shell→dag: exhaustive per-instance census (§4) — the tracked punch-list

[gunbai-bot]

What

Adds §4 — the exhaustive per-instance census to docs/plans/shell-to-dag-residual-census-and-arc-completion.md: the complete, current (@ origin/main) list of every shell-string-construction site, so every instance is tracked to closure. Docs-only (+115 lines).

Why now

A recent wave (#7004, #7006, and the closed srv* cluster) counted relocations as migrations — it moved ShellCommand{script: concat(...)} out of the intent file into a new *_script.dag file and realized a typed variant by calling that concat and stuffing the raw string back into ShellOnHost{script}. Net raw-shell-string construction: unchanged; new §3 coproduct-nickname debt added. This census exists so no site is counted done until the concat is gone, not homed elsewhere.

What's in it

• 4.0 Completeness method — the P1–P8 grep patterns that partition every construction/carrier form (proves exhaustive, not sampled).
• 4.A–4.H — every instance with file:line, classified by ACTION:
  • A relocation regression (fake-migrated *_script.dag) → dissolve to the already-modeled extdeps op; delete the concat AND the nickname variant
  • B direct ShellCommand{script} still in intent
  • C runtime-present shell.Exec.Run with a string/_script body
  • D ssh.Session.Exec command-string vs typed ExecArgv
  • E foreign-executor/bootstrap (legit emit, bounded roster)
  • F bottom transport + the porous TransportScript brand (the Phase-3 construction wall)
  • G bash-AST emit vocab (emit-internal, already confined Phase 4: lock shell→intent via generalized realization_vocabulary_containment #6854)
  • H oracle/test retainers
• Scope in flight — what sleek-crab-621 (in-mission A1/A2) and keen-deer C5 Wave C5: typed-argv exec at realization edge (deploy probes, #5828 slice) #6946 (A3 access) own, and what's deferred (srv* A5, multi-op A4).

The key finding surfaced

The striking fact: almost everything hand-concatenated is already modeled in extdeps/ (systemctl.ShowProperty etc., access.PosixEffectivePrincipal, curl, sccache, git argv). The fix for most rows is "call the op." Only the hostname sites need a new extdeps.os.hostname op modeled first.

Each row is discharged by deletion of the concat (green-by-execution + an injection-RED), never relocation. §4 folds into the host_language_transport_script lens going live — the construction wall that makes new sites unwritable.

🤖 Generated with Claude Code

[gunbai-bot]

Fixed in 71843de — all four findings in review 41399 were valid. Root cause: §4 was grep-grounded on a divergent local worktree that still held the pre-#7006 ShellCommand{script} sites, so the rows drifted from origin/main.

• §4.B misclassification — correct: there are 0 live direct ShellCommand{script} construction sites on main; all became nickname variants. §4.B is now residue-only (the host_effect_plan {script: ""} placeholder + the host_effect.dag type def); the fleet_show/host_identity rows moved to §4.A as their real nickname-variant construction sites (SystemdUnitMemoryPropertiesRead/SystemdUnitMemoryMaxRead, HostIdentityShortHostnameRead).
• P5 under-scope — broadened to inline fn … -> String builders outside the *_script.dag glob, and §4.A now inventories them by name (fleet_runner_unit_property_read_script, fleet_runner_width_count_read_script, host_converge_slice1's …_memory_max_read/set/enumerate_units_script).
• §4.D line drift — corrected and completed the ssh_session_exec command-string inventory (test -x, command -v ×2, id -u/-g, ssh_session_exec_script).

Deeper fix per your DESIGN §6 point: every row is now keyed on file + symbol name, not line numbers — the anchor is stable across line moves, so the ledger can't drift the way it just did. The section is explicitly an interim tracker that dissolves into the enforcement lens (§4.F), which is the drift-proof authority. — sent from calm-ferret-849

[gunbai-bot]

Fixed in 8cc98cb — review 41467 was correct, and it's a real completeness hole. Root cause: my P1 pattern (ShellCommand *{ *script:) was single-line, so it could not match live_deploy/readiness.dag's multiline construction (ShellCommand { then script: on the next line). A census claiming grep-completeness with a line-at-a-time pattern isn't actually complete — that's the honest failure.

• §4.B is no longer 'zero' — it now lists the two live direct sites (live_deploy_healthz_probe_script_for_port, live_deploy_unit_diagnosis_command), both runtime-present via host_effect_apply_gated on srv1 LocalShell, with their intent.dag builders and dissolve-to paths.
• P1 is now multiline (ShellCommand\s*\{\s*script:) with an explicit note that the search must be slurped/multiline, not line-at-a-time. I re-ran it multiline-aware across dag/gunbc and confirmed readiness.dag is the only construction site the single-line pass missed — the other ShellCommand{script:_} => hits in host_effect_realize/fleet_converge_cli/ci_deploy_access_observe are match-arm destructuring, now noted as such.
• §5 updated: healthz curl → http.Client.Get (already exists, no new op); unit diagnosis → a new systemd.Systemctl.Status op added to the §5.A finite list. I also flagged the | tail + defensive exit 0 in live_deploy_unit_diagnosis_command as a §5 absorbing fallback — intent.dag's own comment admits it masks systemctl's nonzero, which the typed op models instead.

The deeper takeaway matches your DESIGN §5 point: a prose census is only as complete as its search method, which is exactly why §4 is framed as an interim tracker that dissolves into the enforcement lens (§4.F) — the lens reads the Node tree structurally and can't be fooled by a line-vs-multiline pattern. — sent from calm-ferret-849

[gunbai-bot]

Both findings in review 41476 valid, fixed in 0a01303:

• Conflicting dissolution triggers — reconciled. P4 has landed (Shell→dag P4 KEYSTONE: ConvergePlan + EmitArtifactThenThinRun + converge_apply #6572/Shell→dag P4-G3 completion: fleet_converge steady-state arms move IN-PROCESS via the landed converge_apply/ConvergePlan (#6572); committed .github/fleet-converge.sh golden SHRINKS from 323 lines to fresh-standup bootstrap + thin gunbc-converge invocation; bootstrap arm re-emitted as ONE intent tree #6585/Shell→dag: wire the gunbc converge CLI receiver — stage0 Subcommand gains converge --host <h>, dispatching to the landed converge_apply/ConvergePlan in-process interpreter (#6572) with typed receipts on the byte-locked receipt grammar; green by EXECUTION on a fixture host + discriminating RED (unkno #6598, recorded in §2), so the bottom 'delete when P4 lands' criterion is met; I rewrote it to unify on the single criterion §4/§5 already name — the doc dissolves when the host_language_transport_script lens goes live (§4.F/§5.E) and program.dag deletes. One criterion across the doc now (DESIGN §6 single authority).
• Clock.Now receipt — correct, the semantics differ: Clock.Now is wired to date -u +%Y-%m-%dT%H:%M:%SZ (UTC …Z), not date -Iseconds (local offset). I flagged it explicitly in the §5.B row: migrate by adopting UTC-Z (canonical for receipts) as a deliberate reconciliation, not a silent drop-in, and if a site genuinely needs local offset, add a Clock.NowLocal variant rather than fork date (DESIGN §3 consume-never-fork).

Also in this push: a wind-down PR ledger (operator request) replacing 'Scope in flight' — the state of every arc PR (landed / open / closed-srv* / not-started), flagging that #7004 and #7006 merged as 'progress' but are relocations, not true dissolutions. — sent from calm-ferret-849