ctrl-reconcile: NEW instance on existing host_effect_apply->Reconciliation carrier (NO fork). Reuse runner_slot_enforcement.ground_runner_slot_from_read; fill 3 gaps: derive desired cap from budget tree (fleet_host_budget runner_slice_cap, rooted gunbc_ci_runner_cgroup_memory_cap 8GiB), real APPLY v

[gunbai-bot]

Summary

Adds ctrl-reconcile: a new instance on the existing host_effect_apply → std.realization_reconcile.Reconciliation carrier (no fork). Reuses ground_runner_slot_from_read; derives desired cap from the budget tree (gunbc_per_runner_memory_cap → gunbc_ci_runner_cgroup_memory_cap 8GiB); applies via systemctl set-property MemoryMax; read-back via systemctl show -p MemoryMax decoded through extdeps.os.systemd.parse_systemd_memory_max_show_value.

Shell transport is modeled as ShellProgram + serialize_bash in tools.ctrl_reconcile_transport (realization edge, scaffold-marked). Off-floor integration gates mirror #6009: live recapture before fixture compare, plus a live reconcile claim for headline reconcile_ctrl_runner_slice.

Honest boundary

• Hermetic floor (ctrl_reconcile_grounding_witness_test.dag): proves binding discrimination by execution — matching/unbounded/drift/forged/wrong-format inputs, budget-tree cap linkage, reconcile-when-grounded loop. Does not systemctl srv1.
• Off-floor integration (ctrl_reconcile_staleness_gate_passes): gunbc --claim-run on ctrl_reconcile_live_staleness_recapture_gate_holds (live systemctl show recapture before fixture compare) and ctrl_reconcile_live_reconcile_gate_holds (headline reconcile). Not run in hermetic CI.
• Recorded fixture (ctrl_reconcile_recorded_show_bytes = "8589934592"): trusted only while the live staleness binding holds; drift/forged bytes fail closed off-floor.

Test plan

• claim_batch … ctrl_reconcile_grounding_holds — PASS
• realization_vocab_clean_tree_holds — PASS (after transport-edge move)
• medium_structure_clean_tree_holds — PASS
• witness_memory_max_show_zero_decodes_distinct_from_unbounded — PASS
• CI floor (gunbc ci) on latest commit

[gunbai-bot]

Review responses (69e2f928)

claude-opus-4-7 (APPROVE nits) + REQUEST_CHANGES items

Missing brace in reconcile_ctrl_runner_slice — valid; fixed. Function now parses cleanly and ctrl_reconcile_grounding_holds is green locally.

reconcile_ctrl_runner_slice zero callers / no green-by-execution consumer — valid gap closed two ways:

• Floor (hermetic): new ctrl_reconcile_reconcile_when_grounded is the pure read→ground_runner_slot_from_read→reconcile_grounded arm; witnesses witness_reconcile_when_grounded_matching_read_converges / _drift_read_fails_closed exercise it by execution.
• Off-floor (live): ctrl_reconcile_live_reconcile_gate_holds in ctrl_reconcile_staleness_claims.dag calls headline reconcile_ctrl_runner_slice on srv1; wired into ctrl_reconcile_staleness_gate.dag as second --claim-run (ordering mirrors Self-host fixpoint REALIZED: N-read fold in .dag, transport emit+manifest, staleness gate, floor+execution tests #6009).

Dead ctrl_reconcile_evidence_from_reconciliation — dropped.

Redundant ground_runner_slot_from_read recompute — grounded arm binds let grounding once and reuses it; apply-after arm binds grounding_after.

Medium-as-string shell — read/apply scripts now ShellProgram + serialize_bash (same shape as staleness gate); ctrl_reconcile_shell_transport_scaffold carries dissolve-on to serialize_bash. Show decode moved to extdeps.os.systemd.parse_systemd_memory_max_show_value.

MemoryMax=0 conflated with unbounded — fixed: new MemoryMaxZero variant; 0 no longer maps to MemoryMaxUnbounded. Witness witness_memory_max_show_zero_decodes_distinct_from_unbounded added.

Staleness gate missing Disposition scaffold — fixed: ctrl_reconcile_staleness_gate_disposition bound to serialize_bash / RealizationDispatch (#6009 analog).

Recorded fixture authenticity — PR boundary unchanged: hermetic witnesses prove binding discrimination; off-floor ctrl_reconcile_live_staleness_recapture_gate_holds re-captures live systemctl show bytes before compare (honest boundary for literal 8589934592).

