From 331fc2a28f0b15d0ffeabc7a04036fd78530a8b4 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 19 Aug 2026 07:44:32 +0000 Subject: [PATCH 01/11] Name the boundary: argv is not the authority, and CLI invocation is not the universal effect model gunbc#8467 establishes that an argv array is a serialization, exactly as bash text is a serialization of a bash AST. Accepted. But stated without a boundary it reads as replacing every typed effect with a CLI tree, which moves the authority downward into one realization technology -- the section 3 violation this lane exists to name, one layer below where it usually appears. So the two lanes are one migration program with a named boundary. This lane owns the semantic destination and site routing: the authority stays the typed domain operation or typed HostEffect, and it decides whether a realization is native, REST, filesystem, library, CLI-backed, or necessarily text-emitting. #8467 owns the inside of the CLI-backed cell. A native handler reaches no CLI surface at all. The census also carried a stale unit. Sizing by argv occurrence, then by executable head, then by tool each produced an inflated remainder, because a tool vertical, its site cutovers and its host_effect_apply caller are commonly ONE vertical whose acceptance condition is the old site's deletion. The measured shape, production only: transport shell 236 lines / 48 files -- 230 lines / 45 files in extdeps argv: 457 lines -- 275 extdeps, 172 gunbc, 10 src/v2 bridge calls 48 across 13 files fn *_argv 333, of which ~158 model no tool at all transport shell is overwhelmingly an extdeps population, i.e. beneath already-typed operations. This lane's original job -- getting shell out of the intent -- is substantially done; the remainder is transport depth. Recorded with the caution that a transport shell block is not a shell program at all: the seed executes it as Command::new(&argv[0]).args(&argv[1..]). Two finish lines are therefore named separately, SHELL-DAG and CLI-AUTHORITY, so a row complete against the first but owing the second reads as the boundary working rather than as incomplete work. A SHELL-DAG row is never blocked on CLI-AUTHORITY. One live instance found while verifying: extdeps.exec.command command_over_transport builds append(ssh_exec_prefix, command.argv) -- the exact SSH-as-prefix shape the boundary forbids -- in production, beneath the generic runner, which is the mechanism by which remote argument boundaries are lost. It shares a file with command_runner's argv -> quoted text -> heredoc round trip, whose carrier already declared the repair in command_runner_dissolution_trigger. The runner cut and the SSH target are one vertical. No code changes. DESIGN.md needs no edit and says so in the text: its shell -> intent row already routes runtime-present sites to typed effects and confines emission to foreign executors and bootstrap, so the boundary falsifies no sentence in it. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-intent-emit-realization-design.md | 19 ++++ ...-dag-residual-census-and-arc-completion.md | 86 +++++++++++++++++++ 2 files changed, 105 insertions(+) diff --git a/docs/plans/shell-intent-emit-realization-design.md b/docs/plans/shell-intent-emit-realization-design.md index de13f3bfac0..4f0082c38ad 100644 --- a/docs/plans/shell-intent-emit-realization-design.md +++ b/docs/plans/shell-intent-emit-realization-design.md @@ -72,6 +72,25 @@ The load-bearing correction (operator review, 2026-07-19): **"dissolve the raw c So the arc is not "N files onto the bash emitter." It is: route each site to the correct path, and generalize `host_effect_apply` from `ShellCommand{script:String}` toward typed effects — the census authority's central finding. +## The boundary beneath realization — a CLI-backed handler is one cell, not the model (2026-08-19) + +The routing decision above says *where* a site goes. This says what the **realization** column may and may not become, and it is placed here because the layering table's four rows are the exact thing a reader can re-fuse. + +`cli-invocation-emission-design.md` (gunbc#8467) establishes that an argv array is a **serialization** — the same relation bash text bears to a bash AST. Its measured census found 556 `argv:` lines across 124 files and 250 `transport shell` blocks whose three welded facts (what the tool is, how we reached it, what we asked it) are re-decided by hand at every site. That diagnosis is accepted, and the consequence for **this** document is narrow and must stay narrow: + +- The **intent** row is untouched. It named no language before and names no tool now. +- The **realization** row gains an internal structure it did not have: a handler is native (REST, filesystem, library) **or** CLI-backed. Only the second lowers a tool-semantic request through cited CLI grammar rows into a carrier. +- **argv is never the authority**, and **CLI invocation is not the universal effect model.** A native handler reaches no CLI surface at all. Making CLI lowering universal would relocate the authority into one realization technology — the §3 violation this document exists to name, one layer below where it usually appears. + +The invariant this document owns generalizes cleanly and needs no restatement per-target: *the intent imports no language-construction vocabulary* becomes, at the layer below, **the domain imports no tool vocabulary**. A domain module that stops concatenating `sudo -n …` and starts authoring a tool's flags — or a tool's embedded program text — has moved the anemic leaf one layer in, not dissolved it. That is the same relocation-counted-as-progress this lane already priced once (#7004/#7006, §4's "why now"). + +Two facts carried here because they change what the emit row means: + +- **Local process execution has no shell.** The v1 seed realizes `transport shell` as `Command::new(&argv[0]).args(&argv[1..])` — no shell, no word splitting, no quoting. So `transport shell` is a historical DSL keyword at that boundary, not a description, and the emit column's bash grammar is *not* on the local path at all. +- **SSH is a separate target**, not a prefix. RFC 4254 carries one command string; `append(ssh_prefix, inner.argv)` is the shape this document already forbids for transports, and it is forbidden here for the same reason. + +Ownership, so neither lane waits on the other: this document and the census own the semantic destination and site routing; #8467 owns the inside of the CLI-backed cell. The negative falsifier that keeps the boundary honest — a Redfish/REST path reaching no CLI surface, no process-argv carrier and no shell target — is owed by that lane. + ## The carriers and the two enforcement milestones (corrected) The anemic `String` leaves are **more than one**: `host_effect.ShellCommand{script}` (`host_effect.dag:25`), `std.orchestration.Run.command` (the `Do{run}` leaf), and `host_effect.BootstrapFragment.script` (`host_effect.dag:59`) — plus the `ThinInvocation`/`EmitArtifactThenThinRun` medium-as-string scaffolds. The target for all of them is **`Do{effect}` — never a command string** (host-effect-orchestration.md's `std.effect_plan` band). Sequencing is **add-replacement → migrate all consumers → delete at arc close** (§5 construction, but you cannot delete `ShellCommand` while other constructors and consumers still populate it). `host_effect.dag` is a DESIGN-named load-bearing carrier — the delete is escalated/co-designed, not improvised. diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 7262f35be81..7a9e9bf05f5 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -26,6 +26,92 @@ A distinct axis from §1's *emission* census: these are ops whose **interface sh --- +## 0c. The named boundary — argv is not the authority, and CLI invocation is not the universal effect model (2026-08-19) + +This lane and the CLI-invocation lane (`cli-invocation-emission-design.md`, gunbc#8467, `sharp-ant-396`) are **one migration program with a named boundary**, not competing destinations. Recorded here because without the boundary stated, #8467's diagnosis — that an argv array is a serialization exactly as bash text is a serialization of a bash AST — reads as replacing every typed effect with a CLI tree, which would move the authority *downward* into one particular realization technology. + +The division: + +- **This lane owns the semantic destination and site routing.** The authority remains the typed domain operation or the typed `HostEffect`. It decides whether a realization is native, REST, filesystem, library, CLI-backed, or necessarily text-emitting. That is unchanged by #8467 and is exactly what §1's five categories already do. +- **#8467 owns one realization sublayer:** how a **CLI-backed** handler lowers a tool-semantic request through cited CLI grammar rows into a carrier. It is the inside of one cell of §1.C, not a replacement for §1. +- **argv is never the authority.** `ArgvCommand` builders and `transport shell { argv: [...] }` are migration substrates. +- **CLI invocation is not the universal effect model.** A native handler reaches no CLI surface at all. + +The complete shape, so the layers are not re-fused by the next reader: + +``` +typed domain operation / HostEffect <- this lane; the authority + | + | realization selection <- this lane + | + +-- native handler: REST / filesystem / library / Redfish / ... + | (no CLI surface is reachable from here) + `-- CLI-backed handler <- #8467 owns everything below this line + | private tool-semantic request + v + admitted tool process plan (tool identity, emitted CLI surface, stdin, + cwd/environment, observation contract) + | + +-- local target: ProcessArgv -> direct process spawn + `-- SSH target: shell simple-command tree -> shell grammar -> RFC 4254 string + | + v + raw ProcessObservation -> tool-policy decoder -> typed tool observation + -> domain decoder -> domain result / reconciliation receipt +``` + +**Two consequences are load-bearing.** Local process execution has **no shell and no quoting** — the v1 seed realizes `transport shell` as `Command::new(&argv[0]).args(&argv[1..])`, with no shell, no word splitting and no quoting layer, so the name is a historical DSL keyword rather than a description (this is why the host-edge carrier is `ProcessArgvExpansion`, not `ShellArgvExpansion` — the §3 nickname class, caught before it spread). And **SSH is a different target**: RFC 4254 carries one command string, and far-side shell interpretation is a deployment capability to be modeled or observed, never assumed. + +### What this corrects in this document + +§5's framing — "the arc needs only ~4 new typed ops", §5.A's new-op list and §5.B's call-an-existing-op table — is **not wrong about the destination** but is written in the vocabulary of the layer #8467 replaces. Typed argv is the terminus for a **CLI-backed** handler only in the sense that argv is what the process boundary consumes; it is not the authority a domain module authors against. Concretely, for the §5.B rows: calling `systemd.Systemctl.ShowProperty` instead of concatenating `systemctl show --property=…` remains exactly the right move and those rows stand as written. What changes is one layer in — the op's *own* realization must not itself be a hand-authored flag list, which is the defect #8467 measured (a dropped `--fail` across eleven curl sites made a 401 read as success). So a §5.B migration is complete at this lane's grain when the concat is gone and the caller names semantics; it is complete at #8467's grain when the op's flags derive from cited rows. **Do not treat a §5.B row as blocked on #8467** — the two grains land independently, and this lane's row is the prerequisite, not the dependent. + +### The measured shape of the remainder (2026-08-19) + +Measured on `dag/**` and `src/v2/**`, excluding `/test/`, `*_test.dag` and fixtures, so these are production populations rather than witness counts: + +| population | production count | +|---|---| +| `transport shell` blocks | 236 lines across 48 files — **230 lines / 45 files in `dag/extdeps`**, 5 lines / 2 files in `dag/gunbc`, 1 in `dag/tools` | +| `argv:` lines | 457 — 275 in `dag/extdeps`, 172 in `dag/gunbc`, 10 in `src/v2` | +| counted retained-script bridge call sites | 48 across 13 files | +| distinct `fn *_argv` builders (whole tree) | 333, of which ~158 lead with `shape`/`witness`/`operation`/`typed` and model no tool at all | + +**The load-bearing reading:** `transport shell` is overwhelmingly an `extdeps` population — 230 of 236 production lines — i.e. it sits *beneath already-typed operations*, in the interface layer, not in the intent. This lane's original job, getting shell out of the intent, is therefore substantially done, and most of what remains is transport depth inside a CLI-backed cell. That is #8467's subject, not this document's. + +Two cautions against over-reading it. The `dag/gunbc` argv residue is **172 lines across 41 files** — real intent-adjacent work, not a rounding error (an earlier scoping pass in conversation quoted the 41 *files* as though it were the line count; recorded so the smaller figure does not get re-cited). And a `transport shell` block is not a residual shell program at all: the v1 seed executes it as `Command::new(&argv[0]).args(&argv[1..])`, so 236 blocks are 236 *process invocations*, of which the shell-shaped ones are the SSH-composed subset. + +**Do not turn these counts into a work plan.** Under the replacement-migration rule the unit is a root consumer × subject population, and the census direction reliably overestimates: sizing by argv occurrence, then by executable head, then by tool, each produced an inflated number, because a tool vertical, its site cutovers and its `host_effect_apply` caller are commonly **one** vertical whose acceptance condition is the old site's deletion — not three workstreams. The domain clusters this document already tracks in §5.D, each with its own un-defer trigger, are the better unit. + +### Two finish lines, named separately + +The program has two, and conflating them is what makes the remainder look larger than it is: + +``` +SHELL-DAG runtime-present script carriers are zero; + foreign/bootstrap shell is emitted from typed intent; + ShellCommand and the runtime retained-script bridges are deleted. + +CLI-AUTHORITY production CLI-backed realizations derive their concrete argv + from semantic tool requests and cited surface rows. +``` + +SHELL-DAG is this document's; CLI-AUTHORITY is `cli-invocation-emission-design.md`'s. A site can be complete against the first and still owe the second, and that is not a defect in either — it is the boundary in §0c working. The corollary for dispatch: **a SHELL-DAG row is never blocked on CLI-AUTHORITY.** + +### A live instance of the forbidden SSH shape + +`extdeps.exec.command` `command_over_transport` constructs `ArgvCommand { argv: append(ssh_exec_prefix(target: t), items: command.argv) }`. That is exactly the `append(ssh_prefix, inner.argv)` composition §0c forbids — SSH is a nested target whose carrier is one RFC 4254 command string, not a prefix on an argument vector. It is production code beneath the generic runner, so every SSH-transported `ArgvCommand` in the tree flows through it, and it is the concrete mechanism by which argument boundaries are lost remotely. + +It sits in the same file as `gunbc.command_runner`'s round trip — `run_shell_command` takes a typed `ArgvCommand`, renders it to quoted text via `shell_command_render`, and posts it through `shell.Exec.Run`'s heredoc transport. That carrier already declares the repair in `command_runner_dissolution_trigger`: *dissolves when `host_effect_apply` binds `ArgvCommand` execution as a typed transport handler*. So the runner cut and the SSH target are one vertical, not two, and the debt was declared before it was scoped. + +### What is owed, and by whom + +- The **negative falsifier** — one witness proving a Redfish/REST path reaches no `JqInvocation`, no `CliSurface`, no `ProcessArgvExpansion` and no shell target — is owed by the CLI lane (`sharp-ant-396`), not by this one. It guards this boundary better than any further argv census would, and per the replacement-migration rule a census over a structure being deleted is the attractor at work. +- The **scoped supersession sentence** in `cli-invocation-emission-design.md` is that document's to place. It supersedes typed argv as the terminal representation *for CLI-backed handlers*; it does not supersede typed domain effects, typed extdeps operations, host-effect routing, or native realizations. +- **`DESIGN.md` needs no edit.