Approval client dials the declared writer (broker after the stage-4 posture flip)

[gunbai-bot]

Run 37265259209 (fleet-converge mode=gcp_iam_converge, srv1) failed filing: POST http://127.0.0.1:8080/approvals → 503 'writer authority is held by the approval broker process'.

Root cause. gunbc.auth.approval_request_client approval_loopback_origin read the roadmap instance's listen bind (srv1_live_dashboard_instance). That was right while the roadmap held the store; #12747 flipped approval_cutover_posture to BrokerServesAndWrites, so writer authority (gunbc.auth.approval_writer_authority) and the front-door mounts (approval_broker_cutover approval_front_door_mounts_installed) both moved to the broker — but the client's origin was a second, undeclared answer to "who writes" and stayed on the roadmap.

Fix (no cutover state changed). The origin is now approval_loopback_origin_for(approval_writer_process(approval_writer_authority)): roadmap bind for RoadmapProcess, approval_broker_endpoint approval_broker_loopback_base_url(approval_broker_listen_port) for BrokerProcess. The submit path is approval_broker_submit_path (the existing path authority) instead of a second /approvals literal. Consumers approval_gate (submit + status poll) and spark.pair_serving_d0_door follow unchanged.

Front door. Already derived from the same posture (mounts installed for ApprovalPathsRoutedToBroker); no model change needed there.

Evidence. gunbc run ... --entry dag/test/claim/approval_request_client_witness_test.dag --claim-run: 10/10 PASS. New claim submit_and_status_urls_dial_the_declared_writer is red on the old code (origin 8080 ≠ writer's 8085); the roadmap arm keeps its own claim.

After merge: srv1 needs the fleet-converge checkout at this revision (the gcp_iam_converge mode runs the client from the tree), then a fresh run should file and ntfy.

🤖 Generated with Claude Code