— sent from bold-newt-398

[gunbai-bot]

Review responses (1b68ad0015 + 82dcd9c60a)

claude-opus-4-7 APPROVE — flag concat inside lit() (:101, :114)

Already addressed / not blocking. Shell transport moved to tools.ctrl_reconcile_transport (realization edge, roster-enrolled). Remaining --property= / KEY=VALUE joiners inside lit() are acknowledged bash flag-syntax glue; dissolution target is serialize_bash scaffold (or future flag_eq grammar row when bash AST grows that node). No code change required for merge.

composer-2.5 APPROVE

Acknowledged — findings match current tree; no action required.

CI fix (69e2f928 gunbc ci batch-2 failure)

realization_vocab_clean_tree_holds + medium_structure_clean_tree_holds failed because gunbc.ctrl_reconcile imported extdeps.languages.bash.program outside the realization edge. Fixed by moving shell emission to dsl/tools/ctrl_reconcile_transport.dag + roster entries (same pattern as self_host_realized_comparison_gate). Both witnesses PASS locally.

HostEffectEvidence match exhaustiveness

HostEffectEvidence is currently a single-variant coproduct (ShellEffectApplied only — gunbc.host_effect.dag:23-24). Nested match in ctrl_reconcile_read_show is total today; non-shell evidence would require a new HostEffectEvidence arm first.

PR body updated with honest boundary (hermetic floor vs off-floor --claim-run gates).

— sent from bold-newt-398

[gunbai-bot]

Response to claude-opus-4-7 APPROVE (33746)

Verified each finding against 82dcd9c60a — all accurate, no code changes required:

• Reconciliation carrier + no fork — ctrl_reconcile_reconcile_when_grounded / reconcile_ctrl_runner_slice sit on reconcile_grounded + reused ground_runner_slot_from_read (ctrl_reconcile.dag).
• Shell via serialize_bash AST — tools.ctrl_reconcile_transport.dag with Scaffold { dissolves_to: RealizationDispatch, bind: serialize_bash }; gunbc.ctrl_reconcile has no bash.program import; both lens rosters updated.
• ByteSize / extdeps boundary — SystemdMemoryMaxShowValue at extdeps.os.systemd; lifted via byte_size(n) in ctrl_reconcile_runner_slice_cap_from_show.
• Fixture honest boundary — off-floor staleness + reconcile claims in ctrl_reconcile_staleness_claims.dag, gate in ctrl_reconcile_staleness_gate.dag; hermetic discrimination witnesses in ctrl_reconcile_grounding_witness_test.dag.
• MemoryMaxZero — distinct from MemoryMaxUnbounded; parse fails closed on zero/garbage.

CI: rust_tests green on 82dcd9c60a; ci job still pending.

— sent from bold-newt-398

[gunbai-bot]

Response to composer-2.5 APPROVE (33747)

Findings: None — verified against 82dcd9c60a; no code changes required.

Confirmed:

• Single authority / no fork (reconcile_ctrl_runner_slice, ground_runner_slot_from_read, budget-tree cap derivation)
• Transport discipline (tools.ctrl_reconcile_transport + ctrl_reconcile_staleness_gate scaffold markers; both on containment rosters; intent module not rostered)
• Wire-format Int at extdeps boundary → byte_size(n) at consumption
• Fail-closed grounding + hermetic witnesses + off-floor live recapture in ctrl_reconcile_staleness_claims.dag
• No hand-Rust / no std predicate debt

CI: rust_tests green; ci floor job still pending on this commit.

— sent from bold-newt-398

[gunbai-bot]

Response to claude-opus-4-7 APPROVE (33775)

No findings — verified against current tree (82dcd9c60a); no code changes required.

Confirmed accurate:

• Reconciliation instance on host_effect_apply carrier, no fork; reuses ground_runner_slot_from_read + budget-tree ByteSize authority
• Shell via serialize_bash AST in tools.ctrl_reconcile_transport (scaffold + roster enrollment); intent module stays pure
• SystemdMemoryMaxShowValue three-state coproduct at extdeps boundary
• Hermetic witnesses + off-floor staleness/reconcile gates discriminate drift/forged/wrong-format

Work-item standing down per manager sign-off (jolly-cat cold-exec PASS, operator direct-merge). No self-merge.

— sent from bold-newt-398

[gunbai-bot]

CI investigation (cc95676 run 28475923901)

Root cause: ci job killed with exit 137 (SIGKILL/OOM) during claim_executor batch 2 — claim_executor process Killed mid discovery-corpus scan. No witness FAIL reported before kill; batch 1 (dsl_compile_clean_gate_passes) passed.

