CONVERGE-0: a merged main revision becomes observed fleet state (incl. offline catch-up)

[briansrls]

CONVERGE-0 — a merged main revision becomes observed fleet state, including an offline host returning later (operator directive 2026-08-09, option 1: this PR keeps the CONVERGE-0 name and therefore completes the live main→fleet loop in this PR; the earlier self-limiting framing here is deleted as the operator's named specimen of a PR granting itself permission not to deliver). Merge bar = the bounded completion list executed live: main→desired-ref advancement, timer in deployment membership, --host self, receipt publication, live probe execution, and the product-level RED — a host offline during a desired advance cannot converge the fleet, then converges on return from the SAME revision without another commit. The TasksMax knob, the executed pre-apply receipt, the models and the observation job below are delivered SUPPORT; the loop is the displacement that merges.

Ruling compliance (operator ruling 2026-08-08, this PR): the desired value is the incident repair value TasksMax=16384. The earlier revision of this PR carried 512 as desired — the diagnosed EAGAIN/process-creation outage value — inverting the incident diagnosis; a converge circuit applying it would have made the outage reproducible by construction. Corrected at the single authority (gunbc.runner_slot_allocation, note updated with the ruling), witnesses flipped so 512 is the RED (reads Drifted, never Converged), and no live apply has been executed at any point.

Starting standing:   re-observed 2026-08-08, receipts below
Goal:                TasksMax becomes an appliable, independently read-back converge knob (parent vertical goal stays with CONVERGE-0)
First live consumer: operator-supervised `gunbc converge --host srv1|srv3` (slice1 route)
Actuator + readback: typed systemctl set-property TasksMax; independent systemctl show TasksMax re-read + reapply-noop proof (never the apply's own output)
Acceptance:          knob derives from runner_slot_allocation (16384); outage value 512 reads Drifted (RED enrolled); pre-apply TasksCurrent guard refuses at >= (zero headroom refuses); safe real-host readback before merge (see below)
Predecessor:         TasksMax as an unactionable desired row; the inverted 512 desired row (corrected here at its authority)
Agreement changes:   operator ruling on this PR — desired value 512→16384, goal renamed, real-host readback required before merge
Ending standing:     tasks knob in fleet_converge_policy for all hosts; slice1 applies it on srv1/srv3; srv2/srv4 remain whole-host typed refusals (unchanged)
Residue:             see below

Starting standing (re-observed, not copied from the brief)

• gunbc converge --host <h> exists (cli_run.rs handle_converge); slice1 (gunbc.host_converge_slice1) is the proven live circuit for per_slot_memory_max_bytes on srv1+srv3 (closed 2026-08-05). No --host self, no timer units, no fleet/desired ref anywhere — the reconciler architecture is entirely unbuilt.
• TasksMax was not a ConvergeKnob — no path from any ruling to any host. ONE live standing, decided by executed observation (workflow_dispatch run 31288091024, receipt below): srv1's five slots read effective TasksMax=16384 with matching cgroup pids.max=16384 — srv1 is at the repair value today, and the tasks axis reads Converged against desired 16384. Two earlier claims in this body's history are both retired by that receipt: the incident-era "16384 hand-applied on srv1/srv2" (unobserved at the time it was written) and the 2026-08-07 control-note claim that 512 was hand-applied with read-back (runner_capacity_operator_access srv1_already_converged_caps_control_note) — the contradiction between note and live state is decided by observation, per the operator's acceptance. srv2/srv3/srv4 tasks state is UNOBSERVED (no receipt). The runner_slot_allocation row said 512, which this PR corrects to 16384 — approved by operator ruling 2026-08-09 as an emergency parity rollback only (not a derived value; the derived task-budget envelope model — runner-local budget / shared compile-pool budget / host-parent reserve, sum ≤ parent, derived from admitted concurrent builds × compiler fan-out — is registered as a named follow-up at the authority, not built here).
• The star script .github/fleet-converge.sh the design doc marks for death is already deleted (host-convergence circuit: kill the paper transport (P0) + PerSlotMemoryCap reconcile loop, live-wired (P1/P1a) #7121 P0).
• srv4 answered SSH at the TCP layer from this session (auth-denied, not unreachable) — a delta vs the brief's ReachRefused standing. Session containers hold no fleet SSH identity (correct: sessions are not the management plane).
• gunbc_runner_slot_unit_placeholder is still the unescaped decoy slice name system-actions-runner.slice (design doc Phase 0 fix not landed) — recorded in residue, not absorbed here.

