From 3ecbf8e85f193ec03cc8a9c017679759399fc8fb Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 09:51:07 +0000
Subject: [PATCH 1/7] read-outcome adoption, gunbc/auth batch: a refused read
 is a typed outcome, never a defaulted none

filesystem sibling of DP-M5; converts all 8 unconverted Filesystem.Read
consumption sites in dag/gunbc/auth to the modeled fold
filesystem_read_outcome (extdeps.filesystem.filesystem_io), per the row
filesystem_read_outcome_adoption_standing:

- ci_app_key_rotation: THE RED -- an unreadable observation record
  collapsed into the absent arm (silent none, same as env-unset). Now
  observe_app_key_mint_record returns AppKeyMintRecordRead? via
  app_key_mint_record_from_read; a refused read is a new typed refusal
  AppKeyMintObservationUnreadable, distinct from Absent (which now
  means only 'env unset'). Red witness + positive controls appended to
  dag/test/claim/ci_app_key_rotation_witness_test.dag.
- credentials, approval_gate, approval_keyring_converge,
  access_token_source, profile_projection (new on main): manual
  if/else and match-on-success routed through the fold; refusal texts
  preserved verbatim; classify_supplied_token now takes
  FilesystemReadOutcome.

Instrument (named re-runnable, per the row's RE-DERIVATION):
tools/read_outcome_recount.sh, identity grain; calibrated -- at
b21b710d5378387ae0c841f07323292c5d72faba it reproduces the row's
recorded baseline exactly (92 sites / 48 files, 0 converted), and at
DP-M5's head 6471587dbaa it agrees with the final-semantics recount
(207 raw unconverted / 43 dag/test/claim fixtures / 98 files).
Sites whose projections all feed filesystem_exact_read are reported as
their own class (exact_read_typed): already typed outcomes, not this
debt.

After this batch: 219 unconverted (44 dag/test/claim fixtures, 175
non-fixture) across 100 files; was 227/183/106 at fresh main
0456f1cfb2b.
---
 dag/extdeps/filesystem/filesystem_io.dag      |   2 +-
 dag/gunbc/auth/access_token_source.dag        |  34 ++--
 dag/gunbc/auth/approval_gate.dag              |  19 +-
 dag/gunbc/auth/approval_keyring_converge.dag  |  34 +++-
 dag/gunbc/auth/ci_app_key_rotation.dag        |  42 ++++-
 dag/gunbc/auth/credentials.dag                |  18 +-
 dag/gunbc/auth/profile_projection.dag         |  26 +--
 .../ci_app_key_rotation_witness_test.dag      |  55 ++++++
 tools/read_outcome_recount.sh                 | 178 ++++++++++++++++++
 9 files changed, 352 insertions(+), 56 deletions(-)
 create mode 100755 tools/read_outcome_recount.sh

diff --git a/dag/extdeps/filesystem/filesystem_io.dag b/dag/extdeps/filesystem/filesystem_io.dag
index eeee7e62d67..13e3ca113f6 100644
--- a/dag/extdeps/filesystem/filesystem_io.dag
+++ b/dag/extdeps/filesystem/filesystem_io.dag
@@ -157,7 +157,7 @@ fn filesystem_create_new(
   }
 }
 
-data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
+data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. The named re-runnable instrument is tools/read_outcome_recount.sh (<script> <tree-root>); at b21b710d5378387ae0c841f07323292c5d72faba it reproduces this row's recorded baseline exactly (92 unconverted sites across 48 files, zero converted). Sites whose projections all feed filesystem_exact_read are a separately reported class in that instrument's output: they are already typed outcomes (the sibling modeled fold) and are not this row's debt -- converting them to filesystem_read_outcome would be a downgrade. Claim fixtures are the dag/test/claim/ prefix. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
 
 // ABSENCE IS ESTABLISHED BY A SUCCESSFUL LISTING, NEVER BY A FAILED READ. `Read` answers
 // success=false both for a path that does not exist and for one that exists and cannot be read, and
diff --git a/dag/gunbc/auth/access_token_source.dag b/dag/gunbc/auth/access_token_source.dag
index b702b451c42..ea5ceca1e35 100644
--- a/dag/gunbc/auth/access_token_source.dag
+++ b/dag/gunbc/auth/access_token_source.dag
@@ -14,7 +14,13 @@ import std.upsert_decision {
   UpsertClassification,
 }
 import extdeps.shell
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  FilesystemReadSucceeded,
+  filesystem_read_outcome,
+}
 import extdeps.cloud.gcp.auth_print_access_token {
   gcloud_stderr_auth_deficit,
 }
@@ -202,19 +208,21 @@ type SuppliedTokenResolution
   = SuppliedTokenReady { token: Secret }
   | SuppliedTokenUnavailable { cause: NonEmptyStr }
 
-fn classify_supplied_token(success: Bool, error: String, content: String) -> SuppliedTokenResolution {
-  if success == false {
-    SuppliedTokenUnavailable {
-      cause: join(["the access token file could not be read: ", error], "") as NonEmptyStr,
-    }
-  } else {
-    let token = trim(s: content)
-    if token == "" {
+fn classify_supplied_token(read: FilesystemReadOutcome) -> SuppliedTokenResolution {
+  match read {
+    FilesystemReadRefused { error } =>
       SuppliedTokenUnavailable {
-        cause: "the access token file is empty, which is never a usable bearer token" as NonEmptyStr,
+        cause: join(["the access token file could not be read: ", error], "") as NonEmptyStr,
+      }
+    FilesystemReadSucceeded { content } => {
+      let token = trim(s: content)
+      if token == "" {
+        SuppliedTokenUnavailable {
+          cause: "the access token file is empty, which is never a usable bearer token" as NonEmptyStr,
+        }
+      } else {
+        SuppliedTokenReady { token: token as Secret }
       }
-    } else {
-      SuppliedTokenReady { token: token as Secret }
     }
   }
 }
@@ -238,7 +246,7 @@ fn read_supplied_access_token() -> SuppliedTokenResolution {
         }
       } else {
         let read = Filesystem.Read(path: path)
-        classify_supplied_token(success: read.success, error: read.error, content: read.content)
+        classify_supplied_token(read: filesystem_read_outcome(content: read.content, success: read.success, error: read.error))
       }
     }
   }
diff --git a/dag/gunbc/auth/approval_gate.dag b/dag/gunbc/auth/approval_gate.dag
index ffa4126b0ec..a73957f1d52 100644
--- a/dag/gunbc/auth/approval_gate.dag
+++ b/dag/gunbc/auth/approval_gate.dag
@@ -8,7 +8,13 @@ import std.scoped_authorization {
   AuthorizationRequest, ScopedAuthorization, authorize, AuthorizationPermitted, AuthorizationRefused, authorization_refusal_reason,
 }
 import extdeps.clock { Clock }
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  FilesystemReadSucceeded,
+  filesystem_read_outcome,
+}
 import extdeps.http.client
 import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
 import extdeps.github.actions_environment { github_runner_temp_variable_name }
@@ -252,10 +258,11 @@ fn approval_file_stored_request(stored: StoredApprovalRequest, body_file_name: S
     ApprovalFilingRefused { reason: join([approval_submission_mac_key_path_env as String, " is unset; the request cannot be filed"], "") }
   } else {
     let key_read = Filesystem.Read(path: sub_path)
-    if !key_read.success {
-      ApprovalFilingRefused { reason: join(["submission MAC key unreadable: ", key_read.error], "") }
-    } else {
-      match sign_stored_request(key_material: trim(s: key_read.content), request: stored) {
+    match filesystem_read_outcome(content: key_read.content, success: key_read.success, error: key_read.error) {
+      FilesystemReadRefused { error } =>
+        ApprovalFilingRefused { reason: join(["submission MAC key unreadable: ", error], "") }
+      FilesystemReadSucceeded { content } =>
+      match sign_stored_request(key_material: trim(s: content), request: stored) {
         SubmissionMacKeyNotHex { key_id: k } => ApprovalFilingRefused { reason: join(["submission MAC key is not hex: ", k as String], "") }
         SubmissionMacReady { tag_hex: tag } => {
           let tmp = actions_variable_trimmed(name: github_runner_temp_variable_name as NonEmptyStr)
@@ -274,6 +281,6 @@ fn approval_file_stored_request(stored: StoredApprovalRequest, body_file_name: S
           }
         }
       }
+      }
     }
   }
-}
diff --git a/dag/gunbc/auth/approval_keyring_converge.dag b/dag/gunbc/auth/approval_keyring_converge.dag
index c951fdd6322..19839aa5c7e 100644
--- a/dag/gunbc/auth/approval_keyring_converge.dag
+++ b/dag/gunbc/auth/approval_keyring_converge.dag
@@ -244,13 +244,30 @@ fn approval_keyring_converge_on_host() -> ProcessExit
     let cap = Filesystem.Read(path: cap_path)
     let sub = Filesystem.Read(path: sub_path)
     let rcpt = Filesystem.Read(path: rcpt_path)
-    if !rcpt.success {
-      exit_failure(reason: concat("approval keyring: staged store receipt MAC key unreadable: ", rcpt.error))
-    } else if !cap.success {
-      exit_failure(reason: concat("approval keyring: staged capability MAC key unreadable: ", cap.error))
-    } else if !sub.success {
-      exit_failure(reason: concat("approval keyring: staged submission MAC key unreadable: ", sub.error))
-    } else {
+    match filesystem_read_outcome(content: rcpt.content, success: rcpt.success, error: rcpt.error) {
+      FilesystemReadRefused { error } =>
+        exit_failure(reason: concat("approval keyring: staged store receipt MAC key unreadable: ", error))
+      FilesystemReadSucceeded { content: rcpt_content } =>
+      match filesystem_read_outcome(content: cap.content, success: cap.success, error: cap.error) {
+        FilesystemReadRefused { error } =>
+          exit_failure(reason: concat("approval keyring: staged capability MAC key unreadable: ", error))
+        FilesystemReadSucceeded { content: cap_content } =>
+        match filesystem_read_outcome(content: sub.content, success: sub.success, error: sub.error) {
+          FilesystemReadRefused { error } =>
+            exit_failure(reason: concat("approval keyring: staged submission MAC key unreadable: ", error))
+          FilesystemReadSucceeded { content: sub_content } =>
+            approval_keyring_converge_with_staged_keys(
+              cap_path: cap_path, sub_path: sub_path, rcpt_path: rcpt_path,
+              cap_content: cap_content, sub_content: sub_content, rcpt_content: rcpt_content,
+            )
+        }
+      }
+    }
+}
+}
+
+fn approval_keyring_converge_with_staged_keys(cap_path: String, sub_path: String, rcpt_path: String, cap_content: String, sub_content: String, rcpt_content: String) -> ProcessExit
+{
       match approval_keyring_staged_digest_ok(path: cap_path as NonEmptyStr, expected_prefix: approval_mac_key_payload_sha256_prefix, role: "capability") {
         ExitSuccess =>
           match approval_keyring_staged_digest_ok(path: sub_path as NonEmptyStr, expected_prefix: approval_submission_mac_key_payload_sha256_prefix, role: "submission") {
@@ -298,9 +315,6 @@ fn approval_keyring_converge_on_host() -> ProcessExit
         other => other
       }
     }
-  }
-}
-
 fn approval_keyring_converge_wet() -> ProcessExit
 {
   match actions_variable_read(name: fleet_converge_expected_host_env_name) {
diff --git a/dag/gunbc/auth/ci_app_key_rotation.dag b/dag/gunbc/auth/ci_app_key_rotation.dag
index 1e863064425..7bd5e200258 100644
--- a/dag/gunbc/auth/ci_app_key_rotation.dag
+++ b/dag/gunbc/auth/ci_app_key_rotation.dag
@@ -3,7 +3,13 @@ module gunbc.auth.ci_app_key_rotation
 import std.types { String, NonEmptyStr, Bool, Int, List }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import extdeps.shell
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  FilesystemReadSucceeded,
+  filesystem_read_outcome,
+}
 import gunbc.auth.github_gcp_federation { fleet_secrets_project_number }
 import extdeps.cloud.gcp.secret_ref {
   SecretRef, secret_ref_version_resource,
@@ -145,6 +151,7 @@ type AppKeyVersionRefusal
   | AppKeyVersionSelectorIsAlias
   | AppKeyVersionSelectorNotANumber { supplied: String }
   | AppKeyMintObservationAbsent { cause: NonEmptyStr }
+  | AppKeyMintObservationUnreadable { cause: NonEmptyStr }
   | AppKeyVersionUnreadable { http_status: String }
   | AppKeyResolvedVersionUndecodable { cause: SmResolvedVersionIdentityRefusal }
   | AppKeyResolvedVersionDiffers { requested: String, resolved: String }
@@ -306,6 +313,8 @@ fn app_key_refusal_text(cause: AppKeyVersionRefusal) -> String {
       join(["AppKeyVersionSelectorNotANumber: '", s, "' is not a Secret Manager version number"], "")
     AppKeyMintObservationAbsent { cause: c } =>
       concat("AppKeyMintObservationAbsent: ", c as String)
+    AppKeyMintObservationUnreadable { cause: c } =>
+      concat("AppKeyMintObservationUnreadable: ", concat(c as String, ": the mint step's observation record exists but could not be read, which is a different failure from there being no record; inspect the record path and its permissions"))
     AppKeyVersionUnreadable { http_status: s } =>
       join([
         "AppKeyVersionUnreadable: Secret Manager answered HTTP ", s,
@@ -381,16 +390,30 @@ fn env_or_empty(name: NonEmptyStr) -> String {
   }
 }
 
