extdeps.systemd.systemd_run: typed options, one projection, ArgvCommand everywhere

[gunbai-bot]

Debt paydown trial (witty-tern-54), PR 1 of 2. The shell-to-dag census counts only shell-text sites; this cuts over the module where argv words were hand-assembled from strings.

Deleted (delete-first): systemd_run_property_argv, systemd_run_user_transient_arguments, systemd_run_user_wait_arguments, systemd_run_system_scope_argv, systemd_run_property (free-form NAME=VALUE hole), systemd_run_transient_unit_argv, systemd_run_transient_wait_unit_argv — seven string-glued builders, gone in the same change.

Minted: SystemdRunOption — a sealed sum whose arms carry systemd-run(1)'s own spellings at systemd 255, the major the module's summary ground reads (grounded_summary_format_majors = [255]). One wire projection, systemd_run_option_words; every builder returns ArgvCommand through SystemdRunCommandReading (Ready | Refused). The service operations take the projected words, and the transport template leads with the declaration literal per the materializer's executable-position contract (ExecutablePositionNotLiteral refuses a bindable argv[0] — the witness run showed the materializer enforcing it and the authority check going red until the template carried the literal head).

Refusals at the wall (reds, all green in the run): a unit name carrying /, a unit name or property value or setenv side carrying a newline, a setenv name carrying =. An unknown flag has no arm to ride: the sum is closed, and every_option_variant_renders_its_man_page_spelling walks all variants so a new one must be spelled there or compilation fails.

Positive controls (projected words == old words, byte for byte, for existing callers): systemd_wait_route_projects_the_old_words, the_user_wait_builder_projects_the_words_the_string_form_rendered, witness_review_unit_option_words_are_the_string_form_words, witness_systemd_run_property_argv_renders_the_wire_name; plus the materialization half, systemd_wait_route_materializes_the_projected_words, and the bridge's authority checks joining materialized words against the one projection.

Callers migrated: roadmap_dispatch_actuator (four unit mints return readings; belt layer composes the resolved program head with projected words; refusals land in ExecRefused/ExecStepFailed), roadmap_belt_actuate (four sites), runner_microvm_lifecycle_realize, runner_throughput_qualification_route (ephemeral_slot_argv -> ephemeral_slot_command), compute.work_provider_local, compute.unit_bounds (grant fold yields typed properties), auth approval_device_enrolment_code_issue, gunbc.systemd_run_transient (bridge carries the typed command end to end), host_effect_nbd_proxy_serve.

Property vocabulary: SystemdUnitProperty widened with the seven real settings the dispatch units bind (StandardOutput, StandardError, ProtectSystem, ProtectHome, PrivateTmp, ReadWritePaths, RemainAfterExit) so no property travels as a free-form string; unit_bounds' KillMode/WorkingDirectory/etc. now cite the enum.

Verification: remote ctrl-build; parse sweep clean over all 21 touched files; CI-lane claim batch (claim_executor's lane shape) over the eight affected witness files plus the manual wet-receipt entry: 20 pass, 0 fail, on the merged tree (origin/main merged before this push). The ephemeral-slot closure types 640 modules clean.

Follow-up (PR 2): the census lens + roster instrument (branch session/witty-tern-54, walk reads the corpus per module; this PR's rows leave the roster and the delta report goes in that PR).

Blocker 6 (manager-side execution), per the parent session's decision: the typed_builder_wet_test claims are removed from this PR entirely — no CI lane can run systemd units, so a claim file nothing can execute is dangling. The standing lives as the module-scope systemd_run_manager_side_claim_gap: DissolutionCondition beside the builders in dag/extdeps/systemd/systemd_run.dag (population: the typed builders' manager-side contract — retained stays loaded, collected is not-found, waited reports the exact child exit; current: no REQUIRED automated claim covers it, the manual lifecycle receipt being non-required real execution; trigger: a required-workflow lane exists that can execute these system-manager builders (they carry no RunUserManager arm, so they target the default/system manager, which the manual lifecycle receipt also executes) under their required privilege/elevation posture, at which point the retained/collected/waited claims are authored and enrolled through the same production integration and the row retires). The fact for the record: the retired builders had NO real execution on CI before this PR — on origin/main the only test invoking real SystemdRun operations is dag/test/manual/runner_microvm_lifecycle_wet_receipt_test.dag, which is not CI-executed (manual/ placement, no LocalRepoWetLane row on main for it, no wet-lane CI job); every other test reference is hermetic word-shape. The gap is pre-existing and simply declared now.

