diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index b597a02d516..0f70fb8f97e 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -376,7 +376,7 @@ Keyed on the **construction site (variant/fn name)** and the modeled op it *shou | ~~`live_deploy/` effect variants~~ **LANDED (D2 #7192)** | ~~`live_deploy/host_effect_script.dag`~~ **file deleted** — no such path in tree | decomposed (multi-op) | **A4 DONE** — verified 2026-07-26: `dag/gunbc/live_deploy/` is `apply · emit · intent · operations · readiness · service_ready · spec` only, and the directory contains **zero** `ShellCommand` occurrences. This closes do-not-miss item 1 below (the #7004/#7006 relocation debt) | | ~~`host_effect_realize.dag` · `ProvisionBuildCache`~~ **ARM SWAPPED, builders relocated** | ~~`host_build_cache_provision_script.dag`~~ **file deleted**; the 6 `build_cache_*_body` fns live in `host_effect_realize.dag` now, matched on `EnsureBuildCacheInstance { desired: BuildCacheInstance }` | decompose | **A5 partially un-deferred** — the effect grain swapped (bounded operator clearance), the shell body did not convert to typed argv; `#5828` still open, `admit_ensure_build_cache_instance` still not wired into realize (render-is-not-admit) | | ~~`host_effect_realize.dag` · `ProvisionCodexRuntime`~~ **LANDED** | ~~`host_codex_runtime_provision_script.dag`~~ **file deleted** — no such path in tree | typed observe/materialize/read-back argv steps (`gunbc.WitnessBin.Run` / `gunbc.Cli.Run` locally, `run_typed_argv_transport` over SSH/FleetSsh); verdict folded in `host_codex_runtime_provision_verdict.dag` | **A5 DONE** for this row — the other srv* A5 rows above remain deprioritized | -| hygiene reaper/liveness | `host_hygiene_reaper_script.dag` (4 `…_body`), `host_hygiene_liveness_script.dag` | decompose | **A5** srv* deprioritized | +| ~~hygiene reaper/liveness~~ **DELETED #8583** | ~~`host_hygiene_reaper_script.dag` (4 `…_body`), `host_hygiene_liveness_script.dag`~~ **file deleted** — migrated to typed `host_hygiene_reaper_observe.dag` / `host_hygiene_reaper_remediate.dag` / `host_hygiene_liveness_observe.dag` | typed observe/remediate modules | **A5 DISSOLVED #8583** — CASE 2 (file deletion upstream): script file deleted, construction migrated to typed sub-modules. No direct successor body names. | | `srv3_host_effect_apply.dag` · `Srv3*` variants, `srv3_install_diagnostic_checklist.dag` · `Srv3InstallDiagnosticObserve`, `nbd_proxy_virtual_media_install.dag` · `Srv3NbdProxyServe` | `srv3_host_effect_script.dag` (5 fns), `srv3_install_diagnostic_observe_script.dag` (5 fns) | typed observe/receipt effects | **A5** srv* deprioritized | **A1 dead-scaffold finding (census true-up, 2026-07-26).** The A1 typed migration (D2 #7192) dissolved the *live* read path onto `ShowProperty`/`ListUnits` but left two `systemctl` concat builders behind in `fleet_show_effective_read.dag`, orphaned: @@ -433,7 +433,7 @@ Exhaustive site list, verified on `origin/main` @ `efe67794cd` (enclosing fn in | `:742` | **`srv3_transport_test_executable`** | `test -x ` | A5-deferred (srv3) | | `:752` | **`srv3_apt_tool_present`** | `command -v ` | A5-deferred (srv3) | | `:775` | **`srv3_tool_bin_path`** | `command -v ` | A5-deferred (srv3) | -| `:821`, `:822` | **`srv3_chown_directory_to_current_user`** | `id -u` / `id -g` | A5-deferred (srv3) | +| ~~`:821`, `:822`~~ | ~~**`srv3_chown_directory_to_current_user`**~~ **RENAMED+CLIMBED #8796** | ~~`id -u` / `id -g`~~ | **CASE 4** — successor is `gunbc.host_effect_realize.srv3_ensure_directory_owned_by_current_user`. New name has a stronger guarantee (readback-based, not chown