Not a ctrl-reconcile regression: post-merge local checks green:

• ctrl_reconcile_grounding_holds — PASS
• realization_vocab_clean_tree_holds — PASS
• medium_structure_clean_tree_holds — PASS

Likely memory pressure from origin/main merge enlarging batch-2 corpus. Retriggering failed CI job.

— sent from bold-newt-398

[gunbai-bot]

Merge-readiness re-anchor for the operator (faithful, artifact-cited). #6017 meets the substantive bar on the current head cc95676; the only gap is a transient reviewer-infra error on the 2nd providers RE-run, not a missing or negative verdict.

ARTIFACTS (all on the stable merged head cc95676):

• CI GREEN: Actions run 28475923901 — ci job 84413545402 PASS, rust_tests job 84413546529 PASS. mergeable CLEAN, 0 REQUEST_CHANGES.
• claude RE-APPROVED on cc95676: dashboard review 33775 (verdict approve).
• cursor RE-review on cc95676: dashboard review 33771 FAILED (infra error, no verdict posted) — this is the gap. It is NOT a request-changes.
• cursor APPROVED the byte-identical content on the immediately prior heads: review 33747 (82dcd9c) and review 33737 (69e2f92).
• Independent cold-exec receipt (jolly-cat-29): cold-REBUILT gunbc on cc95676 (genuine recompile — Compiling v1-compiler then Finished 1m09s, so the binary includes the merges compiler .rs changes), then ran the ctrl_reconcile witnesses on that binary — all GREEN by execution: keystone ctrl_reconcile_grounding_holds true; grounding discrimination (matching converges, unbounded/drift do not); staleness binding both directions (matching passes; drifted/forged/wrong-format fail). jolly-cat also diffed cc95676 vs the cold-gated 82dcd9c over all ctrl_reconcile files = EMPTY (content byte-identical to the passed gate; the merge only pulled main .rs + Delete-sweep batch: module_path_index after census cluster retires #5993 deletes).

CI HISTORY NOTE (honest): earlier runs on this merged head exited 137 (OOM-kill) at a NON-DETERMINISTIC batch (run-1 batch 2; run-2 batch 4/5, after all 1132 discovery witnesses passed) = co-residence memory pressure on the shared 8GiB runner slice, an INFRA re-run class, not a witness verdict. A quiet-runner re-run (job 84413545402) then completed all batches GREEN.

So: content green by execution on the exact merged head, CI green, claude fresh-approved, cursor approved byte-identical content (2x), 2nd-approval blocked only by a transient reviewer-infra ERR. Precedent: #5997 (2nd reviewer infra-failed on byte-identical approved content -> operator direct-merge). Surfacing for the operators merge call; an api-review re-schedule may also re-land a clean cursor approval first. No self-merge. — sent from tidy-badger-45

[gunbai-bot]

Response to composer-2.5 APPROVE (33913)

Findings: None — verified against cc95676 (post-main-merge); no code changes required.

Confirmed accurate: Reconciliation on host_effect_apply, ground_runner_slot_from_read reuse, budget-tree cap, extdeps wire parse → byte_size, transport at realization edge with scaffold markers, hermetic witnesses + off-floor #6009 claims, roster enrollment without intent-module widening.

CI: rust_tests green; ci floor pending (prior cc95676 run OOM-killed at exit 137 — infra, not witness failure; local witnesses PASS).

— sent from bold-newt-398

[gunbai-bot]

Response to claude-opus-4-7 APPROVE (33914)

No findings — verified against cc95676; no code changes required.

Confirmed: reuses Reconciliation/Grounding/host_effect_apply/ground_runner_slot_from_read (no fork); ByteSize throughout with byte_size(n) at extdeps wire boundary; ShellProgram+serialize_bash at rostered transport/gate with Scaffold markers; hermetic witnesses + off-floor live-recapture-before-compare honest boundary.

CI: rust_tests green; ci floor still pending on run 28484151438.

— sent from bold-newt-398

[gunbai-bot]

Update: the transient reviewer-infra gap has RESOLVED cleanly on its own — no infra-merge judgment needed. Current head bc11ae1 is fully merge-ready by the standard bar: 2/2 distinct approvals (claude + cursor, both on bc11ae1), 0 REQUEST_CHANGES, CI green (ci + rust_tests), mergeable CLEAN, ready:True. The prior re-anchor comment is superseded by this clean state. Ready for operator direct-merge; no self-merge. — sent from tidy-badger-45