** Its shell → intent row already routes runtime-present sites to typed effects on `host_effect_apply` and confines emission to foreign executors and bootstrap. The boundary refines what happens *inside* a CLI-backed realization; it falsifies no sentence in that row. Stated explicitly so a later reader does not "discover" a missing correction and add a second account of it. + +--- + ## 1. Residual-shell census (current tree) Five categories. "Genuine emitter" = emits bash that actually runs; "oracle/scaffold" = shell text retained only for a test. *(Corrected 2026-07-26: the oracle/scaffold definition read "`serialize_bash` retained only for a test" — that sidecar is deleted and **no** test retains it, so the definition described an empty class by its mechanism instead of by its role. §4.H is the live statement of this category.)* From 9aceb217f2641ff51ff1088279a4643181480009 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 19 Aug 2026 16:58:09 +0000 Subject: [PATCH 02/11] Delete the refuted transport-wall prose; enumerate the bridge files; weaken the sequencing claim Review on #8535 found the first commit did the exact thing this document warns about five times: it appended a corrected boundary beside stale operational text without deleting the text it supersedes. The finding is correct and the stale claim is load-bearing. TransportScript has not been a transparent brand since #7962. It is a sole_constructor record whose single mint transport_script_seal is admit_callers-sealed to two production declarations, and the cast form closed with it -- 04_infer sole_constructor_construction_diags judges a cast into a sealed type. Both documents still asserted, in the present tense and in fourteen places, that the brand is transparent, that `String as TransportScript` is writable from any module, and that direct shell.Exec.Run is guarded by validation rather than construction. All false at this head. Enumerated by claim across both authorities rather than fixing the site under review -- the document's own standing rule, added after the fifth time this class recurred -- and rewrote every occurrence in place: section 3's terminal paragraph, 4.F's heading and three table cells, the 4 dissolution trigger, 5's end-state paragraph, 5.E's heading, premise and ruling block, the wind-down ledger row, the meta-exec row, and both sites in the invariant doc. The leak fixture is reclassified as scan input and historical record; it can no longer be cited as evidence the cast compiles. What actually survives is smaller and different in kind: the two admitted bridges take a bare body String, so arbitrary text still reaches a transport through a counted, reason-bearing, dissolves_to-carrying call. Conspicuous, not impossible, and it dissolves by per-site migration rather than by further wall work. Also from the review, each verified before acting: - The bridge count named no files. Enumerated all 13. Three -- package_delivery, codex_app_server_press, bmc_netboot_serve -- are absent from the section 4 punch-list that still calls itself complete at 78f43c38. Recorded as that snapshot's correction, not as a second census. - A classification question the count concealed: package_delivery (7 calls) and codex_app_server_press (3) route through retained_foreign, whose dissolves_to is the Bash emitter, while both appear to run inside a present gunbc runtime. If so, ten calls declare the wrong destination. Flagged for their owners; the executor window decides it and this document does not own that fact. - "A SHELL-DAG row is never blocked on CLI-AUTHORITY" was true of the homing decision and false as a sequencing rule, with the counter-example named in the same document: command_runner's cutover needs the structured process-argv carrier, and its SSH arm the nested shell-command target. Reworded. - Added an explicit statement that this is a boundary and scoping increment, not a closeout receipt -- neither finish line is met at this commit. Merged main to pick up #8467, now landed, so the cross-PR references describe a merged authority rather than an open branch. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-intent-emit-realization-design.md | 4 +- ...-dag-residual-census-and-arc-completion.md | 68 ++++++++++++------- 2 files changed, 47 insertions(+), 25 deletions(-) diff --git a/docs/plans/shell-intent-emit-realization-design.md b/docs/plans/shell-intent-emit-realization-design.md index 4f0082c38ad..2049895543a 100644 --- a/docs/plans/shell-intent-emit-realization-design.md +++ b/docs/plans/shell-intent-emit-realization-design.md @@ -98,11 +98,11 @@ The anemic `String` leaves are **more than one**: `host_effect.ShellCommand{scri Two enforcement milestones, kept distinct — my earlier draft conflated them: - **LANDED — bash-AST-vocab containment (#6854).** `realization_vocabulary_containment` reds any intent-layer import of `bash_build` / `ShellStmt` / `serialize_bash`. This confines the *language-AST vocabulary* only; it does **not** recognize `extdeps.shell` or forbid `shell.Exec`. -- **PARTIAL — meta-exec confinement (Wave A1 import wall LANDED #6900; construction wall OPEN).** `shell.Exec` is isolated in `extdeps/shell/exec.dag`, and `v2.lens.meta_exec_confinement` enforces the module-granular import wall. Its exception roster has since shrunk **3 → 0**, so a new intent-layer import outside the declared realization-edge prefixes is a typed leak with no exception to grant. That is validation over the import graph, not the terminal construction wall: `TransportScript` remains a transparent brand over `String`, and direct `shell.Exec.Run` callers on an allowed realization edge can still construct computed/cast inputs. `host_language_transport_script` is live but deliberately green on `ComputedApplication`; it backstops raw literals rather than making the cast path unwritable. Closing that surviving path is the DESIGN-named meta-exec-confinement milestone, coupled to reference/import visibility. +- **PARTIAL — meta-exec confinement (Wave A1 import wall LANDED #6900; construction wall OPEN).** `shell.Exec` is isolated in `extdeps/shell/exec.dag`, and `v2.lens.meta_exec_confinement` enforces the module-granular import wall. Its exception roster has since shrunk **3 → 0**, so a new intent-layer import outside the declared realization-edge prefixes is a typed leak with no exception to grant. That was validation over the import graph rather than the terminal construction wall, and the construction half has **since landed**: `TransportScript` is a **`sole_constructor` record** whose single mint `transport_script_seal` is `admit_callers`-sealed to exactly two production declarations (`gunbc.retained_shell_script` `retained_shell_script_to_transport`, `gunbc.bash_materialized_transport` `bash_materialized_transport`), and the cast form closed with it — `04_infer` `sole_constructor_construction_diags` judges a cast into a sealed type (#7962), so a computed or cast input can no longer reach that edge. `host_language_transport_script` stays live as a raw-literal backstop. The surviving residue is not a construction path but the two admitted bridges' bare-`String` body parameter, counted at every call and dissolved by per-site migration. ### Import-visibility for meta-exec confinement (operator, 2026-07-19; Wave A1 import wall landed, construction wall open) -`shell.Exec.Run` is the honest bottom bash transport — kept, not deleted — but it must be **heavily sequestered** so its only caller is realization and its input is always `emit`'s output. Wave A1's import-graph analysis (`LayerImportFact`) confines the isolated module and now has an empty exception roster. It does **not** constrain how an allowed realization-edge caller obtains a `TransportScript`; because the brand is transparent, a computed `String as TransportScript` remains writable there. Two ways were proposed to sequester the operation; the first landed the import half only: +`shell.Exec.Run` is the honest bottom bash transport — kept, not deleted — but it must be **heavily sequestered** so its only caller is realization and its input is always `emit`'s output. Wave A1's import-graph analysis (`LayerImportFact`) confines the isolated module and now has an empty exception roster. It did not by itself constrain how an allowed realization-edge caller obtains a `TransportScript`; that half landed separately in #7962, which sealed the type and closed the cast form. Two ways were proposed to sequester the operation, and the outcome differed from both: - **(a) Isolate the bottom transport into its own module** (`extdeps/shell/exec.dag`) → the existing module-granular wall confines imports. **Landed (Wave A1), necessary but not sufficient for construction confinement.** - **(b) Add symbol/reference-level visibility** so the bottom transport can be callable only from the emit-owned realization seam — the general feature, converging with the namespace-only-resolution lane (references become `container.member`). This is the still-open construction-confinement direction; do not infer its completion from the empty import-exception roster. diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 7a9e9bf05f5..d492382cf6a 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -74,15 +74,37 @@ Measured on `dag/**` and `src/v2/**`, excluding `/test/`, `*_test.dag` and fixtu |---|---| | `transport shell` blocks | 236 lines across 48 files — **230 lines / 45 files in `dag/extdeps`**, 5 lines / 2 files in `dag/gunbc`, 1 in `dag/tools` | | `argv:` lines | 457 — 275 in `dag/extdeps`, 172 in `dag/gunbc`, 10 in `src/v2` | -| counted retained-script bridge call sites | 48 across 13 files | +| counted retained-script bridge call sites | 48 across 13 files, enumerated below | | distinct `fn *_argv` builders (whole tree) | 333, of which ~158 lead with `shape`/`witness`/`operation`/`typed` and model no tool at all | +The 13 files, named rather than counted, because a count cannot expose a misfiled row: + +`gunbc.command_runner` · `gunbc.host_effect_realize` · `gunbc.retained_shell_script` · `gunbc.package_delivery` · +`gunbc.codex_app_server_press` · `gunbc.bmc_netboot_serve` · `gunbc.provider_wire_evidence` · `gunbc.design_document` · +`tools.gunbc_ci` · `tools.emit_host_gate` · `tools.host_prelude` · `tools.interpreter_dispatch_bijection_real_roster_transport` · +`v2.lens.meta_exec_confinement` + +**Three are absent from the §4 punch-list**, which still calls itself the complete per-instance list at `78f43c38`: +`package_delivery`, `codex_app_server_press` and `bmc_netboot_serve` are post-July production work. That heading's +"complete, current" claim is true as of its stated commit and false as of this one; it is a snapshot, and this row is +its correction rather than a second census. + +**And a classification question the count concealed, flagged not settled.** `package_delivery` (7 calls) and +`codex_app_server_press` (3) route through `retained_foreign`, whose `dissolves_to` is `retained_foreign_emit_ref` — +the Bash emitter, the destination for foreign executors and pre-runtime bootstrap. Both appear to run inside a present +gunbc runtime, which would make their destination typed effects (`retained_runtime`) instead. If that is right, ten +bridge calls declare the wrong dissolution target, and the bucket is precisely what a future session reads to decide +where they go. Recorded as a question for their owners — the executor window is the deciding fact and this document +does not own it — not as a verdict rendered from a grep. + **The load-bearing reading:** `transport shell` is overwhelmingly an `extdeps` population — 230 of 236 production lines — i.e. it sits *beneath already-typed operations*, in the interface layer, not in the intent. This lane's original job, getting shell out of the intent, is therefore substantially done, and most of what remains is transport depth inside a CLI-backed cell. That is #8467's subject, not this document's. Two cautions against over-reading it. The `dag/gunbc` argv residue is **172 lines across 41 files** — real intent-adjacent work, not a rounding error (an earlier scoping pass in conversation quoted the 41 *files* as though it were the line count; recorded so the smaller figure does not get re-cited). And a `transport shell` block is not a residual shell program at all: the v1 seed executes it as `Command::new(&argv[0]).args(&argv[1..])`, so 236 blocks are 236 *process invocations*, of which the shell-shaped ones are the SSH-composed subset. **Do not turn these counts into a work plan.** Under the replacement-migration rule the unit is a root consumer × subject population, and the census direction reliably overestimates: sizing by argv occurrence, then by executable head, then by tool, each produced an inflated number, because a tool vertical, its site cutovers and its `host_effect_apply` caller are commonly **one** vertical whose acceptance condition is the old site's deletion — not three workstreams. The domain clusters this document already tracks in §5.D, each with its own un-defer trigger, are the better unit. +**This section is a boundary and scoping increment, NOT a migration closeout receipt.** Neither finish line below is met at the commit introducing this text: `HostEffect.ShellCommand` still exists and is still constructed (including `host_effect_plan`'s empty placeholder), `command_runner`'s argv → text → heredoc route is live, and `retained_runtime` / `retained_srvn` remain defined and populated. Stated because a section naming a finish line reads, at a glance, like a claim to have reached it. + ### Two finish lines, named separately The program has two, and conflating them is what makes the remainder look larger than it is: @@ -96,7 +118,7 @@ CLI-AUTHORITY production CLI-backed realizations derive their concrete argv from semantic tool requests and cited surface rows. ``` -SHELL-DAG is this document's; CLI-AUTHORITY is `cli-invocation-emission-design.md`'s. A site can be complete against the first and still owe the second, and that is not a defect in either — it is the boundary in §0c working. The corollary for dispatch: **a SHELL-DAG row is never blocked on CLI-AUTHORITY.** +SHELL-DAG is this document's; CLI-AUTHORITY is `cli-invocation-emission-design.md`'s. A site can be complete against the first and still owe the second, and that is not a defect in either — it is the boundary in §0c working. The corollary for dispatch: **a SHELL-DAG row is never blocked on DECIDING its semantic destination.** Its production cutover may share a carrier or target increment with CLI-AUTHORITY — `command_runner`'s is the live case: deleting that argv → quoted text → heredoc route needs the structured process-argv carrier, and its SSH arm needs the nested shell-command target — and those shared increments are implemented once, never bypassed with another shell string. *(Corrected 2026-08-19, review on #8535. This read "never blocked on CLI-AUTHORITY" flat, which is true of the homing decision and false as a sequencing rule, and the counter-example was named in the same document.)