check-composition-budget.sh --print` on the merged tree
# (44392 exactly, matching the CI failure output). Still set to current, not
# padded.
#
# Re-seeded again on 2026-08-04 for the Waves 0-4 batch (#7141+#7160+#7159+
# #7161+#7156 in one branch): the batch's own movers add composition wiring
# (the conversations port adapter +158, consolidation wiring) and the gate
# lands WITH them, seeded to the batch tree's measured count — which
# dissolves the gates-before-movers ordering collision measured earlier
# (the ceiling seeded pre-batch red the batch by 115 LOC).
#
# Re-ratcheted 45127 -> 42938 on 2026-08-04 by the WS6 service-cluster eviction
# (admin-user directory + blocked-auth resume fan-out -> ironclaw_assistant; turn-end
# trace capture -> ironclaw_trace_commons::capture + ironclaw_turn_runner::trace_capture).
# -2189 LOC, measured on this branch with
# `bash scripts/ci/check-composition-budget.sh --print`. Set to current, not
# padded. Sibling WS6 slices lower it further; numeric conflicts belong to the
# coordinator, who takes the LOWEST measured value of the merged tree.
#
# RE-RATCHET AT EVERY WAVE CLOSE. When a wave evicts behavior from composition,
# lower loc_ceiling to the new observed count in the same PR; the gate prints a
# NUDGE once observed sits more than loc_nudge_slack below the ceiling, so the
# obligation is visible in CI output rather than remembered. Raising it is
# allowed but must carry a one-line PR rationale, same rule as ceiling_bp.
#
# Re-ratcheted 45127 -> 42688 on 2026-08-04 by the WS6 policy evictions
# (approval gate -> ironclaw_approvals, fire-time trigger access ->
# ironclaw_triggers): -2,439 production LOC. This is the "RE-RATCHET AT EVERY
# WAVE CLOSE" rule below being executed, not headroom being claimed — measured
# with `bash scripts/ci/check-composition-budget.sh --print` on the post-
# eviction tree. Sibling WS6 branches are shrinking composition too, so a
# numeric conflict here is expected and trivial: take the LOWER number, then
# re-measure on the merged tree rather than trusting either side's figure.
#
# Union re-seed on the waves-0-4 batch, 2026-08-04: the WS6 service-cluster
# eviction (-2,189) and the WS6 policy eviction (-2,439) are disjoint; on the
# merged tree the deltas add exactly: 45,127 - 2,189 - 2,439 = 40,499.
#
# Re-ratcheted 40499 -> 40419 on 2026-08-05 by the WS6 OpenAI-compat eviction
# (the re-scoped clause: the router-state assembly behind a ports params
# struct, the `/v1/models` LlmConfig catalog + its error map, the projection
# streamer + envelope decode, and the scope->caller projection all move to
# `ironclaw_openai_compat::mount`). MEASURED on this tree with
# `bash scripts/ci/check-composition-budget.sh --print`, not derived from the
# diff: the post-eviction branch reads 40419, where the same command on the
# branch's own base (ws7/wasm-and-closeout @ 22e73de89) read 40595 -- i.e. the
# base was already 96 LOC above the 40499 ceiling and passing on tolerance
# alone, so this ratchet reclaims that drift as well as the eviction. Set to
# current, not padded. (The eviction itself removed 199 lines; 9 came back as
# the module doc-comment that records what stayed behind and why, which is the
# honest number to bank.)
# Re-equalized 40419 -> 40423 on 2026-08-05 (program closure): #6831 (standardized
# messaging framework) added 4 governed LOC through the queue's tolerance window;
# ceiling, observed, and the arch-test record move together in this commit.
# Re-seeded 40423 -> 40692 on 2026-08-07 for #7157: the one-time stored-trigger
# delivery migration must run in boot sequencing, and the notification-channel
# capability split plus delivery wiring keep their existing mediated owners.