-fn observe_app_key_mint_record() -> AppKeyMintObservation? {
+// The record read is a typed outcome, never a silently defaulted value (DESIGN §5): a refused read
+// of the observation record is a different fact from there being no record, so it carries its own
+// arm instead of collapsing into the absent one the old Optional shape forced.
+type AppKeyMintRecordRead
+  = AppKeyMintRecordDecoded { observation: AppKeyMintObservation }
+  | AppKeyMintRecordUnread { cause: NonEmptyStr }
+
+fn app_key_mint_record_from_read(read: FilesystemReadOutcome) -> AppKeyMintRecordRead {
+  match read {
+    FilesystemReadSucceeded { content: content } =>
+      AppKeyMintRecordDecoded { observation: decode_app_key_mint_record(record: content) }
+    FilesystemReadRefused { error: error } =>
+      AppKeyMintRecordUnread { cause: error as NonEmptyStr }
+  }
+}
+
+fn observe_app_key_mint_record() -> AppKeyMintRecordRead? {
   let path = env_or_empty(name: app_key_verify_record_env_name)
   if path == "" {
     none
   } else {
     let read = Filesystem.Read(path: path)
-    if !read.success {
-      none
-    } else {
-      Present { value: decode_app_key_mint_record(record: read.content) }
+    Present {
+      value: app_key_mint_record_from_read(read: filesystem_read_outcome(content: read.content, success: read.success, error: read.error)),
     }
   }
 }
@@ -405,9 +428,12 @@ fn ci_app_key_version_verify_wet() -> ProcessExit {
       match observe_app_key_mint_record() {
         Absent =>
           AppKeyVersionRefused {
-            cause: AppKeyMintObservationAbsent { cause: "the mint step's observation record is absent or unreadable" as NonEmptyStr },
+            cause: AppKeyMintObservationAbsent { cause: concat("the mint step recorded no observation record for this run: ", concat(app_key_verify_record_env_name as String, " is unset")) as NonEmptyStr },
           }
-        Present { value: obs } => verify_app_key_version(secret: ci_app_key_contract.subject, version: n, observation: obs)
+        Present { value: AppKeyMintRecordUnread { cause: c } } =>
+          AppKeyVersionRefused { cause: AppKeyMintObservationUnreadable { cause: c } }
+        Present { value: AppKeyMintRecordDecoded { observation: obs } } =>
+          verify_app_key_version(secret: ci_app_key_contract.subject, version: n, observation: obs)
       }
   }
   let wrote = Filesystem.Write(
diff --git a/dag/gunbc/auth/credentials.dag b/dag/gunbc/auth/credentials.dag
index 21fe94fa600..11543df8ac3 100644
--- a/dag/gunbc/auth/credentials.dag
+++ b/dag/gunbc/auth/credentials.dag
@@ -2,7 +2,13 @@ module gunbc.auth.credentials
 
 import extdeps.shell
 import extdeps.cloud.gcp.gcp { GcpOAuth2AccessTokenStrategy }
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  FilesystemReadSucceeded,
+  filesystem_read_outcome,
+}
 import extdeps.cloud.gcp.adc_document {
   decode_adc_document,
   AdcDocumentDecoded,
@@ -74,16 +80,16 @@ pattern gcp_oauth_access_token_via_adc_refresh(
   uses net: std.resources.Network
 {
   node read = Filesystem.Read(path: adc_path as String)
-  return match read.success {
-    true =>
-      match decode_adc_document(document: read.content as Secret) {
+  return match filesystem_read_outcome(content: read.content, success: read.success, error: read.error) {
+    FilesystemReadSucceeded { content: content } =>
+      match decode_adc_document(document: content as Secret) {
         AdcDocumentDecoded { credentials: credentials } =>
           gcp_adc_token_from_credentials(credentials: credentials)
         AdcDocumentDecodeRefused { cause: cause } =>
           GcpAdcDocumentRefused { path: adc_path as String, cause: cause }
       }
-    false =>
-      GcpAdcReadRefused { path: adc_path as String, cause: read.error }
+    FilesystemReadRefused { error: error } =>
+      GcpAdcReadRefused { path: adc_path as String, cause: error }
   }
 }
 
