The drift remedy told operators to run the one operation another module blocks

[gunbai-bot]

The operator-facing remedy named an operation another module blocks

converge_cli_revision_reason rendered, to a human:

gunbc converge: revision drift — desired <D>, local tree at <L>; tree-sync is the catch-up realization

gunbc.live_deploy.deployed_tree_report blocks exactly that operation, and states why:

A tree-only publication is BLOCKED: it moves the deployed HEAD to the admitted revision and
thereby flips roadmap_belt_actuate belt_revision_admission from refusing to admitting while
the installed binary is still the old one, so the belt's next tick dispatches a mixed
realization that was never admitted as a release.

So two authorities disagreed about one operation, and the operator-facing one pointed at the unsafe
half. An operator following this line flips the belt gate to admitting on a host whose binary is
still stale.

Why it survived, which is the part worth keeping

The typed verdict was correct the entire time. RevisionDrifted { desired, local } is right,
its consumers are right, the belt's refusal is right. Nothing that reads the verdict was wrong —
only the sentence a human acts on.

And converge_cli_revision_reason had no witness at all, so there was nothing to go red when
the remedy it named was superseded elsewhere in the corpus. A correct verdict with a stale
human-facing remedy is invisible to every check that reads the verdict.

What changed

• The rendered remedy becomes full host-release publication is required — tree-only synchronization is NOT convergence.
• The joint-verdict annotation carried the same superseded claim and is corrected. Its surviving
  half is untouched and is load-bearing: the catch-up's safe form is a compare-and-swap and so
  needs the prior, which is why the drifted arm carries both operands.
• Two witnesses the function never had.

Evidence

witness_converge_cli_drift_reason_does_not_prescribe_tree_only_sync  => PASS
witness_converge_cli_converged_standing_offers_no_remedy             => PASS

RED CONTROL (superseded string replanted):
witness_converge_cli_drift_reason_does_not_prescribe_tree_only_sync  => FAIL
witness_converge_cli_converged_standing_offers_no_remedy             => PASS   <-- stays green

The pair is discriminating rather than fragile: the plant takes the drift claim red while the
converged claim is unmoved, so the witnesses detect this regression and not merely any edit to
the function. The plant asserts its own pattern is present before rewriting, so a no-op'd edit
cannot masquerade as a control.

The converged arm's claim is not filler — a remedy offered to an operator who has nothing to
remedy is its own defect, and it is the arm most likely to acquire one by accident.

Scope

Does not touch the actuator question, the belt gate, or any decision logic. This is the rendered
sentence and its missing coverage. Held as draft while main is red on #8726's .keys() sweep
(#8784 owns that); flipping to ready once main is green.