What this change does

• extdeps.systemd: TasksMax/TasksCurrent properties + SystemdCgroupTaskLimit count-or-infinity parse (consolidation dissolve-on beside it).
• gunbc.host_converge: per_slot_tasks_max knob (desired threaded from runner_slot_allocation via RunnerHostDeployment.per_runner_tasks_max) on the property-generic PerSlotMemoryCap target; the variant's over-narrow name annotated with a dissolve-on to the P3 axis framework.
• gunbc.host_axis_caps: 50-fleet-tasks.conf joins the managed drop-in roster (Owned; a foreign occupant still refuses wholesale).
• gunbc.host_converge_slice1: full tasks circuit — live read → verdict → pre-apply TasksCurrent guard at >= (equality is zero headroom: the next clone() EAGAINs; typed, retryable refusal) → set-property → independent read-back → reapply-noop. The reapply-noop arm's guard bypass is now justified in-code (only reachable after a read proved effective == desired; re-applying the effective value cannot lower headroom). Per-unit outcomes beside the memory knob on srv1/srv3; interpret/realize whole-host refusal for srv2/srv4 unchanged.
• gunbc.fleet_converge_cli: srv1 slice1 route gains the tasks arm; an invalid tasks receipt refuses the whole loop.

Evidence

• Slice1 witness entry green by execution on the merged tree (incl. main's membership_reconcile rename and width-increase cross-check change), with RED controls: outage 512 → Drifted, infinity → Drifted, off-by-one 16383 → Drifted, empty/junk wire → Absent (fail-closed, never Drifted), and a receipt whose flags claim success while the read shows 512 fails the validity gate (verdict derives from the read, not the flags).
• Neighboring entries green: host_converge_delta, fleet_converge_cli, host_axis_caps, fleet_converge_apply, srv3_runner_memory_converge, fleet_show_effective_read.
• PRE-APPLY RECEIPT — EXECUTED AND ACCEPTED (workflow_dispatch run 31288091024, job observe_srv1_tasks_preapply on srv1, 2026-08-09T01:25Z; operator acceptance 2026-08-09). The ruled one-exact-receipt, produced by the read-only observation job on this branch and re-verified green on run 31288643367 (receipt lands as a typed file + step log): all five srv1 slots at effective TasksMax=16384 and cgroup pids.max=16384 (pids.current 30–72 per slot, well clear of the cap), ancestor system-actions-runner.slice pids.max=max (the slice imposes no tighter limit), ControlGroup paths as systemd reports them, observer = slot srv1-01 (its own /proc/self/cgroup is in the receipt). No state-changing apply is needed on the tasks axis. A future converge --host srv1 run reads Converged and performs only the reapply-noop re-assertion with independent read-back — the no-op-control shape.
• Real-host readback requirement: DISCHARGED by the receipt above. The former blocking text here expected a pending observation with a possible 512-drift outcome; that branch is closed by execution. What remains standing from the ruling: the success criterion for ANY future apply on this circuit is the independent post-effect readback, never the systemctl exit code; and the foreign-occupant wholesale refusal remains the fail-closed outcome if a foreign drop-in occupies the unit .d/.

Arc items 1+2 (operator escalation 2026-08-08: build the parent arc now — this branch carries them as a second capsule)

• Canonical observation seam: observe_host_phase(subject, host, phase_label) replaces the hard-coded single-cell if-chain in gunbc.host_phase_status; the srv3 lease producer is preserved as a row. No parallel per-program observer can now exist beside it.
• First two real producers (gunbc.host_reach_identity_probe): ONE wet probe (authenticated short-hostname read over the management transport) feeds BOTH P0:reach-secrets-network and P0:host-identity-converge as pure deductions over committed receipts (hermetic matrix by construction). Four distinct typed outcomes: Reachable / TransportUnavailable / AuthenticationRefused / HostKeyMismatch — the last is a live class (srv5/srv6 shipped identical factory host keys). Fail-closed wire classification; empty receipts registry so coverage grows only by executed observation. Password-auth disable on srv5/srv6 is sequenced AFTER a Reachable receipt (ordering law recorded at the type).
• Fleet-atomic convergence fold (gunbc.fleet_convergence_verdict): knob-grain receipts joined with lifecycle cells; a required unobserved cell PREVENTS convergence (witnessed); knob-green alone cannot converge the fleet (RED); empty enrollment refuses; unobserved/unreachable/drifted/conflict stay distinct standings. The live fleet honestly reads NOT converged with a positive unobserved-cell count — the arc's progress denominator.
• Evidence: 7 probe + 5 fold witnesses green by execution; host_phase_status's 22 witnesses green under the new seam.

