Class B trim: pool-independent binding repair + live specimen

dag/extdeps/access/posix_effective_principal.dag

@@ -1,5 +1,7 @@
 module extdeps.access.posix_effective_principal
 
+import std.algebra { trim }
+
 import std.types { Bool, Int, NonEmptyStr, String }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }

dag/extdeps/bmc/openbmc_fan_control.dag

@@ -1,5 +1,7 @@
 module extdeps.bmc.openbmc_fan_control
 
+import std.algebra { trim }
+
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Https, Uri }
 import extdeps.ssh.password_session {

dag/extdeps/clock/clock.dag

@@ -1,5 +1,7 @@
 module extdeps.clock
 
+import std.algebra { trim }
+
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {

dag/extdeps/filesystem/linux.dag

@@ -1,5 +1,7 @@
 module extdeps.filesystem.linux
 
+import std.algebra { trim }
+
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Https, Uri }
 import std.types { Bool, Int, List, NonEmptyStr, String }

dag/extdeps/git/object_store.dag

@@ -1,5 +1,7 @@
 module extdeps.git.object_store
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, Bytes, Map }
 import std.content_hash {
   ContentHash,

dag/extdeps/languages/html.dag

@@ -1,5 +1,7 @@
 module extdeps.languages.html
 
+import std.algebra { trim }
+
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import extdeps.communication.medium { Medium, Lossless }

dag/extdeps/linux/proc_self_cgroup.dag

@@ -1,5 +1,7 @@
 module extdeps.linux.proc_self_cgroup
 
+import std.algebra { trim }
+
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Https, Uri }
 import std.decl_ref { DeclarationRef, WholeDeclaration }

dag/extdeps/llm/claude_setup_token_cli.dag

@@ -1,5 +1,7 @@
 module extdeps.llm.claude_setup_token_cli
 
+import std.algebra { trim }
+
 import std.types {
   String,
   NonEmptyStr,

dag/extdeps/llm/cli.dag

@@ -1,5 +1,7 @@
 module extdeps.llm.cli
 
+import std.algebra { trim }
+
 import std.types { List, String, Int, Bool, NonEmptyStr, RenderedTerminalText }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }

dag/extdeps/pijul.dag

@@ -1,5 +1,7 @@
 module extdeps.pijul
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, Bytes, Timestamp, Map }
 import std.integer { NonNegativeInt, UInt8 }
 import extdeps.external_authority { ExternalAuthority }

dag/extdeps/shell/exec.dag

@@ -46,6 +46,8 @@ fn transport_script_seal(body: String) -> TransportScript
 
 data shell_exec_run_stdin_route_note: String = "shell.Exec.Run transport: argv is fixed [bash, -s]; the script input is routed through the transport stdin field. Large payloads belong here — they never become a single argv token, so they do not encounter the Linux per-argument exec ceiling modeled in extdeps.exec.exec_arg_limit.host_exec_arg_max_strlen (deploy Part A / #6711)."
 
+data service_op_string_wire_projection_method_fork_note: String = "🟡 KNOWN CLASS (infer-layer, not runtime Value): extdeps service-operation output fields declared `T from \"wire_key\"` (e.g. stdout: String from \"stdout\") infer as FaithfulFreeMonoid / Coproduct carriers when the closure lacks v1-seed sources (v1.compiler.infer rust_corpus_repr), while ordinary String parameters and algebra ReceiverSelf method templates (trim, length, …) attach to the declared String type node. Method syntax on the wire-minted receiver therefore refuses (method trim not found on Coproduct(FreeMonoid)) even though the extdeps contract names String. Free-call trim(s: x) can still compile when explicit import lists std.algebra { trim } and the argument coerces to String — a binding bridge, not type-node unification (#8062 trim registry). Pinning witness: fixtures/class_b_trim/monoid_specimen.dag + v1-compiler-tests trim_method_form_fails_on_freemonoid_receiver; bold-eagle effect_plan wire projection confirmed same class. Every other String method on any service-op result field shares this latent fork until dissolved. DISSOLVE-ON: service-op wire projection unifies with the declared output type authority so ReceiverSelf algebra methods attach to the same node the extdeps contract names (FaithfulFreeMonoid mint ≡ String for String-declared wire fields)."
+
 data shell_exec_check_argv_embed_note: String = "shell.Exec.Check transport: argv is [sh, -c, command] — the entire command string is ONE argv element. On Linux hosts this is the surface that hits execve(2) MAX_ARG_STRLEN (extdeps.exec.exec_arg_limit.host_exec_arg_max_strlen): an oversized embed fails E2BIG (opaque os error 7) unless the interpreter refuses first at dispatch_shell (InterpError::ArgvExceedsHostArgMax). Prefer Run for payloads approaching the per-argument ceiling."
 