[briansrls]

The closed option model and most caller migrations are directionally right, but several execution semantics changed or are currently broken.

1. Local/direct service callers pass the systemd-run program twice.

The service transports now own the literal head: argv: ["systemd-run", command_argv]. But systemd_run_transient_local, systemd_run_transient_wait_local, and the changed manual wet receipt pass argv_words(command), which already begins with systemd-run. Those routes execute systemd-run systemd-run --unit=..., not the projected command. The module already has the correct accessor, systemd_run_command_argument_words; use it for service-operation inputs.

The same ownership error appears in the compute route: compute_exec receives the resolved systemd-run program separately, while systemd_summary_printing_wait_argv now returns the full argv_words, so the first argument is another systemd-run. The accessor must return the argument tail when its consumer owns the program.

2. RunTransientRetained has silently acquired --collect.

systemd_run_transient_unit_command always includes Collect. runner_microvm_lifecycle_realize and the manual start_retained_payload now use that builder and then call RunTransientRetained. This contradicts this module's own retained-operation contract: --collect unloads terminal Result, ExecMainStatus and Environment, which are exactly why the retained operation exists. Add a distinct retained builder with no Collect and migrate retained callers to it.

3. FleetSsh wait lost a load-bearing typed refusal without gaining exact remote status.

The previous systemd_run_transient_wait_read explicitly refused FleetSsh until remote command status was distinguishable from SSH transport status. The new arm calls typed_argv_exec_over_fleet_ssh and treats its SshSessionExecResult.exit_code as the waited command's exact status. That carrier still documents the exit-255 collision; no began/status side channel landed here. Restore the refusal or add the richer protocol before admitting FleetSsh wait.

4. A projection refusal is fabricated as an executed exit in compute.

compute_run_unit maps SystemdRunCommandRefused to ComputeExecFailed { exit_code: 126, ... }. Nothing executed and no process supplied 126. Preserve it as a typed refusal (either a new ComputeExec arm or a refusal at the enclosing result) rather than manufacturing a plausible process observation.

5. The advertised byte identity is incomplete, and the generic token equality is no longer exact.

The old non-wait transient builder emitted --unit, then --collect, then properties. systemd_run_transient_unit_command emits --unit, properties, then --collect. Systemd may accept both, but this is not word-for-word preservation and no positive control covers that builder. Restore the old order or explicitly disposition and execute the semantic change.

Also, argv_exact_token_equal dropped the cardinality equality that made the separator encoding injective for the empty-list/single-empty-word boundary. Restore count(left) == count(right). The three new cardinality claims are true for the one 11-word fixture; the latter two are implied by the first and do not establish the general equality predicate.

6. DESIGN §3 pairing is not established at this head.

The only real systemd-run claim is still dag/test/manual/runner_microvm_lifecycle_wet_receipt_test.dag, documented as manually invoked and floor-excluded. Its changed start routes currently contain the double-program defect above, and the exact-head required jobs did not execute that manual real path. After fixing composition, run/enrol at least one current typed builder through real systemd-run on this exact tree, including one retained invocation that proves terminal state remains observable.

What passed: the option sum is closed; property, unit and setenv refusals stop before command construction; most product callers preserve refusal as a typed non-execution outcome; the new property-overlap arms (StandardOutput/Error, ProtectSystem/Home, PrivateTmp, ReadWritePaths, RemainAfterExit) are correctly SettableDirective; and the fixture's projected 11-word count itself is correct. Exact-head floor/generated/emit-build/witnesses are green, but none exercises these execution compositions.

[gunbai-bot]

Reviewer map: the six side-chat blockers, each with the commit that closes it and the control that witnesses it (fabric entry = dag/test/claim/fabric/systemd_run_transient_wait_witness_test.dag, 16/16 green at head).

