roadmap: convert Filesystem.Read sites to the read-outcome and file-observation folds

[gunbai-bot]

Batch 2 of the read-outcome adoption trial (filesystem sibling of DP-M5), on the roadmap subsystem, per the parent trial's rulings. Branch is current with origin/main b7543755c8b (merged; the event-carrier proceed path keeps main's new roadmap_event_admitted_after result-binding gate inside the extracted no-receipt path).

Reds first — where an unreadable file used to read as empty/default:

1. belt_occurrence_record_for_attempt read occurrences with a silent [] default: an unreadable occurrence record file became "no occurrences". Now returns AttemptOccurrenceRecordRead = Decoded | Refused, and the census aggregate BeltAttemptOccurrenceRecords carries Observed | Refused; the population caller rides the existing OccurrencePopulationRefused channel instead of silently shrinking the population.
2. belt_workflow_attempt_evidence_for_ref and the publication gate read the modeled-state pointer with a silent default; an unreadable pointer file was indistinguishable from an absent one. Now WorkflowModeledStatePointerState = Absent | Unreadable{cause}; the absent arm keeps today's text, the unreadable arm refuses honestly.
3. ci_app-style kind-string matching deleted in the roadmap receipt paths: the tick receipt and served-observation receipt classifiers text-matched host error strings ("No such file", "not found") and were deleted, replaced by *_from_observation(observation: FilesystemFileObservation) over filesystem_file_observation_of_path — an established fact, not a string comparison (the same construction the parent ruled for event_carrier:232).
4. attempt_request_binding_read_of classified error_kind == "not_found" into RequestBindingAbsent — presence inference from a kind string. Deleted; the classifier now takes the observation: established absence → RequestBindingAbsent, readable → decode, listed-but-refused or otherwise unreadable → RequestBindingUnreadable{cause}. The witness's absent arm is driven through the owner's producers (filesystem_listing_observation omitting the record → filesystem_file_observation → absent), not sealed construction. This site is new on main (Dogfood G4: return a typed attempt result to the requester on the issue event log #13075 added it) and was found by the batch's re-measure.
5. served_observation_body_read_from_filesystem mapped !success to BodyMissing — a failed read claimed absence. Now BodyMissing only on established absence (the row's absence detail names what was established), and the type gains ServedObservationBodyUnreadable{cause}; the consumer refuses 503 with the unreadable label. New red control: a listed body that cannot be read refuses as unreadable and the rendered refusal does not contain the Missing string.

Mechanical conversions (read result bound and matched as the typed outcome, refusals carry the prior default-message): belt_actuate — submission artifact, capture roster, capture for head, spawn origin, worktree bind, integration receipt, tick receipt; acceptance_history_carrier:35; closing_contract_authoring:134; publication_helper:261/906; validation_oracle classifier re-signature plus both callers; event_carrier receipt flow (error_kind comparison replaced by observation arms; committed read folds; proceed path extracted, main's result-binding gate preserved); event_carrier:317; claude preflight decision re-signature plus live caller and four witness call sites construct fold outcomes.

Findings recorded on the row (via #13262, not here):

• argued_collapse (both branches take the same action at every remaining caller): belt_read_or_empty (belt_actuate:7290; annotation above its definition, review 45271; exempted in the absence row) and attempt_launch_revision_hex (served_observation:208; presentation note pinned by roadmap_presentation_witness_test). Not converted here; if a caller is found where the branches act differently, that falsifies the argument and the site becomes a target — reported, not converted silently.
• domain_read_fold: the gunbc.machine_intake proc_read_outcome sites are typed outcomes, not silent defaults — excluded from targets as their own class; the DESIGN 3 fork (it carries error_kind, which the shared fold lacks) has its next-rung trigger and owner named on the row in filesystem: read-outcome adoption row prose corrected; no live remainder claimed #13262.
• Counted debt, ruled out of conversion by the parent: belt_actuate:5670 (admission) and :5672 (spawn_failure) in belt_workflow_attempt_evidence_for_key feed the attempt evidence wire fields (Bool + String) which have no cause slot — an honest conversion needs a typed evidence outcome on the wire, and the wire and its consumers are owned by gunbc.roadmap_belt_actuate. Per the parent's ruling these are NOT a fourth excluded class (an exclusion says "this is not debt"; these are debt): they stay unconverted and COUNTED in the remainder, and the row (via filesystem: read-outcome adoption row prose corrected; no live remainder claimed #13262) names what they need and who owns it.

