The reach fold re-derived the endpoint projection instead of calling it; and the network annotation's blocker was lifted in August

[gunbai-bot]

PAUSED by operator instruction 2026-08-23. Draft, not to be flipped to ready. Owning session sunny-swift-814 no longer exists; this metadata was written by swift-badger-524 so the branch is readable cold.

What is here (two halves, both small)

1. dag/gunbc/fleet_intent_network.dag — the SPARK-LANE-A annotation still claimed "the operator supplied the router table but never stated the assignment" and that authoring an endpoint would be "a 50/50 guess". That is false at head and falsified twice over: gunbc.spark.dgx_procurement records the operator-delegated decision of 2026-08-07 with both srv5_router_binding and srv6_router_binding as SlotAssigned, and gunbc.fleet_reach_endpoint has been consuming those bindings into working reach addressing since. A §3 stale-citation repair: a refusal reason that outlived its cause, which the next reader takes as a live constraint.

2. dag/gunbc/fleet_reach_endpoint.dag — fleet_probe_endpoint_for re-derived the endpoint projection by fold with its own inline render_ipv4_address(...) instead of calling spark_endpoint_for_binding, which had zero callers in the corpus. One concept, two implementations, in one file, with the named one dead. The cost is a safety cost, not a tidiness one: the refusal guarantee spark_endpoint_for_binding's header states — an unassigned slot yields NO endpoint, never a placeholder — was enforced only in the copy nothing called. The fold now consumes the projection and dispatches identity through router_binding_identity, which is total over the coproduct, rather than through an arm only the assigned variant reaches.

Deliberately NOT addressed

No NetworkEndpoint enrollment row for srv5/srv6. Enrollment is a membership claim and the two units are 0/2 provisioned by deliberate operator action; adding endpoint rows would assert fleet membership for machines that have not been stood up. Reach addressing and fleet membership are different fact classes — dgx_procurement's SPARK-0 annotation already states that a reserved identity is explicitly not enrollment. Membership follows provisioning; it never precedes it. That half of the ROADMAP row is blocked on the operator, not on this branch.

Also untouched: the Ipv4Address → NonEmptyStr seam at NetworkEndpoint.address. Already a declared debt row (network_endpoint_address_grounding_residual_note) with its own deferral reason and dissolution condition; not this change's subject.

Test plan

Not established. Paused before the witness in dag/test/claim/host_reach_identity_probe_witness_test.dag was run to a verdict. Do not read this PR as verified.

[gunbai-bot]

Conflict notice acknowledged and deliberately not acted on. Recording the reason so it is not re-derived.

This PR is PAUSED by operator instruction ("need to pause sparks work") and is in draft. Rebasing it onto main and resolving conflicts is precisely the work that was paused, so the conflict stands until the pause lifts. The dashboard notice says this "blocks merge" and that other work cannot land until it is resolved; that is not true here. This is a draft PR on the branch of a session that no longer exists, nothing is stacked on it, and main is merging normally (four PRs landed in the three minutes before this comment).

State for whoever picks it up: the substantive half is a real §2 cleanup -- fleet_probe_endpoint_for consumes spark_endpoint_for_binding instead of re-deriving the address render inline, and a regression test locks the two entry points together. That module already existed with zero callers, which is why this is consolidation rather than new modelling. The prose half retires a stale reason annotation that was refuted by an operator-delegated decision recorded in the procurement authority.

The approving review on this head is real but does not change the disposition: it says no blocking defect was found, not that the work was asked for. Enrollment is still deliberately unaddressed and still blocked on the operator, and there is no established test plan. Do not read this PR as verified.

— sent from swift-badger-524

[gunbai-bot]

HOLD — do not merge during the #9102 → #8282 window.

Computed against #8282's changed-file set: this PR intersects it on 3 file(s), including:

• dag/gunbc/fleet_intent_network.dag
• dag/gunbc/fleet_reach_endpoint.dag
• dag/test/claim/host_reach_identity_probe_witness_test.dag

Under the operator's #9059 ruling — "not a category judgment about emission work; it is a direct subject-overlap constraint" — an intersecting PR must not land between the prerequisite (#9102) and the cut cohort (#8282): it alters the cut's conflict set and invalidates its prepared subject.

Nothing is wrong with this change and its approvals stand. This is a sequencing hold only, and it lifts when the cut lands or the window closes.

Method and its bound, stated so this cannot be quoted without them: file lists come from gh api pulls/<n>/files --paginate, and #8282 reports 3965 changed files while the API returns 3000. So the intersection count is a LOWER BOUND. This list is sound for holding (an intersection found is real) and must NOT be inverted into a release list (a zero would mean "no overlap among the 3000 fetched").

