CB-554: weight <= 0 excludes a profile from automatic placement, not 1.0

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -193,9 +193,15 @@ public record BridgedConfig(
      *                       (minimal-grant default — push over SSH stays free, PR-create is opt-in)
      * @param gitHostEnv     name of the host env var holding the forge host (default {@code GITEA_HOST});
      *                       injected as {@code GITEA_HOST} <em>only</em> when {@code gitTokenEnv} is set
-     * @param weight         relative selection weight for {@code placement: weighted}. Absent or
-     *                       non-positive ⇒ 1.0. Weights are normalised by the policy, so they need
-     *                       not sum to 1.0.
+     * @param weight         relative selection weight for automatic placement ({@code weighted},
+     *                       {@code round-robin}, and {@code fixed}'s fallback walk). Absent ⇒ 1.0.
+     *                       An explicit {@code 0} or negative value (CB-554) means "never
+     *                       auto-select this profile": it is excluded from every automatic policy's
+     *                       pool the same way a quarantined candidate is (see
+     *                       {@code PlacementPolicyUtil}). This does not make the profile
+     *                       unreachable — an explicit {@code bridge_spawn{profile:"..."}} bypasses
+     *                       placement entirely and still resolves it. Weights among the remaining
+     *                       (non-excluded) candidates need not sum to 1.0; only their ratios matter.
      * @param maxLoad         max live workers allowed on this profile at one time; absent or
      *                       non-positive ⇒ unlimited. Live means any session the registry still owns
      *                       (acquired and not yet released), in any state.
@@ -287,7 +293,11 @@ public record BridgedConfig(
             // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.
             gitHostEnv = (gitHostEnv == null || gitHostEnv.isBlank()) ? "GITEA_HOST" : gitHostEnv;
             env = (env == null) ? Map.of() : Map.copyOf(env);
-            weight = (weight == null || weight <= 0.0f) ? 1.0f : weight;
+            // CB-554: absent still means 1.0, but an explicit non-positive value must survive as
+            // "excluded from automatic selection" (PlacementCandidate.excluded(), weight <= 0), not
+            // get coerced back up to 1.0 — that coercion was the bug (weight: 0 looked like "never
+            // pick me" and actually meant "pick me as often as anyone else").
+            weight = (weight == null) ? 1.0f : Math.max(weight, 0.0f);
             maxLoad = (maxLoad == null || maxLoad <= 0) ? null : maxLoad;
             subscription = (subscription != null && subscription) ? Boolean.TRUE : Boolean.FALSE;
             // exhaustedPattern stays null when unset/blank (opt-in) — no defaulting, no vendor

bridged/src/main/java/dev/ltms/bridged/placement/FixedPlacementPolicy.java

@@ -5,28 +5,62 @@ package dev.ltms.bridged.placement;
  * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps and
  * reachability so that a pre-existing config behaves identically after upgrade.
  *
- * <p>Quarantine (CB-578 stage B) is the one exception: a quarantined default is a credential that
- * just refused on a usage limit, not a transient capacity or reachability concern, so {@code fixed}
- * steps to the first non-quarantined candidate instead of walking straight back onto it. A fleet
- * where nothing is ever quarantined never exercises this path, so today's behaviour is unchanged.
+ * <p>Two exceptions walk past the default instead of returning it unconditionally:
+ * <ul>
+ *   <li>Quarantine (CB-578 stage B): a quarantined default is a credential that just refused on
+ *       a usage limit, not a transient capacity or reachability concern.
+ *   <li>Weight 0 (CB-554): {@code fixed} is still automatic selection, so a profile the operator
+ *       marked "never auto-select me" ({@code weight <= 0}) must be skipped here exactly as
+ *       {@code weighted}/{@code round-robin} skip it — an explicit {@code bridge_spawn} naming
+ *       the profile is unaffected, only this automatic fallback walk.
+ * </ul>
+ * A fleet where nothing is ever quarantined or weight-0 never exercises either path, so today's
+ * behaviour is unchanged.
  */
 final class FixedPlacementPolicy implements PlacementPolicy {
 