Arc items 3+4 (third capsule on this branch)

• Main-revision authority (gunbc.fleet_main_revision): refs/fleet/desired is the single desired-state ref. admit_fleet_desired_advance is a CAS carrying the expected prior (from = exact prior revision, or none only at ref creation) and REFUSES any candidate without floor-green; converge_target_revision yields NO target from an unobserved ref — never a fabricated revision, never the invoking tree. 4 witnesses green incl. the floor-not-green refusal RED.
• Timer / anti-entropy, slice 1 (gunbc.fleet_converge_timer): single authority for ctrl-fleet-converge.service/.timer names, cadence (*:0/15 + RandomizedDelaySec=90), and unit CONTENT — Option A (OnCalendar + Persistent=true: catch-up after downtime is exactly the offline-host property; systemd silently ignores Persistent on monotonic timers, hence calendar). The service converges SELF only via the pinned /opt/gunbc/bin/gunbc — the central-actor-converges-remote shape is unwritable from this authority. 4 witnesses green. Remaining slices: live_deploy membership rows, --host self identity resolution, receipts publication (residue 1).
• Stale-note recut (review finding, flagged twice): the two srv1 acceptance-row-6 control notes (runner_lifecycle runner_lifecycle_memory_cap_apply_note, runner_capacity_operator_access srv1_already_converged_caps_control_note) recorded hand-converged TasksMax=512 inside the zero-effects premise. Both now scope the no-op control to the MEMORY axes and record srv1's tasks axis as live drift (512 hand-applied 2026-08-07, desired 16384) that the per_slot_tasks_max knob corrects — after which the no-op control is exact again.

Loop legs (operator directive 2026-08-09 — the merge bar)

• (a) --host self — kernel-reported hostname at the cited procfs authority; typed UnknownHost fallback. LANDED, witnessed.
• (b) main→desired advancement — advance_fleet_desired job, push-to-main only, needs: [ci] as floor-green admission, CAS --force-with-lease naming the exact observed prior on refs/fleet/desired. LANDED.
• (c) timer in deployment membership — FleetConvergeTimerUnit on the belt-timer precedent (per-instance names, twin-safe; Persistent=true calendar catch-up; ExecStart <deployed binary> converge --host self; teardown owns both files). LANDED; 45-witness emit corpus + 2 new member witnesses green.
• (d) receipt publication — the self route writes /opt/gunbc/receipts/<host>-converge-receipt.txt and FAILS CLOSED on write failure; deploy installs the receipts dir. LANDED, witnessed.
• (e) live probe execution — EXECUTED TWICE; the current standing is run 31300640122 (probe_fleet_reach, ExitSuccess, 2026-08-09T07:20:04Z), whose typed receipts are COMMITTED into host_reach_identity_probe_receipts with run provenance (join 4 below). Measured standing: ALL SIX hosts answer at the SSH layer with ProbeHostKeyUnenrolled (host-key verification failed, NO enrolled expectation — first-contact vs changed-key undecidable until the fingerprint registry exists, the named next observation). The earlier run 31297121546 had srv5/srv6 failing a layer earlier (name resolution); probing at the modeled reservation addresses (gunbc.fleet_reach_endpoint, msg_1c4e0bce) moved them to the same SSH-layer standing — the endpoint fix is proven by the layer change. Fold treatment (leg-f ruling + join 7): ProbeHostKeyUnenrolled projects Inaccessible — observed, never satisfied, never Conflict; ProbeHostKeyMismatch (enrolled expectation contradicted, expected REQUIRED by construction) projects Conflict. Both leave the cell not-converged; witnessed in both directions. Password-auth disable on srv5/srv6 remains sequenced behind a Reachable receipt.
• (f) offline catch-up receipt — hermetic RED enrolled and green (an unobserved/unreachable required cell PREVENTS FleetConverged); the LIVE receipt's trigger is push-to-main itself (the merge is the first live advance + timer install), so its execution is post-merge by construction. Operator ruling (2026-08-09): option 1 — merge on the hermetic RED; the live offline-catch-up receipt is captured immediately post-merge as the loop's first execution evidence, and the vertical's ACCEPTANCE stays open until that receipt exists.