exit-status). | | `:1169` | **`run_shell_transport`** | `ssh_session_exec_script(script: script.body)` | **NOT srv3** — this is the realization core's `RetainedShellScript` → SSH path, i.e. the §5.E counted frontier's own transport. It dissolves when the frontier empties, not by a per-site migration. Do not edit under a 4.D brief | The original table's rows are retained below for provenance: @@ -457,16 +457,16 @@ These are correct as shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap | module | symbols | executor | | --- | --- | --- | -| `v2.workflow.ci_workflow_run_emit` | `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script` | GHA `run:` | +| `v2.workflow.ci_workflow_run_emit` | `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, ~~`ci_selection_control_script`~~ **DELETED #8283-CI-FLOOR-CUT** | GHA `run:` | | `v2.workflow.ci_floor_peak_emit` | `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script` | GHA `run:` (**cgroup-ascent leaves further climbed to typed path-intent by #7978, `ecbd0863c2a`; the peak calibration leaves remain raw Phase 2 — see §1.A and the Phase-1 row in §4.J**) | | `v2.workflow.ci_retry_emit` | `ci_cargo_eagain_retry_script` | GHA `run:` (via `ci_release_build_emit`) | -| `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, `gunbc_ci_run_script` | GHA `run:` (partial — still concat-wraps verify script) | +| `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, ~~`gunbc_ci_run_script`~~ **DELETED #9252-PLAN-WALK-DELETE** | GHA `run:` (partial — still concat-wraps verify script) | | `v2.workflow.orchestration_bash_emit_support` | `orch_bash_run`, `orch_bash_do`, `orch_bash_emit_pipeline` | shared emit plumbing (**#7265**; pre-existing four `ci_*_emit` forks migrate in PR2) | | `v2.workflow.ci_materialization_emit` | `ci_sccache_provider_shell_injection` | GHA `run:` (**LANDED #7265**) | | `v2.workflow.ci_merge_admission_emit` | `ci_floor_disposition_marker_init_script` | GHA `run:` (**LANDED #7265**) | -| `v2.workflow.ci_regen_rustfmt_path_emit` | `ci_regen_ensure_rustfmt_path_script` | GHA regen `run:` (**LANDED #7290**; typed control flow, but FileExists/session-env leaves remain raw as named in §4.J) | +| `v2.workflow.ci_regen_rustfmt_path_emit` | ~~`ci_regen_ensure_rustfmt_path_script`~~ **DELETED #8406-REGEN-ROOT-CUT** | GHA regen `run:` (**LANDED #7290**; typed control flow, but FileExists/session-env leaves remain raw as named in §4.J) | | `gunbc.assimilate.bmc_token_federation` | `gcp_token_smoke_script` | GHA `run:` | -| `gunbc.live_deploy.emit` | `expected_live_deploy_apply_script`, `expected_live_deploy_retract_script` | **RECLASSIFIED runtime-present, not an emit-completion receipt.** GHA supplies the outer `run:` medium, but gunbc is already executing and must interpret typed effects; its raw command leaves are the §4.J terminal row. | +| `gunbc.live_deploy.emit` | `expected_live_deploy_apply_script`, ~~`expected_live_deploy_retract_script`~~ **DELETED #7909-RELEASE-IDENTITY-REFACTOR** | **RECLASSIFIED runtime-present, not an emit-completion receipt.** GHA supplies the outer `run:` medium, but gunbc is already executing and must interpret typed effects; its raw command leaves are the §4.J terminal row. | | `gunbc.host_effect` | `fresh_standup_bootstrap_intent` → `EmitArtifactThenThinRun` bootstrap arm | pre-runtime bootstrap | **Remaining concat-built foreign-executor punch-list** — per-symbol table and PR batching in §4.J. @@ -627,7 +627,7 @@ The state of every PR in this arc, so nothing is missed if work pauses here. **A | --- | --- | --- | | ~17 `run:` bodies | `git rev-parse --show-toplevel 