Deployment risk D2 (1/4): role-following singletons resolve the prod-role holder

[gunbai-bot]

Re-derives gunbc#13217 (closed, branch session/sharp-heron-165) on current main, first principles, not rebased. Layers 2 (role-singleton convergence/apply) and 3 (host self-report observation, from gunbc#13339, branch session/nimble-ant-374) and 4 (one environment model, from gunbc#13639, branch session/silent-koi-18) follow as stacked-on-main PRs from the same lane.

What this layer does

• gunbc.roadmap_dashboard_instance: ProdRoleHolder (sole_constructor token), ProdRoleRealization, prod_role_realization_in / prod_role_realization; refusals Unheld / Unrealized / Ambiguous / Unactuatable, never a srv1 fallback.
• gunbc.live_deploy.desired: prod_role_actuated_realization* joins the holder against desired_deployment_roster.
• Fabric storage placement, approval broker placement (gunbc.auth.approval_broker_placement, new), emit, spec, enrolment, request client/gate/decision store, workflow and iOS project follow the holder instead of a spelled srv1.
• The srv1 dashboard-bind leaf is inlined into the instance row (as in the old PR).

Conformance (DESIGN 3b)

Deployment risk: inhabits gunbc.deployment_risk (prod_role_selection stays the one switch). Fabric/compute: inhabits gunbc.fabric_storage_placement (placement is a function of the realization). Leasing/grants, decision/selection, observability: untouched in this layer.
Declared divergence: gunbc.fabric_storage_binding places over the plain realization, not the actuated join, because it sits in live_deploy.desired's own import closure (cycle via fabric_event_log); actuation refuses at selected_deployment_spec.

Consumption (3c)

Every new declaration is consumed in this diff: the resolver by placement/spec/broker; the join by selected_deployment_spec and the broker/request client; the placement module by emit, enrolment, workflow and iOS project.

Old-review findings handled here

Review 75352 (dangling instance_realizes_prod_role_in): not carried; no such function, comparison is on the holder token. Review 78345 (unstated Absent to srv1 fallbacks): the three sites are not carried in this layer; they refuse on Absent. Remaining reviews concern layers 2-3.

Evidence (run on this head, local seed, per-file under the 24 GiB cap)

• claim_batch over test.claim.prod_role_realization_witness_test (new: three discriminating reds, follow-the-selection control, actuated-join red, one real-route inhabitance claim): all PASS.
• claim_batch over approval_request_client_witness_test, approval_decision_store_witness_test, approval_request_submission_witness_test: all PASS.
• Not run: the required witnesses job is CI's; nothing else evaluates these claims.

Operator-only

None in this layer. (Layer 3 will name tailnet reach and the control-directory read grant.)

Not carried from the old PR: the dashboard ownership marker and ensured-directory steps (main now models fabric directories as owned-directory demands); pair_serving_d0_door and serve_function_binding_witness_test (not on main).

🤖 Generated with Claude Code

[gunbai-bot]

Review 78458, both findings real, fixed at 064948a.

• shell.Stat GroupOf had no call site in this layer (its consumer is the ownership-marker design deferred to the role-singleton convergence layer). Dropped here; it returns with its consumer.
• The actuated-join claim now matches ProdRoleHolderUnactuatable carrying macbook_local_deployment, and its comment names the right fixture (macbook_local is a built-in instance on no desired roster). Claim run: prod_role_realization_witness_test, exit 0.

— sent from quiet-heron-491

[gunbai-bot]

Review 78559: confirmed, the citation at the fleet_converge_gcp_iam_converge_job comment named the wrong module. Fixed in 26f7402 (now gunbc.auth.approval_broker_placement approval_broker_host_under). Comment-only (annotations are erased from the semantic projection), so no generated artifact changes; the drift gate was exit 0 at b04e392 and the four subject claim files rerun exit 0 there.

— sent from quiet-heron-491