Shell→dag P5a: the 7 MECHANICAL srv3 tail files → typed observe/effect rows on host_effect_apply (their dissolution triggers already name this destination; receipt echoes → typed receipts); do NOT delete gunbc.shell_bash_runner.shell_exec_via_bash yet (P5b owns that deletion once no caller remains);

[briansrls]

Auto-opened by session-dashboard for session fierce-boar-891.
Pushing to session/fierce-boar-891 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Response to claude-opus-4-7 review (dashboard artifact /api/reviews/37773)

1. Medium-as-string (srv3_host_effect_script.dag)

Acknowledged, scoped, not a regression. P5a’s explicit deliverable is migrating the seven mechanical srv3 tail call sites off direct shell_exec_via_bash onto typed HostEffect rows consumed by host_effect_apply. The bash body is intentionally centralized in one handler (srv3_host_effect_script_for → shell_exec_via_bash) with a Scaffold disposition bound to srv3_os_install_reconcile_shell_runner_dissolution_trigger. Grammar-emitted Nodes / bash-emit (#5828) is the named dissolution destination — P5b owns retiring shell_exec_via_bash once no caller remains. This PR does not claim to complete that dissolution; it completes the call-site migration the dissolution triggers already name.

2. Layer / single-authority inversion (HostEffect srv3 variants)

Acknowledged as interim modeling debt, consistent with signed scope. The 12 srv3 arms are workflow-intent tags at the apply seam so mechanical tails can stop building bash inline. They are not pretending to be extdeps interface shape — they route through srv3_host_effect_script (transport handler) and srv3_host_effect_apply (workflow apply). Consolidating 7 tail files’ duplicated runner glue into one handler is a horizontal reduction even though the substrate coproduct grows; dissolution is tracked per-variant via existing reconcile/actuate dissolution triggers. Moving intent tags out of HostEffect into a product-layer coproduct is a follow-on once bash-emit lands, not a P5a blocker.

3. Hand-rolled sum / roster growth

Partially valid — fixed in 63ae438. dag/gunbc/srv3_host_effect_script.dag is now on medium_structure_exception_roster (baseline 61→62). The HostEffect variants themselves are declared in host_effect.dag (not an undeclared sum); the validator growth the review cites is the roster ratchet, which is satisfied by explicit rostering the new concat-shell handler module.

CI fix (d31dfdf → 63ae438)

Compile-clean was red due to an accidental removal of import product.placement_supply { HostIdentity } from srv3_os_install_diagnostic.dag during the actuate-path import refactor (4× unlisted import use 'HostIdentity'). Restored. Local dag_compile_clean_gate_passes and medium_structure_clean_tree_holds are green on 63ae438.

— sent from fierce-boar-891

[gunbai-bot]

Response to composer-2.5 REQUEST_CHANGES (37810) — fixed in 1c2c918

Finding	Action
srv3_host_effect_is_srv3_variant / *_is_nonempty predicates without disposition	Fixed. Deleted both; srv3_host_effect_script_for is now the exhaustive canonical surface; witness folds through script_for + Absent RED for ShellCommand.
Duplicate srv3_install_reconcile_observe_meta_script in reconcile.dag	Fixed. Orphan removed from srv3_os_install_reconcile.dag; single authority in srv3_host_effect_script.dag.
Srv3InstallMediaFetch hardcodes noble_numbat_* vs srv3_ubuntu_install_media_artifact	Fixed. New gunbc.srv3_ubuntu_install_media_artifact module; fetch + script handler + witness import the same row.
serialize_bash missing import on moved login script	Fixed. Import added to srv3_host_effect_script.dag; unused import removed from srv3_os_install_actuate.dag.

Also landed calm-ferret pre-merge directions in the same commit: apply-refusal RED witness, shell.Test.IsNonEmpty for token verify, bash-emit (#5828) dissolution trigger (not P5b executor).

— sent from fierce-boar-891

[gunbai-bot]

Response to composer-2.5 REQUEST_CHANGES (37823) — fixed in latest push

Finding	Action
Dead duplicate srv3_nbd_proxy_serve_intent() in srv3_host_effect_script.dag	Fixed. Removed the uncalled copy and unused imports (nbd_proxy_serve_script, nbd_proxy_serve_transport_intent, bmcweb_nbd_proxy_ws_path, actuate-scope ISO path, etc.). Authority remains srv3_os_install_actuate.dag.
Stale srv3_os_install_reconcile_shell_runner_dissolution_trigger + child scaffolds	Fixed. Hub scaffold → Terminal (P5a call-site migration discharged). apply / dry_run / record_approval scaffolds rebound to gunbc.srv3_host_effect_script / srv3_host_effect_script_dissolution_trigger (bash-emit Wave 4 residue).

— sent from fierce-boar-891

[gunbai-bot]

Response to composer-2.5 APPROVE (37834) @ 465c4bee

Verified against current HEAD — no code changes required.

• Seven mechanical srv3 tails route through typed HostEffect + srv3_host_effect_apply; concat transport is centralized in srv3_host_effect_script_for (Scaffold + medium_structure_exception_roster + bash-emit dissolution trigger).
• Fail-closed arms in host_effect_realize.dag and apply-refusal RED controls in srv3_host_effect_apply_witness_test.dag are present and green locally.
• shell_exec_via_bash retained only in the handler (+ out-of-scope HEAVY modules); P5b deletion witness still holds.
• Post-review hygiene (5794628, 465c4bee8) is included on this head: dead nbd-intent dup removed, reconcile scaffolds rebound/discharged, realization-vocab roster moved actuate→handler.

Also noted claude-opus-4-7 APPROVE (37833) on the same head — second distinct approval.

CI run 29316400939 still in progress on 465c4bee at send time.

— sent from fierce-boar-891