Delta at identity grain (instrument = the row's RE-DERIVATION recipe; re-measured at this head acf387f894): before the batch, at the merged base b7543755c8b: 222 unconverted consumption sites across 102 files (65 fixtures), 53 converted. After: 207 unconverted across 101 files (65 fixtures), 70 converted — non-fixture unconverted 157 → 142; two new sites #13075 added are converted, not added to the debt. Roadmap non-fixture unconverted: 21 → 4 (2 argued, 2 parked). The row's REMAINDER sentence is re-measured at b7543755c8b in #13262; when this lands the row re-measures again at this head (207/101/65).

Verification: all eight roadmap modules and all three touched witness tests compile on this tree with gunbc compile (dependency pool primary-precedence, source roots dag + src/v2): the only diagnostics in their closures are the pre-existing extdeps/gunbc/gunbc.dag:108-110 shell-transport cluster, untouched here. CI is the verifier for the whole-corpus runs (session runners OOM on them).

[briansrls]

Two semantic blockers remain. The rest of the conversion is sound.

1. An unreadable current-attempt pointer is still collapsed into the legacy/absent state downstream.

WorkflowModeledStatePointerState distinguishes Absent from Unreadable, but belt_workflow_attempt_evidence_without_modeled_state turns both into one WorkflowAttemptEvidence with modeled_state_present: false. It also fills several downstream facts with absence-shaped values (SelectionAbsent, VerificationReceiptAbsent, ReceiptSourceAbsent, review_report_absent, empty goal-audit rows).

That distinction is then lost immediately: workflow_provider_from_evidence treats every modeled_state_present == false as the legacy-attempt arm, and gunbc.roadmap_workflow_command.is_legacy_attempt is literally !modeled_state_present. A pointer read refusal can therefore be presented and consumed as “attempt predates modeled admission / legacy — supersedable,” which is a factual default, not the new unreadable state.

Please carry the typed pointer standing into WorkflowAttemptEvidence (Observed/Absent/Unreadable), or refuse the evidence construction at a distinct top-level arm. The unreadable route must not mint legacy standing or absence-shaped receipt facts. Add a composed control through workflow_provider_from_evidence/the workflow projection, not only a helper-level message test.

2. Two consumers overclaim what FilesystemFileIndeterminate proves.

That arm is produced in two materially different worlds:

• the directory listing itself failed, so whether the entry exists is unknown;
• the listing named the entry and its read failed, so existence is established but content is unavailable.

The new served-body response maps every FilesystemFileIndeterminate to text saying the body “exists but could not be read.” The event carrier maps every one to “the operation receipt is listed and could not be read.” Both are false for the listing-refused world.

Please use wording valid for the carrier’s whole domain (for example, the subject could not be observed, so existence/content is unknown), or preserve a richer distinction before rendering. Add listing-refused controls at both loci; the current witnesses cover only the listed-but-unreadable case.

What passed:

• the occurrence-record conversion correctly refuses the whole census, names the attempt, and no longer silently returns [];
• request-binding, tick-receipt, served-index, and served-body absence is reached only through FilesystemFileAbsent, with witnesses deriving the sealed absence through a successful listing omission;
• the new served-body unreadable arm correctly maps the listed-but-unreadable case to HTTP 503 and is discriminated from BodyMissing;
• the mechanical read-outcome conversions retain their former refusal text/behavior rather than defaulting;
• the validation-oracle and Claude-preflight re-signatures are updated at their production and witness callers; exact-head whole-tree compilation found no stale old-signature caller.

All four exact-head lanes are green. They do not catch these two cross-carrier semantic collapses.

[briansrls]

One blocker remains from review 5407300746.

The top-level standing repair is correct: WorkflowAttemptEvidence now carries Observed | Absent | Unreadable, workflow_provider_from_evidence refuses Unreadable as “attempt standing unknown,” Workspace refuses it, and is_legacy_attempt names all three arms and returns true only for Absent.

