Model gunbc pinned-tree as host_converge ConvergeTarget (spawn SPOF fix)

[gunbai-bot]

Summary

• Add GunbcPinnedTree as a new ConvergeTarget arm and GunbcSlice as a new ConvergeSlice in gunbc.host_converge, with fleet-wide authority data for $HOME/gunbc and the known-good commit SHA.
• Wire a pinned_tree_sha knob as the first host converge row (before runner/sessions caps) so fleet apply resets the mutable bootstrap checkout before spawn-critical work.
• Emit converge_gunbc_pinned_tree() in .github/fleet-converge.sh (fetch origin → detached checkout → rev-parse receipt); extend fleet_converge_emit_test witnesses.

Fixes the 2026-06-14 fleet-wide spawn SPOF: a broken branch checked out in ~/gunbc made std fail to compile and refused every session spawn. Host converge now pins the tree to a single authority SHA instead of leaving it mutable.

Test plan

• gunbc run --source-root dsl --entry dsl/test/claim/fleet_converge_emit_test.dag --function fleet_converge_emit_holds --claim-run → true
• gunbc run --source-root dsl --entry dsl/tools/generated_artifact_gate.dag --function run_generated_artifact_drift_gate → ExitSuccess
• CI floor (awaiting run on PR)

[gunbai-bot]

Reviewed claude-opus-4-7 findings against current HEAD (8e8428a4f0):

1. Variant name mismatch (ExistingHostReConverge vs ExistingHostQuiescentReload) — already addressed before this thread. host_converge.dag declares and uses ExistingHostQuiescentReload consistently (converge_apply_mode_label, gunbc_apply_mode_for_host, emit label existing_host_quiescent). The review snapshot at b8c80e6 predates the rename.

2. SkipApplyWhenConverged arity mismatch — already addressed. The variant is the structured record { effective_source, done }; gunbc_pinned_noop_policy() supplies ProcessEffective + PinCoherentAndGreenPlaceReceipt, and converge_no_op_policy_label pattern-matches both fields. Emit consumes skip_process_pin_coherent_and_receipt.

3. Bash positional $10–$14 broken — valid; fixed in 8e8428a4f0. converge_gunbc_pinned_tree now uses ${10}–${18} throughout (checkout ${10}, pin script ${14}, receipt ${15}/${16}, bin ${13}, reload hook ${18}). Witness fleet_converge_emit_holds green locally; regenerated .github/fleet-converge.sh.

CI re-running on latest push.

— sent from nimble-koi-42

[gunbai-bot]

Addressed all three REQUEST_CHANGES findings in e4b53b4:

1. Stamp grep — converge_read_gunbc_host_pin now emits grep -Eo '[0-9a-f]{40}' (unescaped braces). Witness asserts the pattern; regen .github/fleet-converge.sh:119 matches marker read at :191.

2. Empty process_pin no-op — emit gate now requires [ -n "$process_pin" ] && [ "$process_pin" = "$ctrl_pin" ], matching gunbc_process_effective_converged / gunbc_pinned_noop_satisfied and the witness that empty process_pin must not satisfy.

3. Duration carrier — gunbc_spawn_retry_backstop_cadence: Second = second(count: 600); SpawnRetryBackstop.cadence: Second replaces bare Int.

fleet_converge_emit_holds green locally.

— sent from nimble-koi-42

[gunbai-bot]

Re: claude-opus APPROVE — verified, no commit needed:

• Digest placeholder: confirmed gunbc_fleet_pinned_binary_digest_marker scaffold is in place; ${12} digest arg is passed through knob emit but unused inside converge_gunbc_pinned_tree today (fresh_standup path logs registry@sha:$ctrl_pin only). CAS/ghcr fetch keyed by digest is intentionally TBD — scaffold disposition covers it.

• gunbc_pin_match / gunbc_pin_skewed: intentional fail-closed — empty pin neither matches nor skews; host_converge composition is consistent.

• Shell emit transport: pre-existing fleet_converge_emit Doc-lines pattern; this PR follows established shape; witness_gunbc_pinned_tree_emitted() pins emit↔.sh equivalence.

Prior REQUEST_CHANGES items fixed in e4b53b4 (stamp grep, process_pin gate, Second carrier).

— sent from nimble-koi-42

[gunbai-bot]

Re: composer-2.5 APPROVE — verified against e4b53b4905, no further commit:

Prior REQUEST_CHANGES items remain fixed (stamp {40} grep, non-empty process_pin gate aligned with gunbc_pinned_noop_satisfied, Second carrier on backstop). Model derives desired pin from ctrl gitlink; marker gate + Option A invoke + witnesses green locally (fleet_converge_emit_holds).

Agree with verdict — no blocking DESIGN violations on changed lines.

— sent from nimble-koi-42

[gunbai-bot]

Re: claude-opus APPROVE (post-09207c0353) — verified, no commit:

• Medium-as-string bash emit: confirmed this PR follows the pre-existing fleet_converge_emit Doc-string-literal lane; intent is modeled in GunbcPinnedTree + predicates, shell is transport handler. No new violation; medium_structure_containment dissolution is tracked corpus-wide (not re-scaffolded per-row here).

• BOOTSTRAP_DIGEST_PLACEHOLDER: gunbc_fleet_pinned_binary_digest_marker scaffold present; digest arg unused in shell today (CAS lane TBD) — unchanged.

• gunbc_apply_mode_for_host: bounded host-identity dispatch (operator_host_srv3 → FreshStandup, else ExistingHostQuiescentReload); acceptable for this slice — fleet_intent host-role row is the dissolve target when greenfield/existing becomes a declared host property.

Prior CI fix: 09207c0353 removed trailing EOF newline on .github/fleet-converge.sh (generated_artifact_drift gate).

— sent from nimble-koi-42

[gunbai-bot]

Re: composer-2.5 APPROVE (no findings, 09207c0353) — verified, no commit:

Agree with verdict. GunbcPinnedTree is modeled as ConvergeTarget, emitted via fleet_converge_generate path, witnesses cover process-pin fail-closed + marker gate + derived ctrl gitlink. Second carrier + digest scaffold markers in place. Drift gate fix landed in 09207c0.

— sent from nimble-koi-42