 data shell_exec_transport_ceiling_authority: ByteSize = host_exec_arg_max_strlen

dag/extdeps/systemd/oomd.dag

@@ -1,5 +1,7 @@
 module extdeps.systemd.oomd
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, String, FilePath, Bool }
 import std.measure { Second, second, Percent, percent, percent_count }
 import std.types { Int }

dag/extdeps/tmux/tmux.dag

@@ -1,5 +1,7 @@
 module extdeps.tmux
 
+import std.algebra { trim }
+
 import std.types { List, String, NonEmptyStr, Int, Bool, RenderedTerminalText }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }

dag/extdeps/tools/sha512sum.dag

@@ -1,5 +1,7 @@
 module extdeps.tools.sha512sum
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, String, Bool, FilePath }
 import std.content_hash { Sha512Digest, sha512_hex_digest }
 import std.decl_ref { DeclarationRef, WholeDeclaration }

dag/extdeps/tools/wc.dag

@@ -1,5 +1,7 @@
 module extdeps.tools.wc
 
+import std.algebra { trim }
+
 import std.types { FilePath, String, NonEmptyStr }
 import std.measure { ByteSize, byte_size_count }
 import std.decl_ref { DeclarationRef, WholeDeclaration }

dag/extdeps/uri.dag

@@ -1,5 +1,7 @@
 module extdeps.uri
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr }
 import std.unicode.types {
   unicode_scalar_max_code_point,

dag/gunbc/bmc_fan_converge.dag

@@ -1,5 +1,7 @@
 module gunbc.bmc_fan_converge
 
+import std.algebra { trim }
+
 import extdeps.bmc.capability {
   CurrentEvidenceUnclaimed,
   BmcFirmwareIntent,

dag/gunbc/ci_deploy_access.dag

@@ -1,5 +1,7 @@
 module gunbc.ci_deploy_access
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, List, String, Bool }
 import std.access { AccessDecision, Permit, Deny, access_policy_refusal, access_refusal_reason }
 import std.disposition { Disposition, Scaffold, RealizationDispatch, Terminal }

dag/gunbc/ci_deploy_target_host.dag

@@ -1,5 +1,7 @@
 module gunbc.ci_deploy_target_host
 
+import std.algebra { trim }
+
 import std.types { String, NonEmptyStr, Bool, List }
 import std.access { AccessDecision, Permit, Deny, access_policy_refusal, access_refusal_reason }
 import std.disposition { Disposition, Scaffold, SingleAuthority }

dag/gunbc/ci_layer_roots.dag

@@ -1005,7 +1005,7 @@ data v1_claim_scoped_witness_entries: List<ScheduleWitnessEntry> = [
   },
 ]
 
