Delete the owned-CI control plane at the root

[gunbai-bot]

The owned-CI control plane is deleted whole: both Rust files, the bin registration, gunbc.owned_ci, owned_ci_seed, owned_ci_serve, owned_ci_page, gunbc.ci_execution_plan, the witness module, and the design doc.

Why this is a clean cut

It was built once (#8016), never deployed and never ran — absent from gunbc.ci_release_bins, from every systemd unit, and from every converge membership, with no .gunbc state anywhere in the tree. Its only live surface was the /ci route, which answered a permanent 503 by construction because nothing ever wrote the index it reads.

So it holds no boundary. That makes this the easiest form of the DESIGN §3 delete-first cut rather than the hard one: no coverage gap to declare, no rung to drop, no frozen-X carve-out needed.

What it was

1754 lines of hand-written Rust implementing semantics the substrate already models — a poll loop, a filesystem queue, a lease, HTTP to GitHub, JSON state — under a declared scaffold whose three dissolve-on items were all still open. Per DESIGN §7 the seed shrinks toward zero; this was the seed growing instead.

Lease disposition — corrected

An earlier revision of this description claimed QueueLease was "a nickname for HeldLease" and that the lease obligations were "already witnessed." Both were overclaims, verified against the carrier and corrected here rather than left standing:

• std.temporal_effect HeldLease carries lease_key, resource_fingerprint, owner_fingerprint, generation, observed — and no timestamp and no expires_at. LeaseRunningStale is a supplied observation, not a verdict derived from a deadline. The expires_at / grant_not_expired_at machinery in that module belongs to DurableApprovalGrant, a different type.
• The deleted QueueLease carried an actual wall-clock expiry model. So the two overlap: the deleted carrier duplicated HeldLease's ownership and fencing facts while adding a lease-liveness fact that has no home yet.
• decision_for_held_lease_verdict and held_lease_observed_verdict have zero production consumers. fleet_converge_plan mints a HeldLease with observed: LeaseAbsent as a generation carrier and performs its own compare-and-swap; it does not call them. The type is live; the decision layer is modeled and unconsumed.

Accurate disposition: ownership and generation fencing belong on HeldLease. Lease-liveness observation and retry admission are new modeling the successor owes — not obligations being restored from this lane. Deletion correctness is unaffected either way, because the deleted code never executed.

Evidence disposition

The 16 witnesses are retired with a receipt, not re-enrolled. Their subject is the fused subject/run model this cut rejects, and evidence whose only subject is a rejected shape must not be left standing (DESIGN §4b) — otherwise tests become how obsolete behavior grants itself immortality.

Reviewer notes

• The generated crate-layout artifacts were edited mechanically rather than regenerated locally. heal_generated_artifacts has since passed and pushed no correction commit, so the hand-written bytes are byte-identical to what the authority derives. build and regen also pass.
• roadmap_serve_witness_test still asserted the deleted /ci routes; caught by review 52992 and fixed in e28a3016bb. My first sweep searched deleted module names and missed symbols removed from a surviving module — the re-sweep covers both surfaces and the route literals.
• Residual owned_ci mentions are only in frozen docs/plans/import-strip-* measurement receipts, which are dated records and deliberately untouched.

Follow-on work — a .dag work-and-lease broker — lands separately. This PR only removes the weed.

[gunbai-bot]

Fixed in e28a301. review 52992 is correct — verified by reading the file before changing it.

roadmap_serve_witness_test imported the three CiRuns* handlers and asserted /ci, /ci/runs.json and /ci/run/{run_id} select them; this cut deletes those variants, routes and dispatch arms, so the enrolled witness would not have resolved.

Why my residual sweep missed it, since that's the more useful half: I grepped for the deleted module names — owned_ci, ci_execution_plan, ci_control_plane. None of those strings appear in CiRunsPageHandler. A deletion has two reference surfaces — symbols exported by the deleted modules, and symbols removed from surviving modules — and I swept only the first.

The re-sweep covers both, plus the route literals:

• every symbol removed from a surviving module (the three handlers)
• every exported symbol of each deleted module (owned_ci_check_name, serve_ci_runs_*, CiExecutionSubject, ci_subject_identity_key, QueueLease, owned_ci_run_id_admits, and the rest)
• the route strings "/ci", /ci/runs.json, /ci/run/

All clean across dag/, src/ and .github/. I also checked for a route-count assertion that the three removals would falsify — there is none; the witness asserts per-route selection, not cardinality.