2>/dev/null \|\| pwd` | scope-widen on non-repo → typed refusal (`git.Core.ShowToplevel` with a `nonzero =>` refuse, not `pwd`) | | regen + floor steps | `git fetch --no-tags origin main … \|\| true` | stale-baseline on fetch failure silently corrupts the affected-set diff base → typed refusal or an explicit `DiffBaseUnavailable` marker downstream logic can gate on | -| `ci_workflow_run_emit.dag:31` · `ci_native_cache_root_toolchain_segment_command` | `rustc -V 2>/dev/null … ; if empty: toolchain-unresolved` slug | cache-poison fallback (all native-cache writes land in one poisoned root) → typed refusal on `rustc -V` failure | +| ~~`ci_workflow_run_emit.dag:31` · `ci_native_cache_root_toolchain_segment_command`~~ **DELETED #7436** | `rustc -V 2>/dev/null … ; if empty: toolchain-unresolved` slug | cache-poison fallback — **RESOLVED #7436**: toolchain segment computation reordered after setup-rust-toolchain; refusal instead of fabricated segment. | | `ci_spec.dag:219` · `ci_retry_escalation_level1` | `CARGO_BUILD_JOBS=1` on EAGAIN | masks a fleet-pressure *resource deficit* rather than emitting a typed counted diagnostic (its level-2 sibling `-u RUSTC_WRAPPER` was removed as STEP-2, #7138); recover parallelism-cap as a fleet-admission control, not a per-run silent degrade | **Adjacent (NOT shell-string) — cross-ref, tracked elsewhere.** The same audit found a second class the CI shares that is *not* a `ShellProgram`/string sink and so does **not** belong in this census: hand-spelled **config** that should DERIVE from an existing model. The exemplar is toolchain isolation — `ToolchainEnvIsolation = SharedHomeAcrossJobs \| PerJobCargoHome{…} \| HermeticContainer` (`extdeps/toolchain/types.dag`) is modeled and consumed by `sccache`/`fleet_intent`, but the workflow emit never reads `env_isolation`; it hand-spells per-job isolation (build isolates, the ci/gate job shares → the rustup `ETXTBSY` race, documented in PROSE in `ci_floor_gate_toolchain_note` on `ci_workflow.dag` rather than modeled/gated). Same shape for the GHA **cache key** (modeled `gha_actions_cache_facts` key-derivation vs the hand-spelled `ci_cache_key_template`), **artifact** upload/download (un-modeled; the dissolve-on artifact-CacheProvider named in `ci_materialization.dag` is undone), and **permissions** (`std.effect_grant` vs per-job `WorkflowPermissions`). These are the model↔realization-fork open thread + roadmap `2-emit-partition`, not the ShellProgram arc; noted so the audit's findings aren't lost across the seam. @@ -687,15 +687,15 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | ~~`ci_floor_disposition_marker_init_script`~~ | ~~floor opener (via `gunbc_ci_floor_only_script`)~~ | **RETIRED 2026-07-27** — its only purpose was clearing stale state for an unreachable zero-writer docs-only disposition family | | ~~`ci_documentation_only_gate_skip_prefix`~~ | ~~receipt gates, merge gate, selection control~~ | **RETIRED 2026-07-27** — all four readers, persistent marker writer, stamp branch, and admission override deleted atomically | | ~~`ci_merge_admission_gate_script`~~ (concat builder) | merge-admission gate step | **MIGRATED 2026-07-28 (#7363, Wave B)** — the builder is deleted; the step's `run:` is materialized from a typed `EffectPlan` (`v2.workflow.ci_merge_admission_gate_emit`) whose argv derives from `git.Core.FetchNoTags` and `gunbc.WitnessBin.Run`. The `ROOT=$(git rev-parse …)` line went with it; `FailFast` is now the carrier's policy (`Continue` refuses) rather than the runner's `-e` flag. Gate policy (merge base, tool entry/function, source roots) stays in `merge_admission_produce.dag` as language-blind rows | -| `ci_floor_stamp_merge_admission_script` | floor tail | **PARTIAL #7293** — control/capture now emit through typed `ExitStatus`/`IntNe`/`Exit`; remaining raw leaves are `ci_floor_stamp_ambient_exit_command`, `ci_floor_stamp_root_command`, and `merge_admission_stamp_command()` | +| ~~`ci_floor_stamp_merge_admission_script`~~ | ~~floor tail~~ | **STRIKE — all three raw leaves dissolved #7522 (87a4af3ad0).