diff --git a/dag/gunbc/auth/profile_projection.dag b/dag/gunbc/auth/profile_projection.dag
index b88d1b6d979..91d2790ae5b 100644
--- a/dag/gunbc/auth/profile_projection.dag
+++ b/dag/gunbc/auth/profile_projection.dag
@@ -10,6 +10,7 @@ import extdeps.filesystem.filesystem_io {
   filesystem_file_observation,
   FilesystemFileAbsent, FilesystemFileRead, FilesystemFileIndeterminate,
   FilesystemFileObservationsDisagree, FilesystemFileSubjectRefused,
+  FilesystemReadOutcome, FilesystemReadRefused, FilesystemReadSucceeded,
 }
 import extdeps.languages.json.emit {
   serialize_json, json_object, json_kv, json_string, JsonValue,
@@ -374,19 +375,20 @@ fn profile_store_decode_entries(
         { profiles: acc, skipped: skipped_acc }
       } else {
         let read_result = Filesystem.Read(path: join([layout.root as String, "/", entry], ""))
-        if !read_result.success {
-          { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["read failed: ", read_result.error], "") }]) }
-        } else {
-          match principal_profile_of_json(text: read_result.content) {
-            ProfileFileMalformed { detail } => {
-              let skipped_file = { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["malformed: ", detail], "") }]) }
-              skipped_file
-            }
-            ProfileFileDecoded { profile: p } => {
-              let decoded_file = { profiles: concat(acc, [p]), skipped: skipped_acc }
-              decoded_file
+        match filesystem_read_outcome(content: read_result.content, success: read_result.success, error: read_result.error) {
+          FilesystemReadRefused { error } =>
+            { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["read failed: ", error], "") }]) }
+          FilesystemReadSucceeded { content } =>
+            match principal_profile_of_json(text: content) {
+              ProfileFileMalformed { detail } => {
+                let skipped_file = { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["malformed: ", detail], "") }]) }
+                skipped_file
+              }
+              ProfileFileDecoded { profile: p } => {
+                let decoded_file = { profiles: concat(acc, [p]), skipped: skipped_acc }
+                decoded_file
+              }
             }
-          }
         }
       }
       profile_store_decode_entries(layout: layout, entries: entries.skip(n: 1), acc: stepped.profiles, skipped_acc: stepped.skipped)
diff --git a/dag/test/claim/ci_app_key_rotation_witness_test.dag b/dag/test/claim/ci_app_key_rotation_witness_test.dag
index 77d25ba9df6..dd47a05ccd6 100644
--- a/dag/test/claim/ci_app_key_rotation_witness_test.dag
+++ b/dag/test/claim/ci_app_key_rotation_witness_test.dag
@@ -78,6 +78,16 @@ import gunbc.auth.ci_app_key_rotation {
   decode_app_key_mint_record,
   verify_app_key_version,
   app_key_verdict_evidence,
+  app_key_mint_record_from_read,
+  AppKeyMintRecordDecoded,
+  AppKeyMintRecordUnread,
+  AppKeyMintObservationUnreadable,
+  app_key_refusal_text,
+}
+import extdeps.filesystem.filesystem_io {
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  filesystem_read_outcome,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -452,3 +462,48 @@ test fn the_contract_is_bound_to_the_app_key_and_its_restore_test_is_the_roster(
       Absent => false
     }
 }
+
+// ---------------------------------------------------------------------------
+// The record read is a typed outcome (filesystem_read_outcome_adoption, gunbc/auth batch)
+// ---------------------------------------------------------------------------
+
+// A witness's incidental helper, not a shared authority: three test files already declare their own
+// `string_contains`, so a fourth would make the bare name ambiguous corpus-wide.
+fn contains_text(haystack: String, needle: String) -> Bool {
+  haystack.contains(needle)
+}
+
+// RED for the silent-none conversion: before the read-outcome fold, an unreadable observation
+// record collapsed into the absent arm -- `!read.success` returned `none`, and the operator was
+// told the record was "absent or unreadable", the two facts one text. This witness goes red on a
+// tree without the conversion (the classifier it names does not exist there) and, once it exists,
+// pins that a refused read refuses as unreadable and carries the host's cause verbatim.
+test fn an_unreadable_mint_record_is_refused_as_unreadable_never_collapsed_into_absent() -> Bool {
+  match app_key_mint_record_from_read(read: FilesystemReadRefused { error: "permission denied" }) {
+    AppKeyMintRecordUnread { cause: c } => (c as String) == "permission denied"
+    AppKeyMintRecordDecoded { observation: _ } => false
+  }
+}
+
+// Positive control over the same classifier: the success arm still decodes through the fold, so the
+// red above cannot be satisfied by refusing everything.
+test fn a_readable_mint_record_still_decodes_through_the_read_fold() -> Bool {
+  match app_key_mint_record_from_read(read: filesystem_read_outcome(content: minted_record(), success: true, error: "unused on success")) {
+    AppKeyMintRecordDecoded { observation: obs } =>
+      match obs.key_http_status {
+        Present { value: status } => (status as String) == "200"
+        Absent => false
+      }
+    AppKeyMintRecordUnread { cause: _ } => false
+  }
+}
+
+// The two facts the old shape merged now render as two texts naming two different operator actions:
+// absent says the run recorded nothing; unreadable says the record exists and could not be read.
+test fn the_unreadable_record_refusal_names_the_read_and_names_a_different_action_than_absent() -> Bool {
+  let unreadable = app_key_refusal_text(cause: AppKeyMintObservationUnreadable { cause: "permission denied" as NonEmptyStr })
+  let absent = app_key_refusal_text(cause: AppKeyMintObservationAbsent { cause: "APP_KEY_VERIFY_RECORD is unset" as NonEmptyStr })
+  contains_text(haystack: unreadable, needle: "could not be read")
+    && contains_text(haystack: absent, needle: "AppKeyMintObservationAbsent:")
+    && (unreadable as String) != (absent as String)
+}
diff --git a/tools/read_outcome_recount.sh b/tools/read_outcome_recount.sh
new file mode 100755
index 00000000000..c0bed801735
--- /dev/null
+++ b/tools/read_outcome_recount.sh
@@ -0,0 +1,178 @@
+#!/bin/sh
+# read_outcome_recount.sh -- the filesystem_read_outcome_adoption_standing instrument.
+#
+# Named by the row's RE-DERIVATION recipe in dag/extdeps/filesystem/filesystem_io.dag and
+# re-runnable, so the count is never transcribed session output (DESIGN §6).
+#
+# What it implements, per that recipe:
+#   * enumerate Filesystem.Read assignment calls in tracked .dag source (any `name =` binding
+#     form: let/node/plain); comment and string-literal text is masked before matching, so
+#     prose never counts;
+#   * exclude the adoption-standing data declaration itself, so the instrument cannot count
+#     its own prose;
+#   * classify each binding at identity grain (path:line:binding): converted only when every
+#     success, error, and content projection of the bound result is an argument of the modeled
+#     fold filesystem_read_outcome (balanced-paren spans); otherwise unconverted;
+#   * sites whose projections all feed filesystem_exact_read (the sibling modeled fold) are
+#     reported as their own class, exact_read_typed: they are already typed outcomes and are
+#     not this row debt (converting them to read_outcome would be a downgrade);
+#   * claim fixtures are the dag/test/claim/ prefix;
+#   * count unconverted rows and distinct paths.
+#
+# Calibration (recorded in the PR that checked this tool in):
+#   * b21b710d5378387ae0c841f07323292c5d72faba (the baseline the row's count was recorded on):
+#     92 sites / 48 files, 0 converted -- exact agreement with the row's recorded baseline.
+#   * 6471587dbaa (DP-M5's head): 246 bindings / 31 converted / 8 exact_read_typed / 207 raw
+#     unconverted / 98 files with raw-unconverted / 43 claim fixtures. DP-M5's session
+#     reported 242/28/205/103/39 from a one-off script that no longer exists and that itself
+#     disagreed with the row's b21 baseline by 2 (90/46); the deltas here are the honest
+#     reconciliation, not a claim that the two were the same instrument.
+#
+# Usage: tools/read_outcome_recount.sh [TREE_ROOT]     (default: the repo root of this script)
+# Output: TSV to stdout: one line per unconverted site `path<TAB>line<TAB>binding<TAB>fields`,
+# then a trailing summary line `SUMMARY<TAB>unconverted=<n><TAB>fixtures=<n>
+# <TAB>nonfixtures=<n><TAB>files=<n>`.
+
+set -eu
+
+ROOT="${1:-$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)}"
+
+find "$ROOT" -name .git -prune -o -name target -prune -o -name node_modules -prune -o \
+  -name '*.dag' -type f -print | sort | while IFS= read -r file; do
+  rel=${file#"$ROOT"/}
+  awk -v rel="$rel" '
+function mask(line,   out, i, n, c, ins) {
+  out = ""; ins = 0; n = length(line)
+  for (i = 1; i <= n; i++) {
+    c = substr(line, i, 1)
+    if (ins) {
+      if (c == "\\" && i < n) { out = out "  "; i++; continue }
+      if (c == "\"") { ins = 0; out = out "\"" } else { out = out " " }
+      continue
+    }
+    if (c == "\"") { ins = 1; out = out "\""; continue }
+    if (c == "/" && i < n && substr(line, i + 1, 1) == "/") { break }
+    out = out c
+  }
+  return out
+}
+function call_spans(text, name,   spans, m, re, depth, i, n, c, count, tl) {
+  spans = ""
+  re = name "[ \t]*\\("
+  tl = length(text)
+  pos = 1
+  while (match(substr(text, pos), re)) {
+    s = pos + RSTART - 1
+    depth = 0; i = s + RLENGTH - 1
+    while (i <= tl) {
+      c = substr(text, i, 1)
+      if (c == "\"") { i++; while (i <= tl && substr(text, i, 1) != "\"") {
+        if (substr(text, i, 1) == "\\") i++; i++ } }
+      else if (c == "(") depth++
+      else if (c == ")") { depth--; if (depth == 0) { spans = spans s "," i " "; break } }
+      i++
+    }
+    pos = s + RLENGTH
+  }
+  return spans
+}
+function in_spans(p, spans,   a, b, k, arr, j) {
+  j = split(spans, arr, " ")
+  for (k = 1; k <= j; k++) {
+    split(arr[k], ab, ",")
+    if (p >= ab[1] && p <= ab[2]) return 1
+  }
+  return 0
+}
+{ lines[NR] = mask($0) }
+END {
+  # join masked lines, preserving offsets; NUL-free text
+  text = ""
+  startline[1] = 1
+  for (r = 1; r <= NR; r++) { linestart[r] = length(text) + 1; text = text lines[r] "\n" }
+  text_len = length(text)
+
+  # exclude the adoption-standing data declaration so the instrument cannot count its own prose
+  if (match(text, /\ndata[ \t]+filesystem_read_outcome_adoption_standing\b/) || \
+      index(text, "data filesystem_read_outcome_adoption_standing") == 1) {
+    ds = RSTART; if (ds == 0) ds = 1
+    de = ds
+    while (de <= text_len) {
+      c = substr(text, de, 1)
+      if (de > ds && c != " " && c != "\t" && c != "\n") {
+        # column-0 start of the next top-level declaration ends the excluded region
+        if (substr(text, de - 1, 1) == "\n") break
+      }
+      de++
+    }
+    text = substr(text, 1, ds - 1) sprintf("%*s", de - ds, "") substr(text, de)
+    text_len = length(text)
+  }
+
+  conv_spans = call_spans(text, "filesystem_read_outcome")
+  sib_spans = call_spans(text, "filesystem_exact_read")
+
+  n = 0
+  region_key = ""
+  while (match(substr(text, n + 1), /Filesystem\.Read[ \t]*\(/)) {
+    m_abs = n + RSTART
+    m_len = RLENGTH
+    # enclosing top-level region: previous column-0 line start .. next column-0 line start
+    ra = 1
+    k = m_abs
+    while (k > 1) { c = substr(text, k - 1, 1); if (c == "\n" && substr(text, k, 1) != " " && substr(text, k, 1) != "\t") { ra = k; break }; k-- }
+    rb = text_len + 1
+    k = m_abs + m_len
+    while (k <= text_len) { if (substr(text, k, 1) == "\n" && k + 1 <= text_len && substr(text, k + 1, 1) != " " && substr(text, k + 1, 1) != "\t" && substr(text, k + 1, 1) != "\n") { rb = k + 1; break }; k++ }
+
+    # fold-call spans relative to this region, computed once per region
+    if (ra "," rb != region_key) {
+      region_key = ra "," rb
+      body = substr(text, ra, rb - ra)
+      rconv = call_spans(body, "filesystem_read_outcome")
+      rsib = call_spans(body, "filesystem_exact_read")
+    }
+
+    # binding? the code before the call on its line must end with `name =`
+    ls = m_abs; while (ls > 1 && substr(text, ls - 1, 1) != "\n") ls--
+    before = substr(text, ls, m_abs - ls)
+    sub(/[ \t]+$/, "", before)
+    if (before ~ /(^|[^A-Za-z0-9_])(let[ \t]+|node[ \t]+)?[A-Za-z_][A-Za-z0-9_]*[ \t]*=$/) {
+      match(before, /[A-Za-z_][A-Za-z0-9_]*[ \t]*=$/)
+      nm = substr(before, RSTART, RLENGTH)
+      sub(/[ \t]*=$/, "", nm)
+
+      # every projection use of the binding in the region
+      uses = ""; nuses = 0; inconv = 0; insib = 0; fields = ""
+      for (f = 1; f <= 4; f++) {
+        fld = (f == 1 ? "error_kind" : (f == 2 ? "content" : (f == 3 ? "success" : "error")))
+        use_re = "(^|[^A-Za-z0-9_])" nm "[ \t]*\\.[ \t]*" fld "([^A-Za-z0-9_]|$)"
+        rest = body
+        off = 0
+        while (match(rest, use_re)) {
+          p = off + RSTART
+          nuses++
+          uses = uses p " "
+          if (in_spans(p, rconv)) inconv++
+          if (in_spans(p, rconv) || in_spans(p, rsib)) insib++
+          if (index(fields, fld) == 0) fields = (fields == "" ? fld : fields "," fld)
+          rest = substr(rest, RSTART + RLENGTH)
+          off = off + RSTART + RLENGTH - 1
+        }
+      }
+      # compute 1-based line of the binding
+      ln = 1; k = 1
+      while (k < m_abs) { if (substr(text, k, 1) == "\n") ln++; k++ }
+      if (nuses > 0 && inconv == nuses) continue_skip = 1   # converted: not this row debt
+      else if (nuses > 0 && insib == nuses) continue_skip = 1  # exact_read_typed: sibling fold
+      else print rel "\t" ln "\t" nm "\t" fields
+    }
+    n = m_abs + m_len - 1
+  }
+}
+' "$file"
+done | awk -F'\t' '
+  { print; u++; if ($1 != prev) { files++; prev = $1 }
+    if ($1 ~ /^dag\/test\/claim\//) fx++; else nf++ }
+  END { printf "SUMMARY\tunconverted=%d\tfixtures=%d\tnonfixtures=%d\tfiles=%d\n", u + 0, fx + 0, nf + 0, files + 0 }
+'