# Measured on the merged tree with this gate; the 269-line increase is recorded
# explicitly rather than hidden inside the 150-line working tolerance.
#
# Re-ratcheted DOWN 40692 -> 40432 on 2026-08-07, same PR, after the review-fix
# round: per-record migration quarantine added production lines and tripped the
# absolute ceiling, so `runtime/approval.rs`'s 417-line inline `#[cfg(test)]`
# module was split verbatim into `runtime/approval/tests.rs` — the carve-out
# Phase 0 this file blesses — rather than raising the ceiling to absorb it. Net
# effect is a smaller composition than before the fixes. Measured on this tree
# with `bash scripts/ci/check-composition-budget.sh`.
# Union re-measured 40432 -> 40747 on 2026-08-07 after merging #7157's delivery
# refactor with #7214's sandbox profile and binding assembly.
# Union re-measured on the #7373 merge (2026-08-08): the gate-audit branch had
# independently re-equalized 40423 -> 40524 for the same drift class before
# #7157's chain (40692 -> 40432 -> 40747) landed; both chains fold into the
# merged-tree measure below (40804 on the #7373 merge), set to current, not padded. The recurrence class
# itself is repaired in this PR: the contracts size gate now carries upward
# working slack, and this file's loc_tolerance keeps doing that job here.
# History: 40747 -> 40811 (#7157 acting-user scope helper), then two features
# merged on top on 2026-08-08/09, each service-graph assembly only:
#  - web-app channel assembly (`assemble_web_app`: subscription-store
#    construction, runtime-slot install, VAPID seeding + read-back, manifest
#    push-host extraction, binding-borne outbound-target-provider registration).
#  - skills stack top layer (#7171): skill-bundle staging, host-reachability
#    root map, process-alias host-workdir wiring.
# Re-measured on the MERGED tree (web-app + skills) with
# `bash scripts/ci/check-composition-budget.sh` -> 41509 (base 40811 + web-app
# assembly + #7171 skills assembly; the deltas are additive on the merged tree).
# Re-measured 41509 -> 41582 on 2026-08-10 after merging main into
# implement-issue-6896-fix: #7131's run-failure settlement observer adds its
# production wiring and inline regression coverage to the current main tree.
# Measured with --print; set to current rather than hidden in tolerance.
# 41582 -> 41751 (2026-08-11, channel capability contract): assembly now
# carries the host-owned delivery-registration store, client-bootstrap port,
# generic notification-setup service, and the split ingress/reply/delivery
# bindings. The behavior lives in ironclaw_auth/assistant/extension_host;
# composition only constructs and threads their implementations. Measured on
# the pre-main-sync tree with this gate.
# Re-seeded 41582 -> 41810 on 2026-08-11 for #7471's merged tree. The dedicated
# process-journal PostgreSQL pool adds service-graph assembly needed to keep
# lease heartbeats independent of data-plane saturation; concurrent mainline
# composition growth consumed the prior tolerance before this branch merged.
# Measured by the Fast deterministic checks gate on the GitHub merge commit and
# recorded explicitly rather than weakening or bypassing the absolute bound.
# Union re-measured at 41942 after merging #7471 into the channel-capability
# branch: the two assembly deltas are disjoint (journal pool/filesystem versus
# channel registrations/capability bindings). Set to the merged-tree count;
# do not spend the working tolerance to hide either reviewed change.
# Union re-measured 41810 -> 41820 on 2026-08-12 (#7373 refresh merge of
# main): the audit branch's chain (40804 @ 2026-08-08) and main's chain
# (41810 @ #7471) fold; measured on the merged tree with this gate's
# --print. Set to current, not padded — re-equalized per this file's own
# re-capture instruction so the designed 150-line working window is fully
# live again (main's pin had drifted to 140 lines of effective headroom).