** `ci_floor_stamp_ambient_exit_command`, `ci_floor_stamp_root_command`, `merge_admission_stamp_command()` all deleted. CASE 1 dissolution. The "PARTIAL #7293" status is stale. | #### B — `ci_materialization.dag` (3 script surfaces) | symbol | GHA consumer | status / emit complexity | | --- | --- | --- | | `ci_sccache_provider_shell_injection` | isolate-toolchain pipeline | **DONE (#7265)** → `ci_materialization_emit` | -| `ci_floor_materialization_receipt_gate_script` | ci job gate | open — high (sed parses + if ladder) | -| `ci_floor_resolve_receipt_gate_script` | ci job gate | open — high (sed + numeric compare) | +| ~~`ci_floor_materialization_receipt_gate_script`~~ | ~~ci job gate~~ | **DELETED #7470 (b01cdf4d89).** CASE 1 dissolution — receipt gate dissolved with WalkPlan success stages finalization. No direct successor. | +| ~~`ci_floor_resolve_receipt_gate_script`~~ | ~~ci job gate~~ | **DELETED #7470 (b01cdf4d89).** CASE 1 dissolution — receipt gate dissolved with WalkPlan success stages finalization. No direct successor. | #### C — `ci_spec.dag` (~15 distinct script composers feeding GHA) @@ -706,14 +706,14 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | `ci_floor_build_verify_script` | build verify + unpack | emit (build_step transport pattern) | | `ci_release_bins_pack_script` | build pack artifact | emit | | `ci_release_bins_unpack_verify_script` | ci unpack step | emit | -| `gunbc_ci_floor_only_script` | ci floor `run:` | emit (composes A rows) | -| `ci_regen_floor_skip_shortcut_script` | regen skip | emit (`if` + cmdsubst) | -| `gunbc_ci_regen_floor_only_script` | regen job | emit (composer) | +| ~~`gunbc_ci_floor_only_script`~~ | ~~ci floor `run:`~~ | **DELETED #9252 (489346fff7).** CASE 1 dissolution — plan/walk CLI surface deleted, including its floor-only composer. | +| ~~`ci_regen_floor_skip_shortcut_script`~~ | ~~regen skip~~ | **DELETED #8406 (3b431f34a9).** CASE 1 dissolution — regen_stage0 root cut; regen skip shortcut dissolved with it. | +| ~~`gunbc_ci_regen_floor_only_script`~~ | ~~regen job~~ | **DELETED #8406 (3b431f34a9).** CASE 1 dissolution — regen_stage0 root cut; regen composer dissolved. | | `gunbc_ci_deploy_invoke` | deploy job | emit (thin gunbc run) | | `gunbc_ci_heal_regen_invoke` | heal regen | emit | | `gunbc_ci_heal_commit_push_script` | heal commit/push | emit (git verbs; future typed git ops) | -| `scheduler_invoke` / `scheduler_invoke_with` | floor/regen | emit (thin claim_executor) | -| `git_fetch_script` | floor/regen/deploy | emit (`git fetch` + fallback) | +| ~~`scheduler_invoke` / `scheduler_invoke_with`~~ | ~~floor/regen~~ | **DELETED #9252 (489346fff7).** CASE 1 dissolution — plan/walk CLI surface deleted; scheduler invoke removed. | +| ~~`git_fetch_script`~~ | ~~floor/regen/deploy~~ | **RENAMED #6833 (a5477cf5b4).