From cf5d322fcbc47dabacce5f8a706a1b45fd01015a Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 14:29:51 +0000
Subject: [PATCH 2/7] profile_projection: bind the refused-read arm result
 (parse fix); instrument header carries method, not transcribed counts

The bare record literal as a match-arm body did not parse ('expected
expression, found Colon'), which made every later comment in the module
report 'source annotation names no subject' (37 CI parse errors). The
Refused arm now binds refused_file and returns it.

tools/read_outcome_recount.sh header: calibration numbers were
transcribed output in prose (DESIGN section 6); the header now carries
the method only, and the numbers live where the count is used (the PR
carrying the row update).
---
 dag/gunbc/auth/profile_projection.dag |  6 ++++--
 tools/read_outcome_recount.sh         | 11 +++--------
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/dag/gunbc/auth/profile_projection.dag b/dag/gunbc/auth/profile_projection.dag
index 91d2790ae5b..d564601c675 100644
--- a/dag/gunbc/auth/profile_projection.dag
+++ b/dag/gunbc/auth/profile_projection.dag
@@ -376,8 +376,10 @@ fn profile_store_decode_entries(
       } else {
         let read_result = Filesystem.Read(path: join([layout.root as String, "/", entry], ""))
         match filesystem_read_outcome(content: read_result.content, success: read_result.success, error: read_result.error) {
-          FilesystemReadRefused { error } =>
-            { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["read failed: ", error], "") }]) }
+          FilesystemReadRefused { error } => {
+            let refused_file = { profiles: acc, skipped: concat(skipped_acc, [ProfileStoreSkipped { entry: entry, reason: join(["read failed: ", error], "") }]) }
+            refused_file
+          }
           FilesystemReadSucceeded { content } =>
             match principal_profile_of_json(text: content) {
               ProfileFileMalformed { detail } => {
diff --git a/tools/read_outcome_recount.sh b/tools/read_outcome_recount.sh
index c0bed801735..6820e14bef9 100755
--- a/tools/read_outcome_recount.sh
+++ b/tools/read_outcome_recount.sh
@@ -19,14 +19,9 @@
 #   * claim fixtures are the dag/test/claim/ prefix;
 #   * count unconverted rows and distinct paths.
 #
-# Calibration (recorded in the PR that checked this tool in):
-#   * b21b710d5378387ae0c841f07323292c5d72faba (the baseline the row's count was recorded on):
-#     92 sites / 48 files, 0 converted -- exact agreement with the row's recorded baseline.
-#   * 6471587dbaa (DP-M5's head): 246 bindings / 31 converted / 8 exact_read_typed / 207 raw
-#     unconverted / 98 files with raw-unconverted / 43 claim fixtures. DP-M5's session
-#     reported 242/28/205/103/39 from a one-off script that no longer exists and that itself
-#     disagreed with the row's b21 baseline by 2 (90/46); the deltas here are the honest
-#     reconciliation, not a claim that the two were the same instrument.
+# Calibration: run it against the row's baseline commit and against the tree under test, and
+# record the numbers where the count is USED (the PR carrying the row update) -- this header
+# carries the method, never transcribed output (DESIGN §6).
 #
 # Usage: tools/read_outcome_recount.sh [TREE_ROOT]     (default: the repo root of this script)
 # Output: TSV to stdout: one line per unconverted site `path<TAB>line<TAB>binding<TAB>fields`,

From 6e0af31df79f1001448a391d92ac5ef4e29b0340 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 14:47:23 +0000
Subject: [PATCH 3/7] drop the shell recount instrument; the row keeps its
 recipe as on main

Per review 38602 finding 1 and the trial parent's ruling: a hand-written
shell parser is DESIGN section 6 scaffold ('raw shell implementing
semantics already expressible in .dag'), and the row must not name it.
The census moves to its own PR as a .dag instrument
(tools.read_outcome_census over decl_facts/NodeFold, gunbc-test label,
recalibrated at b21b710d with text-grain to node-grain deltas reported
there); the row will name it when it lands. The batch's population
delta in this PR's description is produced by the row's existing
RE-DERIVATION recipe as it stands on main.
---
 dag/extdeps/filesystem/filesystem_io.dag |   2 +-
 tools/read_outcome_recount.sh            | 173 -----------------------
 2 files changed, 1 insertion(+), 174 deletions(-)
 delete mode 100755 tools/read_outcome_recount.sh

diff --git a/dag/extdeps/filesystem/filesystem_io.dag b/dag/extdeps/filesystem/filesystem_io.dag
index b2f5e1db6b8..df47ab5a7e6 100644
--- a/dag/extdeps/filesystem/filesystem_io.dag
+++ b/dag/extdeps/filesystem/filesystem_io.dag
@@ -157,7 +157,7 @@ fn filesystem_create_new(
   }
 }
 
-data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. The named re-runnable instrument is tools/read_outcome_recount.sh (<script> <tree-root>); at b21b710d5378387ae0c841f07323292c5d72faba it reproduces this row's recorded baseline exactly (92 unconverted sites across 48 files, zero converted). Sites whose projections all feed filesystem_exact_read are a separately reported class in that instrument's output: they are already typed outcomes (the sibling modeled fold) and are not this row's debt -- converting them to filesystem_read_outcome would be a downgrade. Claim fixtures are the dag/test/claim/ prefix. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
+data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
 
 data filesystem_absence_establishment_adoption_standing: String = "RUNG: structurally guaranteed for the consumers that route through filesystem_file_observation, on the source-to-.dag acceptance path only, and MITIGATABLE NOWHERE ELSE -- the raw Filesystem.Read and Filesystem.List operations stay callable, so a module that has not adopted the carrier can still write the conflation. This row states the unconverted population at identity grain rather than as a count, because a count is not a plan and a one-sided ratchet over a number measured on the current tree is the oracle section 5 rejects. SUBJECT: a site that concludes ABSENCE, NOT-PRESENT or a dropped element from a FAILED read or a FAILED boolean path test, rather than from a listing that succeeded. It is not every Filesystem.Read consumer -- most read a file they already know exists, and those are the separate filesystem_read_outcome adoption population above. ENUMERATED SITES, each one read rather than pattern-matched: the roster is EMPTY as of this row's restoration. The six identities the row carried on origin/main 6305a5174c all route through the carrier now -- gunbc.host_effect_nbd_proxy_serve host_effect_nbd_proxy_serve_read_session_token, v2.workflow.product_receipt_stage run_product_receipt_stage, tools.merge_admission_walk read_tested_subject and read_floor_receipt, gunbc.codex_supervised_turn codex_supervised_turn_generation_observation, and tools.opaque_realization_census declaration_body_standing -- the five converted by the change that empties this roster -- each preserving could-not-look as its own typed refusal rather than an absence, and gunbc.fleet_converge_plan_cli observe_cap_members_wet already converted on main -- so a could-not-look at any of them can no longer masquerade as an established absence. THE ROW STAYS NONE THE LESS, and an empty roster is not a deleted row: the raw operations remain callable outside this module, so the class shape can be re-spelled at a new site at any time, and what the row guards is the CLASS, not its former members. A site of this shape found anywhere is a defect to repair by adoption, not a row to add. The mistake this restoration repairs was deleting the row because its enumeration emptied rather than because the trigger below expired, which is exactly the failure the NEXT-RUNG TRIGGER paragraph exists to prevent. WHAT IS DELIBERATELY NOT ON THE LIST: gunbc.roadmap_belt_actuate belt_read_or_empty, whose collapse is scoped and argued in the annotation above its definition -- both branches take the same action at every remaining caller -- and gunbc.fabric_cell_acquire, which already establishes absence from the parent enumeration through its own four-state observation and would gain nothing but a second spelling. MONOTONE DIRECTION: the roster above may only shrink. A row leaves it when the site routes through filesystem_file_observation or filesystem_entry_presence, or when the site is deleted; a NEW site of this shape is a defect to repair rather than a row to add. NEXT-RUNG TRIGGER, and it names the capability rather than an artifact: the raw List and Read result projections cease to be reachable outside this module's folds, so a consumer cannot spell the conflation at all -- at which point the enumeration above has no subject and this row is deleted. That is the same trigger filesystem_read_outcome_adoption_standing carries, one question further in: it asks that every read projection be folded, this asks that every ABSENCE be established."
 
