Plan amendments: bash-minimization rule + census-scoped shell slices + effect-plan band decisions

ROADMAP.md

@@ -80,20 +80,20 @@ Receipts + adjacent levers: [fractal Gantt](docs/plans/ci-floor-fractal-gantt.md
 - [ ] **service allocation receipt** — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses `reconcile_grounded` (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is `NotConverged`, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. **Accept (T4; [checklist](docs/plans/fleet-acceptance-criteria.md)):** one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → `NotConverged` · route present but port dead → `NotConverged` · shell exit-0 with failed read-back → `NotConverged`.
 - [ ] **G3 cgroup caps derived + reconciled** — `TasksMax`/`MemoryMax` are host-set by hand and only *read* live; derive from the budget tree + reconcile via converge so a hand-edit reds.
 - [ ] **G1 placement** — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side. [plan](docs/plans/compute-envelope-model.md)
-- [ ] **shell emission model** — `emit(intent, Bash)`; the mechanism the emitted converge/CD artifacts ride on (kept scoped to the converge/CI path; the tail slices are shelved). [plan](docs/plans/shell-emission-model.md)
+- [ ] **shell emission model** — `emit(intent, Bash)`; scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved). [plan](docs/plans/shell-emission-model.md)
   - [ ] **orchestration emission → agnostic registry dispatch** (#6106) — de-bash the compiler stage (in flight) — ⏳ awaiting sign-off
-    - [ ] **emit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer** *(operator directive, 2026-07-01)* — one grammar per language, read in both directions (DESIGN §4); emission is rows in `extdeps/languages/`, never stage code. Four leftovers: (a) `src/v2/compiler/05_emit_orchestration.dag` still carries orchestration→bash lowering IN the compiler stage (the welded env render `orch_emit_run_env_welded`, the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism, the welded render dissolves when the bash AST grows `EnvUnset` + multi-binding `EnvPrefixed` (#5846); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — `dag/extdeps/languages/bash/` vs `src/v2/extdeps/languages/bash.dag`+`bash_command_fold.dag` — the same §3 class as the `extdeps.shell` fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (`roadmap_spawner`'s `json_escape`/`json_str` is a marked scaffold dissolving to `std.primitives.to_json`; `bmc_onboard` and `tailscale_acl_emit` carry their own). (d) YAML: `ci_yaml_emit`/`ci_yaml_validate`/`gha_yaml_fold_pilot` sit in `dag/gunbc/` (workflow layer) while the fold pilot is `src/v2/extdeps/languages/gha_workflow_yaml_fold.dag` — YAML-the-language rows belong in `extdeps/languages/` with GHA-workflow as rows on top, retiring the `yaml_check` Rust scaffold once parse is grammar-owned.
+    - [ ] **emit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer** *(operator directive, 2026-07-01)* — one grammar per language, read in both directions (DESIGN §4); emission is rows in `extdeps/languages/`, never stage code. Four leftovers: (a) `src/v2/compiler/05_emit_orchestration.dag` still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST `EnvUnset` + multi-binding `EnvPrefixed`; #6137 dissolved `orch_emit_run_env_welded`); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — `dag/extdeps/languages/bash/` vs `src/v2/extdeps/languages/bash.dag`+`bash_command_fold.dag` — the same §3 class as the `extdeps.shell` fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (`roadmap_spawner`'s `json_escape`/`json_str` is a marked scaffold dissolving to `std.primitives.to_json`; `bmc_onboard` and `tailscale_acl_emit` carry their own). (d) YAML: `ci_yaml_emit`/`ci_yaml_validate`/`gha_yaml_fold_pilot` sit in `dag/gunbc/` (workflow layer) while the fold pilot is `src/v2/extdeps/languages/gha_workflow_yaml_fold.dag` — YAML-the-language rows belong in `extdeps/languages/` with GHA-workflow as rows on top, retiring the `yaml_check` Rust scaffold once parse is grammar-owned.
   - [ ] **slice 0 — CI EAGAIN-retry** — `ci_cargo_eagain_retry_core` → `emit(Retry, Bash)`; byte-oracle = committed `ci.yml` [plan](docs/plans/shell-emission-model.md)
-    - [ ] **slice 1 — control-flow emit** — `If` then `For`/`While` (`orch_emit_step` arms + byte goldens) [plan](docs/plans/shell-emission-model.md)
-      - [ ] **slice 2 — fleet_converge emit** — `fleet_converge_emit` → committed `.github/fleet-converge.sh`; the emit half of the re-land [plan](docs/plans/shell-emission-model.md)
+    - [ ] **slice 1 — control-flow emit (census-scoped)** — the `If` band only (`orch_emit_step::If` + else + condition forms + pipes/cmdsubst/`$?`/AndOr/redirect/env words, byte goldens); `For`/`While` NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing them [plan](docs/plans/shell-emission-model.md)
+      - [ ] **slice 2 — converge thin-run** — fleet_converge steady-state moves into the binary as a typed plan via `apply()` (models `EmitArtifactThenThinRun`); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole `.github/fleet-converge.sh`') [plan](docs/plans/shell-emission-model.md)
 - [ ] **`apply()` Phases B–F** — B `host_exec`→`apply()` (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756). [plan](docs/plans/host-effect-orchestration.md)
   - [ ] **temporal-effect-spine-a — temporal realization spine (T1 vocabulary)** *(operator 2026-07-02; not a workflow engine)* — `std.temporal_effect`: durable facts + `plan_next_step_from_prior_receipt_and_lease` (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. **Non-goals:** live mutation, DB, scheduler. **Accept (T1):** witness suite green.
     - [ ] **srv3-install-reconcile-a — dry-run reconcile entrypoint** *(queued; gated on temporal-effect-spine-a + os-install-deduction-a)* — `InstallAttemptIntent` + workflow steps as data; `srv3_os_install_reconcile` folds preflight + diagnostic + temporal spine; dry-run first. **Accept (T3):** dry-run receipt on srv1 actuator host.
   - [ ] **os-install-deduction-a — preflight + KVM diagnostic vocabulary (T1)** *(operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a)* — `gunbc.os_install_deduction`: `fold_nbd_proxy_os_install_preflight_verdict` (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, `TargetDiskState`, weak KVM verdicts (`KvmFirmwareIdleObserved`, `KvmSuggestsOsBooted`; `OsInstalled` reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. **Non-goals:** live mutation, monitoring product, DB. **Accept (T1):** witness suite green.
 - [ ] **srv3 → OsInstalled** — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end. [plan](docs/plans/srv3-webui-kvm-virtual-media.md)
   - [ ] **resource-namespace-upsert-a — vocabulary only** *(#6134 srv3 bringup follow-up; operator reshape 2026-07-03)* — `std.upsert_decision` (`ObservationVerdict` + `UpsertDecision<P>`); domain modules `gunbc.file_access`, `gunbc.session_lease`, `gunbc.install_media`. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.
   - [ ] **install-media-generic-layer — extract Ubuntu flavor from process** — split `extdeps/os/install_media.dag` generic shapes (fetch/remaster/serve verdicts) from `ubuntu_*` flavor rows; move `.gunbc-content-hash` sidecar + remaster policy to `gunbc/install_media_*`; mandatory before second OS/distro. Post-#6134.
-  - [ ] **nbd-serve-held-session-lease** — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classify RunningExpected|RunningStaleExpected|PortOccupiedForeign|TokenMissing|IsoMismatch|Absent; plan Noop|DrainThenStart|Refuse. RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.
+  - [ ] **nbd-serve-held-session-lease** — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE `std.upsert_decision` (`ObservationVerdict` + `UpsertDecision<P>`; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.
   - [ ] **srv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine** — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.
   - [ ] **os-install generic naming cleanup** — rename generic behavior tests/modules away from `srv3_*` where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (`srv3_pre_install_lease_table`, `srv3_seeded_install_media_artifact`). Post-#6134.
 