* ### A live instance of the forbidden SSH shape @@ -229,7 +251,7 @@ Two tracks run in parallel. The v2 bidirectional bash language **is** the single bash authority today. The **Phase-3 wall** that turns *"no sidecar exists"* into *"a hand-built transport string is unwritable"* (§5 construction over validation) has **partially** landed (#7184, operator acceptance 2026-07-24): the free minter is deleted and `RetainedShellScript` — a **record** — is the sole mint **for the `ShellOnHost` realization edge**. -It is **not** the global transport wall. `shell.Exec.Run` still declares `input { script: TransportScript }` over a transparent brand (`dag/extdeps/shell/exec.dag:16,26`), so `String as TransportScript` stays writable outside the record wall — demonstrated in-tree at `src/v2/test/fixture/meta_exec_confinement_scan/leak/plant.dag:6`, and detailed in §4's dissolution trigger and §5's end-state row. So Track 1's **deletion** terminal is behind us; Track 2's **wall** terminal is **not**. What remains is **meta-exec confinement** (§4.F, last row) plus the per-site migration itself. +The construction half of the global transport wall has **since closed too**: `TransportScript` is a **`sole_constructor` record** whose single mint `transport_script_seal` is `admit_callers`-sealed to exactly two production declarations (`gunbc.retained_shell_script` `retained_shell_script_to_transport`, `gunbc.bash_materialized_transport` `bash_materialized_transport`), and the cast form closed with it — `04_infer` `sole_constructor_construction_diags` judges a cast into a sealed type (#7962), so neither a record literal nor a cast can produce one outside those bridges. What remains is not a construction hole but a **String residue** — both admitted bridges take a bare body `String`, so arbitrary text still reaches a transport through a counted, reason-bearing, `dissolves_to`-carrying call. That is conspicuous rather than impossible, and it dissolves with the per-site migration, not with more wall work. So Track 1's **deletion** terminal is behind us and Track 2's **construction** terminal is too; what remains is the per-site migration itself. *(Corrected 2026-07-27, `review 43608`. This read "has also **already landed** … is the sole mint. So Tracks 1 and 2 feed neither a deletion nor a wall; both terminals are behind us." That declared a narrower `ShellOnHost` wall to be the completed **global** transport wall — a §3 violation in which the planning authority overstates a landed scope, and the misdispatch risk is concrete: a worker reading this routes away from the still-open meta-exec confinement work, which is exactly the harm this document exists to prevent. This is the **fifth** site of this same claim corrected in this PR. The first four were fixed while this one survived because each pass swept for the sentences already seen rather than enumerating every sentence that asserts the fact — the standing rule, stated here so it outlives the individual corrections: **enumerate by claim across the whole authority set, then verify each; a correction that fixes only the site under review is not finished.**)* @@ -389,16 +411,16 @@ These are correct as shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap | `roadmap_static_site.dag` body fns | srv1 dashboard (belt B) | E-emit / dissolves with belt B | | `fleet_posix_accounts.dag` `probe_command: "id "` (×4) | account-existence probe | **NOT a shell emit site** — authored provenance metadata; live proof is `deploy_access_check_observed` via typed `SudoNopasswdExecuteProbe` | -### 4.F — bottom transport (Phase-3 WALL — **PARTIALLY LANDED** on the `ShellOnHost` edge, operator acceptance 2026-07-24; the `shell.Exec.Run` sink stays open) +### 4.F — bottom transport (Phase-3 WALL — **LANDED at construction on both edges**: `ShellOnHost` record wall #7184, `TransportScript` seal #7962) -> **Trued up 2026-07-26 (`review 43486`).** This table described the wall as *pending* and directed Phase 3 to "brand `TransportScript`" across "26 sites". **The `ShellOnHost` half of the wall landed on 2026-07-24 and branding was proven ineffective by execution** (the `shell.Exec.Run` sink stays open — see the row below) — both facts were already recorded in §5.E's ruling block ~275 lines below, which superseded this table in place without updating it. A worker reading the action column would have executed superseded work. Corrected against the tree. +> **Trued up 2026-07-26 (`review 43486`).** This table described the wall as *pending* and directed Phase 3 to "brand `TransportScript`" across "26 sites". **The `ShellOnHost` half of the wall landed on 2026-07-24 and branding was proven ineffective by execution** (the `shell.Exec.Run` sink stayed open until #7962 sealed it — see the row below) — both facts were already recorded in §5.E's ruling block ~275 lines below, which superseded this table in place without updating it. A worker reading the action column would have executed superseded work. Corrected against the tree. | surface | status | action | | --- | --- | --- | -| `transport_script_from_body(body: String)` | **DELETED** from `extdeps.shell.exec`. Not 26 live sites — **zero**. Surviving occurrences are a note recording its replacement (`retained_shell_script.dag:15`), two compile-**RED** controls asserting the deleted-minter fake *fails to compile* (`transport_script_wall_compile_red_test.dag`), and v1-seed Rust detector code | **none — done for the `ShellOnHost` edge.** Its realization takes a counted `RetainedShellScript` record. Direct `shell.Exec.Run` remains open: `retained_foreign` / `retained_runtime` accept a bare body `String`, and an authored `String as TransportScript` cast is still legal pending meta-exec construction confinement | -| `TransportScript` branding | **abandoned deliberately, not pending.** `TransportScript = String where brand(…)` is a *transparent* brand: `peel_nominal_alias_identity` peels it to its base, so a bare or computed `String` flows into a `TransportScript` position with no cast. Branding alone cannot make a hand-join a type error | **superseded on `ShellOnHost`** by the record wall — a `String` cannot fill its record-typed field. It does not wall direct `shell.Exec.Run`; see §5.E's design-correction block | +| `transport_script_from_body(body: String)` | **DELETED** from `extdeps.shell.exec`. Not 26 live sites — **zero**. Surviving occurrences are a note recording its replacement (`retained_shell_script.dag:15`), two compile-**RED** controls asserting the deleted-minter fake *fails to compile* (`transport_script_wall_compile_red_test.dag`), and v1-seed Rust detector code | **none — done for the `ShellOnHost` edge.** Its realization takes a counted `RetainedShellScript` record. Direct `shell.Exec.Run` closed at construction with #7962: `TransportScript` is a **`sole_constructor` record** whose single mint `transport_script_seal` is `admit_callers`-sealed to exactly two production declarations (`gunbc.retained_shell_script` `retained_shell_script_to_transport`, `gunbc.bash_materialized_transport` `bash_materialized_transport`), and the cast form closed with it — `04_infer` `sole_constructor_construction_diags` judges a cast into a sealed type (#7962). The residue is the bridges' bare-`String` body parameter, counted at every call, not a construction route | +| `TransportScript` branding | **abandoned deliberately, and now historical.** It *was* `= String where brand(…)`, a transparent brand `peel_nominal_alias_identity` peeled to its base, so branding alone could never make a hand-join a type error | **superseded twice.** The record wall closed `ShellOnHost`; #7962 then made `TransportScript` itself a `sole_constructor` record with an `admit_callers`-sealed mint, closing direct `shell.Exec.Run` and the cast form. Nothing here is pending | | `shell_exec_via_bash` (`shell_bash_runner.dag:32`) | heredoc runner scaffold | dissolves when no caller passes a raw script *(still open)* | -| `host_language_transport_script` lens | **LIVE — activated by #7184**, not inert. `wall_residue_live_test.dag:4`: *"the previously-inert … lens is wired as a per-PR live consumer over the `shell.Exec.Run` anchor sites"*, disposition `ReadsLiveTree`. It reds a **new raw literal** at an enrolled Run position, and stays **deliberately green** on `ComputedApplication` (the counted bridge calls) — which is why it never caught the #7064 computed-join fake | **none — done as a literal-blob backstop.** `RetainedShellScript` closes the computed-join class only at the `ShellOnHost` record field; the lens deliberately permits computed applications and the transparent cast path at direct `shell.Exec.Run` stays open. Do not "promote" the lens — that action presumed a brand that does not work and a lens that was already switched on | +| `host_language_transport_script` lens | **LIVE — activated by #7184**, not inert. `wall_residue_live_test.dag:4`: *"the previously-inert … lens is wired as a per-PR live consumer over the `shell.Exec.Run` anchor sites"*, disposition `ReadsLiveTree`. It reds a **new raw literal** at an enrolled Run position, and stays **deliberately green** on `ComputedApplication` (the counted bridge calls) — which is why it never caught the #7064 computed-join fake | **none — done as a literal-blob backstop.** `RetainedShellScript` closed the computed-join class at the `ShellOnHost` record field and #7962 closed the direct `shell.Exec.Run` sink at the type; the lens deliberately permits computed applications, which are now exactly the counted bridge calls. Do not "promote" the lens — that action presumed a brand that does not work and a lens that was already switched on | | meta-exec module `extdeps.shell.exec` | not walled | module-isolate / symbol-visibility confinement (meta-exec-confinement lane) *(still open — the genuinely remaining Phase-3 item)* | ### 4.G — bash-AST emit vocab (emit-internal — **EXTINCT**, not merely confined) @@ -502,7 +524,7 @@ The state of every PR in this arc, so nothing is missed if work pauses here. **A - **§5.A** — **COMPLETE.** All four ops landed on #7194 and are verified in tree at their post-#7231 homes: `os.Hostname.ReadShort`/`Set` (`dag/extdeps/tools/hostname.dag`), `systemd.Systemctl.ListUnits` and `.Status` (`dag/extdeps/systemd/systemctl.dag:185,219`), `os.Id.Uid` (`dag/extdeps/tools/id.dag:26`). (`ssh.Session.ExecArgv` landed via C5; `Clock.Now` in `dag/extdeps/clock/clock.dag` already existed and is now the single authority for every `date -Iseconds` site.) **The finite new-op list this whole arc needed is closed** — everything remaining in §5.B is calling ops that now exist. - **§5.B** — the call-the-op migrations are **UNPAUSED** (the `ShellOnHost` wall landed, #7184; the still-open direct `shell.Exec.Run` sink does not re-pause them). D1/D2/D3 (#7192/#7193/#7194) and bucket A discharged the hostname, systemctl-read and clock clusters. **The 2026-07-26 “non-deferred queue is empty” conclusion is superseded by merged #7298:** its deploy-access preflight wraps already-modeled C5 operations back into raw `Run.command` strings at a runtime-present edge. The bounded correction is the first current §4.J row. Outside that regression, only the **operator-deferred srv\* cluster** (4.A5, including 4.D) remains in §5.B. -- **§5.E** — the **transport-script construction wall** — **PARTIALLY LANDED #7184** (the `ShellOnHost` record edge only; the `shell.Exec.Run` sink remains open — see §5.E). Built as a `RetainedShellScript` RECORD edge + free-minter deletion + counted bridges + lens activation + compile-fail REDs (see §5.E ruling block; "brand `TransportScript`" was found non-walling because the brand is transparent). The 2026-07-24 wall-first ruling that paused §5.A/§5.B is therefore discharged. +- **§5.E** — the **transport-script construction wall** — **LANDED in two steps**: #7184 walled the `ShellOnHost` record edge, and #7962 sealed `TransportScript` itself, closing the direct `shell.Exec.Run` sink and the cast form. Built as a `RetainedShellScript` RECORD edge + free-minter deletion + counted bridges + lens activation + compile-fail REDs (see §5.E ruling block; "brand `TransportScript`" was found non-walling because the brand is transparent). The 2026-07-24 wall-first ruling that paused §5.A/§5.B is therefore discharged. **⚠ Do-not-miss for wind-down:** @@ -600,7 +622,7 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | Permanent foreign media | `expected_githooks_pre_push_sh`, `build_cron_entry_line` | roadmap `2-emit-partition`; unassigned | their **builders** route through typed intent → Bash; the emitted shell artifacts remain permanently because git/cron require that medium | | Runtime `Run.command` / `ShellCommand` terminal | `live_deploy.emit.deploy_raw` fed by `ensure_apt_package_step`, `apply_systemd_unit_write_step`, `apply_tree_sync_unit_write_step`, `tree_sync_restart_step_with_diagnosis`, `tailscale_serve_apply_step`, `install_d_owned_command`, `deploy_apply_preamble_steps`, `emit_artifact_upsert`, `emit_artifact_teardown`, `emit_deploy_teardown_dependency_refusal`, `apply_intent_from_effects`, `retract_intent_from_effects`; `host_effect_plan_placeholder_effect`; the `gunbc.host_effect.ShellCommand` carrier and its total match consumers `host_effect_realize.resolve_host_effect_cell` and `fleet_converge_cli.converge_cli_applied_knob_count` | roadmap `2-emit-partition`, coordinated with the host-effect lane | replace `Run.command` / `ShellCommand` with `Do{effect}` typed operations, migrate every total match, then delete the carriers; never count Pipeline wrapping as completion | | Deferred runtime srv\* | `host_effect_realize` · `srv3_join_shell_words`, `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user`; `host_build_cache_provision_script` · `build_cache_systemd_user_unit_body`, `build_cache_observe_stats_body`, `build_cache_classify_failure_body`, `build_cache_ensure_daemon_body`, `build_cache_read_back_body`, `build_cache_provision_script_body`, `build_cache_provision_shell_script`; `host_hygiene_reaper_script` · `host_hygiene_reap_install_units_body`, `host_hygiene_reap_classify_and_act_body`, `host_hygiene_reap_stale_override_body`, `host_hygiene_reap_script_body`; `host_hygiene_liveness_script.host_hygiene_liveness_read_body` | operator-deferred surviving srv\* actuator/runtime graph | un-defer a typed-effect migration with its live consumer; the separate dead install/reconcile subgraph is already deleted (#7233/#7237), so do not polish or resurrect it | -| Direct meta-exec construction | `tools.gunbc_ci.main`, `tools.merge_admission_stamp.pr_number_from_event`, `tools.emit_host_gate.gate_failure_exit`, `tools.host_prelude.toolchain_provision_shell_exec`, `gunbc.bmc_netboot_serve.bmc_netboot_run_bmc`, `gunbc.bmc_netboot_serve.bmc_netboot_put_path`, `gunbc.command_runner.run_shell_command`, `gunbc.host_effect_realize.run_shell_transport` — direct `shell.Exec.Run` sites through transparent/counted carriers | node/subtree visibility-grants `Reference` lane; per-site runtime/foreign owners still delete their bodies | confine who may form base→brand/meta-exec edges; `ShellOnHost` is already record-walled, direct `shell.Exec.Run` is not | +| Direct meta-exec construction | `tools.gunbc_ci.main`, `tools.merge_admission_stamp.pr_number_from_event`, `tools.emit_host_gate.gate_failure_exit`, `tools.host_prelude.toolchain_provision_shell_exec`, `gunbc.bmc_netboot_serve.bmc_netboot_run_bmc`, `gunbc.bmc_netboot_serve.bmc_netboot_put_path`, `gunbc.command_runner.run_shell_command`, `gunbc.host_effect_realize.run_shell_transport` — direct `shell.Exec.Run` sites through the two counted bridges | per-site runtime/foreign owners delete their bodies | **construction is closed at both edges** (#7184 record wall, #7962 seal); these rows are migration work, not wall work, and the `Reference`-verb lane is no longer their blocker | **Proposed batching (3 PRs):** @@ -638,7 +660,7 @@ The governing rule for the rest of the sweep, so "all other instances" stays dec **The construction wall this trigger waited on has PARTIALLY landed (#7184, 2026-07-24)** — it record-walls the **`ShellOnHost` realization edge** (`ResolvedHostEffectCell.ShellOnHost { script: RetainedShellScript }`, `dag/gunbc/host_effect_realize.dag:167`) and deletes the free minter `extdeps.shell.exec.transport_script_from_body(body: String)`, so a hand-assembled `String` no longer typechecks *on that edge*, with compile-fail REDs (§4.F, §5.E). -It does **not** close the `shell.Exec.Run` sink. `TransportScript` is a **transparent brand** over `String` (`type TransportScript = String where brand("TransportScript")`, `dag/extdeps/shell/exec.dag:16`) and `shell.Exec.Run` still declares `input { script: TransportScript }` (`:26`) — so `"…" as TransportScript` remains writable from any module, demonstrated live in-tree at `src/v2/test/fixture/meta_exec_confinement_scan/leak/plant.dag:6`. What guards that sink today is **validation, not construction** — the `meta_exec_confinement` scan the fixture feeds, plus `host_language_transport_script` — and DESIGN §5 is explicit that a lens *concedes* the bad state is writable. The code says so itself: `retained_shell_script_wall_note` files the surviving cast-mint's full closure on the node/subtree visibility-grants lane, where the `Reference` verb governs who may cast base→brand. +It did not close the `shell.Exec.Run` sink; **#7962 did.