diff --git a/tools/read_outcome_recount.sh b/tools/read_outcome_recount.sh
deleted file mode 100755
index 6820e14bef9..00000000000
--- a/tools/read_outcome_recount.sh
+++ /dev/null
@@ -1,173 +0,0 @@
-#!/bin/sh
-# read_outcome_recount.sh -- the filesystem_read_outcome_adoption_standing instrument.
-#
-# Named by the row's RE-DERIVATION recipe in dag/extdeps/filesystem/filesystem_io.dag and
-# re-runnable, so the count is never transcribed session output (DESIGN §6).
-#
-# What it implements, per that recipe:
-#   * enumerate Filesystem.Read assignment calls in tracked .dag source (any `name =` binding
-#     form: let/node/plain); comment and string-literal text is masked before matching, so
-#     prose never counts;
-#   * exclude the adoption-standing data declaration itself, so the instrument cannot count
-#     its own prose;
-#   * classify each binding at identity grain (path:line:binding): converted only when every
-#     success, error, and content projection of the bound result is an argument of the modeled
-#     fold filesystem_read_outcome (balanced-paren spans); otherwise unconverted;
-#   * sites whose projections all feed filesystem_exact_read (the sibling modeled fold) are
-#     reported as their own class, exact_read_typed: they are already typed outcomes and are
-#     not this row debt (converting them to read_outcome would be a downgrade);
-#   * claim fixtures are the dag/test/claim/ prefix;
-#   * count unconverted rows and distinct paths.
-#
-# Calibration: run it against the row's baseline commit and against the tree under test, and
-# record the numbers where the count is USED (the PR carrying the row update) -- this header
-# carries the method, never transcribed output (DESIGN §6).
-#
-# Usage: tools/read_outcome_recount.sh [TREE_ROOT]     (default: the repo root of this script)
-# Output: TSV to stdout: one line per unconverted site `path<TAB>line<TAB>binding<TAB>fields`,
-# then a trailing summary line `SUMMARY<TAB>unconverted=<n><TAB>fixtures=<n>
-# <TAB>nonfixtures=<n><TAB>files=<n>`.
-
-set -eu
-
-ROOT="${1:-$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)}"
-
-find "$ROOT" -name .git -prune -o -name target -prune -o -name node_modules -prune -o \
-  -name '*.dag' -type f -print | sort | while IFS= read -r file; do
-  rel=${file#"$ROOT"/}
-  awk -v rel="$rel" '
-function mask(line,   out, i, n, c, ins) {
-  out = ""; ins = 0; n = length(line)
-  for (i = 1; i <= n; i++) {
-    c = substr(line, i, 1)
-    if (ins) {
-      if (c == "\\" && i < n) { out = out "  "; i++; continue }
-      if (c == "\"") { ins = 0; out = out "\"" } else { out = out " " }
-      continue
-    }
-    if (c == "\"") { ins = 1; out = out "\""; continue }
-    if (c == "/" && i < n && substr(line, i + 1, 1) == "/") { break }
-    out = out c
-  }
-  return out
-}
-function call_spans(text, name,   spans, m, re, depth, i, n, c, count, tl) {
-  spans = ""
-  re = name "[ \t]*\\("
-  tl = length(text)
-  pos = 1
-  while (match(substr(text, pos), re)) {
-    s = pos + RSTART - 1
-    depth = 0; i = s + RLENGTH - 1
-    while (i <= tl) {
-      c = substr(text, i, 1)
-      if (c == "\"") { i++; while (i <= tl && substr(text, i, 1) != "\"") {
-        if (substr(text, i, 1) == "\\") i++; i++ } }
-      else if (c == "(") depth++
-      else if (c == ")") { depth--; if (depth == 0) { spans = spans s "," i " "; break } }
-      i++
-    }
-    pos = s + RLENGTH
-  }
-  return spans
-}
-function in_spans(p, spans,   a, b, k, arr, j) {
-  j = split(spans, arr, " ")
-  for (k = 1; k <= j; k++) {
-    split(arr[k], ab, ",")
-    if (p >= ab[1] && p <= ab[2]) return 1
-  }
-  return 0
-}
-{ lines[NR] = mask($0) }
-END {
-  # join masked lines, preserving offsets; NUL-free text
-  text = ""
-  startline[1] = 1
-  for (r = 1; r <= NR; r++) { linestart[r] = length(text) + 1; text = text lines[r] "\n" }
-  text_len = length(text)
-
-  # exclude the adoption-standing data declaration so the instrument cannot count its own prose
-  if (match(text, /\ndata[ \t]+filesystem_read_outcome_adoption_standing\b/) || \
-      index(text, "data filesystem_read_outcome_adoption_standing") == 1) {
-    ds = RSTART; if (ds == 0) ds = 1
-    de = ds
-    while (de <= text_len) {
-      c = substr(text, de, 1)
-      if (de > ds && c != " " && c != "\t" && c != "\n") {
-        # column-0 start of the next top-level declaration ends the excluded region
-        if (substr(text, de - 1, 1) == "\n") break
-      }
-      de++
-    }
-    text = substr(text, 1, ds - 1) sprintf("%*s", de - ds, "") substr(text, de)
-    text_len = length(text)
-  }
-
-  conv_spans = call_spans(text, "filesystem_read_outcome")
-  sib_spans = call_spans(text, "filesystem_exact_read")
-
-  n = 0
-  region_key = ""
-  while (match(substr(text, n + 1), /Filesystem\.Read[ \t]*\(/)) {
-    m_abs = n + RSTART
-    m_len = RLENGTH
-    # enclosing top-level region: previous column-0 line start .. next column-0 line start
-    ra = 1
-    k = m_abs
-    while (k > 1) { c = substr(text, k - 1, 1); if (c == "\n" && substr(text, k, 1) != " " && substr(text, k, 1) != "\t") { ra = k; break }; k-- }
-    rb = text_len + 1
-    k = m_abs + m_len
-    while (k <= text_len) { if (substr(text, k, 1) == "\n" && k + 1 <= text_len && substr(text, k + 1, 1) != " " && substr(text, k + 1, 1) != "\t" && substr(text, k + 1, 1) != "\n") { rb = k + 1; break }; k++ }
-
-    # fold-call spans relative to this region, computed once per region
-    if (ra "," rb != region_key) {
-      region_key = ra "," rb
-      body = substr(text, ra, rb - ra)
-      rconv = call_spans(body, "filesystem_read_outcome")
-      rsib = call_spans(body, "filesystem_exact_read")
-    }
-
-    # binding? the code before the call on its line must end with `name =`
-    ls = m_abs; while (ls > 1 && substr(text, ls - 1, 1) != "\n") ls--
-    before = substr(text, ls, m_abs - ls)
-    sub(/[ \t]+$/, "", before)
-    if (before ~ /(^|[^A-Za-z0-9_])(let[ \t]+|node[ \t]+)?[A-Za-z_][A-Za-z0-9_]*[ \t]*=$/) {
-      match(before, /[A-Za-z_][A-Za-z0-9_]*[ \t]*=$/)
-      nm = substr(before, RSTART, RLENGTH)
-      sub(/[ \t]*=$/, "", nm)
-
-      # every projection use of the binding in the region
-      uses = ""; nuses = 0; inconv = 0; insib = 0; fields = ""
-      for (f = 1; f <= 4; f++) {
-        fld = (f == 1 ? "error_kind" : (f == 2 ? "content" : (f == 3 ? "success" : "error")))
-        use_re = "(^|[^A-Za-z0-9_])" nm "[ \t]*\\.[ \t]*" fld "([^A-Za-z0-9_]|$)"
-        rest = body
-        off = 0
-        while (match(rest, use_re)) {
-          p = off + RSTART
-          nuses++
-          uses = uses p " "
-          if (in_spans(p, rconv)) inconv++
-          if (in_spans(p, rconv) || in_spans(p, rsib)) insib++
-          if (index(fields, fld) == 0) fields = (fields == "" ? fld : fields "," fld)
-          rest = substr(rest, RSTART + RLENGTH)
-          off = off + RSTART + RLENGTH - 1
-        }
-      }
-      # compute 1-based line of the binding
-      ln = 1; k = 1
-      while (k < m_abs) { if (substr(text, k, 1) == "\n") ln++; k++ }
-      if (nuses > 0 && inconv == nuses) continue_skip = 1   # converted: not this row debt
-      else if (nuses > 0 && insib == nuses) continue_skip = 1  # exact_read_typed: sibling fold
-      else print rel "\t" ln "\t" nm "\t" fields
-    }
-    n = m_abs + m_len - 1
-  }
-}
-' "$file"
-done | awk -F'\t' '
-  { print; u++; if ($1 != prev) { files++; prev = $1 }
-    if ($1 ~ /^dag\/test\/claim\//) fx++; else nf++ }
-  END { printf "SUMMARY\tunconverted=%d\tfixtures=%d\tnonfixtures=%d\tfiles=%d\n", u + 0, fx + 0, nf + 0, files + 0 }
-'

From a560dca836f4cc5cdda2f0fe52940128a0991e22 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 16:51:38 +0000
Subject: [PATCH 4/7] approval_keyring_converge: widen filesystem_io import and
 use staged-content params in the extracted converge

The conversion's fold calls referenced filesystem_read_outcome and the two
arm names without importing them, and the extracted
approval_keyring_converge_with_staged_keys still read the caller's
cap/sub/rcpt records instead of its own staged-content parameters. Both
resolution failures are fixed; the extracted body now consumes the typed
read outcomes its caller decoded.
---
 dag/gunbc/auth/approval_keyring_converge.dag | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/dag/gunbc/auth/approval_keyring_converge.dag b/dag/gunbc/auth/approval_keyring_converge.dag
index 19839aa5c7e..09fd85dc063 100644
--- a/dag/gunbc/auth/approval_keyring_converge.dag
+++ b/dag/gunbc/auth/approval_keyring_converge.dag
@@ -9,7 +9,13 @@ import gunbc.auth.approval_store_receipt { approval_store_receipt_mac_key_path }
 import gunbc.auth.approval_request_submission {
   approval_submission_mac_key_path,
 }
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemReadOutcome,
+  FilesystemReadRefused,
+  FilesystemReadSucceeded,
+  filesystem_read_outcome,
+}
 import extdeps.tools.sha256sum { sha256sum_file_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
 import extdeps.sudo.elevation { sudo_elevate }
 import extdeps.tools.chown { chown_argv, ChownOwnerNames }
@@ -282,11 +288,11 @@ fn approval_keyring_converge_with_staged_keys(cap_path: String, sub_path: String
                     ExitSuccess =>
                       match keyring_ensure_dirs(target: target, context: context) {
                         ExitSuccess =>
-                          match keyring_install_file(target: target, context: context, dest: approval_mac_key_path, content: cap.content, step: "capability-key") {
+                          match keyring_install_file(target: target, context: context, dest: approval_mac_key_path, content: cap_content, step: "capability-key") {
                             ExitSuccess =>
-                              match keyring_install_file(target: target, context: context, dest: approval_submission_mac_key_path, content: sub.content, step: "submission-key") {
+                              match keyring_install_file(target: target, context: context, dest: approval_submission_mac_key_path, content: sub_content, step: "submission-key") {
                                 ExitSuccess =>
-                              match keyring_install_file(target: target, context: context, dest: approval_store_receipt_mac_key_path, content: rcpt.content, step: "store-receipt-key") {
+                              match keyring_install_file(target: target, context: context, dest: approval_store_receipt_mac_key_path, content: rcpt_content, step: "store-receipt-key") {
                                 ExitSuccess =>
                                   match keyring_elevated_exec(target: target, context: context, command: ntfy_group_admit_argv(), step: "ntfy-group-admit") {
                                     ExitSuccess =>

From fb5d0efceea7761572b5fa8f93e94d3157b0cdd1 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 19:49:05 +0000
Subject: [PATCH 5/7] mint record: split missing from unreadable via the
 observation authority; inline the keyring converge

Side-chat findings on a560dca836f, both addressed:

1. The unreadable refusal overclaimed existence ('exists but could not be
   read') -- a failed read establishes nothing about what is on the disk.
   The record read now goes through #12982's filesystem_file_observation_of_path:
   a listing-established absence is its own AppKeyMintRecordMissing fact and its
   own AppKeyMintObservationMissing refusal (text makes no existence claim and
   the witness pins that); a record whose content could not be obtained stays
   AppKeyMintRecordUnread with text that no longer speaks of existence.
   app_key_mint_record_from_read is deleted -- the raw read it decoded no
   longer exists on this path.
2. approval_keyring_converge_with_staged_keys was an unrestricted top-level fn
   taking paths and contents separately. Inlined back into
   approval_keyring_converge_on_host, where each installed content is the
   content bound by that path's own successful read arm -- the two cannot
   diverge, and no unsealed caller exists.

