fleet-converge: run the reset-return dispatch admission only for host_reset_return

[gunbai-bot]

Work item adhoc-8fe41036-aa4 (operator ruling 2026-09-27: fleet-converge overhead toward 0).

Root cause. In gunbc.fleet_converge_workflow, fleet_converge_reset_observer_dispatch_admission_step had if_condition: none. The step's fold (host_reset_return_dispatch_admission_wet) maps every other mode to ResetDispatchNotThisMode => ExitSuccess, so the mode decision was made inside a gunbc run process that costs minutes, on every dispatch of every mode (e.g. mtcollins1_boot run 36253081549).

Fix. The step now carries fleet_converge_host_reset_return_step_if = fleet_converge_mode_step_if(mode: HostResetReturn), the same roster-derived gate the reset job's own steps use — no second list. A skip is exactly the NotThisMode arm, decided by the runner. The safety property is unchanged: for host_reset_return the step still runs before the reset job is scheduled.

Audit of the build job. Remaining own steps (release build, pack, upload) serve every mode: the fleet-converge job downloads release-bins unconditionally, so none runs for a mode it doesn't serve. The checkout/prelude steps are shared prelude.

Witness. the_build_job_carries_the_reset_observer_dispatch_admission now also asserts the step's gate equals the HostResetReturn mode condition; removing the gate turns it red.

Regenerated YAML diff: one line — if: github.event.inputs.mode == 'host_reset_return' on the step (applied in emitter shape; the regen fixed-point lane verifies it against the model).

Evidence (instrument, not transcription): before = step timings of run 36253081549, job build, via gh run view 36253081549 --json jobs; after = the same query on the next mtcollins1_boot dispatch after merge, where the step must report skipped. Not yet dispatched — requires merge to main (mtcollins1_boot checks out github.sha of the dispatched ref).

🤖 Generated with Claude Code

[briansrls]

APPROVE-MERGE — exact head f9db76b65a8bf5291396bdbb89b91d7745b16e3b, reconfirmed as the current open, non-draft, mergeable head targeting main. No blocking finding.

The mode gate preserves the host_reset_return admission refusal. This change removes an unnecessary process invocation for other declared workflow modes; it does not turn an applicable safety refusal into a skip.

Reviewed the complete three-file delta: the modeled admission step changes only its if_condition from none to Present { value: fleet_converge_host_reset_return_step_if }, accompanied by the explanatory annotation; the generated YAML gains the corresponding one-line if: github.event.inputs.mode == 'host_reset_return'; and the existing routing witness gains an assertion of that condition. The admission invocation, input environment, timeout and error behavior are unchanged.

Safety route checked at this head:

1. fleet_converge_host_reset_return_step_if is derived by fleet_converge_mode_step_if(mode: HostResetReturn) from the existing mode vocabulary. The host-reset-return JOB uses the same condition. The new step condition does NOT inspect reset_observer, so an empty observer cannot make an otherwise applicable host_reset_return admission disappear.
2. The admission remains in fleet_converge_build_job_own_steps, after release build and before pack/upload. The generated step calls the original host_reset_return_dispatch_admission_wet entry and passes the original dispatch mode and observer through GUNBC_HOST_RESET_DISPATCH_MODE and GUNBC_HOST_RESET_OBSERVER. There is no || true, conditional observer default, or continue-on-error added.
3. admit_reset_dispatch still distinguishes NotThisMode, admitted reset dispatch and unnamed observer; it trims the observer, so both empty and whitespace-only values refuse for the canonical host_reset_return mode. The wet entry maps ResetDispatchObserverUnnamed to exit_failure with the existing ResetObserverUnnamed diagnostic, rather than success.
4. The generated host-reset-return job retains needs: [build] and the ordinary mode-only job condition, without always() or another failure override. Therefore this admission's failed step fails build and prevents the reset job from running. If an earlier build step fails so admission cannot run, the same dependency also prevents the reset job. For other declared modes, skipping this one step does not skip the build job or its release-artifact handoff.

The witness change checks the REAL build-job own-step list, requiring the expected step identity, exact roster-derived gate, target entry and function, and both dispatch-input environment bindings. A missing/incorrect gate cannot satisfy that new conjunct. Existing neighboring controls still exercise unnamed reset refusal, named reset admission, other-mode non-applicability, whitespace-only refusal, and the build dependency edge. I inspected their assertions; I did not independently execute them or the stated gate-removal mutation.