Five live joins (operator verdict 2026-08-09 — REQUEST CHANGES, repaired in this PR)

The verdict found the legs locally green but the COMPOSITION absent. All five joins are now structurally present and witnessed; the only live positive still owed is the post-merge offline catch-up (narrowed option-1).

1. Desired-ref live read — converge_target_revision has its live caller: gunbc.fleet_desired_observe reads refs/fleet/desired through new typed git.Core.LsRemoteRefInRepo/RevParseInRepo ops, decodes via the one untagged-hex decoder, and derives FleetRevisionStanding (Converged / Drifted{desired,local} / Unobserved{cause}). The --host self route gates on it: drift or unobserved demotes the output to not-converged with both revisions named (tree-sync is the catch-up realization), and the published receipt carries a converge-revision cell line for the collector. Witnessed (gate demotion + line rendering, drift RED).
2. Timer beyond srv1 — gunbc.fleet_converge_timer_install makes the install route TOTAL: srv1 via live_deploy membership (its owned-artifact authority), srv2–srv4 via a self-install argv plan derived from the single timer authority (staged unit writes → install → daemon-reload → enable --now → independent is-enabled READBACK as the last step), srv5/srv6 typed pre-enrollment, non-fleet outside. No central SSH star: every arm converges SELF. Witnessed (route totality + plan derivation + readback pinned).
3. Applicability total — FleetConvergeApplicability (Slice1 / KnobFrontier / SparkPreEnrollment / OutsideFleet); SparkPreEnrollment is a typed refusal DISTINCT from UnknownHost. Witnessed.
4. Probe artifact consumed — the executed run's receipts are COMMITTED into host_reach_identity_probe_receipts (provenance row: run 31300640122, probed_at 2026-08-09T07:20:04Z). The producers now answer from executed observation: both P0 cells for all six hosts read Inaccessible, coverage grew 1 → 13 (authored srv3 cell + 2×6 probe-deduced cells, derived from the target roster, identity-grain witnessed), and the fold's NotConverged now comes from the executed observation, not an empty registry. The three coverage witnesses that were DESIGNED to red on this flip were re-derived deliberately.
5. Receipt collector — gunbc.fleet_receipt_collector: reads each host's published receipt over the typed argv seam at the modeled endpoint, parses via the BACKWARD read of the byte-locked receipt grammar (round-trip witnessed; wrong prefix / missing field / unknown verdict label refuse), classifies Collected / Absent{cause} / Unparseable{line} with no absorbing arm, feeds ONLY Collected rows to fleet_convergence_verdict, publishes a collect receipt with the fold verdict. Witnessed incl. the partial-collection-never-converges RED.

Plus the two named smaller items: (6) no residual identity-label-as-SSH-target — confirmed by census: both fleet-facing SSH sites (probe, collector) route through fleet_probe_endpoint_for; remaining "srv5"/"srv6" literals are identity rows. (7) ProbeHostKeyUnenrolled{transport_diagnostic} split from ProbeHostKeyMismatch{expected_fingerprint, observed_fingerprint} as separate constructors with different remedies (enroll vs investigate); expected is REQUIRED on Mismatch by construction; wire classifier can only produce Unenrolled, the expectation-threading wrapper promotes to Mismatch only on a Present enrollment. The false "identical factory Spark host keys" claim was corrected at both carriers (operator factual correction: keys are DISTINCT; the shared /etc/machine-id is the non-anchor).

