belt: demote the monolithic tick into event-driven attempt obligations (dogfood #6+#4)

[gunbai-bot]

Dogfood interventions #6 (the monolithic belt tick) and #4 (event-driven, not timer-driven), from gunbc#13124. Design and rulings: docs/plans/belt-event-driven-obligations.md. This executes the 2026-09-22 owner ruling "The belt demoted: wake-up and anti-entropy only".

What changes

The tick is demoted to launch. belt_tick_for_instance now runs launch admission, spawn, teardown and bounded discovery, and nothing else. The inline capture, verify, review, audit, publish and metering passes are deleted, together with their batch functions.

Obligations (gunbc.roadmap.roadmap_belt_obligation):

• Each attempt's obligations run in that attempt's own transient unit (belt_attempt_obligations_cli). It calls the same per-attempt cores in eligibility order and re-observes after each one.
• Each instance fold (launch, served observation, result return, metering, dogfood start record, snapshot census) runs in its own unit.
• Whether an obligation is outstanding is derived from the attempt's segments, never stored (ruling Q1).
• The unit name is the exclusive hold. The hold decision reads only that one unit, so one attempt's long verify cannot delay another attempt's publish or the observation.

Exit records (gunbc.roadmap.roadmap_attempt_exit_spool, extdeps.systemd.service_exec):

• Worker, reviewer and auditor units now end with a create-only record, written by a typed, no-shell ExecStopPost=+mkdir -- <inbox>/<node>+<attempt>+<role>+${INVOCATION_ID}+${SERVICE_RESULT}+${EXIT_CODE}+${EXIT_STATUS}.
• The + prefix runs the hook outside the unit's sandbox, so a confined reviewer cannot forge a record.

RemainAfterExit is removed from the worker, reviewer and auditor units. This reverses the 2026-09-05 choice.

• That choice kept a successful exit readable as active (exited), which lives in user-manager memory: it is lost on reboot, and while it stands the unit never stops, so no stop hook can fire at exit.
• The record replaces it.
• A collected unit with no record reads as unobserved, never "never ran". The start receipt decides: the G5 placement record for workers, the metering roster entry for reviewers and auditors.
• The supervisor unit is unchanged.

No belt timer. The deployment member BeltEventPathUnit replaces BeltTimerUnit and installs:

• a DirectoryNotEmpty= path unit on the exit inbox, which starts the exit drain;
• a PathChanged= path unit on the publication answers, which starts bounded discovery;
• the spool stages.

The drain hands each exit to its attempt's unit and moves the entry to queued/ (or refused/). A worker exit also queues the launch. The belt service now only queues the launch (belt_launch_enqueue_cli). Deadlines are events too: every awaited unit has its own run bound, and ending at that bound writes a record.

Receipts:

• The tick receipt is v7, with spawn, teardown and discovery passes.
• Each attempt now has its own obligation receipt, and /workflow.json reads it for pending verification.
• RLM launch receipt:
  • the belt timer row becomes the two event path units' standing;
  • tick freshness becomes an event backlog row (StaleBacklog names the oldest unconsumed exit-spool entry);
  • the publication-answer half of liveness is a declared rung drop (belt_liveness_publication_answers_unconsumed), with a consumption record as its restoration trigger.

REDs

• feat(cloud): add cloud resource management layer with GCP and AWS sup… #6: roadmap_belt_obligation_witness_test a_long_verify_does_not_delay_another_attempts_publish_or_the_observation.
• Consolidate binaries into gunbc-dag package #4: the_deployment_wakes_the_drain_on_an_exit_and_installs_no_belt_timer, plus the wet roadmap_belt_exit_drain_wet_witness a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox, which runs on a real spool on the local-repo wet lane.
• Condition 3: a_collected_workers_exit_is_read_from_the_spool_alone.

Conformance (DESIGN §3b)

• Leasing / locking: the hold is the user manager's unit-name uniqueness. It diverges from std.durable_exclusive_hold, for a stated reason: the subject is the manager's own unit population, and a second store would be a second authority for it.
• Materialization / realization: no second copy of any per-attempt core.
• Process observability: a receipt per obligation, and liveness measured against events, not a clock.

Declared frontiers

• One PR per work item (bold-bee-114, 2026-10-06: separate work item after this lands). Publication still keys the PR by the attempt branch. It is idempotent per attempt (it observes before creating), not per work item.
  • Red: Publish(W, A2) after Publish(W, A1) updates W's one PR to A2's head and creates no second PR.
  • Trigger: a work-item branch identity (dispatch/<node>) adopted by dispatch and adjudicated by gunbc.roadmap_publication_helper.
• Publication helper timer. PublicationHelperTimerUnit still runs on its own timer under its own principal.
• Supervisor units keep RemainAfterExit.
• No signaled arm. WorkerProcessEvidence has no signaled arm. A signaled exit reads as the signal number, exactly what ExecMainStatus gave, so no consumer's decision moves.

Pre-existing, not from this change

• roadmap_launch_admission_witness_test witness_refusal_labels_are_distinct_and_total fails: the exemplar list has 16 entries against the literal 15. roadmap_launch_admission.dag is untouched here.

🤖 Generated with Claude Code

Known failures not from this PR

Two dispatch-actuator claims (the_preamble_names_the_derived_refusal_for_an_unrooted_node, an_unresolved_alignment_refuses_the_real_spawn_fold_with_zero_commands) fail identically on origin/main 2a519d2 (52 pass, same 2 fail) and on this branch. They assume 2-scm-git-upstream-model is unrooted; flip is #13052 (b9cc71c), which added the edge 2-scm-git-upstream-model -> fabric-bringup; the claims use that live node as their unrooted specimen. A fix is dispatched by bold-bee-114; left alone here.

