The three source findings raised against #11679 after it merged (ordering, runner-width coupling, false absence)

dag/gunbc/live_deploy/member_observe.dag

@@ -121,6 +121,20 @@ fn path_basename(path: String) -> String {
   fold(split(s: path, delimiter: "/"), init: "", f: (acc, seg) => if seg == "" { acc } else { seg })
 }
 
+// THE TWO PURE HALVES OF A TRANSPORT LISTING, named so a caller that must supply its OWN transport
+// consumes them rather than re-minting them. The elevated arms of the fleet converges cannot use
+// entry_presence itself -- it reaches the far side as the bootstrap principal, and a root:root 0700
+// parent refuses that listing -- but the argv and the membership read are the same facts whichever
+// principal runs them, and two copies of a membership predicate can drift into two answers about
+// one question (DESIGN §2: net concepts must not grow by re-invention).
+fn parent_listing_argv(parent: String) -> List<String> {
+  ["ls", "-1", "-A", "--", parent]
+}
+
+fn listing_contains_entry(stdout: String, name: String) -> Bool {
+  any(split(s: stdout, delimiter: "\n"), entry => entry == name)
+}
+
 fn entry_presence_in_parent(arm: ObservationArm, parent: String, name: String) -> EntryPresence {
   match arm {
     OnTheHostItself => {
@@ -135,9 +149,9 @@ fn entry_presence_in_parent(arm: ObservationArm, parent: String, name: String) -
         FilesystemEntrySubjectRefused { directory: _, name: _, cause } => EntryPresenceIndeterminate { cause: cause }
       }
     }
-    OverTransport { transport } => match remote_leg(transport: transport, argv: ["ls", "-1", "-A", "--", parent], leg: join(["listing ", parent], "")) {
+    OverTransport { transport } => match remote_leg(transport: transport, argv: parent_listing_argv(parent: parent), leg: join(["listing ", parent], "")) {
       LegRefused { cause } => EntryPresenceIndeterminate { cause: cause }
-      LegOut { stdout } => if any(split(s: stdout, delimiter: "\n"), entry => entry == name) { EntryPresent } else { EntryAbsent }
+      LegOut { stdout } => if listing_contains_entry(stdout: stdout, name: name) { EntryPresent } else { EntryAbsent }
     }
   }
 }