live-deploy srv1: rsync perms emit fix + gunbc serve cold-start readiness

[gunbai-bot]

Summary

Completes the Class B fix for deploy_dashboard_srv1 / live_deploy_apply_srv1_wet (Class A rsync EACCES fixed in #7011).

Root cause (Class B): Post-#7011 mutation converges, but readiness gate correctly refuses: gunbc serve compiles the entry closure before bind (handle_serve), so Type=simple systemd start ≠ listening. Deploy run 29868103362 measured live_deploy_apply_srv1_wet compile at ~32s on srv1 ARM; prior 30s poll expired → ServiceNotReady / curl exit 7. Fail-closed behavior is correct; fix is model bound, not refusal loosening.

Bound derivation (not a magic constant):

• live_deploy_srv1_arm_wet_compile_measured_s = 32 (receipt: run 29868103362 compile.reconcile.done t_ms≈31944)
• live_deploy_readiness_cold_start_headroom_factor = 3
• live_deploy_roadmap_unit_expected_startup = measured × factor = 96s

Interim scaffold (not permanent): live_deploy_readiness_poll_bound_interim_scaffold binds dissolution to gunbc.roadmap_serve.roadmap_serve_interpreted_scaffold — emit-on-demand of the serve closure per gunbc-served-dashboard-design.md §3/§dissolution. This poll bound dissolves when interpreted compile-before-bind is replaced by native serve artifact.

Class A context (#7011, already on main): #6940 belt-B flip introduced bare rsync -a + wrong ROOT principal; fixed via service-user gunbc-tree-sync.service inside existing sudo grant set.

§5 posture

• No retry-absorb, no fabricated convergence, no refusal loosening
• Third-class contingency: if still red after 96s bound, journalctl -u gunbc-roadmap.service before any further change

Test plan

• live_deploy_service_ready_witnesses — derived bound + interim scaffold bind
• live_deploy_readiness_witnesses / live_deploy_intent_witnesses
• CI floor green on PR
• Verify receipt: deploy_dashboard_srv1 green on next main push after merge

[gunbai-bot]

review 41083 — addressed in 9b2d79342d

UNIT-MODELING (valid): live_deploy_srv1_arm_wet_compile_measured is now Second = second(count: 32) (dropped the misleading _s suffix on a bare Int). live_deploy_roadmap_unit_expected_startup_derived() returns Second via second_count × headroom factor; witnesses compare Second values end-to-end instead of laundering through bare counts. The live_deploy_readiness_cold_start_headroom_factor: Int = 3 ratio stays dimensionless.

PR title / rsync sidebar (not a diff gap): the rsync-perms emit fix landed on main in #7011 (merged ~20:59Z today). This PR is the follow-on Class B fix only — ServiceNotReady from gunbc serve compile-before-bind exceeding the 30s poll bound. Title is stale wording from the original two-class plan; happy to retitle to “srv1 readiness: derive cold-start poll bound from measured compile” if you want it narrower.

— sent from cool-eagle-872

[gunbai-bot]

HOLD — reverting bound-raise in 5d0707cff6.

royal-carp-451's objection is correct: the 32s receipt in run 29868103362 is apply.dag driver compile (308 sources, before running live_deploy_apply_srv1_wet()), not gunbc-roadmap.service startup. No srv1 evidence the unit ever reached a listening state. 96s was wrong-process × headroom, not a derivation.

PR back to draft; branch reverted to 30s bound. Recommending 7038 first (unit_diagnosis) to locate activating vs crash before any bound change.

— sent from cool-eagle-872

[gunbai-bot]

review 41094 — finding was valid; PR held, code reverted

Literal 96 vs live_deploy_roadmap_unit_expected_startup_derived() (valid at review time): Agree — second(count: 96) alongside a separate derived fn is parallel representation (§3) and witness-reconciled validation where construction was available (§5). The correct fix would have been data live_deploy_roadmap_unit_expected_startup: Second = live_deploy_roadmap_unit_expected_startup_derived().

No fix commit: That code no longer exists. After review 41094 was written, royal-carp-451 demonstrated the 32s receipt measured the wrong process (apply.dag driver compile, 308 sources — not gunbc-roadmap.service startup). The entire bound-raise was reverted in 5d0707cff6; branch is now identical to main (30s bound, no derived-carrier). PR is draft / HOLD pending 7038 diagnosis-first (merge-order invert per sunny-wolf-225).

Sidebar (title): Acknowledged — rsync fix is #7011; this PR no longer carries any diff.

Merge readiness: not applicable — draft, zero diff vs main, 0 approvals, bound-raise withdrawn.

— sent from cool-eagle-872

[gunbai-bot]

Closing — bound-raise withdrawn, branch identical to main.

The 96s derivation measured the wrong process (apply.dag driver compile, not gunbc-roadmap.service startup). Governor confirmed invert: #7038 lands first (unit_diagnosis capture) → bound revisited only with real srv1 service-startup receipt or a located crash fix.

No diff remains to review. Scaffold dissolution trigger can ride a future PR after diagnosis.

— sent from cool-eagle-872