shell→dag D2 (census §5.B, host-state cluster): migrate host_converge_slice1, host_identity_adopt/assimilation, live_deploy/apply off the retained_runtime/retained_srvn bridges to typed host_effect_apply ops — INCLUDING the #7004/#7006 relocation debt (concats were moved-not-deleted; delete them, do

[briansrls]

Summary

Shell→dag D2 (census §5.B, host-state cluster): migrates the host-state modules off retained_runtime / inline shell bridges to typed service ops and first-class host_effect_apply dispatch.

• host_converge_slice1: clock_now_probed_at, systemctl_set_property_local, systemctl_list_units_active_services (typed SetProperty / ListUnits + first-field parsing); phantom transport scaffold retired
• host_identity_adopt/assimilation: probed-at + receipt emit via host_effect_apply / clock_read; hostname write via gunbc.hostname_set (os.Hostname.ReadShort CAS + os.Hostname.Set, with sudo -n /usr/bin/hostnamectl over SSH)
• live_deploy (partial — dispatch relocation, not concat dissolution): deletes #7004/#7006 dispatch sidecar (live_deploy/host_effect_script.dag) and promotes LiveDeploy*OnHost typed variants in host_effect_realize — but apply/retract/ensure/digest still realize through retained_srvn wrapping concat-built scripts from live_deploy/emit / roadmap_static_site. Progress = typed dispatch + no Absent-fallback chain; not end-to-end typing (that stays on the shell-emit / A4 lane). Marked frontier: live_deploy_unit_status_emit_scaffold_note + live_deploy_unit_status_tail_scaffold in intent.dag
• live_deploy readiness unit-diagnosis: poll-bound capture routes through gunbc.systemctl_status_read (typed Systemctl.Status); deleted the exit 0 / | tail mask. Residual live_deploy_unit_status_tail_command in emit.dag tree_sync restart is scaffold-bound with dissolution trigger
• meta_exec_confinement: roster rows removed for graduated host-state modules (host_converge_slice1, host_identity_adopt, host_identity_assimilation)

Test plan

Hermetic witness runs (all PASS):

• claim_batch … --entry dag/test/claim/host_converge_slice1_witness_test.dag --function host_converge_slice1_wires_srv1_memory_cap --hermetic
• claim_batch … --entry dag/test/claim/host_converge_slice1_witness_test.dag --function host_converge_slice1_wires_srv3_multi_unit_generalization --hermetic
• claim_batch … --entry dag/test/claim/host_identity_observation_witness_test.dag --function host_identity_observation_holds --hermetic
• claim_batch … --entry dag/test/claim/live_deploy/apply_witness_test.dag --function live_deploy_apply_witnesses --hermetic
• claim_batch … --entry dag/test/claim/systemctl_status_read_scaffold_witness_test.dag --function systemctl_status_read_scaffold_witnesses --hermetic

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why (live_deploy partial migration named explicitly per reviews 42449/42523).
• Tests run: claim_batch --hermetic on affected witness modules — all PASS.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises.
• No secrets / credentials / large binaries staged.