#
# Re-ratcheted DOWN 41810 -> 41527 on 2026-08-12 by #7365 (memory recall): the
# memory-save guidance and its content pins moved out of composition into the
# memory-native package that owns them, and `runtime/tests/default_system_prompt.rs`
# was split out of the production file — the carve-out Phase 0 this file blesses.
# The gate's NUDGE fired at 283 LOC of slack; this locks the improvement in rather
# than banking it as headroom. Measured on the merged tree with
# `bash scripts/ci/check-composition-budget.sh`.
# Re-seeded 41533 -> 41726 on 2026-08-12 for #7532: structured-trigger creation
# must preflight against the production extension registry, selectable-skill
# source, and scheduled-run profile. That cross-owner adapter is service-graph
# assembly and therefore remains in composition; measured exactly on this branch
# with `bash scripts/ci/check-composition-budget.sh --print`, with no padding.
# Union re-measured on 2026-08-12 after merging main (#7365's composition
# eviction + #7373 re-equalization) into the unified-channel branch: main
# evicted the memory-save guidance while this branch added the channel
# registration/capability assembly; the merged tree is measured, not summed.
# Union re-measured at 42299 on 2026-08-14 after merging main (#7532/#7548
# structured-trigger assembly) into the unbound-turns surfaces branch. The
# surfaces side keeps the prepared-lane behavior in
# `ironclaw_assistant::UnboundPreparedTurnService`; composition holds only
# the wire-DTO mapping, port adapter, and mount wiring. The deltas are
# disjoint and the ceiling is the gate's exact merged-tree measurement.
#
# Re-measured 42299 -> 41991 on 2026-08-14 (post-merge re-measure, same day):
# this changelog's 42299, the prior loc_ceiling/loc_observed of 42086, and a
# fresh `--print` run on the current tree had drifted out of agreement — three
# numbers for the same metric. `bash scripts/ci/check-composition-budget.sh
# --print` is the single authoritative re-capture and reports "composition
# absolute: 41991 LOC (production src)"; loc_ceiling, loc_observed, and the
# mirrored `COMPOSITION_ABSOLUTE_SRC_LOC` constant in
# crates/app/ironclaw_architecture_tests/tests/reborn_restructure_baselines.rs
# all move to this figure together, per this file's own re-capture instruction.
#
# Re-measured 42198 -> 42198 on 2026-08-19 after merging main into
# fix/7681-private-connect-nudge-with-one-click-link. Main's own growth
# (#7712's CheckpointPolicy field, #7717's libSQL write-lane fix) had already
# consumed the entire prior ceiling+tolerance window on its own; this branch's
# delta is the #7681 connect-link notice wiring in extension_host_assembly.rs
# (~11 lines), predating that growth. Measured on the merged tree with
# `bash scripts/ci/check-composition-budget.sh --print`, not summed.
#
# Re-measured 42198 -> 42316 on 2026-08-20 for #7770 phase 1 (memory curation
# wired through composition), in two steps.
#
#   +7   the `[memory].curation_interval_turns` input field/setter and the few
#        lines that hand the runtime's thread service and coordinator to
#        `ironclaw_assistant::memory_curation::after_turn_curation_dispatcher_factory`
#        — the hook/phase/trust-class assembly itself stays in the crate that
#        owns curation, per AGENTS.md.
#   +109 the approach-audit fix that makes curation FAIL CLOSED on a memory
#        binding whose provider cannot replace the standing document
#        (`memory_provider_factory::curation_interval_for_binding` plus its two
#        unit tests, and the runtime.rs call site). Composition is the only
#        layer that may see both the operator's `[memory]` config and the
#        resolved binding, so the decision cannot move down; roughly half the
#        delta is the tests that pin the startup error.
