Main-red hotfix: stale roster row from #7060 + stale script-module import orphaned by #7064

.github/workflows/ci.yml

@@ -251,4 +251,3 @@ jobs:
         run: |
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
           "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/live_deploy/apply.dag --function live_deploy_apply_srv1_wet
-

ROADMAP.md

@@ -92,8 +92,6 @@ The two pillars — §1 get off v1, §2 own the compute fabric — stand as the
 
 **⑤ Everything linear / efficient / minimal — dev UX** *(un-shelved from §4)*. The authoring experience is minimal and non-redundant: **fold-ergonomics** (inert-abstraction lens, non-fold-residue audit, ban source comments), **namespace-only resolution** (minimal naming, delete `import`, no ambiguity — operator-signed 2026-07-06, its two rules *are* the §2/§4 minimality + no-ambiguity walls; gated on the `SymbolIndex` substrate; [design](docs/plans/namespace-resolution-design.md)), and local iteration speed. Detail: §4 *fold-ergonomics lane* (promoted); the namespace-only lane.
 
-**In-flight lane snapshot (2026-07-22, silent-ibex-417 — effect-grants):** dissolving the forked `Hermetic | Wet | Record` bit into the (frame × verb × subtree) grant model (DESIGN open thread; not a pillar item). P-A/P-B landed; **P-C slice 1 MERGED (#6987)** (derived axes + presets), **P-C slice 2 in review (#7071)** (per-grant `HandlerBinding` selection — 2 approvals, mergeable, CI running). Remaining: `LiveTreeDisposition` stamp-retire (blocked on an operator path-A/B decision), `Hermetic|Wet|Record` enum deletion (gated on slice 2 + stamp-retire), hermetic-native run + network isolation (deferred behind a target-env trigger). Full PR ledger + blockers: [effect-namespace-grants §4](docs/plans/effect-namespace-grants.md).
-
 ## 1. Get off v1 — v2 self-hosts (TERMINAL: `src/v1` deleted)
 
 Anchor (do not flip-flop): `.dag` = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is **hand-written compiler logic → 0**, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — `claim_executor`, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → [plan](docs/plans/v2-self-hosting.md) · [de-fork audit](docs/plans/dag-v2-defork-audit.md) · [seed census](docs/plans/seed-shrink-census.md)

dag/gunbc/commit_workflow.dag

@@ -405,10 +405,7 @@ data commit_gate_roster: List<CommitCheckEnrollment> = [
   CommitCheckEnrollment {
     check: CommitWitnessClaim {
       entry: "src/v2/test/claim/meta_exec_confinement/scanner/planted_leak_test.dag",
-      check_fns: [
-        "scanner_planted_meta_exec_leak_detected_holds",
-        "scanner_clean_tree_meta_exec_holds_on_rostered_corpus"
-      ],
+      check_fns: ["scanner_planted_meta_exec_leak_detected_holds"],
       kind: CorpusWitnessKind,
       span: SpanUndeclared
     },

dag/gunbc/host_runner_memory_cap_verify.dag

@@ -19,16 +19,18 @@ import gunbc.host_runner_memory_provision {
   runner_memory_knobs_from,
   runner_memory_cap_readback_verdict,
 }
-import gunbc.fleet_show_effective_read {
-  runner_unit_memory_live_read_from_stdout,
-  fleet_runner_unit_memory_props_read_script,
+import extdeps.os.systemd { MemoryMax, MemorySwapMax, MemoryHigh }
+import gunbc.systemctl_show_read { systemctl_show_property_read_local }
+import gunbc.runner_unit_live_read {
+  RunnerUnitMemoryLiveRead,
+  RunnerUnitLiveReadRow,
+  runner_unit_live_read_typed,
 }
-import gunbc.runner_unit_live_read { RunnerUnitMemoryLiveRead }
 
 data runner_memory_cap_verify_probe_unit_assumption: String = "Path (b) verify read-back samples one representative unit (actions-runner@<host>-01.service; precedent: host_converge_slice1_probe_unit) while apply knobs target runner_instance_glob actions-runner@<host>-*.service (5 slots/host per gunbc.runner_slot_allocation). ASSUMPTION glob-uniform: systemd drop-ins apply the same MemoryMax/MemoryHigh/MemorySwapMax to every slot instance, so the knob tally receipt from -01 is the host-level verdict. Drift confined to -02..-05 alone is invisible until multi-unit fold lands (dissolve-on trigger for path (b) verify close)."
 