Witness: the unreadable red now drives the classifier with a
FilesystemFileIndeterminate observation; the readable control drives it with
FilesystemFileRead; the new missing-path control pins that the missing
refusal says 'no record is there', that neither missing nor unreadable text
contains 'exists', and that the three refusal texts are distinct. The
listing-absence classifier arm is a one-line match the claim module cannot
drive directly: FilesystemEstablishedAbsence is a sole_constructor of
filesystem_io, not constructible from a test module.
---
 dag/gunbc/auth/approval_keyring_converge.dag  | 119 +++++++++---------
 dag/gunbc/auth/ci_app_key_rotation.dag        |  47 ++++---
 .../ci_app_key_rotation_witness_test.dag      |  46 ++++---
 3 files changed, 117 insertions(+), 95 deletions(-)

diff --git a/dag/gunbc/auth/approval_keyring_converge.dag b/dag/gunbc/auth/approval_keyring_converge.dag
index 09fd85dc063..1b6d9319c96 100644
--- a/dag/gunbc/auth/approval_keyring_converge.dag
+++ b/dag/gunbc/auth/approval_keyring_converge.dag
@@ -11,7 +11,6 @@ import gunbc.auth.approval_request_submission {
 }
 import extdeps.filesystem.filesystem_io {
   Filesystem,
-  FilesystemReadOutcome,
   FilesystemReadRefused,
   FilesystemReadSucceeded,
   filesystem_read_outcome,
@@ -254,73 +253,67 @@ fn approval_keyring_converge_on_host() -> ProcessExit
       FilesystemReadRefused { error } =>
         exit_failure(reason: concat("approval keyring: staged store receipt MAC key unreadable: ", error))
       FilesystemReadSucceeded { content: rcpt_content } =>
-      match filesystem_read_outcome(content: cap.content, success: cap.success, error: cap.error) {
-        FilesystemReadRefused { error } =>
-          exit_failure(reason: concat("approval keyring: staged capability MAC key unreadable: ", error))
-        FilesystemReadSucceeded { content: cap_content } =>
-        match filesystem_read_outcome(content: sub.content, success: sub.success, error: sub.error) {
+        match filesystem_read_outcome(content: cap.content, success: cap.success, error: cap.error) {
           FilesystemReadRefused { error } =>
-            exit_failure(reason: concat("approval keyring: staged submission MAC key unreadable: ", error))
-          FilesystemReadSucceeded { content: sub_content } =>
-            approval_keyring_converge_with_staged_keys(
-              cap_path: cap_path, sub_path: sub_path, rcpt_path: rcpt_path,
-              cap_content: cap_content, sub_content: sub_content, rcpt_content: rcpt_content,
-            )
+            exit_failure(reason: concat("approval keyring: staged capability MAC key unreadable: ", error))
+          FilesystemReadSucceeded { content: cap_content } =>
+            match filesystem_read_outcome(content: sub.content, success: sub.success, error: sub.error) {
+              FilesystemReadRefused { error } =>
+                exit_failure(reason: concat("approval keyring: staged submission MAC key unreadable: ", error))
+              FilesystemReadSucceeded { content: sub_content } =>
+                match approval_keyring_staged_digest_ok(path: cap_path as NonEmptyStr, expected_prefix: approval_mac_key_payload_sha256_prefix, role: "capability") {
+                  ExitSuccess =>
+                    match approval_keyring_staged_digest_ok(path: sub_path as NonEmptyStr, expected_prefix: approval_submission_mac_key_payload_sha256_prefix, role: "submission") {
+                      ExitSuccess =>
+                        match approval_keyring_staged_digest_ok(path: rcpt_path as NonEmptyStr, expected_prefix: approval_store_receipt_mac_key_payload_sha256_prefix, role: "store-receipt") {
+                          ExitSuccess =>
+                            match prepare_fleet_ssh_agent_context(attempt_raw: approval_keyring_converge_attempt_raw) {
+                              FleetSshContextRefused { cause: c } =>
+                                exit_failure(reason: concat("approval keyring: ", c))
+                              FleetSshContextReady { context: context, receipt: _ } => {
+                                let target = keyring_ssh_target()
+                                match keyring_elevated_exec(target: target, context: context, command: ["true"], step: "administrator-privilege") {
+                                  ExitSuccess =>
+                                    match keyring_ensure_dirs(target: target, context: context) {
+                                      ExitSuccess =>
+                                        match keyring_install_file(target: target, context: context, dest: approval_mac_key_path, content: cap_content, step: "capability-key") {
+                                          ExitSuccess =>
+                                            match keyring_install_file(target: target, context: context, dest: approval_submission_mac_key_path, content: sub_content, step: "submission-key") {
+                                              ExitSuccess =>
+                                                match keyring_install_file(target: target, context: context, dest: approval_store_receipt_mac_key_path, content: rcpt_content, step: "store-receipt-key") {
+                                                  ExitSuccess =>
+                                                    match keyring_elevated_exec(target: target, context: context, command: ntfy_group_admit_argv(), step: "ntfy-group-admit") {
+                                                      ExitSuccess =>
+                                                        match keyring_elevated_exec(target: target, context: context, command: roadmap_unit_restart_argv(), step: "roadmap-unit-restart") {
+                                                          ExitSuccess => ExitSuccess
+                                                          other => other
+                                                        }
+                                                      other => other
+                                                    }
+                                                  other => other
+                                                }
+                                              other => other
+                                            }
+                                          other => other
+                                        }
+                                      other => other
+                                    }
+                                  other => other
+                                }
+                              }
+                            }
+                          other => other
+                        }
+                      other => other
+                    }
+                  other => other
+                }
+            }
         }
-      }
     }
-}
+  }
 }
 
-fn approval_keyring_converge_with_staged_keys(cap_path: String, sub_path: String, rcpt_path: String, cap_content: String, sub_content: String, rcpt_content: String) -> ProcessExit
-{
-      match approval_keyring_staged_digest_ok(path: cap_path as NonEmptyStr, expected_prefix: approval_mac_key_payload_sha256_prefix, role: "capability") {
-        ExitSuccess =>
-          match approval_keyring_staged_digest_ok(path: sub_path as NonEmptyStr, expected_prefix: approval_submission_mac_key_payload_sha256_prefix, role: "submission") {
-            ExitSuccess =>
-          match approval_keyring_staged_digest_ok(path: rcpt_path as NonEmptyStr, expected_prefix: approval_store_receipt_mac_key_payload_sha256_prefix, role: "store-receipt") {
-            ExitSuccess =>
-              match prepare_fleet_ssh_agent_context(attempt_raw: approval_keyring_converge_attempt_raw) {
-                FleetSshContextRefused { cause: c } => exit_failure(reason: concat("approval keyring: ", c))
-                FleetSshContextReady { context: context, receipt: _ } => {
-                  let target = keyring_ssh_target()
-                  match keyring_elevated_exec(target: target, context: context, command: ["true"], step: "administrator-privilege") {
-                    ExitSuccess =>
-                      match keyring_ensure_dirs(target: target, context: context) {
-                        ExitSuccess =>
-                          match keyring_install_file(target: target, context: context, dest: approval_mac_key_path, content: cap_content, step: "capability-key") {
-                            ExitSuccess =>
-                              match keyring_install_file(target: target, context: context, dest: approval_submission_mac_key_path, content: sub_content, step: "submission-key") {
-                                ExitSuccess =>
-                              match keyring_install_file(target: target, context: context, dest: approval_store_receipt_mac_key_path, content: rcpt_content, step: "store-receipt-key") {
-                                ExitSuccess =>
-                                  match keyring_elevated_exec(target: target, context: context, command: ntfy_group_admit_argv(), step: "ntfy-group-admit") {
-                                    ExitSuccess =>
-                                      match keyring_elevated_exec(target: target, context: context, command: roadmap_unit_restart_argv(), step: "roadmap-unit-restart") {
-                                        ExitSuccess => ExitSuccess
-                                        other => other
-                                      }
-                                    other => other
-                                  }
-                                other => other
-                              }
-                                other => other
-                              }
-                            other => other
-                          }
-                        other => other
-                      }
-                    other => other
-                  }
-                }
-              }
-            other => other
-          }
-            other => other
-          }
-        other => other
-      }
-    }
 fn approval_keyring_converge_wet() -> ProcessExit
 {
   match actions_variable_read(name: fleet_converge_expected_host_env_name) {
diff --git a/dag/gunbc/auth/ci_app_key_rotation.dag b/dag/gunbc/auth/ci_app_key_rotation.dag
index 7bd5e200258..22583e3de45 100644
--- a/dag/gunbc/auth/ci_app_key_rotation.dag
+++ b/dag/gunbc/auth/ci_app_key_rotation.dag
@@ -5,11 +5,9 @@ import std.process { ProcessExit, ExitSuccess, exit_failure }
 import extdeps.shell
 import extdeps.filesystem.filesystem_io {
   Filesystem,
-  FilesystemReadOutcome,
-  FilesystemReadRefused,
-  FilesystemReadSucceeded,
-  filesystem_read_outcome,
+  filesystem_established_absence_detail,
 }
+import gunbc.filesystem_file_observe { filesystem_file_observation_of_path }
 import gunbc.auth.github_gcp_federation { fleet_secrets_project_number }
 import extdeps.cloud.gcp.secret_ref {
   SecretRef, secret_ref_version_resource,
@@ -151,6 +149,7 @@ type AppKeyVersionRefusal
   | AppKeyVersionSelectorIsAlias
   | AppKeyVersionSelectorNotANumber { supplied: String }
   | AppKeyMintObservationAbsent { cause: NonEmptyStr }
+  | AppKeyMintObservationMissing { cause: NonEmptyStr }
   | AppKeyMintObservationUnreadable { cause: NonEmptyStr }
   | AppKeyVersionUnreadable { http_status: String }
   | AppKeyResolvedVersionUndecodable { cause: SmResolvedVersionIdentityRefusal }
@@ -313,8 +312,10 @@ fn app_key_refusal_text(cause: AppKeyVersionRefusal) -> String {
       join(["AppKeyVersionSelectorNotANumber: '", s, "' is not a Secret Manager version number"], "")
     AppKeyMintObservationAbsent { cause: c } =>
       concat("AppKeyMintObservationAbsent: ", c as String)
+    AppKeyMintObservationMissing { cause: c } =>
+      concat("AppKeyMintObservationMissing: ", concat(c as String, ": the mint step was to write an observation record at the supplied path but no record is there; re-run the mint step and check it reported success"))
     AppKeyMintObservationUnreadable { cause: c } =>
-      concat("AppKeyMintObservationUnreadable: ", concat(c as String, ": the mint step's observation record exists but could not be read, which is a different failure from there being no record; inspect the record path and its permissions"))
+      concat("AppKeyMintObservationUnreadable: ", concat(c as String, ": the observation record's content could not be obtained from the supplied path, which is a different failure from there being no record; inspect the record path and its permissions"))
     AppKeyVersionUnreadable { http_status: s } =>
       join([
         "AppKeyVersionUnreadable: Secret Manager answered HTTP ", s,
@@ -390,19 +391,32 @@ fn env_or_empty(name: NonEmptyStr) -> String {
   }
 }
 