** `TransportScript` is a **`sole_constructor` record** whose single mint `transport_script_seal` is `admit_callers`-sealed to exactly two production declarations (`gunbc.retained_shell_script` `retained_shell_script_to_transport`, `gunbc.bash_materialized_transport` `bash_materialized_transport`), and the cast form closed with it — `04_infer` `sole_constructor_construction_diags` judges a cast into a sealed type (#7962). The `meta_exec_confinement` scan and `host_language_transport_script` remain as validation backstops, but construction is no longer what they guard. The leak fixture at `src/v2/test/fixture/meta_exec_confinement_scan/leak/plant.dag` is now **scan input and historical record only** — it can no longer be cited as evidence that the cast compiles. So *new* instances of the `ShellOnHost` class can no longer be authored; the punch-list is **not** closed at the top. @@ -652,7 +674,7 @@ What the trigger does **not** discharge is the **existing** rows: the wall stops ## 5. Method of Action — the bounded path to bash-free user space (calm-ferret-849, 2026-07-22) -**End state:** no user-space `.dag` constructs a shell string. Every "this `.dag` wants to call a bash script" instance resolves to exactly one of four paths below. The `realization_vocabulary_containment` lens (#6854, LIVE) already forbids bash-AST vocab (`ShellProgram`/`ShellStmt`/`serialize_bash`) in user space — the `shell.Exec.Run(script: TransportScript)` sink remains **open** (§5.E). #7184 retyped the **`ShellOnHost` realization edge** to the `RetainedShellScript` record (`host_effect_realize.dag:167`, `retained_shell_script.dag:9-10`) and deleted the free minter `transport_script_from_body`, so a hand-assembled `String` no longer typechecks *there* — but it did not retype `shell.Exec.Run`, which still declares `input { script: TransportScript }` over a transparent brand (`dag/extdeps/shell/exec.dag:16,26`). On the walled `ShellOnHost` edge what is still possible is **conspicuous**, not silent: authoring a counted `RetainedShellScript` row with a hand-built body is the *reviewed* escape, carrying a `reason` and a `dissolves_to` — that visibility is the mechanism, not a leak in it. The `shell.Exec.Run` sink has no such construction gate; it is lens-guarded only, and closing it is the meta-exec confinement milestone (module-isolate the bottom transport, or symbol-level import visibility). *(Rewritten 2026-07-26, `review 43544`. This sentence previously called that sink "the remaining hole", and my first correction **appended** a supersession notice below it instead of rewriting — leaving two mutually exclusive current-state claims in the same paragraph. That misapplied this document's own rule: strike-in-place is for corrections that are **illegible without the original**, and this one is not — the four-path end state survives the rewrite intact, so only the blocker claim needed replacing.)* +**End state:** no user-space `.dag` constructs a shell string. Every "this `.dag` wants to call a bash script" instance resolves to exactly one of four paths below. The `realization_vocabulary_containment` lens (#6854, LIVE) already forbids bash-AST vocab (`ShellProgram`/`ShellStmt`/`serialize_bash`) in user space — the `shell.Exec.Run(script: TransportScript)` sink **closed at construction with #7962** (§5.E). #7184 retyped the **`ShellOnHost` realization edge** to the `RetainedShellScript` record (`host_effect_realize.dag:167`, `retained_shell_script.dag:9-10`) and deleted the free minter `transport_script_from_body`, so a hand-assembled `String` no longer typechecks *there* — but it did not retype `shell.Exec.Run`; #7962 then sealed `TransportScript` itself, so that edge is closed at the type rather than by the lens. On the walled `ShellOnHost` edge what is still possible is **conspicuous**, not silent: authoring a counted `RetainedShellScript` row with a hand-built body is the *reviewed* escape, carrying a `reason` and a `dissolves_to` — that visibility is the mechanism, not a leak in it. The `shell.Exec.Run` sink now has a construction gate of its own — `TransportScript` is a **`sole_constructor` record** whose single mint `transport_script_seal` is `admit_callers`-sealed to exactly two production declarations (`gunbc.retained_shell_script` `retained_shell_script_to_transport`, `gunbc.bash_materialized_transport` `bash_materialized_transport`), and the cast form closed with it — `04_infer` `sole_constructor_construction_diags` judges a cast into a sealed type (#7962) — so the meta-exec confinement milestone is met at construction; what survives is the bridges' bare-`String` body, dissolved by migration rather than by a further wall. *(Rewritten 2026-07-26, `review 43544`. This sentence previously called that sink "the remaining hole", and my first correction **appended** a supersession notice below it instead of rewriting — leaving two mutually exclusive current-state claims in the same paragraph. That misapplied this document's own rule: strike-in-place is for corrections that are **illegible without the original**, and this one is not — the four-path end state survives the rewrite intact, so only the blocker claim needed replacing.)* **The headline (verified by op inventory @ `78f43c38`):** the arc needs only **~4 new typed ops**. Almost every site calls an op that already exists. @@ -718,11 +740,11 @@ Bash-as-target lives in one isolated backend: `src/v2/extdeps/languages/bash*` + This receipt is deliberately narrower than “all srv3 is gone.” `Srv3NbdProxyServe`, the surviving actuator/toolchain helpers in `host_effect_realize`, build-cache provisioning, and host hygiene are different live/deferred rows with their own triggers above; #7233/#7237 must not be used to mark those complete. -### 5.E — the enabler that had to come first — **PARTIALLY LANDED #7184** (closes the `ShellOnHost` string sink; `shell.Exec.Run` still open) +### 5.E — the enabler that had to come first — **LANDED in two steps**: #7184 closed the `ShellOnHost` string sink, #7962 sealed `TransportScript` and closed direct `shell.Exec.Run` -*(Heading and premise trued up 2026-07-26, `review 43537`. This read "THE ENABLER THAT **MUST COME** FIRST" in the imperative, and the paragraph below was written in the present tense — "can be faked" — as though the sink were still open. The `ShellOnHost` sink is closed, so both are past tense **for that edge** — but the `shell.Exec.Run` sink is **not** closed (transparent `TransportScript` brand, §4.F/§5.E), so the present tense still applies there. (Re-corrected 2026-07-27, `review 43614`.) The §5.A/§5.B rows it gates are the work that remains, not this.)* +*(Trued up again 2026-08-19: the heading and premise below were written while the `shell.Exec.Run` sink was open; #7962 closed it, so the present-tense claims are now past tense for BOTH edges. Original correction note follows. (Heading and premise trued up 2026-07-26, `review 43537`. This read "THE ENABLER THAT **MUST COME** FIRST" in the imperative, and the paragraph below was written in the present tense — "can be faked" — as though the sink were still open. The `ShellOnHost` sink is closed, so both are past tense **for that edge** — but the `shell.Exec.Run` sink is **not** closed (transparent `TransportScript` brand, §4.F/§5.E), so the present tense still applies there. (Re-corrected 2026-07-27, `review 43614`.) The §5.A/§5.B rows it gates are the work that remains, not this.))* -Every §5.A/§5.B row **could be** faked at the former `ShellOnHost{script}` edge, and **can still be** faked at direct `shell.Exec.Run(script)`, by joining argv back into a string — sleek-crab #7064 did exactly this (`argv_join(...) + " 2>/dev/null || true"`). While the `ShellOnHost` sink was reachable from intent, relocation was the path of least resistance and a brief alone could not stop it; the same risk remains live at direct `shell.Exec.Run`. So a construction wall was **not cleanup-after** — it was the enabler. The `ShellOnHost` record wall is now built; direct `shell.Exec.Run` remains writable through the transparent cast and counted string-taking bridges, so its construction/meta-exec confinement is still open. The original plan follows, with each bullet's actual fate marked: +Every §5.A/§5.B row **could be** faked at the former `ShellOnHost{script}` edge and at direct `shell.Exec.Run(script)` by joining argv back into a string — sleek-crab #7064 did exactly this (`argv_join(...) + " 2>/dev/null || true"`). While those sinks were reachable from intent, relocation was the path of least resistance and a brief alone could not stop it. So a construction wall was **not cleanup-after** — it was the enabler. **Both sinks are now walled**: #7184 built the `ShellOnHost` record edge, #7962 sealed `TransportScript`. What survives is the counted string-taking bridges, which are conspicuous by design. The original plan follows, with each bullet's actual fate marked: > ⚠ **The three bullets immediately below are the ORIGINAL plan, superseded by the ruling + design-correction block that follows.** Kept because the correction is only legible against them. **Each bullet failed differently, and the difference decides what a reader should do with it** — a *refuted* plan must never be retried; a *completed* one simply already happened; a *partially superseded* one still has live residue. Do not action them as written; read on. *(Flagged `review 43486`; classifications corrected `review 43522` — the earlier version lumped bullets 1 and 3 together as "refuted by execution", which was wrong for bullet 3 and is exactly the conflation §4.G's method note warns about.)* @@ -762,18 +784,18 @@ Every §5.A/§5.B row **could be** faked at the former `ShellOnHost{script}` edg > `transport_script_from_body(argv_join(...) + " 2>/dev/null || true")` and the vivid-wolf string-into-edge > near-miss), reconstructed as inline sources through `compile_dag_rust_emit_check`, **fail to compile** > (`transport_script_wall_compile_red_test.dag`) — not fail review. -> - **Surviving residue (filed, not closed here):** `x as TransportScript` (transparent-brand cast-mint) -> remains writable anywhere — the wall funnels the sanctioned mint through one -> `retained_shell_script_to_transport` body, but nothing *prevents* a stray cast in a fresh module. That -> is not closable by a record; it needs the **`Reference` verb** to govern who may form a base→brand cast -> edge. Filed as a named row on the node/subtree visibility-grants lane -> ([node-subtree-visibility-grants.md](node-subtree-visibility-grants.md) §3.1), the first brand with a -> concrete displaced cost — NOT an ad-hoc seed feature. +> - **Surviving residue (filed here, CLOSED LATER by #7962):** at the time of this ruling `x as TransportScript` +> remained writable anywhere, and the block below judged it not closable by a record, needing the +> **`Reference` verb**. **That prediction was wrong in a useful way.** #7962 closed it without any +> visibility feature, by making `TransportScript` a `sole_constructor` record AND extending +> `04_infer` `sole_constructor_construction_diags` to judge the cast form — the language grew the +> check rather than the carrier growing a guard. Kept because the reasoning is only legible against +> the original: the error was assuming the cast form was outside what construction could reach. ### Sequence 1. **§5.A** — add the ~4 ops (each cited, typed `exit`, typed-argv transport). Small, finite. -2. **§5.E** — **the construction wall LANDED #7184**, but this step is *not wholly* discharged and the original wording overstated it. What landed: the `RetainedShellScript` **record** edge + free-minter deletion + counted bridges + compile-fail REDs. The branding half was **refuted** (transparent brand). The **typed-argv realization edge is still open** — `RetainedShellScript.body` is a `String`, not `List`, so that path remains §5.A/§5.B work (see §5.E bullet 2). §5.B is already the only writable path for the *retained-script* sink. *(Corrected `review 43522`: previously struck through entirely and marked "LANDED", which retired open work.)* +2. **§5.E** — **the construction wall LANDED #7184**, but this step is *not wholly* discharged and the original wording overstated it. What landed: the `RetainedShellScript` **record** edge + free-minter deletion + counted bridges + compile-fail REDs. The branding half was **refuted** (it was a transparent brand), and the sink it left open was closed separately by #7962's seal. The **typed-argv realization edge is still open** — `RetainedShellScript.body` is a `String`, not `List`, so that path remains §5.A/§5.B work (see §5.E bullet 2). §5.B is already the only writable path for the *retained-script* sink. *(Corrected `review 43522`: previously struck through entirely and marked "LANDED", which retired open work.)* 3. **§5.B** — migrate by construction (call the op), green-by-execution + injection-RED, deleting each concat. 4. **§5.C** — route foreign-executor sites through the bash backend (bounded roster). 