Accepting wildcards cut 3: name the two wet-step exit gates

[gunbai-bot]

Accepting wildcards cut 3: name the two wet-step exit gates

Two wet-step gates whose wildcard arm returned the accepting answer (ExitSuccess), so a state added to either outcome coproduct would silently report success. Both now name every arm. On the original base both carried a wildcard _ => ExitSuccess; main has since landed the same named arms independently (both non_fold_residue rows are already dissolved there), so this PR now contributes the extracted pure classifiers, the wet steps calling them, and the hermetic pins. (Stacks on #13383, which stacks on #13382.)

1. dag/gunbc/machine_intake/mtcollins1_kvm_observer_observe.dag::mtcollins1_kvm_observer_release_wet

• Bad state: match hold { ProbeHoldUnreleased { .. } => exit_failure, _ => ExitSuccess } over ProbeHoldReleaseOutcome — five constructors, four of them unnamed: Released, AlreadyFree, NotOurs { holder }, Stale { detail }.
• Path that permitted it: the wildcard carried the step's accepting answer (the release succeeded) for every constructor it did not name. Each of the four is right today — released, already-free, not-ours and left-alone-stale all mean nothing this run owns stays held, which is the fn's stated contract ("fails loudly only when something this run owns stays held"; the module's own probe_hold_release_outcome_text renders Stale as "left alone, stale") — but right by default, not by decision: a release outcome added later (e.g. a partial or unknown-lease state) would have inherited success and a leak would have reported as a clean release.
• Owning invariant: the fn's own contract, plus the outcome coproduct's producer (kvm_observer_release_unit_hold, gunbc.managed_host_unit_hold), which states each outcome's meaning.
• Repair at the owner: the outcome→exit decision is extracted into a pure classifier the wet step calls — probe_hold_release_step_exit in gunbc.managed_host_unit_hold (beside the type and its text classifier), naming all five outcomes. The four success outcomes are named => ExitSuccess; ProbeHoldUnreleased stays the one loud failure, carrying the same line (process + hold outcome text) as before via the classifier's context line. Behavior is unchanged for all five existing constructors.
• Executed discriminator: hermetic claims pin the classifier (see site 2's receipt): an_unreleased_hold_fails_loudly_with_the_run_context and released_and_no_op_holds_still_pass PASS at this head (they also pass against main's decision shape — the enumeration is behavior-preserving; the fresh-constructor refusal is the compiler's, executed by the totality demo). Full required floor exits 0 at this branch's head.
• Census row deleted: dag/gunbc/machine_intake/mtcollins1_kvm_observer_observe.dag::mtcollins1_kvm_observer_release_wet.

2. dag/gunbc/spark/pair_serving_authority_log.dag::host_placement_cleanup_wet

• Bad state: match cleanup(...) { PlacementCleanupStillFencing { .. } => exit_failure, _ => ExitSuccess } over PlacementCleanup — four constructors, three unnamed: FinalizedAt, AbortedAt, and PlacementCleanupUnread { cause }.
• Path that permitted it: PlacementCleanupUnread is a present constructor meaning the cleanup outcome could not be read at all (the log store was unreadable, or the named preparation is not on the placement chain — the producer's own grouping). Through the wildcard it answered success: the step reported the group's placement cleanup complete while nobody knew whether the fencing had stopped. This is a fail-open on a live state, not only on a future one.
• Owning invariant: the step's decision is by outcome: Finalized and Aborted report completion; StillFencing is loud failure; and per DESIGN 5, "a failure arm must refuse, never widen" — an unreadable outcome is not evidence the fence is down, so it must fail loudly too.
• Repair at the owner: the outcome→exit decision is extracted into a pure classifier the wet step calls — placement_cleanup_step_exit (beside the type and its line classifier) — naming all four outcomes. Behavior change (against the original base, superseded on today's base by main's own landing of the same arms): PlacementCleanupUnread { cause } → exit_failure(reason: cause), the cause text being the producer's own located explanation. Against the current base this half is a pure extraction with no behavioral delta; FinalizedAt and AbortedAt => ExitSuccess by arm; StillFencing unchanged.
• Executed discriminator (red against the wildcard decision shape, green after): hermetic claims pin the classifier without an executor, a host store or a clock. Run on the BuildBuddy runner against the pre-main decision shape (the old wildcard relocated verbatim into the classifier): an_unread_placement_cleanup_fails_loudly_with_its_cause FAILs — the wildcard answered success for a present constructor. At this head the same claim PASSes, along with a_finalized_placement_cleanup_still_passes (finalized + aborted), a_placement_still_fencing_fails_loudly_with_its_cause, and — for the kvm gate — an_unreleased_hold_fails_loudly_with_the_run_context and released_and_no_op_holds_still_pass. Totality demos executed earlier (removing an arm per site refuses non-exhaustive); full required floor exits 0 at this branch's head.
• Census row deleted: dag/gunbc/spark/pair_serving_authority_log.dag::host_placement_cleanup_wet.

Census

Two rows deleted from dag/gunbc/non_fold_residue.dag by hand. Roster 907 → 904 (cut 1) → 899 (cut 2) → 897 (cut 3) across the branch set.

[gunbai-bot]

Fixed in a1cd473 — PlacementAbortedAt is now named in the line-9 import. (It had resolved only through the imported classifier's signature types; explicit is right.)

The executing discriminator you asked the behavior change to have now exists, and it has been run on the BuildBuddy runner end to end:

• placement_cleanup_step_exit and probe_hold_release_step_exit now own the two outcome→exit decisions as pure functions (the wet steps are their wet callers after executor, host store and clock are named).
• an_unread_placement_cleanup_fails_loudly_with_its_cause run against main's decision shape (the old wildcard, relocated verbatim into the classifier): FAIL — the wildcard answered ExitSuccess for PlacementCleanupUnread.
• The same five hermetic claims at this head: all PASS — unread fails loudly with its cause, finalized and aborted still pass, still-fencing fails loudly, an unreleased hold fails loudly with the run's context line, and released/already-free/not-ours/stale still pass.

Totality demos for both gates and a full required-floor run (exit 0) were executed earlier at this branch's head.

— sent from loyal-boar-500

[gunbai-bot]

Both blockers from review 76955 and the comment finding from review 76961 are fixed.

• Conflict markers + reverted named arms (review 76955): my rebase resolution of the extraction commit took the whole pre-merge file, which both left <<<<<<< markers in non_fold_residue.dag and reverted main's wider de-wildcarding in pair_serving_authority_log.dag (preparation, JSON member decoders, cancellation retry). 0629b83342 restores both files to the cut-2 base and re-applies only this branch's actual delta — the two classifiers, the wet steps calling them, the hermetic claims. The two roster rows are already absent on main, so the roster now matches base verbatim.
• Stale behavior-change claim (review 76961): agreed — after the rebase, main's named arms (including PlacementCleanupUnread => exit_failure) are the base, so the spark half is a pure extraction. The test comment is reworded in 5d6412aa8f to say the decision is extracted and pinned by name and was already loud on base, and the PR body's repair/discriminator receipts now state the same: the red receipt was executed against the pre-main wildcard decision shape (scratch relocation), not against this PR's base.

Verification: full required floor (parse, roster, witnesses) runs green remotely at the repaired head — exit 0, zero refusals, including the wet lane this time.

— sent from loyal-boar-500

[gunbai-bot]

Closed without folding in the v1 closeout bankruptcy (#13641). Stacked on #13383, which is closed. Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604