-// The record read is a typed outcome, never a silently defaulted value (DESIGN §5): a refused read
-// of the observation record is a different fact from there being no record, so it carries its own
-// arm instead of collapsing into the absent one the old Optional shape forced.
+// The record read is a typed outcome, never a silently defaulted value (DESIGN §5). The facts a
+// supplied record path can produce are kept apart: the record is absent (the directory listing
+// establishes that nothing is there -- the mint step wrote no record), the record's content could
+// not be obtained (a refused read establishes nothing about existence by itself), and the record
+// decoded. The presence claim is only ever licensed by #12982's observation authority, never
+// inferred from a failed read -- DP-M5's defect is mirrored here if a refused read is allowed to
+// speak about what exists.
 type AppKeyMintRecordRead
   = AppKeyMintRecordDecoded { observation: AppKeyMintObservation }
+  | AppKeyMintRecordMissing { cause: NonEmptyStr }
   | AppKeyMintRecordUnread { cause: NonEmptyStr }
 
-fn app_key_mint_record_from_read(read: FilesystemReadOutcome) -> AppKeyMintRecordRead {
-  match read {
-    FilesystemReadSucceeded { content: content } =>
+fn app_key_mint_record_from_observation(observation: FilesystemFileObservation) -> AppKeyMintRecordRead {
+  match observation {
+    FilesystemFileRead { path: _, content: content } =>
       AppKeyMintRecordDecoded { observation: decode_app_key_mint_record(record: content) }
-    FilesystemReadRefused { error: error } =>
-      AppKeyMintRecordUnread { cause: error as NonEmptyStr }
+    FilesystemFileAbsent(absence) =>
+      AppKeyMintRecordMissing {
+        cause: concat("the record path was supplied but ", filesystem_established_absence_detail(absence: absence)) as NonEmptyStr,
+      }
+    FilesystemFileIndeterminate { cause: c } =>
+      AppKeyMintRecordUnread { cause: c as NonEmptyStr }
+    FilesystemFileObservationsDisagree { path: _, cause: c } =>
+      AppKeyMintRecordUnread { cause: c as NonEmptyStr }
+    FilesystemFileSubjectRefused { directory: _, name: _, cause: c } =>
+      AppKeyMintRecordUnread { cause: concat("the record path was refused before any filesystem call ran: ", c) as NonEmptyStr }
   }
 }
 
@@ -411,10 +425,7 @@ fn observe_app_key_mint_record() -> AppKeyMintRecordRead? {
   if path == "" {
     none
   } else {
-    let read = Filesystem.Read(path: path)
-    Present {
-      value: app_key_mint_record_from_read(read: filesystem_read_outcome(content: read.content, success: read.success, error: read.error)),
-    }
+    Present { value: app_key_mint_record_from_observation(observation: filesystem_file_observation_of_path(path: path)) }
   }
 }
 
@@ -430,6 +441,8 @@ fn ci_app_key_version_verify_wet() -> ProcessExit {
           AppKeyVersionRefused {
             cause: AppKeyMintObservationAbsent { cause: concat("the mint step recorded no observation record for this run: ", concat(app_key_verify_record_env_name as String, " is unset")) as NonEmptyStr },
           }
+        Present { value: AppKeyMintRecordMissing { cause: c } } =>
+          AppKeyVersionRefused { cause: AppKeyMintObservationMissing { cause: c } }
         Present { value: AppKeyMintRecordUnread { cause: c } } =>
           AppKeyVersionRefused { cause: AppKeyMintObservationUnreadable { cause: c } }
         Present { value: AppKeyMintRecordDecoded { observation: obs } } =>
diff --git a/dag/test/claim/ci_app_key_rotation_witness_test.dag b/dag/test/claim/ci_app_key_rotation_witness_test.dag
index dd47a05ccd6..b466dc5b4b3 100644
--- a/dag/test/claim/ci_app_key_rotation_witness_test.dag
+++ b/dag/test/claim/ci_app_key_rotation_witness_test.dag
@@ -65,6 +65,7 @@ import gunbc.auth.ci_app_key_rotation {
   AppKeyVersionSelectorIsAlias,
   AppKeyVersionSelectorNotANumber,
   AppKeyMintObservationAbsent,
+  AppKeyMintObservationMissing,
   AppKeyVersionUnreadable,
   AppKeyResolvedVersionUndecodable,
   AppKeyResolvedVersionDiffers,
@@ -78,16 +79,16 @@ import gunbc.auth.ci_app_key_rotation {
   decode_app_key_mint_record,
   verify_app_key_version,
   app_key_verdict_evidence,
-  app_key_mint_record_from_read,
+  app_key_mint_record_from_observation,
   AppKeyMintRecordDecoded,
+  AppKeyMintRecordMissing,
   AppKeyMintRecordUnread,
   AppKeyMintObservationUnreadable,
   app_key_refusal_text,
 }
 import extdeps.filesystem.filesystem_io {
-  FilesystemReadOutcome,
-  FilesystemReadRefused,
-  filesystem_read_outcome,
+  FilesystemFileRead,
+  FilesystemFileIndeterminate,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -473,37 +474,52 @@ fn contains_text(haystack: String, needle: String) -> Bool {
   haystack.contains(needle)
 }
 
-// RED for the silent-none conversion: before the read-outcome fold, an unreadable observation
+// RED for the silent-none conversion: before the observation conversion, an unreadable observation
 // record collapsed into the absent arm -- `!read.success` returned `none`, and the operator was
 // told the record was "absent or unreadable", the two facts one text. This witness goes red on a
 // tree without the conversion (the classifier it names does not exist there) and, once it exists,
-// pins that a refused read refuses as unreadable and carries the host's cause verbatim.
+// pins that an observation that could not be completed refuses as unreadable and carries the
+// cause verbatim. The observation arm here is one where presence was never established -- the
+// listing could not be interrogated -- so nothing in the pinned refusal may speak of what exists.
 test fn an_unreadable_mint_record_is_refused_as_unreadable_never_collapsed_into_absent() -> Bool {
-  match app_key_mint_record_from_read(read: FilesystemReadRefused { error: "permission denied" }) {
+  match app_key_mint_record_from_observation(observation: FilesystemFileIndeterminate { cause: "permission denied" }) {
     AppKeyMintRecordUnread { cause: c } => (c as String) == "permission denied"
     AppKeyMintRecordDecoded { observation: _ } => false
+    AppKeyMintRecordMissing { cause: _ } => false
   }
 }
 
-// Positive control over the same classifier: the success arm still decodes through the fold, so the
-// red above cannot be satisfied by refusing everything.
+// Positive control over the same classifier: the success arm still decodes through the observation,
+// so the red above cannot be satisfied by refusing everything.
 test fn a_readable_mint_record_still_decodes_through_the_read_fold() -> Bool {
-  match app_key_mint_record_from_read(read: filesystem_read_outcome(content: minted_record(), success: true, error: "unused on success")) {
+  match app_key_mint_record_from_observation(observation: FilesystemFileRead { path: "/var/lib/gunbc/ci/app-key/observation.json", content: minted_record() }) {
     AppKeyMintRecordDecoded { observation: obs } =>
       match obs.key_http_status {
         Present { value: status } => (status as String) == "200"
         Absent => false
       }
     AppKeyMintRecordUnread { cause: _ } => false
+    AppKeyMintRecordMissing { cause: _ } => false
   }
 }
 
-// The two facts the old shape merged now render as two texts naming two different operator actions:
-// absent says the run recorded nothing; unreadable says the record exists and could not be read.
-test fn the_unreadable_record_refusal_names_the_read_and_names_a_different_action_than_absent() -> Bool {
+// MISSING-PATH CONTROL (side-chat finding: the permission-denied case cannot catch the overclaim).
+// A record that is not there and a record whose content could not be obtained are two facts, and
+// neither refusal text may claim existence: a failed look does not establish what is on the disk.
+// The Missing and Unreadable refusal arms are constructed here directly; the classifier arm that
+// maps the listing-established absence (FilesystemFileAbsent) onto Missing is the one arm this
+// witness cannot drive from a claim module, because the absence carrier is a sole_constructor of
+// filesystem_io and is not constructible here -- that arm is a one-line match reviewed in the diff.
+test fn a_missing_record_is_distinct_from_unreadable_and_claims_no_existence() -> Bool {
+  let missing = app_key_refusal_text(cause: AppKeyMintObservationMissing { cause: "the record path was supplied but the directory listing establishes absence" as NonEmptyStr })
   let unreadable = app_key_refusal_text(cause: AppKeyMintObservationUnreadable { cause: "permission denied" as NonEmptyStr })
   let absent = app_key_refusal_text(cause: AppKeyMintObservationAbsent { cause: "APP_KEY_VERIFY_RECORD is unset" as NonEmptyStr })
-  contains_text(haystack: unreadable, needle: "could not be read")
+  contains_text(haystack: missing, needle: "no record is there")
+    && !contains_text(haystack: missing, needle: "exists")
+    && !contains_text(haystack: unreadable, needle: "exists")
+    && contains_text(haystack: unreadable, needle: "could not be obtained")
     && contains_text(haystack: absent, needle: "AppKeyMintObservationAbsent:")
-    && (unreadable as String) != (absent as String)
+    && ((missing as String) != (unreadable as String))
+    && ((missing as String) != (absent as String))
+    && ((unreadable as String) != (absent as String))
 }

From 930b969b617c8cffc493b9132c3497d33d8ddc8e Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 20:43:06 +0000
Subject: [PATCH 6/7] ci_app_key_rotation: import the observation type and its
 five constructors explicitly

review 75025: app_key_mint_record_from_observation used FilesystemFileObservation
and its five constructors with no import. They do resolve implicitly (the scoped
compile passed with only the pre-existing secret_rotation error, and
merge_admission_walk on main matches the same arms without importing them), but
the sibling files in this diff and the witness import these names explicitly, so
the module now does too.
---
 dag/gunbc/auth/ci_app_key_rotation.dag | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dag/gunbc/auth/ci_app_key_rotation.dag b/dag/gunbc/auth/ci_app_key_rotation.dag
index 22583e3de45..b5894fbb03c 100644
--- a/dag/gunbc/auth/ci_app_key_rotation.dag
+++ b/dag/gunbc/auth/ci_app_key_rotation.dag
@@ -5,6 +5,12 @@ import std.process { ProcessExit, ExitSuccess, exit_failure }
 import extdeps.shell
 import extdeps.filesystem.filesystem_io {
   Filesystem,
+  FilesystemFileObservation,
+  FilesystemFileRead,
+  FilesystemFileAbsent,
+  FilesystemFileIndeterminate,
+  FilesystemFileObservationsDisagree,
+  FilesystemFileSubjectRefused,
   filesystem_established_absence_detail,
 }
 import gunbc.filesystem_file_observe { filesystem_file_observation_of_path }

From fd6f3224f7903f09bd4f3d5f2a7cbf68e66b548c Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 3 Oct 2026 22:35:51 +0000
Subject: [PATCH 7/7] witness drives established absence through the owner's
 producers; row records the excluded classes

Side-chat finding: the missing-path control constructed AppKeyMintObservationMissing
directly and only checked rendering, so the FilesystemFileAbsent classifier arm was
never exercised. The new control drives the full chain with no forged carrier:
filesystem_listing_observation (succeeded listing omitting the record) plus a refused
read go through filesystem_file_observation -- the sole_constructor absence is produced
inside filesystem_io -- and the witness pins AppKeyMintRecordMissing from the mint
classifier and the rendered AppKeyMintObservationMissing text (no existence claim).