5. **§5.D** — un-defer per trigger. From 0d5030ebbf22a7f1fa8e52ba83363ca13320ca5e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 19 Aug 2026 16:58:50 +0000 Subject: [PATCH 03/11] Fix the DESIGN clause this PR falsified: #8476 cut the row it cited The boundary section asserted DESIGN.md needed no edit BECAUSE its shell -> intent open-thread row already routed runtime-present sites to typed effects. That row is gone: #8476 cut DESIGN to ~9.5k words and removed open-threads wholesale, and this branch merged main two commits ago. The conclusion survives, the reason does not. What the boundary instantiates now is section 3 general paragraph -- interface, realization and policy are three facts, transport is a Realization handler one of N, dispatch sits peripheral -- so a CLI-backed handler is that shape at the tool seam and DESIGN still needs no edit. Caught while verifying the previous commit against the rewritten DESIGN rather than the one the clause was written against, which is the same check the previous commit performed on fourteen other claims. Co-Authored-By: Claude Opus 5 (1M context) --- docs/plans/shell-to-dag-residual-census-and-arc-completion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index d492382cf6a..831dea2cad9 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -130,7 +130,7 @@ It sits in the same file as `gunbc.command_runner`'s round trip — `run_shell_c - The **negative falsifier** — one witness proving a Redfish/REST path reaches no `JqInvocation`, no `CliSurface`, no `ProcessArgvExpansion` and no shell target — is owed by the CLI lane (`sharp-ant-396`), not by this one. It guards this boundary better than any further argv census would, and per the replacement-migration rule a census over a structure being deleted is the attractor at work. - The **scoped supersession sentence** in `cli-invocation-emission-design.md` is that document's to place. It supersedes typed argv as the terminal representation *for CLI-backed handlers*; it does not supersede typed domain effects, typed extdeps operations, host-effect routing, or native realizations. -- **`DESIGN.md` needs no edit.** Its shell → intent row already routes runtime-present sites to typed effects on `host_effect_apply` and confines emission to foreign executors and bootstrap. The boundary refines what happens *inside* a CLI-backed realization; it falsifies no sentence in that row. Stated explicitly so a later reader does not "discover" a missing correction and add a second account of it. +- **`DESIGN.md` needs no edit, and the reason CHANGED under this PR.** The first draft of this clause said its shell → intent open-thread row already routed runtime-present sites to typed effects, so the boundary falsified nothing in it. That row **no longer exists**: #8476 cut DESIGN to ~9.5k words and removed the open-threads section wholesale. What survives, and what the boundary now instantiates, is §3's general paragraph — *interface, realization and policy are three facts, not one row*, with the transport a Realization handler one of N and the dispatch that selects a realization sitting peripheral rather than in the interface. A CLI-backed handler is that paragraph's shape at the tool seam, so the boundary is a consequence of DESIGN rather than an addition to it, and still needs no edit there. *(Rewritten 2026-08-19 while correcting this document's other stale claims — the original clause was accurate when written and was falsified by a merge to main two commits later. Recorded rather than silently swapped, because the failure mode is the subject of this very commit.)* --- From 01bbb421d8f8fc40d3b267ef007071b631bd386b Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 01:38:14 +0000 Subject: [PATCH 04/11] Settle the census's misfiled-bucket question by measurement, and delete the dead import it names The census flagged three modules as possibly-misfiled -- package_delivery, codex_app_server_press and provider_wire_evidence route through retained_foreign, whose dissolves_to is the Bash emitter (foreign executors and pre-runtime bootstrap), while appearing to run inside a present gunbc runtime. It recorded that as "a question for their owners -- the executor window is the deciding fact and this document does not own it." The question was decidable without them. package_delivery calls shell.Mkdir.Parents and shell.Find.FilesAndSymlinksWithMode -- typed operations that cannot execute without a present runtime -- in the same function bodies that then fall back to retained_foreign. A function that interleaves a typed operation with a retained foreign script is runtime-present by the fact that its first half ran. So the six remaining calls declare the wrong dissolution target. Three corrections fall out, all measured on 98d7147f9e: - provider_wire_evidence has ZERO retained_foreign call sites. Its effects became typed extdeps.shell operations under review 50540; what survived was an unused import, deleted here. It is struck from the bucket, which is 12 rather than 13, struck through rather than dropped -- a census row that vanishes without explanation cannot be told from one that was never measured. - The call counts are stale in the direction the census warns about elsewhere: 5 and 1, not 7 and 3. - package_materialized_tree_observation_note records replacing a find-piped-to-sort string with shell.Find plus in-substrate std sort, because the string form escaped its quoting on a root containing an apostrophe and forked an authority extdeps.shell already owned. That migration landed at ONE site; another instance remains in the same module with the same shape and the same exposure. A carrier that records a fix should name the population it fixed, or the next reader takes the note as coverage. Local whole-corpus compile was started and killed at 15 minutes without terminating, so it is INCONCLUSIVE rather than clean -- stated rather than omitted. The deleted import is verified unreferenced by grep; CI's floor is the census. Co-Authored-By: Claude Opus 5 (1M context) --- dag/gunbc/provider_wire_evidence.dag | 1 - ...-dag-residual-census-and-arc-completion.md | 48 +++++++++++++++---- 2 files changed, 39 insertions(+), 10 deletions(-) diff --git a/dag/gunbc/provider_wire_evidence.dag b/dag/gunbc/provider_wire_evidence.dag index bf744817d2c..daf631ed5a1 100644 --- a/dag/gunbc/provider_wire_evidence.dag +++ b/dag/gunbc/provider_wire_evidence.dag @@ -11,7 +11,6 @@ import extdeps.tools.sha512sum { Sha512FileObserved, Sha512FileObservationRefused, } -import gunbc.retained_shell_script { retained_foreign } data provider_wire_evidence_note: String = "Durable private wire evidence for provider account-standing captures. Publication is exclusive under an evidence root: 0700 directory → unique same-directory temporary file → write raw bytes → SHA-512 → hardlink to content-addressed name (fails closed if a concurrent writer already published a different object at that hex) → independent digest read-back → 0600 retained object → remove temporary. byte_count is ByteSize (std.measure) over the UTF-8 code-unit length of the retained String carrier (substrate String length), not a separate host byte-count observation." diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 831dea2cad9..1d7ac2126b6 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -77,10 +77,13 @@ Measured on `dag/**` and `src/v2/**`, excluding `/test/`, `*_test.dag` and fixtu | counted retained-script bridge call sites | 48 across 13 files, enumerated below | | distinct `fn *_argv` builders (whole tree) | 333, of which ~158 lead with `shape`/`witness`/`operation`/`typed` and model no tool at all | -The 13 files, named rather than counted, because a count cannot expose a misfiled row: +The files, named rather than counted, because a count cannot expose a misfiled row. **12 at `98d7147f9e`, not the 13 +first measured** — `gunbc.provider_wire_evidence` is struck below, having migrated fully to typed `extdeps.shell` +operations; it is retained in the list struck-through rather than silently dropped, because a census row that vanishes +without explanation cannot be told from one that was never measured: `gunbc.command_runner` · `gunbc.host_effect_realize` · `gunbc.retained_shell_script` · `gunbc.package_delivery` · -`gunbc.codex_app_server_press` · `gunbc.bmc_netboot_serve` · `gunbc.provider_wire_evidence` · `gunbc.design_document` · +`gunbc.codex_app_server_press` · `gunbc.bmc_netboot_serve` · ~~`gunbc.provider_wire_evidence`~~ · `gunbc.design_document` · `tools.gunbc_ci` · `tools.emit_host_gate` · `tools.host_prelude` · `tools.interpreter_dispatch_bijection_real_roster_transport` · `v2.lens.meta_exec_confinement` @@ -89,13 +92,40 @@ The 13 files, named rather than counted, because a count cannot expose a misfile "complete, current" claim is true as of its stated commit and false as of this one; it is a snapshot, and this row is its correction rather than a second census. -**And a classification question the count concealed, flagged not settled.** `package_delivery` (7 calls) and -`codex_app_server_press` (3) route through `retained_foreign`, whose `dissolves_to` is `retained_foreign_emit_ref` — -the Bash emitter, the destination for foreign executors and pre-runtime bootstrap. Both appear to run inside a present -gunbc runtime, which would make their destination typed effects (`retained_runtime`) instead. If that is right, ten -bridge calls declare the wrong dissolution target, and the bucket is precisely what a future session reads to decide -where they go. Recorded as a question for their owners — the executor window is the deciding fact and this document -does not own it — not as a verdict rendered from a grep. +**The classification question is now SETTLED, by measurement rather than by grep, and the answer is the one the +question feared.** These three modules were flagged as possibly-misfiled because they route through `retained_foreign`, +whose `dissolves_to` is the Bash emitter — the destination for *foreign executors and pre-runtime bootstrap* — while +appearing to run inside a present gunbc runtime. Measured on `98d7147f9e`: + +| module | `retained_foreign(` call sites | at the flag | now | +|---|---|---|---| +| `gunbc.package_delivery` | 5 | 7 | partially migrated | +| `gunbc.codex_app_server_press` | 1 | 3 | partially migrated | +| `gunbc.provider_wire_evidence` | **0** | (flagged) | **fully migrated; import is dead** | + +**The executor window is decided by construction, not by inspection of intent.** `package_delivery` calls +`shell.Mkdir.Parents` and `shell.Find.FilesAndSymlinksWithMode` — typed operations that *cannot execute without a +present gunbc runtime* — in the same function bodies that then fall back to `retained_foreign`. A function that +interleaves a typed operation with a retained foreign script is runtime-present by the fact that its first half ran. +So the destination for the remaining six calls is typed effects (`retained_runtime`), not the Bash emitter, and the +`dissolves_to` on those sites is wrong. This is a *decidable* question and it did not need its owners: the presence of +a typed operation in the same scope answers it. + +**`provider_wire_evidence` is no longer a bridge file at all** and should be struck from the 13 above, leaving 12. Its +effects became typed `extdeps.shell` operations under review 50540; what survives is an unused +`import gunbc.retained_shell_script { retained_foreign }`, which is dead and should be deleted. A module counted as a +bridge on the strength of an import it does not use is the census direction over-reporting in the same way §0c records +it over-reporting elsewhere. + +**A partial migration left a second instance of the exact defect its own note claims to have fixed.** +`package_materialized_tree_observation_note` records that the `find`-piped-to-`sort` string was replaced by +`shell.Find.FilesAndSymlinksWithMode` plus in-substrate `std` sort, because the string form escaped its quoting on a +root containing an apostrophe and forked an authority `extdeps.shell` already owned. That migration landed at one site. +Another `find '…' -type f -name '*.json' | sort` remains in the same module, built by the same concat-into-a-quoted-string +shape, with the same escape exposure and the same locale-dependent collation the note calls out. The note is true about +the site it describes and reads as true about the module. **A carrier that records a fix should name the population it +fixed**, or the next reader takes the note as coverage — which is what happened here, to me, until the count disagreed +with the prose. **The load-bearing reading:** `transport shell` is overwhelmingly an `extdeps` population — 230 of 236 production lines — i.e. it sits *beneath already-typed operations*, in the interface layer, not in the intent. This lane's original job, getting shell out of the intent, is therefore substantially done, and most of what remains is transport depth inside a CLI-backed cell. That is #8467's subject, not this document's. From 17ee6209a21178f4d52f49fd1b41780225f2e0eb Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 02:33:21 +0000 Subject: [PATCH 05/11] Correct the C-note: the fold is an unconsumed authority, not dead code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The C-note filed BuildCacheDaemonObservation / provision_build_cache_verdict / placement_verdict / build_cache_provision_gate_accepts as pre-existing dead production code with a deletion plan. I re-ran the census before acting on it. The zero-caller number reproduces exactly: 8 call sites for the gate, all in one witness file; zero production callers for any of the four symbols. The characterization does not. Reading the module's own receipt rather than the grep output, lane_e_srv1_ci_noncompletion_root_cause_receipt names placement_verdict as the FIX AUTHORITY for the stranded-sccache-server incident that killed CI builds at the 15m compile ceiling, and records that class as "INCIDENT CLEARED, NOT REPAIRED". Nine production modules import the module for other declarations, so the symbol-level zero sits inside a live file. That makes this a §4b rung finding, not a §2 redundancy one: the fold is correct and unasked. Green witnesses establish correctness, not that the class is guarded, and reporting them as the latter reads a rung above where the class sits. The deletion would have applied cleanly, taken the witnesses with it, broken nothing, and removed the named remedy for a recurrable CI-capacity incident -- with the witnesses' greenness as the property that made it look safe. Disposition changed from delete to wire-it-up, with the one measurement that could still make it benign named as the first thing to test. No code touched. Co-Authored-By: Claude Opus 5 (1M context) --- ...ll-to-dag-residual-census-and-arc-completion.