Refuse a warm pool no Bot can be handed a computer from

.github/workflows/ci.yml

@@ -159,6 +159,14 @@ jobs:
             --set networkPolicy.enabled=true \
             --set computers.extraEnv[0].name=EGRESS_PROXY_DEFAULT \
             --set-string computers.extraEnv[0].value=http://proxy.internal:3128
+          # A warm pool nothing claims from. Only meaningful where the target asks for per-Bot
+          # computers; on the others the mode is not sandbox and the refusal is not armed.
+          if grep -qE '^ *mode: sandbox' charts/openbot/ci/${{ matrix.target }}-values.yaml; then
+            refuses "a warm pool no Bot can be handed a computer from" \
+              --set computers.sandbox.warmPool.enabled=true
+          else
+            echo "skipped: the warm-pool refusal is only armed for computers.mode: sandbox"
+          fi
       # And that a values key this chart did not used to have still renders when it is absent.
       #
       # `helm upgrade --reuse-values` takes the previous release's computed values rather than

charts/openbot/templates/validation.yaml

@@ -112,6 +112,27 @@ This template renders nothing.
 {{- end }}
 {{- end }}
 
+{{- /*
+  A pool of warm computers that nothing takes one from.
+
+  `warmPool.enabled` renders a `SandboxWarmPool`, grants the service account `create` and `delete` on
+  `sandboxclaims`, and holds `replicas` browsers ready. A Bot reaches a warm one by claiming it, and
+  the server has no code that creates a `SandboxClaim`: `locate` posts a new `Sandbox` and waits for
+  it, the same as with no pool at all. `warm?()` is declared on the provider interface and called at
+  startup, but no provider implements it, so the call is skipped.
+
+  So the pool runs, reports healthy, and bills for browsers nobody is ever handed, while every first
+  action waits exactly as long as before. That is the same shape as the missing-CRD refusal above —
+  an install that looks finished and is not — and it is worse here because nothing ever fails, so
+  there is no moment at which anybody finds out. A refusal at install is the cheapest place to say so.
+
+  Remove this block when the provider claims from the pool. It is a note that the wiring is
+  unfinished, not a judgement that the feature is unwanted.
+*/}}
+{{- if and (eq .Values.computers.mode "sandbox") .Values.computers.sandbox.warmPool.enabled }}
+{{- fail "computers.sandbox.warmPool.enabled is on, but nothing claims from the pool yet: the server creates a Sandbox per Bot and never a SandboxClaim, so the pool would run and bill without ever shortening a first action. Set computers.sandbox.warmPool.enabled=false until claiming ships." }}
+{{- end }}
+
 {{- if not (has .Values.computers.mode (list "shared" "sandbox" "external")) }}
 {{- fail "computers.mode must be one of: shared, sandbox, external." }}
 {{- end }}

charts/openbot/values.yaml

@@ -240,6 +240,11 @@ computers:
     requireController: true
     namespace: ""
     # Pre-warmed sandboxes, so a Bot's first action after lunch does not wait for Chromium to boot.
+    #
+    # Not usable yet, and the chart refuses to render with it on. A Bot reaches a warm sandbox by
+    # claiming it, and nothing in the server creates a SandboxClaim: `locate` posts a new Sandbox and
+    # waits for it, pool or no pool. Left here, with the template and the RBAC beside it, because the
+    # missing half is the claim rather than any of this.
     warmPool:
       enabled: false
       replicas: 2