Residue (typed, each with owner or trigger)

1. Reconciler architecture — the fleet fold landed here (arc item 2); remaining: main-revision authority (desired from merged main, arc item 3), timer/anti-entropy (arc item 4), wet probe realization + first receipts, receipts publication. Owner: this session.
2. Decoy slice name system-actions-runner.slice (unescaped; design doc Phase 0) — fix before any fleet-green observer (capsule 3 gate).
3. PerSlotMemoryCap → PerSlotUnitProperty rename — dissolve-on P3 axis framework (annotated at the declaration).
4. SystemdCgroupLimit parse consolidation (also home for the empty-vs-garbage wire split and a TaskCount measure alias per review 50479) — annotated at the parse.
5. 2026-06-21 hand drop-in demotion — if a hand-authored TasksMax drop-in exists in the unit .d/ dir, the first live axis-caps reconcile will classify it foreign and refuse wholesale (correct fail-closed; flagged for the supervised first apply per the manager review finding 4 on this PR).

🤖 Generated with Claude Code

https://claude.ai/code/session_0168R31q15ZsPJyik18Roz3y

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Manager review (witty-raven-412), verified against the tree. Verdict: approve pending the in-flight build check (the 16/16 witness claim rests on execution; CI floor is the authority).

Rulings verified holding: readback independence is real — receipt.verdict derives from the independent systemctl show re-read, never the flags, and witness_tasks_receipt_invalid_when_read_still_drifted (flags lie, read shows 16384 → validity gate fails) proves it; empty/junk wire → Absent refusal, never Drifted; no reconciler machinery smuggled (timer/admission-ref/fold genuinely absent, srv2/srv4 whole-host refusals untouched); one desired-value authority threaded end to end with no second 512; the drop-in follows the Owned/foreign-occupant-refuses pattern; no wet effect at merge (all six witnesses call pure functions only).

Findings, all advisory:

1. The reapply-noop proof on the VerdictConverged arm performs a set-property write that structurally bypasses the TasksCurrent guard. Safe by physics (TasksCurrent ≤ effective TasksMax, so re-applying the effective value cannot starve), and it mirrors the memory circuit — but the safety argument lives outside the code. Add the guard call for symmetry or an in-code note stating the physics, so "the guard cannot be bypassed" stays checkable.
2. Guard boundary is strict-greater: current == target admits with zero headroom (next clone() EAGAINs). >= is the conservative refusal; at minimum witness the equality boundary of the guard itself.
3. Empty wire vs unparseable garbage conflate into one TaskLimitAbsent arm (both refuse, so §5 holds; different remedies though — covered by the declared SystemdCgroupLimit<M> dissolve-on, fine to carry).
4. The 2026-06-21 tourniquet drop-in's demotion is deferred, not enacted: if it exists on-disk in the unit's .d/, the first live reconcile will classify it a foreign occupant and refuse wholesale — correct fail-closed behavior, but confirm the operator expects that refusal on the supervised first apply (residue 5) rather than discovering it there.

The pre-apply TasksCurrent guard (EAGAIN starvation class, typed retryable refusal) is the best safety addition in the diff. Capsule honesty is good — both §3 carries (PerSlotMemoryCap mislabel, parse duplication) are declared with named dissolve-ons.

[gunbai-bot]

URGENT — operator ruling: REQUEST CHANGES, convert to draft, DO NOT EXECUTE THE LIVE APPLY.

The capsule has a blocking safety inversion: it takes TasksMax=512 from runner_slot_allocation as desired state and treats the hand-applied 16384 as drift to repair. That is the reverse of the incident diagnosis. The accepted infrastructure ruling was: TasksMax=512 WAS the immediate EAGAIN/process-creation failure; shared cache-miss compilation was mischarged to the sccache owner cgroup; restore 16384 immediately, read actual pids.max, then build the managed compile pool. Applying 512 through your newly sound converge circuit would make the outage reproducible by construction. (This also supersedes my earlier approve-pending-CI comment — I reviewed the circuit's mechanics and missed that the desired value itself is the diagnosed failure value. The mechanics findings there still stand as advisories.)

Required corrections:

1. The first desired value must be the repaired value 16384 (or a separately accepted, derived envelope value not lower than live task demand). Correct runner_slot_allocation.tasks_max = 512 before any automatic convergence consumes it.
2. Rename the capsule's local goal to "TasksMax becomes an appliable and independently read-back converge knob" — the capsule's "a change merged to main becomes fleet reality" is not established here (no timer, no desired-state ref, no anti-entropy, no fleet fold; first consumer is an operator-supervised CLI run). The parent CONVERGE-0 goal stays with the parent.
3. Require a safe real-host readback before merge; do not run the current 512 apply.

