Problem
Externally allocator-selected fair-share credits currently use the ordinary class-reservation guard. This can reject a Default-class credit even when the adaptive scheduler has unused total capacity, preventing work-conserving dispatch.
A downstream adaptive target-binding stage also needs an unforgeable witness that the request redeemed a live fair-share capacity credit. The witness must not be constructible from request headers or remain claimable after its scheduler permit is cancelled.
Scope
- Let externally selected fair-share credits borrow unused class-reserved slots while preserving the authoritative total adaptive capacity ceiling.
- Keep ordinary scheduler admissions and class guards unchanged.
- Attach a private one-shot proof only after registry redemption, bound to tenant, request, canonical model, partition, generation, and policy epoch.
- Revoke unclaimed proof clones when the scheduler permit is cancelled or dropped.
- Preserve existing reservation settlement, cancellation, and refund ownership.
Acceptance
- Reproduce the capacity-shrink/class-reserve case and prove an external credit can acquire a truly idle total slot.
- Prove ordinary Default admission remains blocked by class reservations.
- Prove request/scope mismatch, replay, and post-cancellation claim all fail closed.
- Pass scheduler tests, full SMG library tests, strict Clippy, and formatting.
Problem
Externally allocator-selected fair-share credits currently use the ordinary class-reservation guard. This can reject a Default-class credit even when the adaptive scheduler has unused total capacity, preventing work-conserving dispatch.
A downstream adaptive target-binding stage also needs an unforgeable witness that the request redeemed a live fair-share capacity credit. The witness must not be constructible from request headers or remain claimable after its scheduler permit is cancelled.
Scope
Acceptance