fix(ops): prioritize live gitea pressure routing

scripts/ops/tests/test_host_runaway_process_exporter.py

@@ -526,6 +526,80 @@ def test_sustained_load_controller_routes_gitea_quota_pressure_even_when_load_is
     assert "scripts/ops/" not in payload["commands"]["dry_run"]
 
 
+def test_sustained_load_controller_prioritizes_hot_gitea_container_over_control_plane_average(
+    tmp_path: Path,
+) -> None:
+    metrics_file = tmp_path / "host.prom"
+    metrics_file.write_text(
+        "\n".join(
+            [
+                'awoooi_host_runaway_process_monitor_up{host="110",mode="read_only"} 1',
+                'awoooi_host_load5_per_core{host="110"} 0.70',
+                'awoooi_host_swap_used_ratio{host="110"} 0.1',
+                'awoooi_host_runaway_process_remediation_authorized{host="110"} 0',
+                'awoooi_host_gitea_actions_active_container_count{host="110"} 0',
+                'awoooi_host_gitea_actions_active_process_group_count{host="110"} 0',
+                'awoooi_host_runaway_browser_orphan_group_count{host="110",rule="stockplatform_headless_smoke",min_age_seconds="1800",min_cpu_percent="50"} 0',
+            ]
+        ),
+        encoding="utf-8",
+    )
+    docker_file = tmp_path / "docker.prom"
+    docker_file.write_text(
+        "\n".join(
+            [
+                'docker_container_cpu_cores{host="110",container_name="gitea"} 1.59',
+                'docker_container_cpu_cores{host="110",container_name="redis"} 0.2',
+            ]
+        ),
+        encoding="utf-8",
+    )
+    ps_file = tmp_path / "ps.txt"
+    ps_file.write_text(
+        "\n".join(
+            [
+                "100 1 100 75507 61.8 0.0 systemd /sbin/init",
+                "101 1 101 75469 6.7 0.0 dbus-daemon @dbus-daemon --system",
+                "200 1 200 75348 53.1 1.3 gitea /usr/local/bin/gitea web --config /home/wooo/gitea/app.ini",
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(CONTROLLER_PATH),
+            "--host",
+            "110",
+            "--load5-per-core-threshold",
+            "0.75",
+            "--hot-container-cpu-threshold",
+            "1.0",
+            "--container-cpu-threshold",
+            "2.0",
+            "--metrics-file",
+            str(metrics_file),
+            "--docker-stats-file",
+            str(docker_file),
+            "--ps-file",
+            str(ps_file),
+            "--json",
+        ],
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 75
+    payload = json.loads(result.stdout)
+    assert payload["classification"] == "blocked_gitea_queue_or_hook_backlog_requires_playbook"
+    assert payload["next_action"] == "run_gitea_queue_or_hook_backlog_playbook_check_mode"
+    assert payload["readback"]["control_plane_process_cpu_percent"] == 68.5
+    assert payload["readback"]["top_container_cpu"]["container_name"] == "gitea"
+    assert "/home/wooo/scripts/host-sustained-load-evidence.py" in payload["commands"]["dry_run"]
+    assert "/home/wooo/gitea/app.ini" not in result.stdout
+
+
 def test_sustained_load_controller_ignores_stale_docker_stats_attribution(tmp_path: Path) -> None:
     metrics_file = tmp_path / "host.prom"
     metrics_file.write_text(
@@ -842,6 +916,50 @@ def test_sustained_load_evidence_emits_sanitized_gitea_recommendation(tmp_path:
     assert "/home/wooo" not in result.stdout
 
 
+def test_sustained_load_evidence_prioritizes_hot_gitea_container_over_control_plane_average(
+    tmp_path: Path,
+) -> None:
+    ps_file = tmp_path / "ps.txt"
+    ps_file.write_text(
+        "\n".join(
+            [
+                "100 1 100 75507 61.8 0.0 systemd /sbin/init",
+                "101 1 101 75469 6.7 0.0 dbus-daemon @dbus-daemon --system",
+                "200 1 200 75348 53.1 1.3 gitea /usr/local/bin/gitea web --config /home/wooo/gitea/app.ini",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    docker_file = tmp_path / "docker.prom"
+    docker_file.write_text(
+        'docker_container_cpu_cores{host="110",container_name="gitea"} 1.4591\n',
+        encoding="utf-8",
+    )
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(EVIDENCE_PATH),
+            "--host",
+            "110",
+            "--ps-file",
+            str(ps_file),
+            "--docker-stats-file",
+            str(docker_file),
+            "--json",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+    payload = json.loads(result.stdout)
+    assert payload["recommendation"] == "gitea_queue_or_hook_backlog_playbook"
+    assert payload["top_process_families"][0]["family"] == "systemd_control_plane"
+    assert payload["top_containers"][0]["container_name"] == "gitea"
+    assert "/home/wooo/gitea/app.ini" not in result.stdout
+
+
 def test_sustained_load_evidence_keeps_stale_container_samples_untrusted(tmp_path: Path) -> None:
     metrics_file = tmp_path / "host.prom"
     metrics_file.write_text(