-data v1_claim_scoped_witness_batch_note: String = "This is one INSTANCE of std.realization_schedule ScopedWitnessBatch, not a parser branch in the floor mechanism. The four file-grain rows expand through ScheduleWitnessEntry's empty-function authority, so adding or renaming a test fn changes no roster. Their dag plus src/v1 source-root envelope admits the v1 compiler closure without widening witness_layer_roots for unrelated witnesses. SelectionApplied is deliberate: normal affected-set selection avoids paying the measured closure materialization on unrelated PRs; every unselected roster row still emits an exact-head ScopedWitnessSelectionSkipped receipt with provenance, while a provenance failure refuses loudly and never widens. The executor's own module universe is a distinct fact carried by ScopedWitnessBatch.execution_authority as InheritedWalkSourceRoots: the worker resolves affected_set_floor_runner, witness_entry_eligibility_census, and post-discovery cost/attribution projectors from the enclosing walk's roots while the witness subject index remains exactly dag plus src/v1. Adding src/v2 to this batch's witness roots was considered and refused because it widens the subject envelope, moves the receipt digest, and invalidates the measured clamp basis; executor-authority dependencies never enter the witness roots as an absorbing fallback. The profile declares a substantial whole-tree resolve, Hermetic effects, a batch-owned 360-second clamp, and SequentialChildProcess isolation. The 360-second clamp is the smallest whole-minute value covering the measured 199.393-second optimized arm64 wall after the full executor-authority projection path was made reachable, at gunbc.ci_spec gunbc_ci_compile_clean_clamp_note's documented 1.8x fleet spread: 199.393 x 1.8 = 358.9074 seconds, rounded upward to the family grain. The earlier 180-second basis measured only 96 seconds before the cost projector and renderers were reachable from the narrow scoped envelope, so it no longer described the executing batch. COST DISPOSITION: the approximately 103-second increase correlated with making the cost projector, histogram, and slowest-attribution renderer reachable while witness row evaluations themselves remain negligible per-row; that reporting/closure cost has not been decomposed in this scoped-scheduling change and is tracked by the real ROADMAP module-grain-materialization lane. Its trigger is a per-projector resolve/materialization attribution showing whether the three projections recompute identical semantic facts, followed by cached-vs-cold receipts before any optimization claim. The larger clamp must not normalize that open cost question into proportionality. per_unit_ms remains zero because row evaluation is negligible; this catches closure growth and deliberately does not price row-count growth until a file brings a distinct closure. Exact-head run 30713632253 proves SharedWalkProcess cannot satisfy this instance: ordinary discovery completed at 7.113GB RSS, then the floor vanished while materializing this second root closure before a batch-start line. The kernel cause is unclassified, but additive same-process residency is established. SequentialChildProcess makes the ordinary worker exit before this worker starts, releasing the first live set without claiming the stronger fresh-cgroup semantics of FreshJobProcess. v1_claim_scoped_witness_dissolve_on fires when the v2 parser owns these claims."
+data v1_claim_scoped_witness_batch_note: String = "This is one INSTANCE of std.realization_schedule ScopedWitnessBatch, not a parser branch in the floor mechanism. The four file-grain rows expand through ScheduleWitnessEntry's empty-function authority, so adding or renaming a test fn changes no roster. Their dag plus src/v1 source-root envelope admits the v1 compiler closure without widening witness_layer_roots for unrelated witnesses. SelectionApplied is deliberate: normal affected-set selection avoids paying the measured closure materialization on unrelated PRs; every unselected roster row still emits an exact-head ScopedWitnessSelectionSkipped receipt with provenance, while a provenance failure refuses loudly and never widens. The executor's own module universe is a distinct fact carried by ScopedWitnessBatch.execution_authority as InheritedWalkSourceRoots: the worker resolves affected_set_floor_runner, witness_entry_eligibility_census, and post-discovery cost/attribution projectors from the enclosing walk's roots while the witness subject index remains exactly dag plus src/v1. Adding src/v2 to this batch's witness roots was considered and refused because it widens the subject envelope, moves the receipt digest, and invalidates the measured clamp basis; executor-authority dependencies never enter the witness roots as an absorbing fallback. The profile declares a substantial whole-tree resolve, Hermetic effects, a batch-owned 480-second clamp, and SequentialChildProcess isolation. RECEIPTED RAISE (2026-08-08, PR #7924 CI run 31223532865 @ 93b1373751): scoped child FLOOR-BATCH-OVER-BUDGET wall_ms=375553 clamp_ms=360000 units=27 — reproduced locally on the same commit after merge with main. Prior 360s basis (199.393s arm64 x 1.8 = 358.9s) is stale: post-merge scoped-worker stage wall is ~376s on x86_local with the full executor-authority projector path. Sizing follows gunbc.ci_spec gunbc_ci_floor_batch_clamp_note fleet-margin policy (measured worst wall x 1.2, not host roulette): 375.553s x 1.2 = 451s, rounded up to 480s whole-minute grain (+33% over the retired 360s row). THE ENROLLMENT THAT GREW THE BATCH: none — wall is closure-materialization dominated, not a roster edit. The earlier 180-second basis measured only 96 seconds before the cost projector and renderers were reachable from the narrow scoped envelope, so it no longer described the executing batch. COST DISPOSITION: the approximately 103-second increase correlated with making the cost projector, histogram, and slowest-attribution renderer reachable while witness row evaluations themselves remain negligible per-row; that reporting/closure cost has not been decomposed in this scoped-scheduling change and is tracked by the real ROADMAP module-grain-materialization lane. Its trigger is a per-projector resolve/materialization attribution showing whether the three projections recompute identical semantic facts, followed by cached-vs-cold receipts before any optimization claim. The larger clamp must not normalize that open cost question into proportionality. per_unit_ms remains zero because row evaluation is negligible; this catches closure growth and deliberately does not price row-count growth until a file brings a distinct closure. Exact-head run 30713632253 proves SharedWalkProcess cannot satisfy this instance: ordinary discovery completed at 7.113GB RSS, then the floor vanished while materializing this second root closure before a batch-start line. The kernel cause is unclassified, but additive same-process residency is established. SequentialChildProcess makes the ordinary worker exit before this worker starts, releasing the first live set without claiming the stronger fresh-cgroup semantics of FreshJobProcess. v1_claim_scoped_witness_dissolve_on fires when the v2 parser owns these claims."
 
