srv1 daily workspace still doesn't work at all

.gitattributes

@@ -12,6 +12,7 @@
 .githooks/pre-commit merge=generated-artifact
 .githooks/pre-push merge=generated-artifact
 .github/workflows/fleet-converge.yml merge=generated-artifact
+.github/workflows/fleet-desired.yml merge=generated-artifact
 .github/workflows/witnesses.yml merge=generated-artifact
 .gitignore merge=generated-artifact
 DESIGN.md merge=generated-artifact

.github/workflows/fleet-desired.yml

@@ -0,0 +1,43 @@
+name: fleet-desired
+on:
+  workflow_run:
+    workflows: [witnesses]
+    types: [completed]
+concurrency:
+  group: gunbc-fleet-desired-admission
+jobs:
+  admit:
+    runs-on: [self-hosted, linux, arm64, srv1]
+    timeout-minutes: 60
+    if: github.event.workflow_run.head_branch == 'main'
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1.16.0
+        with:
+          cache: false
+      - name: Build the admission binary
+        run: |
+          cargo build --release -p v1-compiler --bin gunbc
+      - name: Stage the floor run event payload
+        run: |
+          set -eu
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          mkdir -p "$ROOT/target"
+          rm -f "$ROOT/target/fleet-desired-authorized-push.sh"
+          cp "$GITHUB_EVENT_PATH" "$ROOT/target/fleet-desired-admission-event.json"
+      - name: Decide whether the floor admits this revision
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root dag --source-root src/v2 --entry dag/gunbc/fleet_desired_admission.dag --function admit_fleet_desired_from_floor_event_wet
+      - name: Execute the authorized fleet-desired advance
+        run: |
+          set -eu
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          test -s "$ROOT/target/fleet-desired-authorized-push.sh"
+          sh "$ROOT/target/fleet-desired-authorized-push.sh"

dag/gunbc/ci_spec.dag

@@ -869,18 +869,39 @@ fn gunbc_ci_authorized_key_enroll_invoke() -> String {
   )
 }
 
-// gunbc_ci_advance_fleet_desired_script, its Scaffold disposition and its dissolution
-// trigger were DELETED HERE with the deploy workflow authority. The function rendered a
-// shell CAS advance -- git ls-remote, then a bare `git push origin "$GITHUB_SHA:$DESIRED_REF"`
-// on the create branch with no lease at all -- and its only two consumers were
-// gunbc.live_deploy_workflow and that module's witness file, both deleted in the same cut.
+// THE UNGATED FLEET-DESIRED ADVANCE WAS DELETED HERE, and the deletion is the point rather than a
+// tidy-up. What stood here was gunbc_ci_advance_fleet_desired_script, a concat-built shell step
+// that pushed $GITHUB_SHA onto refs/fleet/desired -- with a compare-and-swap on the observed prior
+// on the advance branch, and on the CREATE branch a bare `git push origin "$GITHUB_SHA:$DESIRED_REF"`
+// carrying no lease at all, which is the branch that runs when the ref does not yet exist.
 //
-// It is not preserved for a future actuator. gunbc.fleet_desired_admission is the admitted
-// replacement: it advances the ref only behind a modeled decision over a completed floor
-// run, and renders the push from typed values rather than from $GITHUB_SHA. Keeping a
-// function that can still emit the raw form would leave the unsafe spelling one call site
-// away from returning, which is the same leaf-versus-root error that let the deleted
-// workflow regenerate itself.
+// The CAS half was correct. The ADMISSION half did not exist: gunbc.fleet_main_revision requires the
+// desired revision to derive from merged, FLOOR-GREEN main and models that gate as
+// admit_fleet_desired_advance, and this script never called it -- so the gate's only caller was its
+// own witness test while the unproven path ran on every push to main. That is exactly the raw-HEAD
+// advance the authority names as its prevented class, and it reached further than the ref:
+// gunbc.roadmap_belt_actuate gates worker dispatch on revision standing, so a desired ref equal to
+// whatever last landed made that gate agree unconditionally and pass in silence.
+//
+// The replacement is gunbc.fleet_desired_admission, whose decision consults the modeled gate with a
+// floor conclusion observed from the floor run's own workflow_run payload, and which renders the
+// authorized push itself so the surrounding shell carries no ref, revision or prior of its own. It
+// is cut at the root rather than kept beside the replacement: two answers to how the fleet's
+// admitted revision advances is the fork DESIGN section 3 forbids, and the weaker one was the live
+// one. Keeping a function that can still render the raw form would leave the unsafe spelling one
+// call site from returning. The script's only other consumers were gunbc.live_deploy_workflow and
+// its witness file, both deleted with the deploy workflow authority.
+//
+// The Scaffold disposition and dissolution trigger that tracked this script's medium-as-string debt
+// went with it -- the replacement's actuation is a model-rendered script, so that debt is re-declared
+// where the remaining shell actually lives, not inherited here.
+//
+// This annotation was itself a merge conflict: the root cut and the admission change each deleted
+// this script and each wrote their own account of why. Two annotations for one deletion is the
+// duplication section 3 forbids, so they are merged here rather than stacked, and the accompanying
+// `data ..._deleted_note: String` row is dropped -- a String declaration whose sole purpose is
+// commentary is the misplaced data section 4c names, and the annotation above already carries it.
+
 
 data gunbc_ci_srv1_tasks_observation_shell_emit_scaffold: Disposition = Scaffold {
   dissolves_to: SingleAuthority,