The remaining build, pack and upload steps still provide the shared release artifacts; this PR neither removes those capabilities nor changes the selected jobs' consumers. The approval does not claim overall fleet-converge overhead is now zero, or that building the entire release-bin roster is globally minimal. It accepts this narrowly removed not-this-mode invocation.

Non-blocking import hygiene: the new witness reference to HostResetReturn is not in that file's explicit gunbc.fleet_converge_workflow import list. Include it alongside the other named modes when touching the witness next; this is not a reason to widen or change the gate.

Evidence scope: source and generated-workflow review only. I did not rebuild, regenerate, run claim_batch, dispatch a workflow, or independently measure the reported approximately four-minute saving. The after-merge measurement remains the named admission step reporting skipped on a non-reset dispatch; no live post-change receipt exists in the supplied evidence.

At the latest exact-head check, clippy was successful; compiler, floor and emit-build were still in progress. Require the normal exact-head and merge-queue gates to finish green before landing.

[briansrls]

STRATEGY REVIEW — APPROVED WITH AMENDMENTS. This is approval of the fleet-converge overhead work plan, not an exact-head approval of unsubmitted implementation and not authorization to execute a live boot/reset/IAM operation. Existing source approval of #12419 is unchanged.

Decision: retain the three independent lanes; choose route B (the existing fleet-converge build job as the on-demand keyed release-pack producer). Do not widen the required merge-group/floor/witness job roster or add R2 publication credentials there merely to manufacture a cache producer. This is a scoped first implementation choice given the submitted producer inventory, not a claim that route B is globally optimal for every future workload.

1. Mode applicability: fleet-converge: run the reset-return dispatch admission only for host_reset_return #12419 is already source-approved at f9db76b (review 5330982020). Preserve the actual applicable admission: gate on mode, not on whether a required observer/consent/input was supplied. For host_reset_return with an unnamed observer, admission must still execute and refuse before its dependent job. No blanket removal of admissions in the name of speed.

2. Pre-entry cost: approve phase decomposition and repair at the earliest unjustified demand. The RFM explicitly calls whole-tree preparation a hypothesis, not an established cause. Reuse the existing observation/timing infrastructure for a committed named instrument: distinguish startup/root/name-index work, closure discovery, parse/resolve/typecheck, context/service construction and first entry evaluation; record wall/CPU and actual populations, retaining unaccounted time rather than inventing attribution. Measure a tiny credential-free entry and actual separately compiled operational entries; unrelated-tree growth must not silently change their meanings. Entry closure is semantic dependency closure under the real roots/options, not merely textual imports. Necessary global name-resolution facts may need an indexed producer; deleting visibility or diagnostic obligations to make the corpus smaller is not approved. Share repeated same-input work within the invocation before introducing a provider. Cross-invocation materialization must obey std.materialization_ladder. The design note before a large change must state the cut, affected entry/configuration population, preserved refusals and falsifiers. The infer: refuse a Present arm over an unresolved scrutinee (silent wrong answer from #12386) #12398 union-closure census is not independent-entry equivalence evidence.