Row: the exact_read_typed exclusion was lost when the RE-DERIVATION prose was restored
in 6e0af31; both it and the new domain_read_fold class are now recorded on the row.
domain_read_fold covers sites routing raw reads through a domain fold of the same shape
(machine_intake proc_read_outcome -> ProcRead | ProcReadRefused, carrying error_kind):
typed outcomes, excluded from this lane; the second read-outcome fold is a DESIGN 3
fork to be unified by growing the shared fold. In-scope population at current main:
139 sites across 70 files (161 non-fixture before exclusions).
---
 dag/extdeps/filesystem/filesystem_io.dag      |  2 +-
 .../ci_app_key_rotation_witness_test.dag      | 30 +++++++++++++++++--
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/dag/extdeps/filesystem/filesystem_io.dag b/dag/extdeps/filesystem/filesystem_io.dag
index df47ab5a7e6..f55365fc048 100644
--- a/dag/extdeps/filesystem/filesystem_io.dag
+++ b/dag/extdeps/filesystem/filesystem_io.dag
@@ -157,7 +157,7 @@ fn filesystem_create_new(
   }
 }
 
-data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
+data filesystem_read_outcome_adoption_standing: String ="RUNG: mitigatable. filesystem_read_outcome provides the single modeled fold from Filesystem.Read's scalar transport observation into FilesystemReadSucceeded | FilesystemReadRefused, but nothing forces callers through it. gunbc.ci_yaml_validate is the first converted consumer and preserves read refusal separately from YAML parse refusal. The raw operation remains directly consumed elsewhere, so content+success+error nonsense combinations remain writable at those sites. SUBJECT: an unconverted consumption site is a Filesystem Read call whose bound result has any success, error, or content projection outside the three arguments of filesystem_read_outcome. The call and those three projections remain after conversion because they supply the fold; adoption changes where they are consumed, not whether they exist. CLASSES EXCLUDED FROM THE TARGET POPULATION, recorded so exclusion is a decision and not a blind spot: a site whose read projections already flow through this fold's own typed shape is exact_read_typed and is not a target; a site that routes a raw read through a domain-specific fold of the same shape -- gunbc.machine_intake proc_read_outcome into ProcRead | ProcReadRefused, which additionally carries error_kind -- is domain_read_fold: it is a typed outcome, not a silent default, but a second read-outcome fold beside this one is a DESIGN 3 fork, recorded to be unified later by growing the shared fold, and those sites are targets of that unification, not of this lane. BASELINE measured on origin/main b21b710d5378387ae0c841f07323292c5d72faba: 92 unconverted consumption sites across 48 .dag files. REMAINDER after the first conversion: 91 unconverted consumption sites across 47 files. RE-DERIVATION: enumerate Filesystem Read assignment calls in tracked .dag source, excluding this adoption-standing data declaration so the instrument cannot count its own prose; for each bound result, classify it converted only when every success, error, and content projection is an argument of filesystem_read_outcome, otherwise classify it unconverted; count unconverted rows and distinct paths. NEXT-RUNG TRIGGER: the unconverted population reaches zero -- every Filesystem Read result projection occurs only as an argument to filesystem_read_outcome. The compiler-only filesystem_read intrinsic is a separate replacement migration and is not part of this population or this fold."
 
 data filesystem_absence_establishment_adoption_standing: String = "RUNG: structurally guaranteed for the consumers that route through filesystem_file_observation, on the source-to-.dag acceptance path only, and MITIGATABLE NOWHERE ELSE -- the raw Filesystem.Read and Filesystem.List operations stay callable, so a module that has not adopted the carrier can still write the conflation. This row states the unconverted population at identity grain rather than as a count, because a count is not a plan and a one-sided ratchet over a number measured on the current tree is the oracle section 5 rejects. SUBJECT: a site that concludes ABSENCE, NOT-PRESENT or a dropped element from a FAILED read or a FAILED boolean path test, rather than from a listing that succeeded. It is not every Filesystem.Read consumer -- most read a file they already know exists, and those are the separate filesystem_read_outcome adoption population above. ENUMERATED SITES, each one read rather than pattern-matched: the roster is EMPTY as of this row's restoration. The six identities the row carried on origin/main 6305a5174c all route through the carrier now -- gunbc.host_effect_nbd_proxy_serve host_effect_nbd_proxy_serve_read_session_token, v2.workflow.product_receipt_stage run_product_receipt_stage, tools.merge_admission_walk read_tested_subject and read_floor_receipt, gunbc.codex_supervised_turn codex_supervised_turn_generation_observation, and tools.opaque_realization_census declaration_body_standing -- the five converted by the change that empties this roster -- each preserving could-not-look as its own typed refusal rather than an absence, and gunbc.fleet_converge_plan_cli observe_cap_members_wet already converted on main -- so a could-not-look at any of them can no longer masquerade as an established absence. THE ROW STAYS NONE THE LESS, and an empty roster is not a deleted row: the raw operations remain callable outside this module, so the class shape can be re-spelled at a new site at any time, and what the row guards is the CLASS, not its former members. A site of this shape found anywhere is a defect to repair by adoption, not a row to add. The mistake this restoration repairs was deleting the row because its enumeration emptied rather than because the trigger below expired, which is exactly the failure the NEXT-RUNG TRIGGER paragraph exists to prevent. WHAT IS DELIBERATELY NOT ON THE LIST: gunbc.roadmap_belt_actuate belt_read_or_empty, whose collapse is scoped and argued in the annotation above its definition -- both branches take the same action at every remaining caller -- and gunbc.fabric_cell_acquire, which already establishes absence from the parent enumeration through its own four-state observation and would gain nothing but a second spelling. MONOTONE DIRECTION: the roster above may only shrink. A row leaves it when the site routes through filesystem_file_observation or filesystem_entry_presence, or when the site is deleted; a NEW site of this shape is a defect to repair rather than a row to add. NEXT-RUNG TRIGGER, and it names the capability rather than an artifact: the raw List and Read result projections cease to be reachable outside this module's folds, so a consumer cannot spell the conflation at all -- at which point the enumeration above has no subject and this row is deleted. That is the same trigger filesystem_read_outcome_adoption_standing carries, one question further in: it asks that every read projection be folded, this asks that every ABSENCE be established."
 
diff --git a/dag/test/claim/ci_app_key_rotation_witness_test.dag b/dag/test/claim/ci_app_key_rotation_witness_test.dag
index b466dc5b4b3..1e7ba86c9fe 100644
--- a/dag/test/claim/ci_app_key_rotation_witness_test.dag
+++ b/dag/test/claim/ci_app_key_rotation_witness_test.dag
@@ -89,6 +89,9 @@ import gunbc.auth.ci_app_key_rotation {
 import extdeps.filesystem.filesystem_io {
   FilesystemFileRead,
   FilesystemFileIndeterminate,
+  FilesystemReadRefused,
+  filesystem_file_observation,
+  filesystem_listing_observation,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -507,9 +510,9 @@ test fn a_readable_mint_record_still_decodes_through_the_read_fold() -> Bool {
 // A record that is not there and a record whose content could not be obtained are two facts, and
 // neither refusal text may claim existence: a failed look does not establish what is on the disk.
 // The Missing and Unreadable refusal arms are constructed here directly; the classifier arm that
-// maps the listing-established absence (FilesystemFileAbsent) onto Missing is the one arm this
-// witness cannot drive from a claim module, because the absence carrier is a sole_constructor of
-// filesystem_io and is not constructible here -- that arm is a one-line match reviewed in the diff.
+// maps the listing-established absence (FilesystemFileAbsent) onto Missing is driven separately
+// through the owner's producers in an_established_absence_of_the_record_refuses_as_missing_...
+// below -- the absence carrier is a sole_constructor of filesystem_io and is never forged here.
 test fn a_missing_record_is_distinct_from_unreadable_and_claims_no_existence() -> Bool {
   let missing = app_key_refusal_text(cause: AppKeyMintObservationMissing { cause: "the record path was supplied but the directory listing establishes absence" as NonEmptyStr })
   let unreadable = app_key_refusal_text(cause: AppKeyMintObservationUnreadable { cause: "permission denied" as NonEmptyStr })
@@ -523,3 +526,24 @@ test fn a_missing_record_is_distinct_from_unreadable_and_claims_no_existence() -
     && ((missing as String) != (absent as String))
     && ((unreadable as String) != (absent as String))
 }
+
+// MISSING-PATH CONTROL, DRIVEN THROUGH THE OWNER'S PRODUCERS (side-chat finding: constructing the
+// Missing refusal directly exercises only the rendering). A succeeded listing that omits the record
+// name plus a refused read establish the absence inside filesystem_io -- the sole_constructor
+// carrier is produced there, never forged here -- and the full chain must hold: the fold yields
+// FilesystemFileAbsent, the mint classifier maps it to AppKeyMintRecordMissing, the verify
+// classifier maps that to AppKeyMintObservationMissing, and the operator-facing text names the
+// absence and claims no existence.
+test fn an_established_absence_of_the_record_refuses_as_missing_and_claims_no_existence() -> Bool {
+  let listing = filesystem_listing_observation(directory: "/var/lib/gunbc/ci/app-key", success: true, entries: "stale-agent-sock\nnote.txt", error: "unused on success")
+  let observed = filesystem_file_observation(listing: listing, name: "observation.json", path: "/var/lib/gunbc/ci/app-key/observation.json", read: FilesystemReadRefused { error: "permission denied" })
+  match app_key_mint_record_from_observation(observation: observed) {
+    AppKeyMintRecordMissing { cause: c } => {
+      let text = app_key_refusal_text(cause: AppKeyMintObservationMissing { cause: c })
+      contains_text(haystack: text, needle: "no record is there")
+        && !contains_text(haystack: text, needle: "exists")
+    }
+    AppKeyMintRecordDecoded { observation: _ } => false
+    AppKeyMintRecordUnread { cause: _ } => false
+  }
+}