A request goes in.A hardened resource comes out.

Calc sheet: the scheduler on a public workload

The first 93.5 minutes of the Google 2011 cluster trace: 12,477 machines, 57,012 placements, synthetic spot labels on half the machines. Once through the plugin's scoring function as a model, once through kube-scheduler itself on an envtest API server, with the default profile and the kiln profile as the config declares them. An empty cluster, so every idle machine can be released.

The binary agrees with the model on the bill to within a few percent and on the class guarantee exactly. On the cluster as the trace found it, already 92.3% requested and carrying 132,982 tasks, the model bills $1329.75 for both profiles: no machine ever empties, so placement alone saves nothing. What holds in both scenarios is the guarantee, 0 production-priority tasks on reclaimable capacity against 263 for an economics-blind placement. The binary did not finish the full cluster, so that row stands as the model's only; the full tables say so.

Test sheet: the canary decision against two other rules

The sequential test at its defaults, a consecutive-breach threshold (the shape Flagger and Argo Rollouts ship) and a multi-window burn-rate alert (the shape the SRE Workbook gives), on the same seeded traffic, the alternatives tuned to the same false-rollback ceiling. Each cell is detection from onset, p50 / p95, and the share of regressions that promoted anyway.

Then 21 traffic classes, 12 of them new, split in two: each alternative tuned on one half and scored on the other, the sequential test untuned. Where it loses:

• 99.3% false rollbacks at 5 rps, every one as Inconclusive. The 500-request sample gate outlasts the step deadline at that rate, and the controller does not derive either field from the traffic it sees. A spec mismatch, named as one.

• 7.5% false rollbacks on retry storms, against the 5% it promises. Correlated bursts break the independence the likelihood ratio assumes.

• 27.9% of heavy-tailed regressions missed, against the 10% it promises. The burn-rate alert misses 42.4% and the threshold 97%: everyone loses on that traffic, the sequential test least.

• 15 s against 30 s on a flagrant step, the burn-rate alert's win, one window against the three the evidence cap needs.

Every tuning point, with intervals, and the trade-off plot: held-out evaluation.

Load sheet: a thousand rollouts at once

N concurrent CanaryRollouts through the reconciler on an envtest API server. As shipped, the manager had controller-runtime's default client budget, 20 requests per second with a burst of 30, and one worker, because nothing had set either. The fix is three flags: the client budget and the reconcile concurrency.

Lateness in a canary controller is risk: a regression that should roll back in 30 s rolls back while the queue drains. The fix moves the wall rather than removing it; at a thousand rollouts the status patches alone reach the new budget. Next in line, measured: one live read of the VirtualService per reconcile, because unstructured reads bypass the cache, and Events at a quarter of the budget. Per-verb request rates.

Revision note: the proof that never ran

The durable-outbox proof kills every controller, repeatedly and without grace, through a burst of requests, and requires each transition to land exactly one audit row with the chain intact.

It failed on every nightly for 29 days after it was pushed, on a precondition the harness asserted instead of waiting for, and nothing alerted. An audit of every claimed number found the streak, the harness now waits for its own precondition, a red nightly opens an issue, and the proof passed in run 38176386056 on 2026-10-11. The postmortem is blameless and names its action items; the audit itself and the second pass are methods in TESTING.md.