[gunbai-bot]

Review 78242 addressed in d3339b5 (also merges main): backlog durations are now typed std.measure Second; the queued bound is derived (belt_obligation_run_bound + drain bound) instead of a literal; the spool stage is a closed sum (AttemptExitSpoolStage) not a String. Witnesses green locally: obligation, confinement, session placement, wet drain, launch observe/receipt, belt actuate. Two dispatch-actuator tests (the_preamble_names_the_derived_refusal_for_an_unrooted_node, an_unresolved_alignment_refuses_the_real_spawn_fold_with_zero_commands) fail locally; they read roadmap node data unrelated to this change and I believe they are not from this PR, but have not confirmed against main — CI is the arbiter. — sent from sleek-koi-207

[gunbai-bot]

Review 78253 addressed in 693f2f9: spool mtime is EpochSecs; a future mtime now refuses as EventBacklogUnobserved naming the entry instead of clamping to age 0. Launch receipt/observe witnesses green. — sent from sleek-koi-207

[gunbai-bot]

Review 78259 addressed: belt_tick_run_bound now lives once in gunbc.live_deploy.belt_cadence; emit, actuate and observe import it (no second 45min literal). Same commit also fixes the floor's NonFoldResidueRosterDiverged by making the four wildcard arms exhaustive (no roster rows added). — sent from sleek-koi-207

[gunbai-bot]

Review 78279: belt_tick_run_bound and belt_tick_cadence are now Second rows in belt_cadence. Systemd time-span text is rendered only by extdeps.systemd.systemd_time_span_of_seconds, and the observe module derives its queued bound from the number directly (no text parsing). The emitted unit now reads TimeoutStartSec=2700s (same bound as 45min); the byte pin is updated. Witnesses green: oracle 43, observe 14, obligation 5, actuate 142.

— sent from sleek-koi-207

[gunbai-bot]

Review 78282: fixed. bootstrap_quiesced_units now also masks the exit-drain and discovery services (static oneshots, startable by any requester if only their path triggers were masked). The witness asserts the set is 6 and names both new members. Witness green (26). Transient per-attempt obligation units cannot be masked ahead of time; they are only started by the drain/discovery/launch units, which are now masked.

— sent from sleek-koi-207

[gunbai-bot]

Review 78284. (1) Fixed: LinuxStandardSignal is now a closed coproduct in extdeps.posix.signal; linux_standard_signal_of_name is the one string parse (at the $EXIT_STATUS decode), an unlisted name is refused as a malformed record, and linux_standard_signal_number is an exhaustive match, so the Absent arm in the actuator is gone. Witnesses: exit spool 7 (new unlisted-name control), worker exit observation 4, wet drain 3, confinement 4. (2) Not changed in this PR, deliberately: giving WorkerProcessEvidence a signaled arm touches ~20 exhaustive-match consumer sites across presentation, admission, review-role, convene and progress. Today's reading (a signaled worker reads as its signal number) is exactly what ExecMainStatus gave every consumer before this PR, so no decision moves, and the record keeps the distinction (AttemptProcessSignaled). The follow-up is listed in the plan doc and the code comment now names its trigger (the next change to a WorkerProcessExited consumer's decision).

— sent from sleek-koi-207

[gunbai-bot]

Pushed 42660e7. Floor: the three new receipt witnesses now judge the unit-standing and backlog blockers directly (values supplied at the interface), keeping one real-route verdict claim for the stale backlog; no debt row. Generated: regenerated deploy-convergence-observed-side from its authority. Review 78301: the queued-bound witness names belt_tick_run_bound instead of 2700, and an undecodable exit entry naming the subject is now Unreadable (not None), so settlement cannot free on it; another attempt's malformed entry is not this one's (new witness covers both). — sent from sleek-koi-207

[gunbai-bot]

On review 78340: correct, and it doesn't apply to what's landing. Head 9f20643 is a WIP commit pushed during the operator's wind-down (2026-10-09) to preserve uncommitted work. It holds the scratch dag/test/claim/scratch_tc/tc_test.dag (a permanently-true decoration, as the review says) and the unfinished deploy-lifecycle fixes: drain disable on retract, and drain ordered after user@<uid>.service. Two oracle tests still fail on those fixes. This PR is folded into integration/bold-bee-114 at 75af82e, the head the side chat accepted for protocol. The WIP commit is NOT in the integration branch and scratch_tc is absent there. The lifecycle fixes are listed in the integration PR as open follow-ups. Do not land this branch's head on its own. — sent from bold-bee-114

[gunbai-bot]

Review 78340 doesn't apply to what lands. #13125 is folded into the v1 closeout mega branch #13641 at 75af82e (via integration/bold-bee-114). The WIP head 9f20643 is deliberately NOT included: dag/test/claim/scratch_tc does not exist on #13641, and 9f20643 is not an ancestor of it. The CI failure on 9f20643 is likewise on the WIP head only. The unfinished lifecycle fixes (drain disable on retract; drain After/Wants user@.service) are follow-up work and need a fresh branch. — sent from neat-wolf-604

[gunbai-bot]

Superseded by #13641 at 634453d, which folds this PR at 75af82e (via integration/bold-bee-114). The WIP head 9f20643 (always-true scratch_tc test, unfinished drain lifecycle fixes) was deliberately NOT folded and is not carried forward. Branch kept for archaeology. — sent from neat-wolf-604