#
# Measured with `bash scripts/ci/check-composition-budget.sh`, not summed; the
# mirrored `COMPOSITION_ABSOLUTE_SRC_LOC` in
# crates/app/ironclaw_architecture_tests/tests/reborn_restructure_baselines.rs
# moves to the same figure in this commit.
# ✎ Re-measured 42316 -> 42479 on 2026-08-21: the main merge into the #7770
# phase-1 branch combined main's own composition growth (durable notification
# inbox #7697, subagent background-delivery slice #7788) with this branch's
# curation wiring. The two ceilings merged textually without a git conflict
# while the SUM exceeded both — the gate caught exactly the case it exists
# for. No new composition code in this commit; measured with
# `bash scripts/ci/check-composition-budget.sh`; the mirrored
# COMPOSITION_ABSOLUTE_SRC_LOC moves to the same figure in this commit.
# Re-seeded 42198 -> 42371 on 2026-08-24 for #7833 (unattended-safe suggestion
# tools). Between 08-19 and this branch's base, unrelated main-side growth had
# already consumed all but 7 lines of the 150-line tolerance window (base
# a1e3ca5bf5 measures 42341), so a modest addition tipped it.
#
# This branch's delta is `unattended_denied_capability_ids()` in
# crates/app/ironclaw_composition/src/runtime.rs: the cross-crate list of
# mutating synthetic capabilities denied to an unattended run. It stays in
# composition deliberately — the ids are owned by ironclaw_assistant,
# ironclaw_loop_host, ironclaw_memory and ironclaw_host_runtime, and composition
# is the only layer allowed to depend on all four at once; the loop layer that
# enforces the deny-list (ironclaw_turn_runner) cannot. Assembly of a config
# value from constants owned elsewhere, not new domain policy.
#
# The first measurement was 42380. Nine of those lines were a rationale comment
# duplicating the one on `DefaultPlannedRuntimeConfig::unattended_denied_capability_ids`;
# that explanation now has one home and composition points at it, which is why
# the seed is 42371 rather than 42380. Measured with
# `bash scripts/ci/check-composition-budget.sh --print`, not padded.
#
# ✎ Re-measured on 2026-08-26 merging main (ceiling 42371, incl. #7833 and the
# subagent background-mode slices) into the #7770 branch (ceiling 42479, the
# curation wiring above). Same pair hazard as the 08-21 entry: the two
# ceilings cannot be summed or max'd — the merged tree is the only truth.
# `bash scripts/ci/check-composition-budget.sh --print` on the merged tree
# measures 42732. No new composition code in this merge commit; the mirrored
# COMPOSITION_ABSOLUTE_SRC_LOC moves to the same figure in this commit.
# Re-measured 42732 -> 42935 on 2026-08-28 after merging current main into
# #7875. Main contributes the resource-block observer wiring and #7875 adds
# the durable auth notification observer wiring. Both lifecycle policies stay
# in ironclaw_assistant/ironclaw_notifications; composition only supplies their
# dependencies. Measured on the merged tree with
# `bash scripts/ci/check-composition-budget.sh --print`, not padded.
loc_ceiling = 42935
# Working slack for in-flight PRs. Deliberately small: the inflow this gate
# exists to catch was +619 lines, and a tolerance that would have absorbed it
# is a gate that constrains nothing. A change adding more than this to
# composition is a reviewed decision, not routine wiring.
loc_tolerance = 150
# Print the down-ratchet NUDGE once the ceiling sits more than this far above
# the observed count — i.e. once a wave's eviction has not been locked in.
loc_nudge_slack = 200
# Informational — observed when this file was last updated. Not consulted for
# the pass/fail decision.
loc_observed = 42935
loc_observed_date = "2026-08-28"