 data runner_memory_cap_verify_scope_disposition: Disposition = Terminal {
-  reason: "Path (b) verify-only close for runner memory caps (operator mandate 2026-07-21): read-back ONLY over a runner unit on the host's instance glob via fleet_show_effective_read transport + per_slot_memory_cap_verdict_from_unit_read. Emits a counted tally (converged/drifted/absent knob counts, no apply claim). Does NOT call host_effect_apply, interpret_converge_knob, or SshShell ConvergePlan — the host_converge_realize lane stays untouched. Shell realization is scaffold-marked medium-as-string (host_runner_memory_cap_verify_transport_script_scaffold) until host_effect orchestration emit binds grammar rows — read scripts delegate to fleet_show_effective_read; probed_at uses slice-local date -Iseconds. Interim shell.Exec.Run is also rostered on meta_exec_confinement_exception_roster (precedent: host_converge_slice1) until typed host_effect_apply read transport lands. One-unit proxy read (slot -01) under glob-uniform assumption — see runner_memory_cap_verify_probe_unit_assumption."
+  reason: "Path (b) verify-only close for runner memory caps (operator mandate 2026-07-21): read-back ONLY over a runner unit on the host's instance glob via fleet_show_effective_read transport + per_slot_memory_cap_verdict_from_unit_read. Emits a counted tally (converged/drifted/absent knob counts, no apply claim). Does NOT call host_effect_apply, interpret_converge_knob, or SshShell ConvergePlan — the host_converge_realize lane stays untouched. Shell realization is scaffold-marked medium-as-string (host_runner_memory_cap_verify_transport_script_scaffold) until host_effect orchestration emit binds grammar rows — memory-prop reads route through gunbc.systemctl_show_read typed ShowProperty local reads (slice1 precedent; re-grounded here after #7064 deleted the concat script module this verify path consumed); probed_at uses slice-local date -Iseconds. Interim shell.Exec.Run is also rostered on meta_exec_confinement_exception_roster (precedent: host_converge_slice1) until typed host_effect_apply read transport lands. One-unit proxy read (slot -01) under glob-uniform assumption — see runner_memory_cap_verify_probe_unit_assumption."
 }
 
 data host_runner_memory_cap_verify_transport_script_scaffold: Disposition = Scaffold {
@@ -156,13 +158,29 @@ fn runner_memory_cap_live_read(host: HostIdentity) -> RunnerUnitMemoryLiveRead?
   let unit = runner_memory_cap_probe_unit(host: host)
   match runner_memory_cap_verify_probed_at() {
     Present { value: probed_at } =>
-      let result = shell.Exec.Run(
-        script: transport_script_from_body(body: fleet_runner_unit_memory_props_read_script(unit: unit))
-      )
-      if result.success {
-        runner_unit_memory_live_read_from_stdout(unit: unit, stdout: result.stdout, probed_at: probed_at)
-      } else {
-        none
+      match systemctl_show_property_read_local(unit: unit, property: MemoryMax) {
+        Present { value: memory_max_raw } =>
+          match systemctl_show_property_read_local(unit: unit, property: MemorySwapMax) {
+            Present { value: memory_swap_max_raw } =>
+              match systemctl_show_property_read_local(unit: unit, property: MemoryHigh) {
+                Present { value: memory_high_raw } =>
+                  Present {
+                    value: runner_unit_live_read_typed(
+                      row: RunnerUnitLiveReadRow {
+                        unit: unit,
+                        memory_max_raw: memory_max_raw,
+                        memory_swap_max_raw: memory_swap_max_raw,
+                        memory_high_raw: memory_high_raw,
+                        memory_current_raw: "",
+                        probed_at: probed_at,
+                      }
+                    )
+                  }
+                Absent => none
+              }
+            Absent => none
+          }
+        Absent => none
       }
     Absent => none
   }

src/v2/lens/layering_imports.dag

@@ -2,6 +2,13 @@ module v2.lens.layering_imports
 
 import v2.lens.common.construction_justification { ConstructionJustification, WallAfterGrounding }
 import std.disposition { SingleAuthority }
+import v2.std.layer {
+  LayerPrefix,
+  LayerPrefixStd,
+  LayerPrefixExtdeps,
+  LayerPrefixCompiler,
+  LayerPrefixWorkflow,
+}
 
 type LayerImportFact {
   layer: LayerPrefix