** CASE 3 bare rename — successor is `git_fetch_no_tags_shell` / `git_fetch_prune_shell` in `dag/extdeps/git/git.dag`. Old name cleaned up by #9252. | #### D — permanent roster (emit target, never typed-op dissolve) @@ -726,14 +726,14 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | row | exact production symbols | owner | dissolve trigger | | --- | --- | --- | --- | -| Merge-admission foreign executor | ~~concat builder `ci_merge_admission_gate_script`~~ (deleted #7363); raw leaves remaining inside the already-emitted floor tail: `ci_floor_stamp_ambient_exit_command`, `ci_floor_stamp_root_command`, `merge_admission_stamp_command()` | roadmap `2-emit-partition`; gate half **CLOSED #7363 (Wave B)**; floor-tail half unassigned | **Gate half done:** the live gate composer is a typed `EffectPlan` materialized through the canonical Bash medium (`effect_plan_bash_materialize`, Wave A #7356) and its concat builder is deleted; argv derives from the referenced `extdeps` declarations, and a materialization refusal renders a located marker rather than substitute shell. The floor-tail leaves remain separate raw-`Run.command` work and were explicitly out of Wave B's scope. The zero-consumer stamp-script orphan and the zero-writer documentation-only disposition reader/marker/policy family retired rather than gaining invented consumers or dead FileExists/typed-read models. | -| CI materialization foreign executor | `ci_floor_materialization_receipt_gate_script`, `ci_floor_resolve_receipt_gate_script` | roadmap `2-emit-partition`; unassigned | same, with receipt parsing/refusal represented by typed predicates rather than `sed`/test strings | -| CI-spec foreign executor | `ci_release_build_line`, `ci_fmt_gate_line`, `ci_floor_build_verify_script`, `ci_release_bins_pack_script`, `ci_release_bins_unpack_verify_script`, `gunbc_ci_floor_only_script`, `ci_regen_floor_skip_shortcut_script`, `gunbc_ci_regen_floor_only_script`, `gunbc_ci_deploy_invoke`, `gunbc_ci_heal_regen_invoke`, `gunbc_ci_heal_commit_push_script`, `scheduler_invoke`, `scheduler_invoke_with`, `git_fetch_script` | roadmap `2-emit-partition`; unassigned; `ci_spec.dag` is load-bearing | `ci_fmt_gate_line` calls `cargo.Build.Fmt`; the remaining rows become typed intent → canonical Bash emission; old composers delete and `ci.yml` drift+parse stays green | +| Merge-admission foreign executor | ~~concat builder `ci_merge_admission_gate_script`~~ (deleted #7363); ~~raw leaves remaining inside the already-emitted floor tail: `ci_floor_stamp_ambient_exit_command`, `ci_floor_stamp_root_command`, `merge_admission_stamp_command()`~~ **STRIKE — all three raw leaves DELETED #7522 (87a4af3ad0). CASE 1 dissolution.** | roadmap `2-emit-partition`; ~~gate half **CLOSED #7363 (Wave B)**; floor-tail half unassigned~~ **CLOSED — entire merge-admission raw-leaf surface dissolved #7522.** | ~~Gate half done: the live gate composer is a typed `EffectPlan` materialized through the canonical Bash medium (`effect_plan_bash_materialize`, Wave A #7356) and its concat builder is deleted; argv derives from the referenced `extdeps` declarations, and a materialization refusal renders a located marker rather than substitute shell. The floor-tail leaves remain separate raw-`Run.command` work and were explicitly out of Wave B's scope. The zero-consumer stamp-script orphan and the zero-writer documentation-only disposition reader/marker/policy family retired rather than gaining invented consumers or dead FileExists/typed-read models.~~ **All raw leaves deleted; the "floor-tail half" is now closed.** | +| CI materialization foreign executor | ~~`ci_floor_materialization_receipt_gate_script`, `ci_floor_resolve_receipt_gate_script`~~ **DELETED #7470 (b01cdf4d89). CASE 1 dissolution — WalkPlan success stages finalization dissolved both receipt gates.** | ~~roadmap `2-emit-partition`; unassigned~~ **CLOSED.** | ~~same, with receipt parsing/refusal represented by typed predicates rather than `sed`/test strings~~ **Rendered moot — both symbols gone; receipt gates no longer exist.