     @Override
     public PlacementCandidate select(PlacementContext ctx) {
         String d = ctx.defaultProfile();
-        if (d != null && !d.isBlank() && !ctx.quarantined().contains(d)) {
+        if (d != null && !d.isBlank() && !ctx.quarantined().contains(d) && !weightExcluded(ctx, d)) {
             return new PlacementCandidate(d, null, 1.0f, null);
         }
         for (PlacementCandidate c : ctx.candidates()) {
-            if (!ctx.quarantined().contains(c.profile())) {
+            if (!ctx.quarantined().contains(c.profile()) && !c.excluded()) {
                 return new PlacementCandidate(c.profile(), null, c.weight(), c.maxLoad());
             }
         }
         if (d != null && !d.isBlank()) {
-            throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
-                    + "exhausted) and no un-quarantined candidate is available");
+            boolean dQuarantined = ctx.quarantined().contains(d);
+            boolean dWeightExcluded = weightExcluded(ctx, d);
+            if (dQuarantined && dWeightExcluded) {
+                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
+                        + "exhausted) and has weight 0 (excluded from automatic selection), and no "
+                        + "available candidate remains");
+            }
+            if (dWeightExcluded) {
+                throw new PlacementException("worker profile '" + d + "' has weight 0 (excluded "
+                        + "from automatic selection) and no available candidate remains");
+            }
+            if (dQuarantined) {
+                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
+                        + "exhausted) and no un-quarantined candidate is available");
+            }
+        }
+        if (!ctx.candidates().isEmpty()) {
+            throw new PlacementException(
+                    "all worker profiles are excluded from automatic selection (quarantined or weight-0)");
         }
         throw new PlacementException("no worker profiles configured");
     }
+
+    /** Whether {@code profile} carries {@code weight <= 0} (CB-554) among {@code ctx}'s candidates. */
+    private static boolean weightExcluded(PlacementContext ctx, String profile) {
+        for (PlacementCandidate c : ctx.candidates()) {
+            if (c.profile().equals(profile)) {
+                return c.excluded();
+            }
+        }
+        return false;
+    }
 }

bridged/src/main/java/dev/ltms/bridged/placement/PlacementCandidate.java

@@ -17,4 +17,18 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
     public static PlacementCandidate profile(String profile) {
         return new PlacementCandidate(profile, null, 1.0f, null);
     }
+
+    /**
+     * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
+     * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
+     * skipped. {@code BridgedConfig.Profile}'s compact constructor already normalises "absent" to
+     * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
+     * not need to distinguish "explicit 0" from "absent" itself.
+     *
+     * <p>Exclusion is about <em>automatic</em> selection only — an explicit
+     * {@code bridge_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
+     */
+    public boolean excluded() {
+        return weight <= 0.0f;
+    }
 }

bridged/src/main/java/dev/ltms/bridged/placement/PlacementPolicyUtil.java

@@ -12,13 +12,16 @@ final class PlacementPolicyUtil {
     }
 
     /**
-     * Candidates that are not known-unreachable, not quarantined (CB-578 stage B), and have not
-     * reached their maxLoad. A {@code null} maxLoad means unlimited.
+     * Candidates that are not weight-excluded (CB-554: explicit {@code weight <= 0}, checked
+     * first because it is a static config choice rather than transient state), not
+     * known-unreachable, not quarantined (CB-578 stage B), and have not reached their maxLoad.
+     * A {@code null} maxLoad means unlimited.
      */
     static List<PlacementCandidate> available(PlacementContext ctx) {
         List<PlacementCandidate> out = new ArrayList<>();
         for (PlacementCandidate c : ctx.candidates()) {
-            if (ctx.unreachable().contains(c.profile()) || ctx.quarantined().contains(c.profile())) {
+            if (c.excluded() || ctx.unreachable().contains(c.profile())
+                    || ctx.quarantined().contains(c.profile())) {
                 continue;
             }
             Integer cap = c.maxLoad();
@@ -34,16 +37,21 @@ final class PlacementPolicyUtil {
     }
 
     /**
-     * Build a clear exception describing why every candidate was dropped: all at capacity,
-     * all unreachable, all quarantined, or a mix.
+     * Build a clear exception describing why every candidate was dropped: all weight-0, all
+     * quarantined, all at capacity, all unreachable, or a mix. Each candidate is counted into
+     * exactly one bucket (weight-excluded takes priority) so a candidate excluded for more than
+     * one reason is never double-counted.
      */
     static PlacementException emptyException(PlacementContext ctx) {
+        int weightExcluded = 0;
         int atCap = 0;
         int unreachable = 0;
         int quarantined = 0;
         for (PlacementCandidate c : ctx.candidates()) {
             Integer cap = c.maxLoad();
-            if (ctx.quarantined().contains(c.profile())) {
+            if (c.excluded()) {
+                weightExcluded++;
+            } else if (ctx.quarantined().contains(c.profile())) {
                 quarantined++;
             } else if (ctx.unreachable().contains(c.profile())) {
                 unreachable++;
@@ -56,6 +64,10 @@ final class PlacementPolicyUtil {
         if (total == 0) {
             return new PlacementException("no worker profiles configured");
         }
+        if (weightExcluded == total) {
+            return new PlacementException(
+                    "all worker profiles have weight 0 (excluded from automatic selection)");
+        }
         if (quarantined == total) {
             return new PlacementException("all worker profiles are quarantined (backend exhausted)");
         }
@@ -67,6 +79,7 @@ final class PlacementPolicyUtil {
         }
         return new PlacementException("no worker profile available: " + atCap + " at maxLoad, "
                 + unreachable + " unreachable, " + quarantined + " quarantined, "
-                + (total - atCap - unreachable - quarantined) + " remaining");
+                + weightExcluded + " weight-0, "
+                + (total - atCap - unreachable - quarantined - weightExcluded) + " remaining");
     }
 }