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 317369add7b..f441d164ef6 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -208,13 +208,23 @@ The surviving srv\* dissolution triggers are unanimous: runtime-present raw tran **Not a shell-residual row** — this is a dead-code finding, surfaced while working the `host_build_cache_provision_script.dag` deletion (row above) precisely because the two module names differ by one suffix (`host_build_cache_provision.dag` vs `host_build_cache_provision_script.dag`), hold unrelated concepts, and one was being edited while the other was being deleted in the same PR — a naming hazard that produced a real false-negative dependents-census answer during that PR's review. Recorded here so the next person near either file gets the warning where they stand, and so the fold is sequenced deliberately rather than appended to an unrelated vertical. -`dag/gunbc/host_build_cache_provision.dag` carries a full catalog-gate/verdict fold — `BuildCacheDaemonObservation`, `provision_build_cache_verdict`, `placement_verdict`, `build_cache_provision_gate_accepts` — with **zero non-test, non-self-file callers tree-wide**, confirmed by grep on both `main` and `session/proud-swift-703` (2026-08-20). It is pre-existing dead production code; PR #8598's arm-swap touched only the two effect-constructor functions at the bottom of the file (mechanically required by the `HostEffect` rename) and did not create, fix, or reach this dead fold. +`dag/gunbc/host_build_cache_provision.dag` carries a full catalog-gate/verdict fold — `BuildCacheDaemonObservation`, `provision_build_cache_verdict`, `placement_verdict`, `build_cache_provision_gate_accepts` — with **zero non-test, non-self-file callers tree-wide**, confirmed by grep on both `main` and `session/proud-swift-703` (2026-08-20). The zero-caller count reproduces. **The characterization that followed it did not survive re-measurement, and is corrected below** — this is an *unconsumed authority*, not dead code. PR #8598's arm-swap touched only the two effect-constructor functions at the bottom of the file (mechanically required by the `HostEffect` rename) and did not create, fix, or reach this dead fold. Two test consumers, and they do **not** get the same disposition: - `dag/test/claim/host_build_cache_provision_design_witness_test.dag` — entirely dedicated to this fold (gate/verdict/classifier). Its subject disappears whole with the fold: pure deletion population, no assertion needs rehoming. - `dag/test/claim/build_cache_placement_observation_test.dag` — its real subject, `placement_of_endpoint_observation` (in `build_cache_endpoint_observation.dag`), is **live and unrelated to this fold**. Only its `refuses()` helper (used by 3 of 8 witnesses) reaches into the dead fold's `placement_verdict` as a convenience boolean-collapse over a `BuildCacheServerPlacement`. Deleting the fold without rehoming `refuses()` onto a live equivalent would silently drop those 3 witnesses' pass/fail assertion, not just their subject — this file is the "reaches its subject through the fold while asserting something else" case, not deletion population. -No deletion has been made against this finding. Next step, when sequenced: delete `host_build_cache_provision.dag`'s fold and `host_build_cache_provision_design_witness_test.dag` whole; rehome `build_cache_placement_observation_test.dag`'s `refuses()` onto a live BuildCacheServerPlacement-refusal predicate (or inline the three call sites' match arms directly) before touching the fold, so no coverage is lost in the same motion that removes it. +**CORRECTION (2026-08-20, same day, before any deletion was made): the disposition above is wrong and the fold must NOT be deleted.** + +The zero-caller measurement is right and reproduces. What it does not establish is that the fold is *unwanted*, and re-reading the module's own receipt rather than the grep output shows it is the opposite. `lane_e_srv1_ci_noncompletion_root_cause_receipt`, in this same file, names `placement_verdict` **as the fix authority for a live incident class** — in its words, "FIX AUTHORITY: ServerManagedUnitOwned on the managed compile-pool slice — ServerRunnerOwned on ANY lifecycle (active or retired) must refuse ProvisionConverged (`placement_verdict`, `build_cache_placement_observation_test` `witness_both_runner_lifecycles_refuse_at_the_verdict`)" — for the stranded-sccache-server defect that killed CI builds at the 15m compile ceiling. That receipt's own status is "INCIDENT CLEARED, NOT REPAIRED ... the class can strand again the next time a slot retires while holding the server." + +Nor is the module dead: nine production modules import `gunbc.host_build_cache_provision` (`extdeps.cache.sccache`, `build_cache_ensure`, `build_cache_instance`, `build_cache_unit`, `fleet_host_budget`, `host_effect_realize`, `host_layout`, `host_standup`, `runner_capacity_realize`). They consume other declarations in it. A symbol-level zero sitting inside a heavily-imported module is exactly the shape that reads as dead from a whole-file glance and is not. + +So the finding is **strictly worse than dead code, and it is a §4b rung problem rather than a §2 redundancy problem**: the verdict fold exists, the gate exists, the witnesses exist and pass — and nothing on the provisioning path asks any of them. The refusal named as the remedy is computed by a function no production caller calls. Green witnesses establish that the fold is *correct*, not that the class is *guarded*; reported as though they established the latter, the class reads a rung above where it sits, which is the inflation §4b calls worse than sitting low, because an inflated class never ranks for climbing. + +**What the deletion would have cost, stated because it very nearly happened:** it would have applied cleanly, taken the witnesses with it, broken nothing, and removed the named remedy for a recurrable CI-capacity incident — leaving a prose receipt pointing at a symbol that no longer exists. The witnesses' greenness was the property that made removal look safe. + +**Next step, replacing the one this paragraph supersedes: wire it up, do not delete it.** Someone must find the provisioning path that should be gated and establish why it is not — a different job, a different size, and a different owner than a deletion. The first thing to test is the one way this could still be benign: that the path is genuinely ungated, rather than gated by an equivalent check under another name. The `refuses()` rehoming note above becomes moot if the fold stays, and is retained only in case a future measurement re-establishes the deletion case. ### D. Oracle / scaffold retainers — NOT genuine emitters (mostly my Phase 3a work) From 85c961bd80c176cddb8bab78c752364993adc8ed Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 02:37:21 +0000 Subject: [PATCH 06/11] Answer the C-note's first test: the path is genuinely ungated for placement The correction said nobody should wire anything before establishing whether the provisioning path is ungated or gated by an equivalent check under another name. Measured on origin/main by reading the three modules involved. There is a check under a different name and it is not equivalent. realize_provision_build_cache gates on provision_build_cache_catalog_gate_verdict, which is pure catalog-id validation in a third module -- unknown id refuses, a non-sccache_local id refuses, otherwise realizable. It never observes placement, principal, unit ownership or lifecycle, so passing it says nothing about the stranded-daemon class the incident receipt names placement_verdict as the fix for. host_effect_realize matches none of the admission symbols. Two unconsumed authorities, not one: build_cache_ensure's admit_ensure_build_cache_instance is in the same state. Both name the same single next consumer, realize_provision_build_cache_body, so this is one wiring job rather than two -- materially smaller than the correction implied. The tree recorded this itself in ensure_effect_grain_migration_note. Verified against the code rather than quoted, since tonight's repeated failure was a correct measurement of a subject that had moved. It has not moved. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-to-dag-residual-census-and-arc-completion.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index f441d164ef6..927a55edccd 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -226,6 +226,16 @@ So the finding is **strictly worse than dead code, and it is a §4b rung problem **Next step, replacing the one this paragraph supersedes: wire it up, do not delete it.** Someone must find the provisioning path that should be gated and establish why it is not — a different job, a different size, and a different owner than a deletion. The first thing to test is the one way this could still be benign: that the path is genuinely ungated, rather than gated by an equivalent check under another name. The `refuses()` rehoming note above becomes moot if the fold stays, and is retained only in case a future measurement re-establishes the deletion case. +**That first test is now answered, on `origin/main` at 2026-08-20, by reading `host_effect_realize.dag`, `build_cache_ensure.dag` and `host_build_cache_catalog_gate.dag` directly. The benign explanation is refuted: the path is genuinely ungated for placement.** + +`realize_provision_build_cache` has exactly one gate before it dispatches to the body — `provision_build_cache_catalog_gate_verdict(catalog_id: instance.implementation)` — and that function, in a third module, is pure id validation: unknown id refuses, an id other than `sccache_local` refuses, otherwise realizable. It never observes placement, principal, unit ownership, or lifecycle. So there *is* a check under a different name, and it is **not an equivalent check**: passing it says nothing about whether the daemon is stranded in a retired slot's cgroup, which is the class the incident receipt names `placement_verdict` as the fix for. `host_effect_realize.dag` matches none of `placement_verdict`, `provision_build_cache_verdict`, `build_cache_provision_gate_accepts`, `admit_ensure_build_cache_instance`, or `EnsureBuildCacheAdmission`. + +**Two unconsumed authorities, not one — and therefore one wiring job, not two.** `build_cache_ensure.dag` carries a second admission authority, `admit_ensure_build_cache_instance`, with its own `EnsureBuildCacheAdmission` / `EnsureRefusal` / `EndpointPreflight` vocabulary and also no production caller. Both name the *same* single next consumer: `realize_provision_build_cache_body`. That materially reduces the sizing this note originally implied. + +**The tree already recorded this, and the record has not gone stale.** `ensure_effect_grain_migration_note` in `build_cache_ensure.dag` states it in terms — "RENDER IS NOT ADMIT ... NO PRODUCTION CALLER IS NAMEABLE TODAY ... The nameable next consumer is `realize_provision_build_cache_body` ... once it is rewritten to observe `BuildCacheServerPlacement` and `EndpointPathState` for the target host and route through this admission instead of unconditionally rendering and restarting the unit." That claim was verified against the code rather than quoted, because a correct note goes stale silently; it has not. The scope boundary that produced the gap was a deliberate ruling on #8598 (arm-plus-render only, explicitly refusing to wire a consumer that did not then exist) — correct for that PR, and now the open obligation. + +**Not established here:** what it costs to observe `BuildCacheServerPlacement` and `EndpointPathState` at realize time. That is the actual content of the wiring job and the reason it was deferred rather than done; this note does not size it. + ### D. Oracle / scaffold retainers — NOT genuine emitters (mostly my Phase 3a work) | site | state | From 29ebb3e6706599dd615588d4f55b0432fb949690 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 07:23:46 +0000 Subject: [PATCH 07/11] Correct the refinement calibration: no predicate is evaluated, on any kernel The guarantee-recovery doc's calibration example read "a nonliteral refined argument is RuntimeBoundaryOnly" -- a check that fires at the runtime boundary rather than at compile time. Measured across all three kernels the refinement family uses, that is true of none of them. String the conversion runs and is the identity. Executed: "" as NonEmptyStr returns "". Int the only conversion refuses every value, so it is never used; values arrive by declaration and no conversion runs. Executed: the cast refuses a valid 5 identically to -1, and -1 reaching an EpochMs-declared parameter comes back unchanged. collection a sound unforgeable wall -- private tuple field, new the only door -- with zero call sites corpus-wide, and zero refinement declarations over any collection base behind it. A gate that passes everything, a gate nobody walks through, and a wall with no door behind it. The Int row most needs stating: "fail-closed by absence of capability" reads as safe and is not, since 74 declared positions against effectively zero casts means the refusing conversion is almost never on the path. This is the document's own section 4b failure rather than a wording slip: one state was recorded for a class whose paths differ, and it was the strongest of them. Each kernel needs a different remedy, so the row cannot be weakened -- it has to be split. Population recorded as a dated measurement with its limits: 3939 across 612 files at a750b6761da, four pre-committed predicates passing including a by-name planted control, reproduced exactly on separate runners, corroborated by an independent static scan smaller in the predicted direction. The instrument was deleted, so the number is not reproducible without rebuilding it, and it is an unverified-obligation population -- the census cannot distinguish violated from unverified. Co-Authored-By: Claude Opus 5 (1M context) --- ...ompiler-guarantee-recovery-gap-analysis.md | 45 ++++++++++++++++++- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/docs/plans/compiler-guarantee-recovery-gap-analysis.md b/docs/plans/compiler-guarantee-recovery-gap-analysis.md index 3f3b5790971..e42506d48d8 100644 --- a/docs/plans/compiler-guarantee-recovery-gap-analysis.md +++ b/docs/plans/compiler-guarantee-recovery-gap-analysis.md @@ -267,13 +267,54 @@ independent review: Calibration examples, each verified on `main`: `NonEmptyList` is RepresentableButForgeable; string `non_empty` where-refinement is LiteralOnlyWall; a -nonliteral refined argument is RuntimeBoundaryOnly (five `WhereRefinementUnenforced` deferral +nonliteral refined argument is **`Absent`** (five `WhereRefinementUnenforced` deferral reasons are enrolled as *advisory* — `v1.compiler.core` -`where_refinement_deferral_reason_scaffold_note`); v2 loop termination is a ConstructionWall +`where_refinement_deferral_reason_scaffold_note`) — **corrected 2026-08-20 from +`RuntimeBoundaryOnly`, which was measured to be true of no kernel; see the executed row below**; v2 loop termination is a ConstructionWall (`v2.std.cardinality` requires a declared loop measure, fail-closed to `DescentUnknown`); unknown method is a fail-open Absent; host state is ExternalNotGuaranteed by the guarantee statement itself. +**Executed correction to the nonliteral-refined-argument calibration (2026-08-20).** That +example read `RuntimeBoundaryOnly` — *a check that fires at the runtime boundary rather than at +compile time*. Measured across all three kernels the refinement family uses, **no refinement +predicate is ever evaluated, on any kernel**. Three mechanisms, one outcome: + +| kernel | mechanism | executed evidence | +| --- | --- | --- | +| String | the conversion runs and is the **identity** | `"" as NonEmptyStr` evaluates successfully and returns `""` | +| Int | the only conversion **refuses every value**, so it is never used; values arrive by *declaration* and no conversion runs | `x as EpochMs` refuses a valid `5` identically to `-1`; and `-1` reaching an `EpochMs`-declared parameter comes back `-1` unchanged | +| collection | a sound, unforgeable wall with **zero traffic and zero declarations behind it** | `NonEmptyVec`/`NonEmptyBTreeSet` have private tuple fields so `new` is the only door, and `new` has **zero call sites** corpus-wide; **zero** refinement declarations exist over any collection base | + +A gate that passes everything, a gate nobody walks through, and a wall with no door behind it. +The Int row is the one that most needs stating: *fail-closed by absence of capability* reads as +safe, and it is not — 74 declared `: EpochMs` / `: Duration` positions against effectively zero +casts means the refusing conversion is almost never on the path, so the predicate goes +unevaluated by a third route rather than by a permissive one. + +Why this is the document's own §4b failure rather than a wording slip: one state was recorded for +a class whose paths differ, and it was the strongest of them. In emitted Rust `NonEmptyStr` is a +**bare alias** (`pub type NonEmptyStr = String;`), so a violation is not merely unchecked — it is +unrepresentable as a distinction, which does not reach even the *brand* that §4b calls cosmetic. +Each kernel needs a different remedy: String needs a carrier to exist at all; Int needs a +conversion that can succeed; collection needs the emitter to route values through the wall that +already exists (a plausible, **unproven** cause for the orphaned carriers is a name mismatch — +the type mapping emits `non_empty_list` → `NonEmptyList` while the emitted carriers are +`NonEmptyVec`/`NonEmptyBTreeSet`, with `NonEmptyList` modeled through `Refined>` +rather than `where`). + +**Population, as a dated measurement rather than a property of the tree:** a whole-tree resolve at +`a750b6761da` counted **3939 `WhereRefinementUnenforced` across 612 files** (of `TOTAL_ALL` 8183; +`HARD` 0, so every hard-diagnostic census structurally reads zero for this class). Four +pre-committed predicates passed, including a by-name planted-row control, and the count reproduced +exactly across two dispatches on separate runners. An independent static scan — sharing no +machinery with the resolve-time census — counts 3757 `as NonEmptyStr`, smaller in the predicted +direction because a text scan for one spelling of one type must count strictly less than a census +over every refinement construct. **The instrument was deleted and nothing landed, so the number is +not reproducible without rebuilding it.