ctrl-reconcile: NEW instance on existing host_effect_apply->Reconciliation carrier (NO fork). Reuse runner_slot_enforcement.ground_runner_slot_from_read; fill 3 gaps: derive desired cap from budget tree (fleet_host_budget runner_slice_cap, rooted gunbc_ci_runner_cgroup_memory_cap 8GiB), real APPLY v

[gunbai-bot]

Auto-opened by session-dashboard for session bold-newt-398.
Pushing to session/bold-newt-398 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Cold-exec gate receipt (re-anchored from #6017 — same content, same head)

This PR (#6067) is a clean re-open of #6017 at the identical head bc11ae1a. Re-anchoring the gate evidence here so it is inline on the current number.

Content identity (verified now): dsl/gunbc/ctrl_reconcile.dag, dsl/test/claim/ctrl_reconcile_grounding_witness_test.dag, and dsl/gunbc/ctrl_reconcile_staleness_claims.dag are byte-identical on this head to the content I cold-exec gated on #6017 (git diff --quiet clean vs the gated heads). So the gate carries with no re-run.

Cold-exec gate (performed on #6017, carries by byte-identity):

• Cold-rebuilt gunbc from a fresh target (confirmed Compiling v1-compiler, not a stale Finished) on the gated head, then re-ran on the post-main-merge tree cc956764fc.
• Ran all 8 ctrl_reconcile_grounding_* witnesses by execution → green (hermetic, zero live I/O: synthetic ReadObserved fixtures).
• Control A (non-vacuity): perturbing the fixture bytes / feeding a non-grounding read flips the grounding witness RED; restore → green.
• Control B (staleness binding): the fixture-staleness binding fails closed on a forged/drifted fixture — verified ctrl_reconcile_fixture_staleness_binding_holds compares a re-captured live systemctl show (host_effect_apply, OneShotIdempotent) against the recorded bytes, recapture-before-compare (Self-host fixpoint REALIZED: N-read fold in .dag, transport emit+manifest, staleness gate, floor+execution tests #6009 ordering).
• §5 fence: the live host_effect_apply path is operator-manual-only — the live funcs are not floor-discovered (not test fn in *_test.dag) and absent from ci_floor_plan, so they do not auto-run on merge/CI.

CI on bc11ae1a: ci COMPLETED/SUCCESS + rust_tests COMPLETED/SUCCESS (some cancelled duplicates are re-open churn, not failures).

The content earned 3 distinct-provider approvals on #6017 at this exact head; the 0/2 here is purely the PR-number reset clearing reviewDecision. Substantive bar unchanged.