File what the preferred repair actually costs, against the ruling that requires it

dag/gunbc/recurring_failure_mode/capability_arrives_outside_the_converged_path.dag

@@ -29,6 +29,8 @@ data capability_arrives_outside_the_converged_path: RecurringFailureMode = Recur
 
     "AND THE REASON IT HAS NO CALLER IS ITSELF A NAMED CLASS, WHICH IS WHY THE WIRING NEVER HAPPENED. The module was not deferred pending an ownership decision and it is not a half-finished design: #10628 introduced it WHOLE, expressly to close this gap -- that commit's own account is that `executor_privileged_operation_argv` had no production consumer, that `runner_host_privileged_operations` fed only the sudoers renderer, and that this module 'closes it, and executes THE SAME argv function' -- and then landed it without the caller it was written for. That is DESIGN section 3c exactly, down to the tell that section lists in its own words: consumption described in the PR body but absent from the diff. So the repair that was supposed to end this class was itself an instance of a neighbouring one, and the two facts are the same fact: 'one wiring remains' and 'a section 3c dangling consumer' describe the same missing edge, but only the second says WHY it is missing and therefore why waiting will not produce it. ",
 
+    "THE PREFERRED REPAIR IS MORE EXPENSIVE THAN THE RULING ABOVE READS, MEASURED WHEN A LANE TRIED TO TAKE THE CHEAP ROUTE INSTEAD. Closing this in fleet converge is not a call-site move: `gunbc.fleet.fleet_converge_plan` imports only `fabric_cell_effect_operations` and `fabric_allocation_store_effect_operations` from `gunbc.runner.runner_host_grants`, and NOTHING in the corpus consumes `runner_host_privileged_operations` except `runner_host_sudoers_content`, the renderer that writes permission. So the preferred arm requires the converge plan to CARRY and APPLY host privileged operations, with the lease and receipt story attached -- `fleet_converge_plan_held_lease` is generation-scoped so two applies against one baseline cannot both proceed, and an apply reached outside that spine inherits none of it. That is a piece of the converge spine, not a wiring. THIS IS WHY THE CHEAP ROUTE KEEPS BEING ATTEMPTED AND MUST KEEP BEING REFUSED. A lane wired the existing applier from `gunbc.runner_microvm_host_ready` -- the disclaiming module -- as its own CI run step, which is exactly the arm this ruling forbids, and did not notice it had done so. The refusal is not stylistic: an applier that lives beside the disclaimer inherits the disclaimer position and therefore its blind spots, which is how the capability arrived outside the converged path to begin with. Recording the cost here rather than softening the ruling, because the ruling being expensive is the reason nobody has discharged it -- not evidence that it should not be discharged. ",
+
     "REPAIR, IN PREFERENCE ORDER: bake the capability into a host image so the question cannot be asked, or close it in fleet converge. NOT an applier bolted beside the disclaiming module, and never the sudoers argv by hand -- that converts a modeled hole into a second undeclared deviation, which is how specimen A was produced. The reviewer's question for any host-capability claim: which run put it there, and can you name it. ",
   ],