3. Release reuse: route B is approved subject to these implementation boundaries.

• Use one typed request/result contract through the existing identity/materialization authorities, deriving required outputs from gunbc.ci_release_bins rather than copying sixteen names. std.computation_identity provides identity grades, not a complete release-pack input recipe by itself; the concrete request and canonical input binding still have to be modeled.
• Close the build-input preimage. Besides source/linked/generated inputs, lock/manifests/configuration, toolchain, host/target, profile/features/flags and bin roster, account for embedded build identity. At reviewed main 9ce0394, src/v1/stage0/build.rs embeds either GUNBC_MATERIALIZED_TREE_IDENTITY or git HEAD plus dirty state. A tree-only key does not cover that commit-stamped output. Include the actual identity input, or use the already-modeled materialized-tree path with its derivation established. Do not restamp an old binary as the current commit. rustc -V alone is not the entire Cargo/linker/build-script environment. Unknown relevant inputs refuse reuse; omit a dimension only with an established invariance argument.
• Keying happens against the actual admitted checkout, before the costly build, without a new full-cost gunbc invocation merely to decide reuse. On a hit, avoid miss-only build setup/compilation/repacking where the verified pack can be handed through unchanged. Preserve the current build-job dependency and current-run release-bins handoff on both paths.
• An exact key recorded beside an artifact is not proof of the artifact's bytes or its producer. Derive the expected key independently; verify the immutable payload/member digests, complete roster and supported execution platform, and constrain which admitted source/recipe/principal may publish a reusable executable. Do this before executing anything from the restored pack. Carry build provenance separately from current dispatch identity; do not fabricate a current-run build receipt on a hit.
• If the chosen backend is actions/cache, model its actual behavior: GitHub documents prefix matching of the primary key even without restore-keys. Require an actual exact match, not a truthy output or mere file existence. Restore into isolation rather than over the active checkout/executable directory. A returned wrong-key/corrupt/incomplete candidate refuses; no fallback scan/latest selection or laundering it into a cold build.
• Ordinary exact-key absence/eviction leads to the original build and validated immutable publication, with a counted miss. Transport failure is not absence; corruption is not eviction. Provider retention/capacity and publication/race behavior must be explicit. Never overwrite conflicting same-key bytes or globally serialize/cancel unrelated fleet dispatches. A valid fresh build with a failed save is not evidence that persistence succeeded; its permissible degradation, if any, must be separately named and reviewed.
• Keep runtime authority fresh: a cached toolchain does not authorize a boot, satisfy UnitHoldProof, establish current EDAC/power state, or substitute for live image readback. Retain the per-dispatch admissions and evidence route.

Acceptance of the reuse implementation needs a real cold build/publish -> separate-dispatch restore -> actual consumer path, plus mutated-input, wrong-key, tampered/missing-bin, invalid-producer and eviction controls. Measure warm total cost (identity + lookup + transfer + verification + handoff), not just a skipped Cargo step. Same-key reuse does not make a first dispatch at a new build identity free. Keeping the existing complete pack is a safe initial scope; it does not establish that every member is necessary for every mode forever.

4. Boot waits belong in the optimization objective, as separate reviewed changes rather than a dependency that stalls the three lanes. Remove gratuitous sleeps or replace readiness waits with immediate observation and bounded event/poll waiting; do not remove protocol-required settling, minimum observation/test coverage, or finite failure bounds. A timeout allowance is not elapsed work. main's boot model distinguishes a 15-second poll cadence and 2-second SOL settle from its timeout allowances. Preserve param5 before/handoff/after, terminal evidence and final-power attribution under the same unit hold before release; do not parallelize away those causal edges. CPU/socket/RAM observations are published as observed capacity, not waited on until a wished-for topology appears. Any health/qualification cutover is its own modeled change.

Reported baseline is 11 minutes across the three stated pre-hardware steps; savings must not double-count the pre-entry work already removed when an entire inapplicable step is skipped. Optimize time to first authorized hardware action and time to completed verified observation separately, and report cold and warm cases. No live post-change latency or cache-hit result was measured by this review.

[briansrls]

Follow-up to the approved overhead strategy (comment 5857457629), at the operator's explicit request to make the manual boot-retry residue modeled and wired: tracked in #12423. This does not revoke this PR's source approval or make all recovery work a dependency of the mode-gate change.

Please route #12423 to sleek-fox-141's attach change and the boot-waits/recovery child, link their actual PR heads, and attach the retained manual-residue log/response evidence (redacted; no bearer material). I found no pushed attach PR/branch to bind a source verdict to yet.

Load-bearing correction: the current megarac_redirection_presentation_standing accepts 100/connecting and 1/started as presenting, and both the fresh and already-attached routes can immediately authorize handoff through ExitSuccess. A new readiness fold must be consumed by mtcollins1_boot_actuate -> mtcollins1_drive_handoff, on BOTH routes, under the same UnitHoldProof. For this repair, keep connecting pending and wait boundedly for a verified started presentation of the exact intended image; do not erase the historical observation that 100 once booted GRUB or claim code 16/255 has an established vendor meaning.

The tracker requires StopMedia response + independent detach readback (1411 is not an automatic success), fresh post-detach enumeration, no mount_cd refresh toggle, no first-row/ambiguous-session readiness, bounded request/poll deadlines rather than a fixed 12-second/two-minute sleep, and evidence in the actual attempt/bundle. A separate recovery policy must preserve original boot failure and pre/post-cleanup power; no blanket failure=>power-off and no new destructive action smuggled into the on-or-cycle handoff.

Current run 36333687404 was manually preconditioned with attached/started media. Even a successful CPU/EDAC result from it cannot establish automated detach/attach/readiness recovery. Close residue only when the implementation, real consumer, discriminating production-route control and retained unassisted execution receipt are joined. A local log plus a promise, or a named open item, is not closure. No live action was taken by this review.