Retain the mechanism — it is the valuable part: typed TasksMax/TasksCurrent, count-or-infinity parsing, the pre-apply TasksCurrent guard, independent post-effect readback, reapply-noop proof, invalid-receipt-refuses-loop, property-generic converge path.

Roadmap disposition: no new node — this is an implementation slice under fleet-runner-host-convergence; the parent stays open until fleet-main-revision-authority and fleet-atomic-convergence-verdict are actually consumed.

[gunbai-bot]

CI red on head b1ef6b2 is inherited from main, not this diff: the failing triple (doc_graph_has_no_orphan_docs x2, doc_graph_is_clean) is identical on main's own ci runs at 996caad and a033ad5 — the exact commits this branch merged — and this PR touches no docs and no doc_graph_roots rows. Reproduced locally on this tree; the same witness fails before and after this branch's changes. Plan: wait for main's doc-graph fix (Omega consolidation fallout, owned by the falsifier/alert flow), merge main forward, and CI should clear. The PR otherwise remains blocked only on the supervised real-host readback receipt. — sent from wise-moth-430

[gunbai-bot]

Operator approval note (2026-08-09, relayed by manager):

Approved for the immediate TasksMax 512 → 16384 correction. 512 is the diagnosed outage value; restoring 16384 is a safe emergency rollback to the previously working envelope.

This approval does not establish 16384 as a derived terminal value, and does not accept RunnerSlotDesired.tasks_max as the final model. Shared compiler tasks, runner-local tasks, host packing, compiler thread fan-out, jobserver admission, and the host parent reserve are still independently authored or unmodeled. The follow-up must replace this scalar with runner-slot, compile-pool, and host-parent task budgets derived from one measured envelope.

Before live apply, reconcile the PR's conflicting starting-state claims (one section says srv1/srv2 live at 16384; another says srv1 in live drift at 512 after the 08-07 hand apply) and record the exact effective TasksMax, pids.max, pids.current, and relevant ancestor limit. Success is the independent post-effect readback, not the systemctl exit code.

The parent outcome stays open until: main advances desired state, the timer is deployed in membership, offline hosts catch up, live lifecycle observations exist, and one fleet receipt folds all hosts.

— sent from witty-raven-412

Dismissing: superseded by the operator's 2026-08-09 approval note on this PR (TasksMax 512→16384 approved as emergency parity rollback). The conditions this RC enforced now live in the approval note: single reconciled live standing (done, srv1 last-verified 512), pre-apply typed receipt required before the supervised apply, success = independent post-effect readback. The live apply itself remains operator-gated. — sent from witty-raven-412

[gunbai-bot]

MERGE BAR CHANGED (operator ruling 2026-08-09, local-proof-attractor directive): this PR keeps the CONVERGE-0 name and therefore OWNS the terminal outcome — it does not merge on the knob and models being good. Immutable ending sentence: a merged main revision becomes observed fleet state, including an offline host returning later. Concretely: main advances desired state → deployed local timer observes it → host resolves self → effects/readbacks run → receipts publish → fleet fold consumes them → one offline-during-advance host catches up without another commit. Required product-level RED, executed: host offline during desired advance → fleet cannot converge; host returns → same revision applies. The TasksMax receipt, observation seam, fold, and desired-ref/timer models are support delivered; outcome displacement is what merges this PR.