** | +| CI-spec foreign executor | `ci_release_build_line`, `ci_fmt_gate_line`, `ci_floor_build_verify_script`, `ci_release_bins_pack_script`, `ci_release_bins_unpack_verify_script`, ~~`gunbc_ci_floor_only_script`~~ **DELETED #9252**, ~~`ci_regen_floor_skip_shortcut_script`~~ **DELETED #8406**, ~~`gunbc_ci_regen_floor_only_script`~~ **DELETED #8406**, `gunbc_ci_deploy_invoke`, `gunbc_ci_heal_regen_invoke`, `gunbc_ci_heal_commit_push_script`, ~~`scheduler_invoke`, `scheduler_invoke_with`~~ **DELETED #9252**, ~~`git_fetch_script`~~ **RENAMED #6833** | roadmap `2-emit-partition`; unassigned; `ci_spec.dag` is load-bearing | `ci_fmt_gate_line` calls `cargo.Build.Fmt`; the remaining rows become typed intent → canonical Bash emission; old composers delete and `ci.yml` drift+parse stays green | | Phase-1 orchestration fidelity | ~~`ci_floor_peak_while_cond_command`, `ci_floor_peak_while_body_command`~~ **DISCHARGED #7978 (`ecbd0863c2a`, 2026-08-08)** — both leaves, and `ci_floor_peak_assign_cgroup_dir_command` with them, are derived from typed `std.path_intent` / `extdeps.linux.proc_self_cgroup` models via `bash_orch_if`, refusing with a located marker rather than widening. **Still open on the same module, and NOT discharged by that commit:** the peak calibration leaves (`ci_floor_peak_test_f_memory_peak_command`, `ci_floor_peak_echo_reset_redirect_command`, `ci_floor_peak_pre_reset_ok_command`, `ci_floor_peak_pre_reset_unsupported_command`, `ci_floor_peak_pre_unavailable_command`, `ci_floor_peak_post_ok_command`, `ci_floor_peak_post_unavailable_command`) and `bash_membership_assign_from_source`, which are Phase 2 typed-observation work | roadmap `6-shell-intent-phase1`; While-fidelity half CLOSED #7978, Phase 2 calibration half unassigned | ~~model the two live While leaves and move their discriminating witness onto normal cadence~~ (done); the residual trigger is Phase 2 typed filesystem observation through `host_effect_apply` for the calibration leaves; #7318 explicitly refuses nonempty Retry body `Run.env`, BoundedPoll was deleted 2026-08-07 (zero-production-constructor census), and three-or-more (N-level) Retry is refused, so the remaining scope/adoption claim either gains a need-driven consumer with faithful lowering or narrows explicitly | -| Already-routed foreign emit, terminal raw leaves | the §4.E exact output roster: `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script`, `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script`, `ci_cargo_eagain_retry_script`, `ci_release_build_script`, `gunbc_ci_run_script`, `ci_sccache_provider_shell_injection`, `ci_regen_ensure_rustfmt_path_script`, `gcp_token_smoke_script`, and `fresh_standup_bootstrap_intent`. The #7290 rustfmt-path output's exact raw leaves are `ci_regen_rustfmt_test_x_cargo_home`, `ci_regen_rustfmt_test_x_opt_cargo`, `ci_regen_rustfmt_test_x_home_cargo`, `ci_regen_rustfmt_test_x_rf`, `ci_regen_rustfmt_command_v`, `ci_regen_rustfmt_export_cargo_home_path`, `ci_regen_rustfmt_export_opt_cargo_path`, `ci_regen_rustfmt_export_home_cargo_path`, `ci_regen_rustfmt_export_rf_dir_path`, `ci_regen_rustfmt_error_echo`, `ci_regen_rustfmt_rustup_which_assign`, plus the inline `StrNonempty` shell operands in `ci_regen_rustfmt_probe_cargo_home_step` / `ci_regen_rustfmt_probe_rustup_then` | roadmap `2-emit-partition`; Phase-1 owns the While fidelity and scope/adoption subset | retain the correct foreign/bootstrap Bash target, but replace ambient `Run.command` strings with modeled `Do{effect}` leaves and delete each raw