fabric DB: a modeled read-only partition readout

[gunbai-bot]

Follow-up to #11723. Carries the read-only partition readout, so the fabric DB's live receipt stops being a hand-built curl.

Why

The cutover PR left the live group A read with no modeled entry. The only instrument that reaches a partition is fabric_event_log_probe, and it writes: it appends events and takes a seat in its own pool, so it may never be pointed at a live partition. That left a hand-built request as the only way to ask what a live seat pool holds — and a typed request is not an instrument, because nothing re-derives it and the reply it renders is whatever the person typed (DESIGN §6, name the instrument).

What it adds

gunbc.instruments.fabric_partition_read, two entries over one fold:

• fabric_partition_read_served — any tailnet host, against the placed store's endpoint. This is what the live group A receipt runs.
• fabric_partition_read_local — on the placed host, straight against the store's files.

Both read the production fold (event_log_read_partition), the same function the harness's seat transaction reads through, so a refusal here is the refusal a seat acquisition would meet, in the same typed vocabulary. Neither writes anything.

Deliberately not included: any pool or seat standing. Whether a pool has room is a fold over these events against a ceiling, and answering it here would be a second spelling of fabric_seat_observe. This answers only what the log holds: the head, and the chain from it, oldest first.

Refusals, not prefixes. An incomplete chain or an exhausted budget refuses. A readout that truncated would be a fabricated answer about a live seat pool — a reader would count fewer acquisitions than the partition holds.

Evidence

Three new live witnesses (test.claim.fabric.fabric_partition_read_wet_witness), all passing against a real store in a temp directory, enrolled as the usual triple (wet schedule, route-gap chunk 17, exclusion frontier):

• an empty partition reports head absent / events 0 — the correct answer for a live partition right after the cutover, since partitions start empty
• two appended events come back oldest first, each under the id its append was answered with
• a chain longer than the budget refuses rather than reporting the part that fit

Roster consistency re-checked: local_repo_wet_terminal_test (11) and witness_exclusion_reconciliation_test (14) pass.

Not in this PR: the writer-principal roster

The rung drop gunbc.rung_drop.fabric_db_append_principal_unrefused still stands, deliberately.

The reading that was owed came back: srv1 and srv2 are both tagged nodes (tag:ci, tag:dashboard), not user-owned. So a roster keyed on Tailscale-User-Login would refuse the fleet hosts themselves — the guess I declined to make when filing the drop, now falsified by observation rather than by argument. The roster must key on node identity, and what tailscale serve actually forwards for a tagged caller has not been read yet: the endpoint is not deployed, so no live journal exists to read it from.

Modeling the arm now would mean inventing a header name and writing a check no execution has seen — the same guess in a new place. It lands once the deploy produces that journal, with an unidentified caller refusing rather than defaulting to admitted.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 68812 in 67616dc — both findings verified and fixed.

• Quadratic readout. readout_lines was a fold over a copied string accumulator, re-copying the whole text per event, bounded at partition_read_budget() = 4096 events — quadratic in bytes on a live partition. Now join(map(...), ""), the linear idiom the corpus already carries. Fixed on the cost shape, not on the realized n (DESIGN §6). The three wet witnesses still pass, including the two-event readout assertion that reads the rendered text.
• Citation. The local_repo_wet_terminal note enumerated two of the three member modules; it now names test.claim.fabric.fabric_partition_read_wet_witness as well, matching the sibling note in floor_route_gap.