Repair the test -e absence probe in runner_host_file_converge (metadata failure read as absent)

[gunbai-bot]

The defect

gunbc.runner_host_file_converge observe_runner_host_file_content observed a desired host file with ["test", "-e", <path>] over fleet ssh, and classify_host_file_presence mapped exit_code == 1 to HostFileAbsent.

GNU test -e is stat(path) == 0. ENOENT, EACCES on an ancestor directory, ELOOP, ENOTDIR and EIO all answer exit 1 with an empty stderr, so "the file is not there" and "I could not look" arrived as one value — and they license opposite actions. HostFileAbsent is the arm that walks into write-admission and the comparison path for a file this module exists to keep root-owned and non-injectable.

The repair — inhabiting an existing model

• The probe is extdeps.tools.stat stat_file_type_command, built through the sealed argv_command mint rather than spelled at the call site. That operation's own annotation states this exact defect as the reason it exists, and gunbc.fabric.fabric_cell_acquire already consumes it in production.
• The read has two honest outcomes and absence is not one of them. classify_host_file_metadata yields HostFileMetadataRead { file_type } or HostFileMetadataUnread { cause }. An exit-zero read that printed nothing is unread, not a nameless file type — exit success is a fact about the call, never about whether the answer arrived.
• Absence is established by the parent, never by the probe's silence. classify_host_file_path joins the reading with gunbc.live_deploy.member_observe entry_presence — the landed authority for establishing absence from a parent listing over a transport, which also returns EntryPresenceIndeterminate when the parent itself cannot be listed. Consumed rather than restated, so no second absence vocabulary is minted beside the containment rule of absence_proof_whose_premise_the_success_destroys (gunbc#11823).
• Three distinct outcomes: HostFilePathPresent / HostFilePathAbsent / HostFilePathUnreadable. runner_host_file_settled_standing maps them to the standing grain: unreadable reaches HostFileUnobservable carrying the cause and can no longer reach HostFileAbsent; present settles nothing and continues into the existing byte comparison.
• The parent is enumerated only when the read failed (observe_runner_host_file_path), because that is the only outcome whose meaning the parent decides. entry_presence is a remote leg that recurses up the ancestor chain on a refusal, so asking it beside a read that already answered buys a standing the classifier discards.

classify_host_file_presence is deleted, not left standing beside its replacement.

The REDs

In test.claim.runner_host_file_converge_witness_test:

• an_unread_path_reaches_unobservable_and_never_absent — the control that is red for this reason. One unread cause, held constant, must reach HostFileUnobservable beside a parent that holds the entry and HostFileAbsent only beside a parent that lacks it. Collapsing them again — which is exactly what test -e did — reds on the first row. A control that merely separated exit 0 from exit 1 would pass every row here, which is why the cause is held constant across all three.
• a_metadata_read_that_failed_is_absent_only_when_the_parent_lacks_the_entry — the same discrimination at the path-standing grain, including the indeterminate parent.
• a_metadata_read_that_answered_is_present_whatever_the_parent_said — the parent cannot turn a read file unreadable.
• a_stat_that_exited_zero_and_printed_nothing_is_unread — exit success is not an answer.
• the_production_probe_sends_the_cited_stat_metadata_words — inhabitance (DESIGN §3): the words the observer sends, over the path a production desired file produces, equal argv_words(stat_file_type_command(...)) and contain no boolean test. The remote leg is not hermetically executable (gunbc.rung_drop runner_host_file_apply_route_hermetic), so this is the deepest live route to the new probe.

Test plan

CI run 35513652407 on head e8aef59a447: clippy, compiler, floor, witnesses all pass. The floor job shows the claims executed rather than skipped —

[floor-phase] phase=touched-entry-compile-subject seeds=2
  modules=["gunbc.runner_host_file_converge", "test.claim.runner_host_file_converge_witness_test"]
[changed-witness] an_unread_path_reaches_unobservable_and_never_absent   outcome=passed
[changed-witness] a_metadata_read_that_failed_is_absent_only_when_…      outcome=passed
[changed-witness] a_metadata_read_that_answered_is_present_whatever_…    outcome=passed
[changed-witness] a_stat_that_exited_zero_and_printed_nothing_is_unread  outcome=passed
[changed-witness] the_production_probe_sends_the_cited_stat_metadata_…   outcome=passed

CI is re-running at the current head, which carries review 69169's fix and a merge of main.

Out of scope, deliberately untouched

gunbc.typed_remote_file_write exit 1 (cmp reporting a genuine byte difference), extdeps.shell exec ExitZeroOrOneSucceeds (a declared policy), and the runner_host_path_ancestors ownership guard.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 69169 in 192921f.

The finding is correct and my in-diff justification was wrong. DESIGN §3c asks who consumes a declaration and by what executing route; computing the parent standing inside the HostFileMetadataUnread arm keeps HostFilePathAbsent and HostFilePathUnreadable inhabited by exactly the production route that can reach them, and classify_host_file_path stays total and pure, so the witnesses over it are unchanged. The unconditional call was buying a remote ls -1 -A — recursing up the ancestor chain on a refusal — whose result the common HostFileMetadataRead path discarded, which is §2 and §6's bare-minimum-cost rule regardless of the realized n.

observe_runner_host_file_path now carries the uses net leg and calls entry_presence only on the unread arm; the annotation that made the bad §3c argument is deleted rather than reworded.

Also in this push: a merge of main (7f9e624), and the PR body replaced — it was still the auto-opened TODO template because my gh pr create was a silent no-op against the dashboard's already-open draft.

The discriminating RED is being executed on a throwaway branch (#11868, draft, not for merge): it collapses the unreadable arm back into HostFileAbsent and an_unread_path_reaches_unobservable_and_never_absent must go red. Local execution was not available — claim_batch in this container refuses under MemoryStallRefusedPageThrash (and exits 0 while doing it), and srv1 is not reachable from this session.

— sent from bold-moth-41