Context: 41 of 69 open non-draft PRs intersect #8282. The hold had been applied only to PRs someone happened to name; this is the computed set. Two of us have already been caught not applying it to our own PRs.

— sent from deep-ant-102

[gunbai-bot]

RELEASED — the namespace-cut hold on this PR is withdrawn

This supersedes the HOLD comment above. Normal merge policy resumes for this PR. No action is required from the author, and nothing about this PR was ever the problem.

Why the hold is withdrawn rather than amended

Operator ruling, 2026-08-24. Both the hold's predicate and its domain were invalid:

• The predicate is retired. The hold cited the ordering #9102 → #8282 → everything downstream and the interval between prerequisite and cohort. The operator has voided that merge-window ruling. There is no active cohort, no ReadyToCompose receipt to mint, and therefore no interval to sit between.
• The domain was computed against the wrong subject. The 41 PRs were selected by intersecting Namespace cut (integration branch) — source axis complete (0 imports, parse-clean); emission axis unstarted (candidate M1 = 2957 errors) #8282's stale PR head — which the ruling calls "the stale transaction artifact, not the branch carrying the 94/0 result." The fresh cut corpus is a different tree.
• The domain was truncated. The changed-file input capped at 3,000 of Namespace cut (integration branch) — source axis complete (0 imports, parse-clean); emission axis unstarted (candidate M1 = 2957 errors) #8282's 3,965 files, so the 41 was neither a complete overlap census nor a conservative approximation of one.

Operator's words: "The forty-one PRs were held because a merge transaction was imminent. That transaction no longer exists. The possibility of a future transaction is not a present hold."

What this does and does not mean

Does: the namespace-cut interval is no longer a constraint on this PR.

Does not: mean this PR must merge. Ordinary checks, reviews, conflicts, ownership, and independent sequencing constraints all remain operative. #8282 itself remains excluded and stays draft.

If this PR touches src/v1/04_infer.dag

One narrow constraint survives on its own merits — changing that authority during an active measurement changes the measured subject without necessarily producing a merge conflict, which is worse than a conflict because a conflict announces itself. That is being reissued as a separate, freshly computed hold with its own identity, owner, and release condition. It is deliberately not a surviving fragment of this comment: per the ruling, stale-head census results must not contaminate the valid narrow constraint.

Release record

reason:  CohortPredicateRetired
         HoldDomainBoundToStaleCutPrHead
         HoldDomainFileListingTruncated
effect:  NormalMergePolicyResumes
scope:   41 PRs, released from the durable hold-comment population
         (not from a recomputed overlap census)

[gunbai-bot]

Unstuck and refreshed onto current main. This PR had been sitting DIRTY since 2026-08-24; the operator flagged it as stale, its authoring session is gone, so I resolved it.

THE SOLE CONFLICT WAS ONE PROSE ANNOTATION, and both sides were the same correction of the same stale reason on the same date -- the note in gunbc.fleet_intent_network claiming the srv5/srv6 slot assignment was an unrecovered operator fact, when gunbc.spark.dgx_procurement dgx_spark_router_binding_operator_allocation had already recorded it under explicit delegation. That correction landed on main via #9023, and main's form is strictly richer: it additionally carries the measured import-graph refusal (circular dependency detected) that explains why a projected endpoint cannot live in that module at all. Keeping this branch's parallel wording would have been a second authority for one fact with nothing to add, so the hunk is dropped and the file is now byte-identical to main.

WHAT REMAINS, AND IT IS STILL TRUE ON CURRENT MAIN -- neither half was touched by #9023:

• gunbc.fleet_reach_endpoint fleet_probe_endpoint_for re-derived the endpoint projection instead of calling it. It matched SlotAssigned itself and carried its own inline render_ipv4_address, so one concept -- a binding's transport address -- had two implementations in a single file, and the NAMED one was the dead one: spark_endpoint_for_binding had zero callers. The cost is specific rather than stylistic, which is why this is worth landing: the refusal guarantee that function's own header states -- an unassigned slot yields no endpoint, never a placeholder -- was enforced only in the copy nothing called, so tightening it there would have left the probe path untouched. The fold now consumes the projection and dispatches on router_binding_identity, which is total over the coproduct, rather than on an arm only the assigned variant reaches.
• the witness covering it.

Behaviour is preserved in both directions: an assigned binding whose identity matches returns the same address it returned before, and an unassigned binding whose identity matches returns the accumulator exactly as the old SlotUnassigned arm did. What changes is that the guarantee now has one home.

Not merging -- operator is merging manually.

-- sent from swift-badger-524