Source converge: read historical patch sets byte-exactly (srv8 arm A tree, digest 0f979787)

[gunbai-bot]

Fixes the #12336 source-converge ownership-by-content defect that refused srv8's arm A tree (production build run 36326156975).

Why the history match missed

• Enumeration was fine. LogPathCommits over the two patch paths includes 034aef0, whose bytes are the set main 77193e6 carried (arm A, run 36207135528).
• --index was fine. The scratch worktree applies with git apply --index, the same as the real converge.
• The bytes were wrong. v41_known_patch_set_at read each historical blob with git.Core.Show. Its content comes from "stdout", and the shell channel's retained text is trim_end()ed (bounded_shell_host_drain retained_utf8_lossy_trimmed). In 034aef0, engram_storage_backed.patch ends in two blank context lines ((__name__)\n \n \n). After the trim and one re-appended \n, the hunk was two lines short, git apply refused it (corrupt patch at line 22, reproduced), and the set contributed no digest. So the tree's digest matched no set, and the converge refused it as not ours.

Wet re-derivation: a fresh vllm checkout at d2d649e674c7, with both 034aef0 blobs applied via git apply --index, gives git diff --binary HEAD sha256 = 0f979787aa2a52e0…, which is srv8's digest.

Fix

• New declared operation git.Core.RestoreBlobTo (git --work-tree=<dir> restore --source=<ref> --worktree -- <path>). It writes the blob byte-exactly and leaves the index untouched.
• The fold restores each member into a mktemp scratch work tree and reads it with Filesystem.Read, the same read the declared patch already takes. It removes the scratch dir afterwards. A scratch dir that can't be created derives no sets, which can only make the fold refuse more.

RED

red5_the_arm_a_set_srv8_carried_is_derived_byte_exactly_from_history derives the 034aef0 set from history. It asserts the hook member keeps its trailing blank context, and that both members' sha256 equal the git blob contents at that commit. The patch paths are supplied as values; DigestFile is not re-run.

• Control, run live with a locally built gunbc run --claim-run: FAIL with the pre-fix fold swapped in, PASS with the fix. All 19 claims in the module PASS live.
• Note: claim_batch is hermetic and reports a route gap, not a verdict, for this claim and for the two pre-existing effectful claims in the module (digestfile_inhabits…, empty_diff…).
• The claim needs history, which CI has (fetch-depth: 0).

Not changed, and worth knowing: every other git.Core.Show consumer gets trimmed content. Show is fine for text whose trailing whitespace carries no meaning. Byte-exact consumers should use RestoreBlobTo.

🤖 Generated with Claude Code