runner browser toolchain: the readiness-label converge executes typed argv steps -- the retained-shell text leaves the module

dag/extdeps/exec/program.dag

@@ -132,6 +132,7 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mkdir_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mv_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "sort_program"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "tee_program"),
     decl_ref(module_path: "extdeps.tools.ldd", decl_name: "ldd_program"),
     decl_ref(module_path: "extdeps.tools.dpkg_deb", decl_name: "dpkg_deb_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "printf_program"),
@@ -140,7 +141,6 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "rmdir_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "dd_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "timeout_program"),
-    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "tee_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "true_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "whoami_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "pwd_program"),

dag/gunbc/ci/ci_layer_roots.dag

@@ -377,6 +377,10 @@ data excl_install_media_reason: String = "real host-effect execution witness (sh
 
 data excl_local_repo_wet_reason: String = "real host-effect execution witness over a THROWAWAY LOCAL REPOSITORY -- refused by the hermetic envelope, so excluded from the discovery corpus, and executed instead by the required floor's local-repo wet lane (v2.workflow.local_repo_wet_terminal local_repo_wet_schedule). This row is NOT the dark bin-wet class: every function in the named file is on that schedule, the floor decodes it, runs each member wet, and joins the observed terminals back to the roster at identity grain, so a member that stops executing refuses rather than reading as covered."
 
+data excl_local_repo_wet_browser_ready_label_reason: String = "real host-effect execution witness whose effect is ARGV EXECUTION THAT WRITES INSIDE A THROWAWAY TEMP DIRECTORY -- the readiness-label converge (gunbc.runner_browser_toolchain browser_ready_labels_converge_wet) driven over LocalShell with the unprivileged posture parameterization against a mktemp scratch root: dd writes the scratch drop-in, cat reads it back, rm -f removes it, the scratch is removed. Refused by the hermetic envelope (shell.Exec over argv and shell.Mktemp.Dir have no mock_response), so excluded from the discovery corpus and executed by the required floor's local-repo wet lane. IT IS A DISTINCT ADMITTED EFFECT FROM ITS NEIGHBOURS AND IS NAMED RATHER THAN FOLDED IN: unlike excl_local_repo_wet_tempdir_write_reason the writes go through EXECUTED ARGV (dd/cat/rm over the host-effect transport), not a Filesystem.Write call; unlike excl_local_repo_wet_bash_materialized_reason a file IS written and read; unlike excl_local_repo_wet_host_probe_reason the probe writes. What admits it to the same lane is the shared negative half: no network, no cargo, no remote host, no install media, no sudo (the unprivileged posture skips daemon-reload with a typed cause), and nothing outside a directory the witness created and removes. The production FLEET route is a different row's subject: the declared stall is rostered as gunbc.guarantee_stall.browser_ready_labels_fleet_route_stall."
+
+data excl_local_repo_wet_browser_ready_label_dissolve: DissolutionCondition = unbound_dissolution(description: "mock_response coverage lands for the argv-over-host-effect-transport legs and shell.Mktemp.Dir, sufficient for the converge's write-then-proceed and remove-then-proceed folds to be asserted under fixed mocks at the scratch destination; then these fns re-enroll as ordinary hermetic discovery rows, drop off local_repo_wet_schedule, and this row deletes. The FleetSsh production route's own stall (gunbc.guarantee_stall.browser_ready_labels_fleet_route_stall) is NOT this row's trigger: the receipts keep executing over LocalShell regardless of when the shared transport admits that arm.")
+
 data excl_local_repo_wet_tempdir_write_reason: String = "real host-effect execution witness whose effect is a FILESYSTEM WRITE INTO A THROWAWAY TEMP DIRECTORY -- refused by the hermetic envelope (Filesystem.Write and shell.Mktemp.Dir have no mock_response), so excluded from the discovery corpus and executed by the required floor's local-repo wet lane. THIS IS A DISTINCT ADMITTED EFFECT FROM BOTH NEIGHBOURS AND IS NAMED RATHER THAN FOLDED INTO EITHER: it is not excl_local_repo_wet_reason's throwaway REPOSITORY property -- no repository is built and no git operation runs -- and it is not excl_local_repo_wet_host_probe_reason, which admits read-only probes that write NOTHING. What admits it to the same lane is the negative half those rows share: no network, no cargo, no remote host, no install media, and nothing outside a directory the witness created and removes. IT IS ENROLLED IN THE IDENTITY-GRAIN LANE DELIBERATELY rather than in the dark bin-wet class, because the whole purpose of the witness is that a wall which stops executing must REFUSE rather than read as covered -- enrolling a witness about silent absence somewhere it could be silently absent would reproduce its own subject."
 