[briansrls]

DECISION — APPROVE WITH AMENDMENTS: scope entry-path bare-reference admission to the entry's semantic closure, and retain the full-pool obligation in a required whole-tree phase. This is the requested decision within the pre-entry lane, discussed against still-deer-403's instrumented tree 7737ee5. It is NOT an exact-head merge approval of the unsubmitted scope change, and changes no live authorization. Please link this decision from that lane's design/implementation PR. The existing #12419 source approval is unchanged.

The two intended contracts are different and both are approved:

• An entry run establishes the applicable reference/admission facts for its actual semantic dependency closure under its supplied roots and resolution policy. It is not a whole-repository clean certificate.
• Repository acceptance establishes the bare-reference obligation over the declared whole-pool population before a PR/merge-group can pass.

Important precedent correction: #11092 is precedent for demand-driven EDGE PRODUCTION, but it deliberately retained the unrelated-file ambiguity refusal. Its four-module fixture made both the unrelated entry and the ambiguous consumer refuse. Removing the unrelated-entry refusal is therefore a newly authorized boundary change here, not behavior already authorized by #11092. The parse-sweep precedent supports moving an obligation to its proper consumer, but grammaticality does not discharge semantic bare-reference admission.

Conditions for the implementation:

1. ATOMIC COVERAGE CUT. The entry-scoping change must land with the named whole-pool phase and its real required consumer, or after that consumer is already enforced. No intervening state in which the runtime check has gone and CI coverage is merely a follow-up. Reuse an existing required job/whole-source preparation route; this decision authorizes the semantic phase, not a new CI job, credentials, or an unreviewed budget increase. The PR must name module/symbol -> phase roster/driver -> emitted workflow invocation -> blocking terminal result. Both pull_request and merge_group must judge the subject tree. A merge-group-only regeneration phase is insufficient. The reviewed branch's witnesses.yml has both triggers, but its stage0_regen step is explicitly merge_group-only: do not confuse workflow trigger coverage with phase execution coverage.

2. SAME PREDICATE, DIFFERENT DEMAND. Reuse one per-source bare-reference judgment and its existing resolution semantics. The entry consumer folds it over reached eligible files; the whole-pool consumer folds it over the complete declared eligible pool. Preserve the current import-less eligibility rule, ambiguity/candidate multiplicity, located causes, and required observation completeness. Do not add exclusions to green the sweep or replace a failed/missing source judgment with an empty edge row. Keep existing intentional-invalid fixture dispositions explicit. Share the heads/parse readings already owned by the required preparation rather than adding another unconditional whole-pool parse merely to run the new phase.

3. CLOSURE MUST INCLUDE SEMANTIC DEPENDENCIES. Demand-driven does not mean textual-import-only. Evaluate reference selection for each reached file against the same complete heads-derived name/candidate context, close transitively over selected providers and the existing sidecar/ancestor/import rules, and refuse on relevant ambiguity before evaluating the entry. A declaration outside the final selected closure can still affect name resolution and is not 'unrelated' merely because it was not selected. Keep the global name facts needed for that decision; remove unrelated body work, not those facts. Step 1's explicit whole-graph consumers (affected-set/compile-clean and relevant reverse walks) must retain full edge coverage through the same authority rather than a second implementation.

4. DO NOT REUSE A POOL-WIDE GREEN BIT FOR SCOPED ADMISSION. The instrumented diff shows admit_pool_bare_references first reading index.bare_reference_admission and later storing one cached Result there. After scoping, success for closure A cannot certify B or certify the pool. Use scope/input-correct existing cache machinery or per-file judgments whose validity is bound to the file AND its relevant pool name environment/compiler policy. The consumer must establish every demanded file's coverage. A required full-pool phase cannot return early merely because an entry run previously filled that slot. Required control: same index, unrelated clean entry first, then a poisoned entry and then the whole-pool demand; the latter two must refuse. Repeat the meaningful order/cache variations and invalidate correctly when source/candidate facts change. No new cache framework is requested.

