Deployment risk D2 layer 4: remaining srv1 pins resolve through the prod-role holder

[gunbai-bot]

Deployment-risk D2 layer 4 — one environment model, remaining srv1 pins

Layer 1 (#13688) made gunbc.deployment_risk prod_role_selection the one switch and gunbc.roadmap_dashboard_instance prod_role_realization its resolver. This PR moves the pins that decide placement or identity by the literal host srv1 onto that authority. Role-following production readers consume layer 1's actuated join, gunbc.live_deploy.desired prod_role_actuated_realization(), so a selected holder with no desired_deployment_roster() row refuses. The *_under functions remain pure folds over a supplied realization, for controls. No new switch, no new nickname.

Changed (each with a consumer in this diff)

• Belt entry (gunbc.roadmap_belt_actuate): belt_dispatch_instance_cli no longer defaults an unset/blank GUNBC_BELT_INSTANCE_ID to srv1-live; it refuses before anything stages. Names resolve through dashboard_instance_for_id (the roster), not hand-listed constructors. Stale annotations rewritten: parent's srv1 receipt (2026-10-11 ~05:45Z) shows no unit references belt_dispatch_node_cli / GUNBC_BELT_NODE_ID / GUNBC_BELT_INSTANCE_ID, no Node roadmap server runs, and the only listeners are native gunbc on 127.0.0.1:8080 and :8085.
• Served slice charge (gunbc.live_deploy.served_slice_charge): served_deployment_placement() consumes prod_role_actuated_realization() and follows the actuated holder's host. A refused or unactuatable realization refuses the charge (ServedDeploymentClaimUnmeasured), never srv1, never Unplaced.
• Approval keyring converge (gunbc.auth.approval_keyring_converge): the host check and ssh target are the approval broker host. A new zero-argument gunbc.auth.approval_broker_placement approval_broker_host() (= approval_broker_host_under(realization: prod_role_actuated_realization())) is the one production authority for where the broker lives. approval_keyring_converge_wet consumes it, and the keyring functions take the resolved ApprovalBrokerHost. A refused or unactuatable realization refuses the run on every host.

Divergence stated (DESIGN 3b)

belt_dispatch_admitted_instance_ids is a two-id list (srv2-deploy, srv1-live), not a roster row: DashboardActuating also admits the srv1 lab and macbook-local, so the roster cannot say "belt-admitted". Modeling that is a frontier.

Declared frontier A — entry wrappers still calling srv1_live_dashboard_instance() (38 sites)

Trigger: an entry takes the instance its deployment names. roadmap_belt_actuate (16), roadmap_serve (10), roadmap_dispatch_actuator (5), roadmap_dashboard_instance_apply (2, lab peer, bright-moth-475), roadmap_launch_deployment_cli (1), dispatch_preflight (1), dispatch_selection (1 — handled by #13720, not duplicated).

Left as host facts (reason)

• runner_host_grants, fleet_converge_plan(_cli) name the srv1 RUNNER host, not prod.
• Host-capability conditionals and the slice-charge evidence floor (session_residency, session_reservation_policy) are facts about the host.

Deferred to a follow-up PR (valiant-gull-69/d2-l4b)

Dark-install (apply.dag approval_broker_dark_install_srv1_wet) and its ci_spec target, the deployment_spec_srv1 uses in live_deploy desired/apply/readiness, and the roadmap_launch_deployment_cli prod pins. Reason: they sit in files layer 2 (#13723) edits, and #13723 is held to land together with layer 3 (host self-report). They follow on a fresh branch after layers 2+3 land.

Evidence

Remote claim_batch, all PASS: belt selection 5/5 (REDs: unset, blank, unadmitted spelling, lab-roster id), slice charge 4/4 (including moving the role off srv1, the real route, and an_unactuatable_holder_is_never_charged), keyring 12/12 (held-by-srv1, held-by-srv2, NoProdRole, and an_unactuatable_holder_refuses_the_keyring_converge_on_every_host). The two unactuatable-holder controls use srv2-preview (in the public instance roster, no desired row) through the real joined route prod_role_actuated_realization_in. Read-only drift gate exit 0 on head 623a87c; witnesses run 38127000341 on this head. Pre-existing red also failing on origin/main: host_allocation_conservation_test the_shakedown_charge_separates_conserves_from_oversubscribed.

Known unexecuted

No live srv1 step. Holder/broker host equals srv1 under the current selection by claim only. Out-of-tree callers relying on the old belt default now meet a refusal.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 78614's soft point: the comment on belt_dispatch_admitted_instance_ids now names the trigger (an entry takes the instance its deployment names) and the replacement (a modeled belt-dispatch admission row on the roster). Comment-only change; claims unaffected. Drift gate, witnesses and the #13723-gated pins remain outstanding. — sent from valiant-gull-69

[gunbai-bot]

Re review 78615: agreed it is a citation nit, not a stall. The trigger is the capability (an entry takes the instance its deployment names) and the replacement is a modeled admission row; the PR reference only points at the frontier A census in the body. No code change. — sent from valiant-gull-69