 // Capture verification hashes the supplied bytes through stdin. The capture
@@ -1243,6 +1247,12 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_reason,
     dissolution: excl_local_repo_wet_dissolve},
+  WitnessExclusionRow {
+    pattern: "browser_ready_label_real_path_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_browser_ready_label_reason,
+    dissolution: excl_local_repo_wet_browser_ready_label_dissolve,
+  },
   WitnessExclusionRow {
     pattern: "roadmap_belt_base_advance_wet_witness_test.dag",
     classification: LocalRepoWetLane,

dag/gunbc/guarantee_stall/browser_ready_labels_fleet_route_stall.dag

@@ -0,0 +1,31 @@
+module gunbc.guarantee_stall.browser_ready_labels_fleet_route_stall
+
+import gunbc.guarantee_rung { MechanicallyPreventable, StructurallyGuaranteed }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+// THE READINESS-LABEL CONVERGE'S PRODUCTION FLEET ROUTE EXECUTES NOWHERE — A PRE-EXISTING STALL,
+// NOT AN EVENT (review round on gunbc#13401; the side chat's ruling: a gap that never held is a
+// GuaranteeStall awaiting one grounding, not a RungDrop, because nothing that held stopped
+// holding). In a real bootstrap the converge's transport is always FleetSsh
+// (browser_toolchain_admin_transport), and BOTH shared host-effect runners -- the argv runner and
+// the argv+stdin runner -- return RunArgvTransportRefused for FleetSsh before any leg runs; the
+// arm's own fail-closed note says admitting that capability "is its own change with its own
+// analysis". So grant, revoke and daemon-reload never execute over fleet, on CI or in a bootstrap,
+// and the route's outcome is always BrowserReadyLabelsFailed there. The deleted shell path was
+// carried by the same posture, so this change newly breaks nothing -- it declares what the route
+// already was. The steps DO execute for real in the changed-witness receipts
+// (test.claim.runner.browser_ready_label_real_path_witness): the production converge over
+// LocalShell, the unprivileged posture, against a mktemp scratch destination, with the unprivileged
+// reload honestly skipped as a typed posture arm.
+data browser_ready_labels_fleet_route_stall: GuaranteeStall = GuaranteeStall {
+  subject: "The runner readiness-label converge over its production fleet route: every decision is typed and the step pairing is executed for real in the LocalRepoWet receipts over LocalShell against a scratch destination, but the production route itself -- whose transport is always FleetSsh -- is refused by both shared host-effect runners before any leg, so the converge executes nowhere over fleet and its outcome there is always BrowserReadyLabelsFailed.",
+  current: MechanicallyPreventable,
+  ceiling: StructurallyGuaranteed,
+  blocker: AwaitsOneGrounding {
+    grounding: "the shared host-effect FleetSsh argv and argv+stdin realization, plus a safe daemon-reload realization",
+  },
+  population: BoundedPopulation { members: [
+    "gunbc.runner_browser_toolchain::browser_ready_labels_converge_wet over browser_ready_labels_production_target",
+  ] },
+  next_rung_trigger: climbs_when(capability: "the shared fleet_subsumption route admits FleetSsh argv and argv+stdin, safely realizes reload, and an executing fleet receipt traverses the route."),
+}

dag/gunbc/guarantee_stall/roster.dag

@@ -15,6 +15,7 @@ import gunbc.guarantee_stall { GuaranteeStall }
 import gunbc.guarantee_stall.pci_address_rendering_equivalence_stall { pci_address_rendering_equivalence_stall }
 import gunbc.guarantee_stall.fabric_purpose_handover_registration_unobserved_stall { fabric_purpose_handover_registration_unobserved_stall }
 import gunbc.guarantee_stall.emission_provenance_missing_consumer { emission_provenance_missing_consumer }
+import gunbc.guarantee_stall.browser_ready_labels_fleet_route_stall { browser_ready_labels_fleet_route_stall }
 import gunbc.guarantee_stall.emit_returns_medium_not_contribution_stall { emit_returns_medium_not_contribution_stall }
 import gunbc.guarantee_stall.emission_apply_generic_r_uninstantiated_stall { emission_apply_generic_r_uninstantiated_stall }
 import gunbc.guarantee_stall.pre_resolve_entry_closure_module_identity_stall { pre_resolve_entry_closure_module_identity_stall }
@@ -243,6 +244,7 @@ data all_guarantee_stalls: List<GuaranteeStall> = [
   emitted_inline_crate_path_edges_unreturned_stall,
   test_reference_ledger_typed_census_stall,
   compile_pool_provision_wired_but_unreachable_stall,
+  browser_ready_labels_fleet_route_stall,
   accumulator_copy_untyped_combiner_refusals_stall,
   keyed_apply_patch_rebuilds_rows_per_hunk_stall,
 ]