@@ -148,7 +148,7 @@ Every lane below was live roadmap before the reset. Shelved = plan docs and carr
 - **caching completion** — `realize(subject)` one door (P2) · M5 fixture-store · native `content(T)` (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model [loop](docs/plans/realization-measurement-loop.md) [M4](docs/plans/m4-universal-hermetic-corpus.md) [M5](docs/plans/m5-fixture-store-consolidation.md)
 - **CI inline-shell de-fork · interpreter terminal-output de-fork** (seed forks of modeled authorities; both shrink as v1 burns down) [emission-ingestion](docs/plans/emission-ingestion-inverse.md)
 - **idea machine** — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · `Medium` homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue [plan](docs/plans/idea-machine.md) [format reconciliation](docs/plans/format-model-reconciliation.md) [invert](docs/plans/invert-hand-maintained.md)
-- **shell-emission slices 3–4** — live_deploy golden · bmc_token_federation → ci_workflow RunSteps → githooks tail [plan](docs/plans/shell-emission-model.md)
+- **shell-emission slices 3–4 (census-rescoped)** — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim [plan](docs/plans/shell-emission-model.md)
 - **TypeScript first-class emit + TS self-host** — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point [gap census](docs/plans/typescript-gap-census.md)
 - **HTML/React + live dashboard lane** — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal **stateless-frontend fabric slice is active in §2** only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD *transport* fix is also §2 live work)
 - **session dashboard + roadmap-as-spawner** — the *automatic* spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked **dispatch actuator** slice is un-shelved into §2 (2026-07-03) [plan](docs/plans/roadmap-spawner.md)

dag/gunbc/plans/fold_ergonomics.dag

@@ -28,7 +28,7 @@ fn fold_ergonomics_body() -> List<MarkdownBlock> {
     p(text: "**Root B — generic inference is weak, so the fold is awkward to reach (the friction).** Two concrete failures:"),
     ul(items: [
       li(text: "generic fn-param results mis-infer as kernel `Witness`/`Optional` → must route through a typed param (the `resolve_probe` workaround in `staging.dag`; same in `target_model.dag`);"),
-      li(text: "generic type-alias instantiation fails — `type QualifiedName = FreeMonoid<Symbol>` won't define (\"variant not found in type `FreeMonoid`\") → **55 lines of hand-rolled `qualified_name_eq`/`for_all`** (`qualified_name.dag:25–57`), and it is the *same* root that makes v2 still hand-roll `ParseTable`."),
+      li(text: "generic type-alias instantiation — **partially fixed by #5552**: `type QualifiedName = FreeMonoid<Symbol>` now defines, and simple construct/match/use-site instantiation resolves (proven by `generic_alias_coproduct_instantiation_test.dag`); the hand-rolled `qualified_name_eq`/`for_all`/`singleton` were dissolved into `FreeMonoid` ops + structural `==` (QualifiedName seed de-fork). **Remaining resolver gap:** raw variant-matching a value *bound from a `Cons.tail` field* (or a nested `tail: Empty` pattern) on a recursive `FreeMonoid` still corrupts resolution (\"variant not found in type `FreeMonoid`\") — thread tails through the algebra (`list_head`/`list_tail`/`fold`) instead, the idiom all `FreeMonoid` consumers already use. It is the *same* root that makes v2 still hand-roll `ParseTable`."),
     ]),
     p(text: "Root A is the fail-open class the lane retires; Root B is the friction that keeps producing it."),
     h2(text: "3. Ranked focus (displaced cost named, per the §6 guardrail)"),