But belt_workflow_attempt_evidence_without_modeled_state still unconditionally mints the same absence-shaped subordinate facts for BOTH pointer states:

• verification_selection: SelectionAbsent
• verification_source: VerificationReceiptAbsent
• publication_source: ReceiptSourceAbsent
• review_report_absent(...)
• goal_audit: []

This is observable, not merely an inert record inconsistency. workflow_attempt_progress passes verification_selection directly to verification_segment without first gating on modeled_state. verification_segment matches SelectionAbsent first and renders VerificationWorkflowSegment as Pending (“the belt has not selected…”). ReviewWorkflowSegment and GoalAuditWorkflowSegment then also render Pending. Thus an unreadable current-attempt pointer still becomes absence/pending in three workflow projections even though provider and workspace now refuse it as unknown.

The new composed control does not catch this because it stops at workflow_provider_from_evidence; it never calls workflow_attempt_progress or inspects the segment roster.

Please make the unreadable branch non-absent all the way through. A sufficient repair is to populate SelectionUnaddressable { cause }, VerificationReceiptUnreadable { detail }, and ReceiptSourceUnreadable { detail } for WorkflowModeledStatePointerUnreadable, and/or gate every dependent segment on WorkflowModeledStateUnreadable before it consumes subordinate fields. Add a composed control through workflow_attempt_progress requiring the unreadable case to refuse as unknown rather than producing pending/absent verification, review, or goal-audit standing. The established-absent case should continue to take the legacy arm.

The second prior blocker is closed. Served-body and event-receipt indeterminate wording is valid for both producer worlds (“could not be observed”), the listing-refused controls preserve the owner’s cause without claiming existence, and listed-but-unreadable remains a distinct 503 at the served-body boundary. The observed-state provider chain also preserves main’s ordering: admission receipt, receipt content, spawn failure, event capture, then process reconciliation.

All four exact-head lanes are green. I found no other blocker.

[briansrls]

Re-review at ae53cd5: approved.

The remaining pointer-standing collapse is closed at both seams.

1. Evidence construction now derives subordinate standings from WorkflowModeledStatePointerState. Established absence alone produces SelectionAbsent / VerificationReceiptAbsent / ReceiptSourceAbsent / review_report_absent. An unreadable pointer instead produces SelectionUnaddressable, VerificationReceiptUnreadable, ReceiptSourceUnreadable, and review_report_refused, each carrying the located pointer-read cause. The unreadable route can no longer mint the absence-shaped subordinate facts that previously rendered as “not yet.”

2. workflow_segment_from_evidence now gates on WorkflowModeledStateStanding before reading any subordinate field. WorkflowModeledStateUnreadable produces a refused segment for every workflow obligation with the pointer cause; Observed and Absent alone enter the existing fold. That closes verification, review, and goal-audit even if a future subordinate field regresses.

The controls are at the right grain: one checks the pure standing projections, and the composed workflow_attempt_progress control requires unreadable standing to refuse verify/review/audit while established absence retains the legacy pending behavior. is_legacy_attempt remains exhaustive and true only for WorkflowModeledStateAbsent.

The prior indeterminate-wording repair remains intact, and the fresh main merge preserved both sides of its only conflict. Exact-head floor, generated, emit-build, and aggregate witnesses are green. No remaining blocker.

[gunbai-bot]

Agreed — the placeholder refused read in the HOME-unset arm of belt_claude_preflight_for_instance is fabricated shape: the arm owes the function's typed read-outcome, but nothing downstream reads it because belt_claude_preflight_decision refuses on the empty HOME before that argument is touched. The honest fix is to return the refusal directly rather than mint a read that pretends to have been observed. The branch is deliberately confined to the merge-conflict resolution right now (dequeued for re-review on the conflict-only diff), so I'll make that change as a follow-up immediately after it requeues rather than dirtying the diff under confirmation.

[briansrls]

Approved at d1a3669.

The merge resolution preserves both parent semantics in the WorktreeBind arm, in the right order:

1. Filesystem.Read is classified through filesystem_read_outcome; FilesystemReadRefused retains the previously approved located refusal text.
2. FilesystemReadSucceeded feeds the content into main's belt_scm_delta_resident_for re-bind check.
3. DeltaResidentRefused retains main's refusal text and halts the fold.
4. DeltaResident passes its resident store to store_authored_source; SourceStored carries the resulting store and re-binds the path's unique target.

The merge commit's parents are the previously approved head ae53cd5 and main@864c9ce0c9. The exact head is mergeable, and floor, generated, emit-build, and aggregate witnesses all passed. No remaining blocker.