 data v1_claim_scoped_witness_batch: ScopedWitnessBatch = scoped_witness_batch(
   batch_id: "v1-claim-scoped-witnesses" as ScopedWitnessBatchId,
@@ -1021,7 +1021,7 @@ data v1_claim_scoped_witness_batch: ScopedWitnessBatch = scoped_witness_batch(
       execution_mode: Hermetic,
     ),
     clamp: RunnableBatchClamp {
-      overhead: second(count: 360),
+      overhead: second(count: 480),
       per_unit: millisecond(count: 0),
       authority: decl_ref(
         module_path: "gunbc.ci_layer_roots",
@@ -1492,7 +1492,7 @@ data falsifier_substrate_long_lane_rows: List<SubstrateLongLaneRow> = [
   SubstrateLongLaneRow {
     entry: "dag/test/claim/long/qualified_declaration_reference_emit_cross_module_witness_test.dag",
     function: "cross_module_qualified_reference_emits_call_from_correct_module",
-    reason: "compile_dag_rust_emit_check cross-module fixture importing std.emit_on_demand.interpreter_surviving_roles_ceiling: measured ~4125ms thread-CPU warm locally; PR CI run 31198854678 discovery batch 3 killed at 5544ms > 5000ms fast-lane budget. Same-module sibling stays per-PR in dag/test/claim/qualified_declaration_reference_emit_witness_test.dag.",
+    reason: "compile_dag_rust_emit_check cross-module fixture (std.unicode.types.unicode_scalar_max_code_point — minimal std closure, not the heavy std.emit_on_demand roster the prior fixture dragged in): measured 5436-5544ms thread-CPU vs 5000ms fast-lane cap on srv_fleet_arm64 PR CI discovery batch 3. Same-module sibling stays per-PR in dag/test/claim/qualified_declaration_reference_emit_witness_test.dag.",
     dissolve_on: "eval lands under gunbc_ci_fast_lane_witness_eval_budget on a measured cold run and re-enrolls per-PR discovery; row deletes with the long-lane file"
   },
   SubstrateLongLaneRow {