1. Program passed twice. 6d01965 — systemd_run_transient_local and systemd_run_transient_wait_local hand the transport systemd_run_command_argument_words(command) (the argument tail); the transport owns the ["systemd-run", ...] head. Same correction in the wet receipt (start_retained_payload) and systemd_summary_printing_wait_argv (compute gets the program separately). Controls: systemd_wait_route_projects_the_old_words + systemd_wait_route_materializes_the_projected_words (head/tail split), the_user_wait_builder_renders_the_old_order.
2. --collect on retained. 6d01965 — new systemd_run_transient_retained_unit_command (identical to the collecting builder minus the Collect arm); runner_microvm_lifecycle_realize and the wet receipt's retained invocation migrated to it; RunTransientRetained semantics restored (terminal state not collected). Controls: the_retained_transient_builder_omits_collect; wet claim asserting the retained unit stays loaded.
3. FleetSsh wait refusal. 6d01965 — systemd_run_transient_wait_read's FleetSsh arm returns SystemdRunTransientWaitTransportRefused { reason: "systemd-run transient wait refused FleetSsh until exact remote status is distinguished from transport status" } (ssh's own 255 collides with a remote exit status). The outcome sum is discriminated in the fabric entry (completed-exit-86 arm vs refusal arm).
4. Fabricated 126. 6d01965 — ComputeExec gained ComputeExecRefused { reason }; compute_run_unit's SystemdRunCommandRefused arm returns it (nothing ran, so no exit is fabricated); all ComputeExec matches widened (work_provider_local, test_run, checkout) and the refusal surfaces as WorkInfrastructureRefusal.UnitLaunchRefused.
5. Order + equality. c2108c0 — non-wait transient builder restored to --unit, --collect, properties, --; scope builder restored to --user --scope lead; argv_exact_token_equal carries length(left) == length(right) again. Controls: the_collecting_transient_builder_emits_unit_collect_then_properties, the_scope_builder_leads_with_user_and_scope, probe_materialized_cardinality_is_exactly_11 (the retired user-wait builder emitted -p and its value as two words — 71a9a1c~1 list_push(list_push(acc, "-p"), p) — so the 11-word count pins the general shape, not one fixture).
6. Real execution. 56affb0 — dag/test/claim/systemd/typed_builder_wet_test.dag: three claims through real systemd-run on LocalRepoWetLane (retained failing unit still loaded via ShowLoadState; its collected twin not-found; waited invocation reports exit 86 exactly), proving terminal-state observability for a RETAINED invocation. Enrolled as LocalRepoWetLane in dag/gunbc/ci/ci_layer_roots.dag.

Post-review tree fixes: floor declaration errors (comments inside fn bodies are not modeled — moved to module grain: 87466b6, 2723f94) and the property-union rename (MemoryMaxProperty → MemoryMax, e2dd286). origin/main merged through 87466b6.

[briansrls]

Approved at c6ce015.

The prior blocker is closed. The dissolution row now states the actual manager posture: the retained, collecting, and waited builders carry no RunUserManager option, target the default/system manager, and are the same builders traversed by the non-required manual lifecycle receipt. Its trigger now requires a required-workflow lane capable of executing those exact system-manager builders under their required privilege/elevation posture, followed by retained/collected/waited claims authored and enrolled through the same production integration. That is sufficient; a merely usable user manager can no longer satisfy the trigger while leaving the population unpaired.

The PR body matches the exact-head declaration. Exact-head run 37450090474 is green across generated, rust-unit-tests, emit-build, floor, and aggregate witnesses.

Nonblocking wording cleanup: the comment immediately above the row says “three SystemdRun service transports,” while the population is three builders (retained and collected share RunTransient, waited uses RunTransientAndWait). The typed DissolutionCondition description itself says builders correctly, so this does not affect the verdict.

[gunbai-bot]

Agreed on the mechanism — this exact fix was applied at 8696c2e (systemd_unit_property_wire(property: compute_kill_mode_property) as String, with the extdeps.systemd import) and then reverted from the branch under the trial's routing: the side-chat-approved head does not move for review polish, and every extra content delta restarts review and CI on a PR that is already queued.

It is on the recorded follow-up list (with review 77115's two items and the two comment-wording notes from reviews 77663 and the parent's queue note) to land as a follow-up PR immediately after this one merges. The current head's only delta beyond main is the two optional-equality comparison fixes the merge-group floor demanded (plus main's own merge content).

— sent from witty-tern-54