producer; for #7290 this is the cited `FileExists` + session-`EnvExport` carrier trigger; do not re-home them in another String carrier | +| Already-routed foreign emit, terminal raw leaves | the §4.E exact output roster: `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, ~~`ci_selection_control_script`~~ **DELETED #8283**, `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script`, `ci_cargo_eagain_retry_script`, `ci_release_build_script`, ~~`gunbc_ci_run_script`~~ **DELETED #9252**, `ci_sccache_provider_shell_injection`, ~~`ci_regen_ensure_rustfmt_path_script`~~ **DELETED #8406** (and all 11 named raw leaves similarly deleted: `ci_regen_rustfmt_test_x_cargo_home`, `ci_regen_rustfmt_test_x_opt_cargo`, `ci_regen_rustfmt_test_x_home_cargo`, `ci_regen_rustfmt_test_x_rf`, `ci_regen_rustfmt_command_v`, `ci_regen_rustfmt_export_cargo_home_path`, `ci_regen_rustfmt_export_opt_cargo_path`, `ci_regen_rustfmt_export_home_cargo_path`, `ci_regen_rustfmt_export_rf_dir_path`, `ci_regen_rustfmt_error_echo`, `ci_regen_rustfmt_rustup_which_assign`), `gcp_token_smoke_script`, and `fresh_standup_bootstrap_intent`. | roadmap `2-emit-partition`; Phase-1 owns the While fidelity and scope/adoption subset | retain the correct foreign/bootstrap Bash target, but replace ambient `Run.command` strings with modeled `Do{effect}` leaves and delete each raw producer; for #7290 this is the cited `FileExists` + session-`EnvExport` carrier trigger; do not re-home them in another String carrier | | Permanent foreign media | `expected_githooks_pre_push_sh`, `build_cron_entry_line` | roadmap `2-emit-partition`; unassigned | their **builders** route through typed intent → Bash; the emitted shell artifacts remain permanently because git/cron require that medium | -| Runtime `Run.command` / `ShellCommand` terminal | `live_deploy.emit.deploy_raw` fed by `ensure_apt_package_step`, `apply_systemd_unit_write_step`, `apply_tree_sync_unit_write_step`, `tree_sync_restart_step_with_diagnosis`, `tailscale_serve_apply_step`, `install_d_owned_command`, `deploy_apply_preamble_steps`, `emit_artifact_upsert`, `emit_artifact_teardown`, `emit_deploy_teardown_dependency_refusal`, `apply_intent_from_effects`, `retract_intent_from_effects`; `host_effect_plan_placeholder_effect`; the `gunbc.host_effect.ShellCommand` carrier and its total match consumers `host_effect_realize.resolve_host_effect_cell` and `fleet_converge_cli.converge_cli_applied_knob_count` | roadmap `2-emit-partition`, coordinated with the host-effect lane | replace `Run.command` / `ShellCommand` with `Do{effect}` typed operations, migrate every total match, then delete the carriers; never count Pipeline wrapping as completion | -| Deferred runtime srv\* | `host_effect_realize` · `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user`; `host_effect_realize` (relocated from the now-deleted `host_build_cache_provision_script`, unit body builder dropped in favor of `gunbc.build_cache_unit.render_build_cache_unit`) · `build_cache_observe_stats_body`, `build_cache_classify_failure_body`, `build_cache_ensure_daemon_body`, `build_cache_read_back_body`, `build_cache_provision_script_body`, `build_cache_provision_shell_script`; `host_hygiene_reaper_script` · `host_hygiene_reap_install_units_body`, `host_hygiene_reap_classify_and_act_body`, `host_hygiene_reap_stale_override_body`, `host_hygiene_reap_script_body`; `host_hygiene_liveness_script.host_hygiene_liveness_read_body` | operator-deferred surviving srv\* actuator/runtime graph | un-defer a typed-effect migration with its live consumer; the separate dead install/reconcile subgraph is already