dag/gunbc/fleet_show_effective_read.dag

@@ -1,5 +1,7 @@
 module gunbc.fleet_show_effective_read
 
+import std.algebra { trim }
+
 
 type RunnerSliceCapLiveReadRow {
   slice_unit: NonEmptyStr

dag/gunbc/git_diff_change_window.dag

@@ -1,5 +1,7 @@
 module gunbc.git_diff_change_window
 
+import std.algebra { trim }
+
 import extdeps.git.object_store {
   GitObjectId,
   git_object_id_from_untagged_hex,

dag/gunbc/host_effect_realize.dag

@@ -1,5 +1,7 @@
 module gunbc.host_effect_realize
 
+import std.algebra { trim }
+
 import gunbc.host_effect {
   HostEffect, ShellCommand, RedfishAction, ConvergePlan,
   OsInstallActuatorToolchainEnsure, ProvisionBuildCache,

dag/gunbc/host_identity_observation.dag

@@ -1,5 +1,7 @@
 module gunbc.host_identity_observation
 
+import std.algebra { trim }
+
 
 type HostIdentityObservationRow {
   short_hostname_raw: String

dag/gunbc/host_phase_status.dag

@@ -16,6 +16,7 @@ import gunbc.host_assimilation_program {
   HostEnrollmentIntent,
   assimilation_program_for,
   ci_runner_enrollment_participation,
+  inference_serving_enrollment_participation,
 }
 import gunbc.host_standup_assimilation_deduction { srv3_post_install_actuation_verdict }
 import gunbc.membership_reconcile {
@@ -29,7 +30,7 @@ import gunbc.membership_reconcile {
   membership_write_count,
 }
 import gunbc.ownership { Ownership, Owned }
-import gunbc.fleet_intent_network { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_intent_network { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6 }
 import product.placement_supply { HostIdentity }
 import std.measure { millisecond }
 
@@ -144,6 +145,8 @@ data fleet_subsumption_enrollments: List<HostEnrollmentIntent> = [
   HostEnrollmentIntent { host: operator_host_srv2, participation: ci_runner_enrollment_participation },
   HostEnrollmentIntent { host: operator_host_srv3, participation: ci_runner_enrollment_participation },
   HostEnrollmentIntent { host: operator_host_srv4, participation: ci_runner_enrollment_participation },
+  HostEnrollmentIntent { host: operator_host_srv5, participation: inference_serving_enrollment_participation },
+  HostEnrollmentIntent { host: operator_host_srv6, participation: inference_serving_enrollment_participation },
 ]
 
 data fleet_subsumption_hosts_projection_note: String = "The bare host list is DERIVED from the enrollments, never authored beside them. Consumers that legitimately care only about WHICH hosts exist -- toolchain components, network diagnosis, swap backing -- keep reading a List of HostIdentity and are untouched by program scoping, while the enrollment rows stay the single authority for who is in the fleet and what they are in it for. Authoring both lists would rebuild the parallel representation this refactor removes."

dag/gunbc/hostname_read.dag

@@ -1,5 +1,7 @@
 module gunbc.hostname_read
 
+import std.algebra { trim }
+
 import std.types { String, NonEmptyStr, List, Bool }
 import extdeps.tools.hostname
 import gunbc.host_effect { HostEffectTransport, LocalShell, SshShell, EmitArtifactThenThinRun }

dag/gunbc/legacy_test_inflow.dag

@@ -1,5 +1,7 @@
 module gunbc.legacy_test_inflow
 
+import std.algebra { trim }
+
 import std.types { Bool, FilePath, Int, List, NonEmptyStr, String }
 import gunbc.legacy_test_behavior_disposition {
   LegacyTestBehavior,

dag/gunbc/merge_admission_produce.dag

@@ -1,5 +1,7 @@
 module gunbc.merge_admission_produce
 
+import std.algebra { trim }
+
 import std.types { NonEmptyStr, CommitSha, String, Int, List, Bool, GitRef }
 import std.content_hash {
   serialize_content_hash,