Fixes found bringing up the srv1 lab: sudoers install regression, ALL grant, subshell truncation, host-keyed Claude offer, placement-record type

[gunbai-bot]

These five fixes were made and run live on the srv1 lab (branch bright-moth-475/lab-dev) on 2026-10-10/11. Each is cherry-picked onto main with -x. The first one repairs a regression main has right now.

1. #13705 poisoned the sudoers install (main is broken for every deploy)

• Deploy blockers: tailnet door binds in a service-owned directory; grant-list probe reads its whole listing #13705 replaced the grant-list probe's grep -Fqx with grep -Fx >/dev/null. The bash serializer refuses a redirect on a pipeline's right operand, so deploy_sudoers_install_shell emits its __GUNBC_BASH_EMIT_REFUSED__ marker and every deploy stops there.
• deploy_mutation_gate_witness (12/13) and live_deploy/emit (83/84) were red on Deploy blockers: tailnet door binds in a service-owned directory; grant-list probe reads its whole listing #13705. Its author (me) merged before reading them.
• The fix is plain grep -Fx, which still reads its whole input, so the SIGPIPE fix holds.
• extdeps.sudo.nopasswd_execute_probe_check_op sudo_nopasswd_grant_list_shell_condition.

2. A (ALL) NOPASSWD: ALL grant read as holding no roster command

• An operator-local deploy (briansrls) refused every grant-list probe right after installing the drop-in. The 2026-10-09 bringup ran as ghrunner for the same reason.
• The typed reading (sudo_nopasswd_grant_list_line_admits_probe) and its shell twin now admit an ALL line whose run-as is (ALL), (ALL : ALL) or (root). Any other run-as still grants nothing as root.

3. bash_build_subshell given an or-else body dropped the right operand

• The probe's ( A || B ) rendered as ( A ). The builder now constructs the subshell from a statement list (bash_build_subshell_from_stmts).
• Not fixed here: the shared reader (bash_fold_flatten_stmt_list) still silently drops children of a malformed body. That's tracked in the convergence-coverage program (cause B), not papered over here.

4. The Claude offer belonged to one instance id, not the host

• An executor=claude dispatch on the srv1 lab refused ("no provider offer matches the requested selection shape"), although the lab shares srv1's provider state and Claude credential.
• declared_provider_inventory_for_instance now keys the offer on host_identity.
• The annotation sits at module grain. A copy inside the fn body is a blocking error, and it took the lab server down once.

5. Every harness spawn crashed with split expects a string, got Record

• Since extdeps.systemd.systemd_run: typed options, one projection, ArgvCommand everywhere #13257 (2026-10-07), belt_session_container_create passed List<SystemdRunProperty> to session_placement_record_write(unit_properties: List<String>).
• The assignment Name=value is now spelled once (extdeps.systemd.systemd_run systemd_run_property_assignment) and read by both option forms and the record.
• The typechecker admitted the mismatch. That's the compiler-floor finding, tracked separately (product_value_at_a_scalar_formal_is_accepted), not fixed here.

Evidence

• On srv1 at this head: deploy_mutation_gate_witness 13/13, live_deploy/emit 84/84.
• Live on the lab (lab-dev): sudoers install and roster probe pass operator-locally; harness dispatch spawns and runs against the GPU-pod backend.
• Typecheck of roadmap_serve / roadmap_belt_tick_cli at this head: results to follow as a comment.
• Findings ledger: https://claude.ai/artifact/7AMGHuyVXu1U7bFXDnbG1M (private to the operator).

🤖 Generated with Claude Code

[gunbai-bot]

Executed on srv1 at c54baa2 (built in its own checkout):

• typed_argv_exec_realization_witness 24/24 held, including the three new claims for review 78587: the ERE is derived from sudo_nopasswd_all_grant_runas, (ALL) NOPASSWD: ALL admits any command, and (gunbc-ntfy) NOPASSWD: ALL admits nothing;
• deploy_mutation_gate_witness 13/13 held, red on Deploy blockers: tailnet door binds in a service-owned directory; grant-list probe reads its whole listing #13705;
• live_deploy/emit 84/84 held, red on Deploy blockers: tailnet door binds in a service-owned directory; grant-list probe reads its whole listing #13705.

At b740571, roadmap_serve.dag and roadmap_belt_tick_cli.dag typecheck with 0 blocking errors.

Live: srv1's gunbc-ghrunner drop-in, reinstalled from main 982222d, admits the tailscale grant under this probe as ghrunner (pipeline exit 0).

— sent from bright-moth-475