deleted (#7233/#7237), so do not polish or resurrect it; build-cache's own trigger is `#5828` — the relocation into `host_effect_realize` is not that trigger firing | +| Runtime `Run.command` / `ShellCommand` terminal | `live_deploy.emit.deploy_raw` fed by `ensure_apt_package_step`, `apply_systemd_unit_write_step`, `apply_tree_sync_unit_write_step`, `tree_sync_restart_step_with_diagnosis`, `tailscale_serve_apply_step`, `install_d_owned_command`, `deploy_apply_preamble_steps`, `emit_artifact_upsert`, `emit_artifact_teardown`, `emit_deploy_teardown_dependency_refusal`, `apply_intent_from_effects`, `retract_intent_from_effects`; ~~`host_effect_plan_placeholder_effect`~~ **DELETED #10509**; the `gunbc.host_effect.ShellCommand` carrier and its total match consumers `host_effect_realize.resolve_host_effect_cell` and `fleet_converge_cli.converge_cli_applied_knob_count` | roadmap `2-emit-partition`, coordinated with the host-effect lane | replace `Run.command` / `ShellCommand` with `Do{effect}` typed operations, migrate every total match, then delete the carriers; never count Pipeline wrapping as completion | +| Deferred runtime srv\* | `host_effect_realize` · `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, ~~`srv3_chown_directory_to_current_user`~~ **DELETED #8796 (see §4.D)**; `host_effect_realize` (relocated from the now-deleted `host_build_cache_provision_script`, unit body builder dropped in favor of `gunbc.build_cache_unit.render_build_cache_unit`) · `build_cache_observe_stats_body`, `build_cache_classify_failure_body`, `build_cache_ensure_daemon_body`, `build_cache_read_back_body`, `build_cache_provision_script_body`, `build_cache_provision_shell_script`; ~~`host_hygiene_reaper_script` · `host_hygiene_reap_install_units_body`, `host_hygiene_reap_classify_and_act_body`, `host_hygiene_reap_stale_override_body`, `host_hygiene_reap_script_body`~~ **ALL DELETED #8583 (see §4.A)**; ~~`host_hygiene_liveness_script.host_hygiene_liveness_read_body`~~ **DELETED #8583** | operator-deferred surviving srv\* actuator/runtime graph | un-defer a typed-effect migration with its live consumer; the separate dead install/reconcile subgraph is already deleted (#7233/#7237), so do not polish or resurrect it; build-cache's own trigger is `#5828` — the relocation into `host_effect_realize` is not that trigger firing | | Direct meta-exec construction | `tools.gunbc_ci.main`, `tools.merge_admission_stamp.pr_number_from_event`, `tools.emit_host_gate.gate_failure_exit`, `tools.host_prelude.toolchain_provision_shell_exec`, `gunbc.bmc_netboot_serve.bmc_netboot_run_bmc`, `gunbc.bmc_netboot_serve.bmc_netboot_put_path`, `gunbc.command_runner.run_shell_command`, `gunbc.host_effect_realize.run_shell_transport` — direct `shell.Exec.Run` sites through the two counted bridges | per-site runtime/foreign owners delete their bodies | **construction is closed at both edges** (#7184 record wall, #7962 seal); these rows are migration work, not wall work, and the `Reference`-verb lane is no longer their blocker | **srv3 deferral — premise measured false, disposition still owed (2026-08-20, measured at `origin/main` `4cec10f6`).** The deferral of the `srv3_*` runtime helpers rested on the premise that the subgraph was pending subsumption by the `EmitArtifactThenThinRun` transport, so migrating its call sites would be wasted work. That premise is false, and the refutation is a typed refusal rather than an absence: all 22 `EmitArtifactThenThinRun` match arms in `gunbc.host_effect_realize` refuse, none accept, and the refusal text names the boundary — *"reserved for ConvergePlan (host-effect Phase D)."*