Remaining references are still only in the frozen docs/plans/import-strip-* measurement receipts, which are dated records and deliberately untouched.

— sent from silent-bear-842

[gunbai-bot]

Correcting two claims in this PR's commit message. Neither changes the diff — the deleted code never executed, so nothing regresses either way — but both are wrong as written and this repo treats a false claim in an authority as a defect in its own right.

1. QueueLease was not a pure nickname for HeldLease. The message says HeldLease "already yields stale-lease reclaim." Verified against std.temporal_effect: HeldLease carries lease_key, resource_fingerprint, owner_fingerprint, generation, and observed — and no timestamp and no expires_at. LeaseRunningStale is a supplied observation, not a verdict computed from a deadline. The expires_at and grant_not_expired_at machinery in that module belongs to DurableApprovalGrant, a different type.

So decision_for_held_lease_verdict yields the reclaim plan given an already-classified stale lease. It does not determine expiry. QueueLease did carry expiry seconds and a reclaim decision, which makes the two overlapping, not identical — and means the successor owes an expiry model HeldLease does not provide. Accurate statement: the deleted carrier duplicated HeldLease's ownership and fencing facts while adding an expiry fact that has no home yet.

2. Deletion correctness is unaffected. The lane was never deployed and never ran, so no capability regressed regardless of which carrier was the better home. The disposition stands: ownership and fencing belong on HeldLease; expiry is new modeling for the successor, not a thing being restored from the deleted lane.

Separately, for anyone reading this cut as precedent for the successor design: flock in gunbc.fleet_converge_plan_cli guards a generation compare-apply-commit over a per-host subject. It is the right shape for a conditional commit but is not cross-host serialization, because each host converges itself. A global allocation state would need that property established, not inherited.

Found by re-checking my own claims against the carrier rather than by review.

— sent from silent-bear-842

[gunbai-bot]

CI is red on this head, and I am not pushing a fix, because the evidence says this PR is not the cause. Recording the discriminating check rather than asserting it.

main is redder than this branch. The witnesses workflow on main at 611fd0277 (the FLOOR-Y cutover merge, run 32076934126) reports:

main:  planned=9366 executed=9366 terminal=9366 passed=8523 known_red_held=795 failed=48
ours:  planned=9347 executed=9347 terminal=9347 passed=8511 known_red_held=813 failed=23

48 failures on main against 23 here. The 19-row roster difference is exactly this PR's deleted witness population.

Set difference, not counts. Of the 23, nineteen also fail on main. Four are ours-only, and none is reachable from this diff:

• where_refinement_record_field_literal_accepts — exceeded Cpu budget, 503ms against 500ms
• where_refinement_cast_literal_positive_int_accepts — Cpu budget, 502ms against 500ms
• build_artifact_verification_witness.witness_serialized_conjuncts_and_teeth — Wall budget, 501ms against 500ms
• roadmap_dashboard_instance_apply_witness.dashboard_health_requires_intended_instance_identity — enrolled expected-red and passed

The first three are overruns of 1–3ms against a 500ms budget. A diff that only deletes files cannot make an unrelated witness three milliseconds slower. main independently fails three different where_refinement_enforcement_witness entries, so that module is marginal on both sides of the comparison.

The fourth imports gunbc.roadmap_dashboard_instance, not gunbc.roadmap_serve, and asserts health URLs and instance JSON. It has no path to the /ci routes this PR removed.

The dominant failure class is unstable on main. enrolled as expected-red and PASSED appears 25 times on main and 7 here. A roster of expected-red witnesses that pass is a property of the post-cutover tree, not of a deletion.

What I have not done, deliberately. I have not edited v2.workflow.floor_expected_red to silence rows. That roster belongs to the floor lane, its population is visibly in flux, and removing entries from another cut's roster to green my own PR would be changing the measurement to fit the result.

This PR carries 2 approvals, no REQUEST_CHANGES, and MERGEABLE. It should merge when main's floor is green, or under an explicit decision to merge against a known-red main — not by my pushing changes to unrelated rosters.

— sent from silent-bear-842