Decommission Group A (srv5-srv8, sold): remove it from fleet config and convergence

[gunbai-bot]

Operator-approved (msg_5d88338f, msg_9e5a2fee via valiant-crab-775): Group A (srv5–srv8, fabric cage 1) was sold and wiped, so it is removed from fleet config and convergence. Group B (srv9–srv12, cage 2) is untouched. Nothing was dispatched to the hosts.

Removed

• Roots: the operator_host_srv5..8 identities, the four cage-1 lanes and the FabricGroupA variant, the router bindings and reservations, the LAN endpoints. The procurement keeps its meaning: 8 ordered and all 8 accounted for. 4 are retained (srv9–srv12, the only source of fleet rosters). The 4 cage-1 units are typed DgxSparkAssetSold dispositions under the operator's 2026-10-07 decision. No inventory QuantitySold is booked: no serial is joined to a router label, so that join is an open obligation.
• Fleet rows: site/locale, phase status, cell roles, chassis, roadmap components, administrator credentials, wireless link, host keys, reach-identity receipts, the reach and multi-principal probe rosters, the first pair's bootstrap population, and first-party serving.
• Serving: the A arms of enrollment, offer, group launch and the harness rosters. The pair-serving authority now claims no group. The Group A runtime row and its registry reading are removed, as is the DeepSeek (Group A) arm of deployment selection.
• (f) The arm path, which had no consumer once Group A was gone: group_arm_launch, arm_group_launch_dispatch, group_checkpoint_materialize, group_image_produce, group_arm_serving_load, runtime_image_produce_dispatch and glm53_kvplan_image. serving_load_runner is kept.
• Group-A-only modules: the V4.1 Group A launch, load, checkpoint and runs; the GLM staircase; llama.cpp RPC; the V4.1 capacity measurement; and the byte-span producer, whose only consumer was the V4.1 checkpoint.
• The twelve Group A workflow modes, the D0 mode, their ci_spec targets and their dispatch inputs.
• (a) D0 whole, plus standing_operator_grant. The fabric store now admits no scope for the operations D0 performed, so they refuse as NoApprovalFlowForOperation, which fails closed.
• The rung drops d0_store_walls_single_lifecycle and sha256_span_program_serialize_new_witness_eval_step_cost are Superseded, because their population went with Group A.
• Rosters: the entries for deleted witnesses are removed from route-gap, wet-terminal, exclusion, cost-drop and reference-census.
• Tests: tests of Group A behaviour are deleted; tests that only used Group A as a fixture are re-pointed to srv9–srv12 / FabricGroupB.

Kept, as records

History strings, dated receipts, GB10 measurements, the cable EEPROM readings, recurring-failure-mode rows, and the retired debt-ledger dispositions.

srv7 blob daemon

Nothing outside Group A pulls blobs from srv7. Blob sources are per group by construction: the checkpoint seed is per group, and image distribution requires a source in the image's own group. So no replacement source is needed.

Rulings applied (valiant-crab-775, 2026-10-07)

1. Training readiness: no training-cell row is invented. The coverage loss is declared as gunbc.rung_drop.training_readiness_has_no_training_cell_after_group_a. Its population is four claims in spark_training_ready_witness. It restores when a fleet host is assigned a training cell role.
2. Pair serving: pieces that Group B's path never executes are deleted: pair_incumbent_identity with its instrument, and pair_serving_capacity_floor. A cascade also removed eight declarations that became unreferenced. Kept, because Group B's path executes them:
   • pair_serving_apply: the host-apply plan types, used by native_serving_apply and native_experiment_apply.
   • pair_serving_launch_receipt: serving_standing, used by native_serving_apply.
   • pair_serving_realization: unit, container and port names, used by serving_offer, serving_group_launch, host_occupancy_admission and serving_enrollment.
   • pair_serving_authority and pair_serving_authority_log: the authority read and the host-effect claims, used by harness_seat, host_commitment, and image build and distribution.
   • pair_serving_desired: the group head, used by serving_enrollment.
   • pair_serving_observed: the rank free-memory type, used by deployment selection. Its rows are now empty.
3. V4.1 modules: arm_memory_fit memory tiers (part 2 of 2): Spark as the one-tier inhabitant, GH200 two-tier frontier #13321 imports none of them. Eleven unconsumed modules are deleted with their witnesses. Kept: v41_published_image_observation (engram materialization, deployment selection, capability probe) and v41_runtime_image_probe (the runtime-image probe mode).

Notes

• Durable placement history. The shared host-placement partition still holds D0's Group A records. Its records carry RecordedFabricGroup (a live group, or RecordedRetiredGroupA), and its intents carry RecordedAuthority (a live state, or the retired Group A state word). So Group A history decodes and folds as history. Writers take only a live FabricGroup, which has no Group A constructor. A retired record never matches a live query or fence, and consuming or cancelling one refuses naming it. The controls run through the real codec and placement_fold: a full retired saga (prepared, claimed, finalized) followed by a Group B event folds, and Group B's fence is exactly its own.
• FabricGroup now has one variant. It is written the way the corpus writes single-variant coproducts: type FabricGroupB {} plus the alias type FabricGroup = FabricGroupB, with values FabricGroupB {}.
• Main's Standing mtjade1 live-ops grant; grant scope is fabric-group or host #13493 added an mtjade1 standing grant, so gunbc.auth.standing_operator_grant stays and only the Group A grant is removed. Its three effect arms have no consuming gate now. They stay only because the type cannot be empty until Emit arrival_converge; IAM pair and pinned accessor (msg_f03558d1) #13497 lands mtjade1's arms.
• With D0 gone, the fabric store admits no scope for the operations D0 performed, so they refuse as NoApprovalFlowForOperation. The receipt check approved_operation is exercised at its own interface with a supplied scope.
• Four optional-versus-required comparisons that were already broken on main are fixed. They were on this change's closure, so the floor reported them.

🤖 Generated with Claude Code

[gunbai-bot]

Review 78113 addressed in 568c345; both findings were valid. In v41_runtime_image_build_witness_test, the hostname-join claim now uses retained srv9 (spark-0c75, 192.168.1.236) for the answered and mismatch arms. A new arm asserts that a reading from sold srv5 classifies as SparkHostIdentityUnjoinable. The claimed-host claim drops the srv5-srv8 not-unplaced arms, which were vacuous once those hosts were gone, and its build-refusal arm now asks for claimed srv9. All 25 claims in the file pass in a remote claim_batch run.

— sent from cool-carp-342

[gunbai-bot]

Folded into #13641 (merge second parent = 9fb3744).