** And it is an *unverified-obligation* population, not a +defect population: the census cannot distinguish violated from unverified — the planted +known-violated row was indistinguishable from the other 3939 in every output. + This vocabulary is prose-interim: it becomes a typed enum on the claim carrier when the guarantee authority lands (§11), the same way `DescentEvidence` and `DecodeFidelity` model their own verdicts. The DESIGN.md §5 wall-classification (*wall now* / *wall after From 9138ad45331d60b86473f416b29ae95cc7784ebd Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 07:54:47 +0000 Subject: [PATCH 08/11] Census: retire the stale srv3_join_shell_words citation, record the srv3 deferral measurement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two corrections to the residual census, both measured at origin/main 4cec10f6. srv3_join_shell_words has zero definitions and zero mentions on main; it was cited in two places (the §1.C row and the §4.D deferred table) as a live srv3 transport helper. Removed from both. The five sibling symbols cited beside it all still resolve in gunbc.host_effect_realize and are left untouched. The srv3 deferral's premise is refuted by typed refusal: all 22 EmitArtifactThenThinRun arms in gunbc.host_effect_realize refuse, none accept, and the refusal names "reserved for ConvergePlan (host-effect Phase D)." The control widens it past that file -- the variant is realized nowhere in the tree; the three sites that appear to accept it are classifiers returning a Bool or the variant name for totality. So nothing is pending cutover and no srv3 site waits on a Phase D that exists. That settles the premise, not the disposition. Whether the srv* actuator graph survives at all is an operator decision, and migrating 22 call sites in a subgraph slated for deletion by another route is wasted work under a different premise than the original. Recorded as due for re-decision rather than expired. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-to-dag-residual-census-and-arc-completion.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index f28b05f9461..6e119cd6102 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -193,7 +193,7 @@ These run before a gunbc runtime exists on the target, so shell is the honest lo | site | what | current path | dissolves to | | --- | --- | --- | --- | | `fleet_converge_emit.dag` | **dissolved** (slice 2 keystone LANDED: #6572 `ConvergePlan`+`EmitArtifactThenThinRun`+`converge_apply` · #6585 golden shrink 323→21 lines · #6598 `gunbc converge --host` CLI receiver) — the census-time ~275 lines / 12+ fn defs / 4 for-loops / while-read drain / arithmetic / verdict if-elif are gone; the emitter now projects only the fresh-standup bootstrap intent + thin invocation lines | committed `.github/fleet-converge.sh` (21-line thin-run golden), steady-state interpreted in-process | done — `EmitArtifactThenThinRun` (slice 2) — §2 | -| `host_effect_realize.dag` srv3 transport helpers | `srv3_join_shell_words`, `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user` still build/pass command strings to SSH; the old `srv3_host_effect_script` / diagnostic-checklist builders are deleted | typed local/SSH argv operations; operator-deferred with the surviving srv\* actuator graph (§4.D), never polish a deletion-bound subgraph in isolation | +| `host_effect_realize.dag` srv3 transport helpers | `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user` still build/pass command strings to SSH; the old `srv3_host_effect_script` / diagnostic-checklist builders are deleted | typed local/SSH argv operations; operator-deferred with the surviving srv\* actuator graph (§4.D), never polish a deletion-bound subgraph in isolation | | ~~`host_build_cache_provision_script.dag`~~ **FILE DELETED — A5 un-deferred, bounded to the effect-grain swap only** | `HostEffect.ProvisionBuildCache` is gone; the constructible arm is `EnsureBuildCacheInstance { desired: BuildCacheInstance }`, matched in `host_effect_realize.realize_provision_build_cache`. The six `build_cache_*_body` builders **relocated unchanged in spirit** into `host_effect_realize.dag` beside it — a RELOCATION of the concat-built shell, not the typed-argv conversion `#5828` names; render-is-not-admit (see `gunbc.build_cache_ensure`'s `ensure_effect_grain_migration_note`), so `admit_ensure_build_cache_instance`'s placement/path admission is still not wired into the realize path | `host_effect_apply_gated` retained-script transport, now built from `host_effect_realize.dag` | typed observe/effect operations over the new typed effect grain; `#5828` remains open, un-deferred by nothing this row records | | `host_hygiene_{reaper,liveness}_script.dag` | concat-built runtime host mutation/observation bodies | `host_effect_apply_gated` retained-script transport | typed observe/effect operations; operator-deferred A5 | | ~~`host_codex_runtime_provision_script.dag`~~ **LANDED** | concat-built observe/ensure/read-back for `ProvisionCodexRuntime` | typed observe/materialize/read-back argv steps in `host_effect_realize.dag` (`gunbc.WitnessBin.Run` / `gunbc.Cli.Run` locally, `run_typed_argv_transport` over SSH/FleetSsh), verdict folded in `host_codex_runtime_provision_verdict.dag` | done — file deleted in the same cut | @@ -684,9 +684,15 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | Already-routed foreign emit, terminal raw leaves | the §4.E exact output roster: `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script`, `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script`, `ci_cargo_eagain_retry_script`, `ci_release_build_script`, `gunbc_ci_run_script`, `ci_sccache_provider_shell_injection`, `ci_regen_ensure_rustfmt_path_script`, `gcp_token_smoke_script`, and `fresh_standup_bootstrap_intent`. The #7290 rustfmt-path output's exact raw leaves are `ci_regen_rustfmt_test_x_cargo_home`, `ci_regen_rustfmt_test_x_opt_cargo`, `ci_regen_rustfmt_test_x_home_cargo`, `ci_regen_rustfmt_test_x_rf`, `ci_regen_rustfmt_command_v`, `ci_regen_rustfmt_export_cargo_home_path`, `ci_regen_rustfmt_export_opt_cargo_path`, `ci_regen_rustfmt_export_home_cargo_path`, `ci_regen_rustfmt_export_rf_dir_path`, `ci_regen_rustfmt_error_echo`, `ci_regen_rustfmt_rustup_which_assign`, plus the inline `StrNonempty` shell operands in `ci_regen_rustfmt_probe_cargo_home_step` / `ci_regen_rustfmt_probe_rustup_then` | roadmap `2-emit-partition`; Phase-1 owns the While fidelity and scope/adoption subset | retain the correct foreign/bootstrap Bash target, but replace ambient `Run.command` strings with modeled `Do{effect}` leaves and delete each raw producer; for #7290 this is the cited `FileExists` + session-`EnvExport` carrier trigger; do not re-home them in another String carrier | | Permanent foreign media | `expected_githooks_pre_push_sh`, `build_cron_entry_line` | roadmap `2-emit-partition`; unassigned | their **builders** route through typed intent → Bash; the emitted shell artifacts remain permanently because git/cron require that medium | | Runtime `Run.command` / `ShellCommand` terminal | `live_deploy.emit.deploy_raw` fed by `ensure_apt_package_step`, `apply_systemd_unit_write_step`, `apply_tree_sync_unit_write_step`, `tree_sync_restart_step_with_diagnosis`, `tailscale_serve_apply_step`, `install_d_owned_command`, `deploy_apply_preamble_steps`, `emit_artifact_upsert`, `emit_artifact_teardown`, `emit_deploy_teardown_dependency_refusal`, `apply_intent_from_effects`, `retract_intent_from_effects`; `host_effect_plan_placeholder_effect`; the `gunbc.host_effect.ShellCommand` carrier and its total match consumers `host_effect_realize.resolve_host_effect_cell` and `fleet_converge_cli.converge_cli_applied_knob_count` | roadmap `2-emit-partition`, coordinated with the host-effect lane | replace `Run.command` / `ShellCommand` with `Do{effect}` typed operations, migrate every total match, then delete the carriers; never count Pipeline wrapping as completion | -| Deferred runtime srv\* | `host_effect_realize` · `srv3_join_shell_words`, `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user`; `host_effect_realize` (relocated from the now-deleted `host_build_cache_provision_script`, unit body builder dropped in favor of `gunbc.build_cache_unit.render_build_cache_unit`) · `build_cache_observe_stats_body`, `build_cache_classify_failure_body`, `build_cache_ensure_daemon_body`, `build_cache_read_back_body`, `build_cache_provision_script_body`, `build_cache_provision_shell_script`; `host_hygiene_reaper_script` · `host_hygiene_reap_install_units_body`, `host_hygiene_reap_classify_and_act_body`, `host_hygiene_reap_stale_override_body`, `host_hygiene_reap_script_body`; `host_hygiene_liveness_script.host_hygiene_liveness_read_body` | operator-deferred surviving srv\* actuator/runtime graph | un-defer a typed-effect migration with its live consumer; the separate dead install/reconcile subgraph is already deleted (#7233/#7237), so do not polish or resurrect it; build-cache's own trigger is `#5828` — the relocation into `host_effect_realize` is not that trigger firing | +| Deferred runtime srv\* | `host_effect_realize` · `srv3_transport_witness_bin_success`, `srv3_transport_test_executable`, `srv3_apt_tool_present`, `srv3_tool_bin_path`, `srv3_chown_directory_to_current_user`; `host_effect_realize` (relocated from the now-deleted `host_build_cache_provision_script`, unit body builder dropped in favor of `gunbc.build_cache_unit.render_build_cache_unit`) · `build_cache_observe_stats_body`, `build_cache_classify_failure_body`, `build_cache_ensure_daemon_body`, `build_cache_read_back_body`, `build_cache_provision_script_body`, `build_cache_provision_shell_script`; `host_hygiene_reaper_script` · `host_hygiene_reap_install_units_body`, `host_hygiene_reap_classify_and_act_body`, `host_hygiene_reap_stale_override_body`, `host_hygiene_reap_script_body`; `host_hygiene_liveness_script.host_hygiene_liveness_read_body` | operator-deferred surviving srv\* actuator/runtime graph | un-defer a typed-effect migration with its live consumer; the separate dead install/reconcile subgraph is already deleted (#7233/#7237), so do not polish or resurrect it; build-cache's own trigger is `#5828` — the relocation into `host_effect_realize` is not that trigger firing | | Direct meta-exec construction | `tools.gunbc_ci.main`, `tools.merge_admission_stamp.pr_number_from_event`, `tools.emit_host_gate.gate_failure_exit`, `tools.host_prelude.toolchain_provision_shell_exec`, `gunbc.bmc_netboot_serve.bmc_netboot_run_bmc`, `gunbc.bmc_netboot_serve.bmc_netboot_put_path`, `gunbc.command_runner.run_shell_command`, `gunbc.host_effect_realize.run_shell_transport` — direct `shell.Exec.Run` sites through the two counted bridges | per-site runtime/foreign owners delete their bodies | **construction is closed at both edges** (#7184 record wall, #7962 seal); these rows are migration work, not wall work, and the `Reference`-verb lane is no longer their blocker | +**srv3 deferral — premise measured false, disposition still owed (2026-08-20, measured at `origin/main` `4cec10f6`).** The deferral of the `srv3_*` runtime helpers rested on the premise that the subgraph was pending subsumption by the `EmitArtifactThenThinRun` transport, so migrating its call sites would be wasted work. That premise is false, and the refutation is a typed refusal rather than an absence: all 22 `EmitArtifactThenThinRun` match arms in `gunbc.host_effect_realize` refuse, none accept, and the refusal text names the boundary — *"reserved for ConvergePlan (host-effect Phase D)."* + +The control widens the finding past the one file. `EmitArtifactThenThinRun` is **realized nowhere in the tree**: `gunbc.systemd_run_transient`, `gunbc.systemctl_stop_run`, `gunbc.systemctl_status_read`, `gunbc.systemctl_show_read`, `gunbc.systemctl_is_active_read`, `gunbc.hostname_set`, `gunbc.hostname_read`, `gunbc.spark_serving_converge_apply`, and `gunbc.live_deploy.readiness` each carry a refusing arm too. The sites that appear to accept it — `gunbc.ci_deploy_access`, `gunbc.ci_deploy_target_host`, `gunbc.host_identity_adopt` — are classifiers whose arms return a `Bool` or the variant's own name for totality; not one of them executes the transport. So the variant is **declared but unrealized**: nothing is pending cutover anywhere, and no srv3 call site is waiting on a Phase D that exists. + +What this settles and what it does not. **Settled by measurement:** the srv3 subgraph is not subsumed today and is not scheduled for subsumption by any live mechanism, so the deferral has no standing premise. **Not settled, and it is a decision rather than a measurement:** whether the `srv*` actuator graph survives at all. The tree cannot answer that — migrating 22 call sites (`srv3_transport_witness_bin_success` 10, `srv3_tool_bin_path` 6, `srv3_apt_tool_present` 4, `srv3_chown_directory_to_current_user` 2) in a subgraph the operator intends to delete by another route would be wasted work under a different premise than the original one. The deferral is therefore **due for re-decision, not automatically expired**, and that re-decision is the last blocking input on the largest remaining block in this census. + **Proposed batching (3 PRs):** | PR | scope | From 298dfdd6e52682c4d37be9cfab7d873efdfa794b Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 07:57:04 +0000 Subject: [PATCH 09/11] =?UTF-8?q?Census:=20correct=20"realized=20nowhere"?= =?UTF-8?q?=20=E2=80=94=20EmitArtifactThenThinRun=20has=20exactly=20one=20?= =?UTF-8?q?realizer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The paragraph committed earlier today claimed EmitArtifactThenThinRun is realized nowhere in the tree and is therefore declared-but-unrealized. That is false, by exactly one path, in the file the claim examined most closely. realize_converge_on_host splits its EmitArtifactThenThinRun arm on gunbc_apply_mode_for_host: FreshStandup refuses as fail-closed Unimplemented, but ExistingHostQuiescentReload calls realize_converge_in_process -- the identical call the LocalShell arm makes. For an existing quiescent host the transport takes the same path as the shell transport. The sibling SshShell and FleetSsh refusals direct the caller to "use EmitArtifactThenThinRun", which points the same way. Two disguises produced the wrong count and each survives a scan written for the other: a refusal shaped as a success-valued record (hostname_set answers HostnameSetCasApplyFailed with the refusal in a stderr field, invisible to a NotConverged scan), and a realizer behind a refusing first sub-arm (the arm above, whose opening lines read as a refusal). Reading all 24 bodies was the only method that survived; the corrected text records both disguises so the next reader does not re-derive them. The srv3 conclusion is unchanged. The realizing path is for HostConverge, not for any srv3 effect -- every Srv3* arm still refuses. Only the supporting sentence changes: not "realized nowhere so nothing is pending" but "exactly one realizer, and srv3 is not on it." Corrected in place rather than annotated beside, per the standing rule against two accounts of one fact. