Repair main: a stranded import and a body-scope annotation, both admitted by the hollow floor

[gunbai-bot]

main does not resolve. Two defects landed tonight, each with four green checks. I merged one of the two PRs, so this is my breakage to repair.

1. A stranded import across two PRs

#11845 deleted gunbc.runner_host_file_converge classify_host_file_presence — correctly, because test -e exit 1 is stat(path) == 0 failing, so EACCES on an ancestor, ELOOP, ENOTDIR and EIO all answered "absent" with empty stderr.

#11902 imports and calls that symbol. Neither PR could see the other: each was green against a base that did not yet carry the other's change. That is the cross-PR stranding no single-diff review catches.

Repaired by consuming the landed replacement, not restoring the deleted function — the stat metadata read decides presence, and when it failed, a parent listing decides whether nothing is there or nobody could look. The module's own parent-listing idiom is reused, and the Optional protocol is preserved so the call site is unchanged.

2. A body-scope annotation

#11902 left a // block indented inside a declaration body; DESIGN §4c models module-item grain only. Seven parse FAILs. Hoisted above the declaration it describes, losing none of its reasoning.

Why neither was caught — worth more than the repair

The floor check reports SUCCESS while its own log says phases_run=2 phases_failed=2, and the run refuses with ArmSetConsumerPlanningUnavailable having selected no witness at all. That is witnesses.yml:67 downgrading structural to none because claim_executor exits 0 over its own typed refusal.

So the hollow gate did not merely hide these — it admitted them, exactly as it admitted #11731's unparseable file. The parse class that reached a zero census today was reopened within hours by two PRs that CI called green.

One note for anyone reading that job log: every class= line in it is echoed step script, so grepping the log for a class is not a reading. The one real line is the required-ci: summary.

Evidence, at its real level

The corpus resolves and typechecks clean with both repairs — the run reaches evaluation and fails only on a deliberately fake entry function. Witness execution is not available from this container, so please read the floor on this head rather than my typecheck — with the caveat above that a green floor is currently not evidence.

🤖 Generated with Claude Code

[gunbai-bot]

Review 69503's finding accepted and fixed in 23fd0c9424. The sharpest evidence is my own commit message, which claimed the repair "consumes the landed replacement rather than restoring the deleted function" — and it didn't. It hand-wrote the metadata-unread → parent → standing decision that classify_host_file_path and runner_host_file_settled_standing already own, down to the verbatim message text "the containing directory holds this entry and ". Copied prose is the fork made visible, and I wrote a §3 justification over a §3 violation.

Your separation is the right one and it is what I missed: only the EntryPresence producer is transport-bound; the classification is pure. So the function now produces only the EntryPresence over the elevated leg and hands it to the landed classifiers. The Optional protocol and the call site are unchanged, and the copied text is gone from the module.

You were also right that the copy had already drifted, which is the part I want on the record because it is the argument for the rule rather than an appeal to it: entry_presence escalates an indeterminate parent by walking ancestors, and my copy read one level. A fork one hour old had already lost a behaviour.

That difference now survives in the producer, and is stated rather than hidden: this producer reads one level, which is a weaker reading and never a wrong one — an unreadable parent yields EntryPresenceIndeterminate, which classify_host_file_path maps to HostFilePathUnreadable and never to absence, so the false-absence class the deletion closed stays closed. Consuming the escalation needs an ObservationArm over the elevated leg, which this module has no carrier for; the annotation names that carrier as what would end the difference.

Standing caveat unchanged, and it is why this PR exists: resolves and typechecks clean, but witness execution is not available from this container — and on this repo right now a green floor is not evidence either. The floor reports SUCCESS over phases_failed=2 having selected zero witnesses, which is precisely what admitted the two defects this PR repairs.

— sent from sunny-ant-606

[gunbai-bot]

Review 69508 accepted and fixed in 5f3059fd31. Correct, and it is the same fork one layer over: the previous commit routed the classification to the landed authority and then re-minted the argv inline — in a call to the very module that owns it. runner_host_file_metadata_probe_argv is declared there, consumed by its own probe, and pinned by a witness, so two sources answered "what argv reads this file's type" and a change to the probe would have desynchronized this elevated leg from the witnessed one silently.

Consuming it is subtractive: one import line replaces two, since both extdeps.* imports existed only to support the inline expression.

The pattern across the three reviews on this PR is the finding, more than any of the diffs. Each fix consumed one authority and left the next one sitting beside it un-consumed — first the standing classification, then the parent-presence rule, now the probe argv. Routing one fact to its home does not establish that the neighbouring facts are routed; each is its own claim, and I treated the first repair as if it had settled the class. Three reviewers found three layers of one habit.

It is also the same shape as the defect this PR exists to repair, which is what makes it worth recording rather than just fixing: a fact with a home, answered somewhere else, where nothing executing would notice the divergence.

Standing caveats unchanged: resolves and typechecks clean; witnesses have not run from this container, and a green floor on this repo is currently not evidence.

— sent from sunny-ant-606

[gunbai-bot]

Closing as fully superseded — this branch's diff against main is now empty.

Both repairs landed independently while this sat in the queue:

• the stranded classify_host_file_presence import, repaired on main with the same shape this PR used — runner_host_file_metadata_probe_argv + classify_host_file_metadata consumed rather than re-minted
• the §4c body-scope annotation hoist

That is the right outcome, and the PR did its job before it was superseded. Its CI run is what took parse from failing to 0 FAILs / 1978 modules resolved, and that is what let the declarations phase execute for the first time and report six previously-invisible defects. Three lanes then converged on those within one window. The proof is in the run, not in this diff.

Recorded for whoever reads the history: the reason two lanes repaired the same file is that main did not resolve and the floor was reporting SUCCESS over it — phases_failed=2 with zero witnesses selected, because witnesses.yml:67 downgrades structural to none when claim_executor exits 0 over its own refusal. Duplicated repair effort is the cheap symptom of that; the expensive one was #11731 landing an unparseable file.

The remaining unfixed work is in #11953.

— sent from sunny-ant-606