# --- Dispatch (Arc<dyn>) ratchet ------------------------------------------
# A companion metric for the "reduce traits & dispatch" goal (issue #6168 / the
# runtime-decomposition plan #4471). Counts Arc<dyn> sites in composition's
# PRODUCTION code. (The former exclusion of the v1 `src/slack` / `src/extension_host`
# trees no longer applies — the v1 monolith was deleted under Tier B; the Reborn
# channel/extension work lives in its own crates outside composition.)
# One-directional like the mass ratchet: it only trips on GROWTH. Prefer concrete
# types for single-impl seams; introduce a dyn boundary only at a real second impl
# or genuine test-fake seam, and raise arc_dyn_ceiling with a PR rationale if so.
# PR #6159 (telegram channel): +63 governed sites over the 1093 calibration —
# NOT new dispatch: the vendor de-tangle moved the adapter-generic final-reply
# delivery machinery out of the EXCLUDED slack/ subtree into the shared
# outbound/channel_delivery module (FinalReplyDeliveryServices' injected ports
# and the observer/driver internals), making previously-unGoverned Arc<dyn>
# sites visible to this gate. The telegram host wiring itself is excluded by
# subtree parity with slack/ (see DISPATCH_EXCLUDE_RE).
# Sixth fold (generic-runtime reconciliation): after the 2026-07-20 main sync,
# the generic extension-ingress/delivery lane and deleted composition telegram
# module leave 1096 governed sites. This locks a net 60-site reduction from
# main's 1156-site baseline while accounting for the Reborn services added on
# main after the branch's pre-sync 1060-site calibration.
# 2026-07-21 PR #6116 moved-head cleanup: follow-up branch work removed stale
# product-auth, capability-surface, and channel-state vocabulary while leaving
# the branch at 1122 governed sites. This ratifies the current post-cleanup
# baseline without lowering the mass ratchet; future work must shrink again.
# 2026-08-05 (program closure): nudge taken, 1122 -> 814 — locked at today's
# observed count; the WS0 record (827) stays within the effective ceiling (829).
# 2026-08-07 (gate audit): re-equalized 814 -> 819 — five governed sites of
# merged main-side drift through the 15-site tolerance window since 08-05,
# leaving 10 sites of live headroom. Measured with the gate's --print; set to
# current, not padded; the WS0 record (827) stays within the effective
# ceiling (834).
# 2026-08-08 (#7373 merge): union re-measured 819 -> 826 — the folded #7157
# delivery lane and siblings carry 7 more governed sites. Set to current; the
# WS0 record (827) stays within the effective ceiling (841).
# 2026-08-10 PR #7474 (#7247 truthful connection context): 814 -> 816 for the
# two injected context-provider ports (`ExtensionCredentialSetupService` +
# channel-connection facade) wired into the communication-context assembly —
# genuine dyn seams (implementations live in extension_manager/auth; composition
# only wires). Observed on the batch branch: 831 (829 on main pre-batch + these
# two); effective ceiling 816 + 15 tolerance = 831 — equal to the observed
# count exactly, no slack.
# 816 -> 818 (2026-08-11, unified channel model): the session-inbound lane's
# two inverted ports wired at assembly — the `SessionChannelDirectory`
# (declared in product_contracts, implemented by extension_host over the
# deployment registry) and the durable session-inbound `IdempotencyLedger` —
# plus the generic `ChannelNotificationSetupService`, offset by the deleted
# `WebPushComposition` handle family. Observed on the merged branch: 833;
# 818 + 15 tolerance = 833 — equal to the observed count exactly, no slack.
# 818 -> 822 (2026-08-11, host-owned delivery registrations): four net
# governed carrier/assembly sites for two genuine multi-implementation seams,
# `DeliveryRegistrationService` (filesystem production + fakes) and
# `DeliveryClientBootstrap` (slot-backed production + rejecting default).
# Observed here: 837; 822 + 15 tolerance = 837, exactly, with no hidden slack.
# 822 -> 823 (2026-08-12, channel-owned startup initialization): one generic
# binding-held `FirstPartyChannelInitializer` seam lets binary-linked packages
# initialize their own secret material without extension-specific composition
# branches. The initialization context borrows the existing secret-store port,
# so this records only the real multi-implementation initializer boundary.
# Observed after splitting its inline tests out of production mass: 838.
# 2026-08-12 (#7373 refresh merge): union re-measured — the merged tree
# reports 831 governed sites, exactly the effective ceiling above, i.e. the
# gate was live at ZERO headroom (the recurrence class §3.2 of the gate
# audit names). Re-equalized 816 -> 831 per this file's re-capture
# instruction, restoring the designed 15-site window. The WS0 record (827)
# stays within the effective ceiling (846).
# Union re-measured on 2026-08-12 after merging main into the unified-channel
# branch (both sides re-equalized on their own trees: 838 here, 831 on main);
# measured on the merged tree, keeping the designed 15-site window.
# 823 -> 826 on 2026-08-13 after merging #7532: the structured-trigger path
# adds the production preflight seam and carries its existing multi-impl
# capability/create-hook ports through assembly. The merged tree reports 841;
# 826 + 15 tolerance = 841, preserving zero hidden headroom.
# 826 -> 830 on 2026-08-14 for the shared runtime-event sink: four governed
# carrier/assembly sites route cancellation and milestone producers through one
# `EventSink` seam. Production uses `CoalescingEventSink`; the overload fake
# verifies lossless cancellation behavior. The merged tree reports 845;
# 830 + 15 tolerance = 845, preserving zero hidden headroom.
arc_dyn_ceiling = 830
arc_dyn_tolerance = 15
arc_dyn_observed = 845