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-to-dag-residual-census-and-arc-completion.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 6e119cd6102..59cf60f7f79 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -689,7 +689,13 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari **srv3 deferral — premise measured false, disposition still owed (2026-08-20, measured at `origin/main` `4cec10f6`).** The deferral of the `srv3_*` runtime helpers rested on the premise that the subgraph was pending subsumption by the `EmitArtifactThenThinRun` transport, so migrating its call sites would be wasted work. That premise is false, and the refutation is a typed refusal rather than an absence: all 22 `EmitArtifactThenThinRun` match arms in `gunbc.host_effect_realize` refuse, none accept, and the refusal text names the boundary — *"reserved for ConvergePlan (host-effect Phase D)."* -The control widens the finding past the one file. `EmitArtifactThenThinRun` is **realized nowhere in the tree**: `gunbc.systemd_run_transient`, `gunbc.systemctl_stop_run`, `gunbc.systemctl_status_read`, `gunbc.systemctl_show_read`, `gunbc.systemctl_is_active_read`, `gunbc.hostname_set`, `gunbc.hostname_read`, `gunbc.spark_serving_converge_apply`, and `gunbc.live_deploy.readiness` each carry a refusing arm too. The sites that appear to accept it — `gunbc.ci_deploy_access`, `gunbc.ci_deploy_target_host`, `gunbc.host_identity_adopt` — are classifiers whose arms return a `Bool` or the variant's own name for totality; not one of them executes the transport. So the variant is **declared but unrealized**: nothing is pending cutover anywhere, and no srv3 call site is waiting on a Phase D that exists. +The control widens the finding past the one file, but **not** to "the transport is unrealized" — that stronger claim was asserted here on 2026-08-20 and falsified the same day by reading every arm body rather than pattern-matching for refusal shapes. `EmitArtifactThenThinRun` has **exactly one realizer**: `gunbc.host_effect_realize` `realize_converge_on_host` splits its arm on `gunbc_apply_mode_for_host` — `FreshStandup` refuses as fail-closed Unimplemented, and `ExistingHostQuiescentReload` calls `realize_converge_in_process`, *the identical call the `LocalShell` arm makes*. For an existing quiescent host the transport is not merely accepted; it takes the same path as the shell transport. The neighbouring `SshShell`/`FleetSsh` refusals confirm the direction, since their text directs the caller to "use EmitArtifactThenThinRun." + +Two disguises defeated the pattern-based reads that produced the wrong count, and both are worth naming because each survives a scan written for the other: a **refusal shaped as a success-valued record** (`gunbc.hostname_set` answers `HostnameSetCasApplyFailed { stderr: "EmitArtifactThenThinRun unsupported..." }`, which no `NotConverged` scan sees), and a **realizer behind a refusing first sub-arm** (the arm above, whose opening lines read as a refusal). Reading all 24 arm bodies cost about five minutes and was the only method that survived. + +Everything else does refuse: `gunbc.systemd_run_transient`, `gunbc.systemctl_stop_run`, `gunbc.systemctl_status_read`, `gunbc.systemctl_show_read`, `gunbc.systemctl_is_active_read`, `gunbc.hostname_set`, `gunbc.hostname_read`, `gunbc.spark_serving_converge_apply`, `gunbc.live_deploy.readiness`. The sites that appear to accept — `gunbc.ci_deploy_access`, `gunbc.ci_deploy_target_host`, `gunbc.host_identity_adopt` — are classifiers whose arms return a `Bool` or the variant's own name for totality; none executes the transport. + +**The srv3 finding is unaffected by the correction.** The one realizing path is for `HostConverge`, not for any srv3 effect: every `Srv3*` arm still refuses, including `Srv3BootOnceReadBackSleep`, `Srv3SeededInstallMediaToolchainEnsure`, and the four `srv3_actuator_toolchain_*` helper refusals. What changes is the supporting sentence, not the conclusion — it is no longer "the transport is realized nowhere, so nothing is pending cutover" but **"the transport has exactly one realizer and srv3 is not on it."** What this settles and what it does not. **Settled by measurement:** the srv3 subgraph is not subsumed today and is not scheduled for subsumption by any live mechanism, so the deferral has no standing premise. **Not settled, and it is a decision rather than a measurement:** whether the `srv*` actuator graph survives at all. The tree cannot answer that — migrating 22 call sites (`srv3_transport_witness_bin_success` 10, `srv3_tool_bin_path` 6, `srv3_apt_tool_present` 4, `srv3_chown_directory_to_current_user` 2) in a subgraph the operator intends to delete by another route would be wasted work under a different premise than the original one. The deferral is therefore **due for re-decision, not automatically expired**, and that re-decision is the last blocking input on the largest remaining block in this census. From bba7aa1aadfb7bd9b6f1c80ad4144da7ec431eb9 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 09:49:58 +0000 Subject: [PATCH 10/11] =?UTF-8?q?Census:=20correct=20the=20arm=20denominat?= =?UTF-8?q?or=20=E2=80=94=2036=20production=20arms,=20not=2024?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The paragraph recording how the one-realizer finding was measured stated that all 24 arm bodies had been read. That number came from the manual audits and is wrong. Measured at 4cec10f66a3d84cbde631e20ca9feaa31457d88c: 41 EmitArtifactThenThinRun occurrences -- 1 variant declaration in gunbc.host_effect, 36 production match arms across 14 modules, 4 in dag/test/claim. Neither manual audit reached 36 and neither mentioned gunbc.host_effect_codex_supervised_turn, whose arm answers CodexSupervisedSessionApplyRefused: a refusal named by its record rather than by a refusal type, which is the same disguise class the paragraph documents. The finding is unchanged -- exactly one arm realizes, realize_converge_on_host under ExistingHostQuiescentReload. What was wrong was the stated size of what had been examined, inside the paragraph about examining carefully. Recorded as a dated measurement at a named SHA for a derived detector to reproduce and reconcile against, explicitly not as a fixed law, since migrations are expected to change it. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-to-dag-residual-census-and-arc-completion.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 59cf60f7f79..732564f0045 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -691,7 +691,11 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari The control widens the finding past the one file, but **not** to "the transport is unrealized" — that stronger claim was asserted here on 2026-08-20 and falsified the same day by reading every arm body rather than pattern-matching for refusal shapes. `EmitArtifactThenThinRun` has **exactly one realizer**: `gunbc.host_effect_realize` `realize_converge_on_host` splits its arm on `gunbc_apply_mode_for_host` — `FreshStandup` refuses as fail-closed Unimplemented, and `ExistingHostQuiescentReload` calls `realize_converge_in_process`, *the identical call the `LocalShell` arm makes*. For an existing quiescent host the transport is not merely accepted; it takes the same path as the shell transport. The neighbouring `SshShell`/`FleetSsh` refusals confirm the direction, since their text directs the caller to "use EmitArtifactThenThinRun." -Two disguises defeated the pattern-based reads that produced the wrong count, and both are worth naming because each survives a scan written for the other: a **refusal shaped as a success-valued record** (`gunbc.hostname_set` answers `HostnameSetCasApplyFailed { stderr: "EmitArtifactThenThinRun unsupported..." }`, which no `NotConverged` scan sees), and a **realizer behind a refusing first sub-arm** (the arm above, whose opening lines read as a refusal). Reading all 24 arm bodies cost about five minutes and was the only method that survived. +Two disguises defeated the pattern-based reads that produced the wrong count, and both are worth naming because each survives a scan written for the other: a **refusal shaped as a success-valued record** (`gunbc.hostname_set` answers `HostnameSetCasApplyFailed { stderr: "EmitArtifactThenThinRun unsupported..." }`, which no `NotConverged` scan sees), and a **realizer behind a refusing first sub-arm** (the arm above, whose opening lines read as a refusal). Reading arm bodies rather than matching shapes was the only method that survived. + +**The denominator both audits used was itself wrong, and the correction belongs here rather than in a footnote.** An earlier revision of this paragraph said "all 24 arm bodies," inherited from the manual audits. Measured at `4cec10f66a3d84cbde631e20ca9feaa31457d88c`, the tree carries **41** `EmitArtifactThenThinRun` occurrences: 1 variant declaration (`gunbc.host_effect`), **36 production match arms** across 14 modules, and 4 in `dag/test/claim/`. Neither manual audit reached 36, and neither mentioned `gunbc.host_effect_codex_supervised_turn`, whose arm answers `CodexSupervisedSessionApplyRefused` — another refusal wearing a record name rather than a refusal type. The **conclusion is unchanged**: exactly one arm realizes, and it is `realize_converge_on_host` under `ExistingHostQuiescentReload`. What was wrong was the count of what had been examined, in a paragraph about examining carefully. + +That is the point, not an aside. Two readers who had just corrected each other on method still could not state their own denominator, because a hand-assembled roster cannot prove its own completeness — it can only report what someone remembered to look at. A derived census is not a stylistic preference over a careful manual one; it is the only kind that can be wrong *loudly*. The 36/1 partition above is therefore recorded as a **dated measurement at a named SHA, to be reproduced by a derived detector and reconciled against — never as a fixed law**; migrations are expected to change it. Everything else does refuse: `gunbc.systemd_run_transient`, `gunbc.systemctl_stop_run`, `gunbc.systemctl_status_read`, `gunbc.systemctl_show_read`, `gunbc.systemctl_is_active_read`, `gunbc.hostname_set`, `gunbc.hostname_read`, `gunbc.spark_serving_converge_apply`, `gunbc.live_deploy.readiness`. The sites that appear to accept — `gunbc.ci_deploy_access`, `gunbc.ci_deploy_target_host`, `gunbc.host_identity_adopt` — are classifiers whose arms return a `Bool` or the variant's own name for totality; none executes the transport. From 2c2ef16749946230acbf4fcd9539337bb76f0394 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 20 Aug 2026 11:50:22 +0000 Subject: [PATCH 11/11] Census: record v2.lens.effect_reach as prior art to supersede, not extend Answering the census brief's stop condition -- whether existing parsed-body facts can carry the derived census -- surfaced a lens already answering approximately this question, which a later reader could mistake for coverage. v2.lens.effect_reach classifies host-effect sinks and carries a ShellExecRunSink variant. But sink_kind_for_callee selects by name equality against a remembered callee-text list ("Run", "shell.Exec.Run", "Exec.Run", "WitnessBin.Run", "Read"), everything else falling to UnknownHostEffectSink. That is the forbidden seed form -- where we remember doing it rather than what interprets bytes as shell -- and it cannot see sh -c, sh -s on stdin, or a sudo -S sh -s wrapper. It carries the same blind spot this census carried before Spark was found. Two bounds on its weight: it classifies from callee text rather than resolved callee identity, the text-scanning substitution the brief's stop condition forbids; and enforcement_live_witness_test asserts its contract is unbound, the corpus's own record that it has no enrolled consumer. Disposition is supersede rather than extend: a census seeded from interpretation semantics subsumes its whole sink vocabulary, while extending it would inherit its selection principle. Recorded so the derived cut treats it as prior art with a known-narrow frontier, and so its ShellExecRunSink rows are never read as an existing shell-reach population. Co-Authored-By: Claude Opus 5 (1M context) --- .../shell-to-dag-residual-census-and-arc-completion.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 732564f0045..b06d98b79bc 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -703,6 +703,13 @@ Everything else does refuse: `gunbc.systemd_run_transient`, `gunbc.systemctl_sto What this settles and what it does not. **Settled by measurement:** the srv3 subgraph is not subsumed today and is not scheduled for subsumption by any live mechanism, so the deferral has no standing premise. **Not settled, and it is a decision rather than a measurement:** whether the `srv*` actuator graph survives at all. The tree cannot answer that — migrating 22 call sites (`srv3_transport_witness_bin_success` 10, `srv3_tool_bin_path` 6, `srv3_apt_tool_present` 4, `srv3_chown_directory_to_current_user` 2) in a subgraph the operator intends to delete by another route would be wasted work under a different premise than the original one. The deferral is therefore **due for re-decision, not automatically expired**, and that re-decision is the last blocking input on the largest remaining block in this census. +**Prior art the derived census must supersede rather than extend — `v2.lens.effect_reach` (measured 2026-08-20 at `4cec10f6`).** A lens answering approximately this question already exists, and a reader who finds it may mistake it for coverage. It classifies host-effect sinks and carries a `ShellExecRunSink` variant, so its subject overlaps the shell census directly. + +Its selection is the forbidden seed form. `sink_kind_for_callee` takes a `callee_text: String` and compares it by name equality against a remembered list — `"Run"`, `"shell.Exec.Run"`, `"Exec.Run"`, `"WitnessBin.Run"`, `"Read"` — with everything else falling to `UnknownHostEffectSink`. That is *where we currently remember doing so*, not *what interprets bytes as shell*, and the consequence is mechanical: it cannot see `sh -c`, cannot see `sh -s` on stdin, and cannot see a wrapper stack such as `sudo -S sh -s`. It therefore carries **the same blind spot this census carried before Spark was found** — `gunbc.spark_managed_access_apply`'s four script builders reach a host through `stdin_payload` behind a wrapper, and no callee-name comparison can reach them. + +Two further facts bound how much weight it can hold. Its classification is derived from callee *text* rather than from resolved callee identity, which is the text-scanning substitution the census brief's stop condition forbids. And `v2.test.claim.enforcement_live_witness_test` asserts `lens_contract_is_unbound(c: lens_contract_effect_reach)` — the corpus's own record that the contract has no enrolled consumer. Whatever else it is, it is not gating. + +The disposition is therefore **supersede, not extend**: a census seeded from interpretation semantics subsumes this lens's entire sink vocabulary, while extending the lens would inherit its selection principle. Recorded here so the derived cut treats it as prior art with a known-narrow frontier rather than as an available foundation — and so its `ShellExecRunSink` rows are never read as an existing shell-reach population. **Proposed batching (3 PRs):** | PR | scope |