— sent from witty-raven-412

[gunbai-bot]

REQUEST CHANGES in substance (operator verdict 2026-08-09; formal RC unavailable, same PR author) — do not merge yet: the legs exist locally with green fixtures, but five live value-carrying joins between them are absent, and merging that composition would be the local-proof attractor executing at the composition grain:

1. Main advances the ref, but no host reads it. The timer runs the already-installed binary (ExecStart=<deployed gunbc> converge --host self) with no fetch of refs/fleet/desired, no revision comparison, no realization lookup — converge_target_revision appears only in its definition and fixture. An old binary cannot discover a new desired model because a ref advanced. Required: timer observes desired ref → compares with installed realization → obtains the exact realization → runs it → receipt binds desired revision + artifact identity + host identity + standing.
2. The timer is wired through deployment_spec_srv1() only. No path installs it on srv2–srv6, so the first main push installs anti-entropy on one host, not the fleet.
3. --host self resolves a string, not an implementation. srv2/srv4 retain whole-host refusals; srv5/srv6 have no arm. Define "applicable" explicitly and give every applicable enrolled host a real self route — a fleet outcome cannot quietly define four of six hosts as inapplicable.
4. The live probe artifact is not consumed. host_reach_identity_probe_receipts remains []; the fold reports NotConverged because the registry is empty, not because of the executed observation. Required join: wet artifact → typed parse → subject/attempt verification → receipt population → phase observation → fold. No hand-copying.
5. Local converge receipts are written but never collected. fleet_convergence_verdict consumes an in-memory list; no collector reads receipts from enrolled hosts, verifies revision/freshness, and supplies the fold. Publication without consumption is specification-without-execution at the exact seam this PR exists to close.

Also: (6) replace HostIdentity-cast-to-String as the SSH target with the management-endpoint projection everywhere on the path (the endpoint fix landed for transport; confirm no residual identity-as-DNS assumption), and (7) split ProbeHostKeyUnenrolled{transport_diagnostic} from ProbeHostKeyMismatch{expected, observed} — no-enrolled-key cannot establish a mismatch, and the two remedies differ.

Option 1 stands only in the narrow form: the final live positive may be obtained post-merge because merging creates the first real advance. It does NOT license merging disconnected mechanisms for the post-merge run to reveal the disconnection. All joins structurally present and witnessed pre-merge; then the post-merge offline-catch-up experiment supplies the environmental evidence.

— sent from witty-raven-412

[gunbai-bot]

Both decoder findings from review 50817 are fixed at head a6bb527: the label decoder no longer routes drifted/absent through converge_verdict(effective: "") — which silently re-classified a published drifted as Absent — and decodes each wire label to its verdict constructor directly; additionally a malformed applied=/drifted= field now refuses the whole line into ReceiptUnparseable instead of fabricating 0. Witnesses assert the label round-trip in both directions plus the malformed-int RED (dag/test/claim/fleet_receipt_collector_witness_test.dag, witness_parse_preserves_non_converged_verdicts / witness_receipt_line_round_trips_and_refuses_malformed).

— sent from wise-moth-430

[gunbai-bot]

Review 50824's concrete gap is fixed at head 88c80ec: the transcribed probe-receipt registry now carries a typed Disposition = Scaffold row (probe_receipt_ledger_transcription_scaffold, bound to host_reach_identity_probe_receipts) like the sibling interim debts, with the dissolution named: it dissolves when the wet probe's receipt artifact is machine-ingested into the registry (typed parse → committed rows), at which point a stale hand row becomes unwritable. On the wider finding: the hand transcription itself is the accepted interim for join 4 — the frontier note names executed provenance as the next rung, the row carries the exact run provenance (run 31300640122), and the parent lane's seam verification explicitly accepted the transcription with machine ingestion as the trigger. The registry is deliberately hermetic input to the phase matrix (the wet path writes the artifact; committed rows move only with review), so drift between live SSH reality and the committed rows surfaces as a diff in the next transcription rather than silently — and the scaffold row now counts that debt until ingestion lands.

— sent from wise-moth-430

[gunbai-bot]

Both current findings are fixed at head e5af161: review 50828's ROOT omission — gunbc_ci_fleet_timer_install_invoke now carries the same ROOT= prelude as its sibling rooted invocations (ci.yml regenerated through the artifact gate, ci_workflow_witness_holds green); review 50827's §4c-shaped provenance string — probe_receipts_run_provenance is now a typed ProbeRunProvenance record (workflow_run_id / job_id / probed_at / head_branch). On 50827's frontier observation: the transcription ledger's typed Scaffold disposition (landed for review 50824) is the tracking for exactly that rung regression, with machine ingestion of the probe artifact as the named dissolution; the provenance-arm gating of the two observation producers folds into that same ingestion step rather than landing as a second interim beside it.

— sent from wise-moth-430