5. REQUIRED MEANS JUDGED, NOT PLANNED OR SKIPPED. This is not an ordinary diff-selected witness. Keep the full-pool phase outside unchanged/no-op shortcuts that would skip its subject, or make such shortcuts consume an exact full-subject admitted receipt with the same complete diagnostics/coverage contract. Under the requested every-PR/every-merge_group policy each run must execute the phase's admission; no stale green from another tree or merely successful job label. A timeout, abandoned check, or unavailable observation is not a zero-refusal pass. A control must fail the required result when the phase is removed/bypassed, not only when its internal predicate changes.

6. CONSUMER CENSUS AND SCOPE HONESTY. Enumerate callers and operating configurations, not only the helper's direct Rust call sites: gunbc run/compile and per-entry discovery/test routes; shared-index/module-binding evaluation; whole-pool compile-clean, affected-set and regeneration/reverse-walk routes; and any named operational workflow that relied on pool-wide refusal before its entry. Classify each as entry-local (approved narrowing), whole-pool (retain explicit judgment), or historically reliant and migrated to a named required result. This is the population to be derived, not a claim that this list is an exhaustive census. Local dirty workspaces/additional roots are not certified by a CI result over some other tree. Do not solve that by restoring a full-tree preflight to every local run: keep entry-local execution honest, and require an explicit matching whole-pool judgment only from consumers that actually need one. Update affected RFM/guarantee statements and preserve old falsifiers at their new acceptance boundary; no claim of byte-identical CLI behavior on the intentionally changed unrelated-bad-file case.

Minimum discriminating matrix:

• Bad bare reference/ancestor ambiguity in a genuinely unrelated eligible file: entry run succeeds under the narrowed contract; required whole-pool phase refuses with the located cause, on PR and merge_group routes.
• Same bad source made reachable, including through a reference-derived edge rather than an explicit import: entry still refuses before its function executes; whole-pool phase refuses.
• Valid twin: both accepted; demanded provider selection, closure identities/typed keys and program stdout retain the expected result.
• Missing/unreadable required observation or incomplete census: refuses rather than reporting zero or terminating closure discovery early.
• Reused index/cache case above: no scoped-success contamination.
• Bypass/remove the full-pool phase: an executing required-path control goes red. Keep the original non-closure ambiguity specimen, pairing its new entry-local outcome with the mandatory global refusal rather than deleting the negative evidence.

Evidence must exercise actual entry configurations. A synthetic union closure does not establish every entry's meaning without equivalence; the #12398 coverage hold is not waived here. Ordinary source compilation is enough for this change's operational census; do not execute boot/IAM functions to measure it.

Cost receipt: the proposed whole-tree selection term is replaced with reached-file work, not made physically free. Re-measure total time plus exclusive phases and admitted populations; the inclusive resolve row cannot be added to its children. Report cold and warm paths and the incremental cost in the required phase. A disappearing timer label is not itself the saved-time result. The submitted remote timings remain author-run evidence; I did not independently reproduce them. I inspected the instrumentation delta, relevant entry/model/workflow sources and #11092 history; I have not exhaustively enumerated the callers or verified a completed replacement phase.

Bottom line: proceed with both independent optimizations. Step 1 preserves selection semantics; the proposed bare-reference split intentionally changes which consumer demands whole-pool admission. The latter is approved only with the full required-path cutover, scope-correct admission caching, preserved closure refusals and named consumer dispositions above. No additional strategy approval is needed for that shape; the resulting implementation still needs exact-head review.

[briansrls]

The operator's boot-process ruling and 100-host reliability target are recorded at #12423, comment 5858637192: STOP → ROOT CAUSE → strengthen the model for the failure class → exact-head review → proceed. Please route the SOL child's actual PR/head there and keep the next boot paused until its integrated deployed path clears the applicable findings; a merge event alone does not clear that hold.

This does not revoke #12419's previous source approval at f9db76b or require unrelated recovery work inside this patch. The adjacent class for its review is admission/effect applicability disagreement: a new/unknown/missing mode, drift between the mode condition on the admission step and the consuming job, or skipping a refusal because the required observer input is absent. Keep the single roster authority and execution controls over the applicable refusal. No new full-tree runtime preflight is requested.

Fresh get_pr_info readback reports this head non-mergeable against main; treat that as the current metadata, not the earlier queued status. Resolve and rebind source changes through the normal exact-head process. Separately, a successful non-reset skip demonstrates this optimization only; it is not evidence that media/SOL/whole-boot correctness is established.

The process record explicitly separates verified functional success from safe refusal and excludes no software/transport failures by silently labeling them hardware failures. This is process coordination, not a fresh source verdict or live authorization.