Managed-host cut O1c-3a: ManagedHostAdmission population with drop-arm for mtcollins1

[gunbai-bot]

Summary

• managed_hosts() is now a projection of committed ManagedHostAdmission records (OrdinaryMember | MemberUnderDeclaredDrop | Absent). Currency still means compare_qualification_subject against megarac_current_build; it is not redefined.
• mtcollins1 remains on the projected roster only as MemberUnderDeclaredDrop citing mtcollins1_bmc_secure_standing_predates_reflash. No mtjade1 admission record (still Absent).
• Cut O1c-3 PR (a) only. Does not enrol the 13 KVM hermetic route gaps. Does not enqueue.

Test plan

• claim_batch --hermetic on managed_host_admission_witness_test (8 claims, eval_steps 1401–7280, inhabitance 7280)
• claim_batch --hermetic on managed_host_admission_forged_probe_witness_test (3 compile RED probes)
• Consumer inhabitance: reset-roster, unit-hold, boot, boot-federation, megarac-managed-host (all PASS)
• Reviewer: do not merge or enqueue from this session

Parent warm-crane-577 D2: drop-arm, not a currency rewrite. #13419 is on this merge-base; #13433 is also already on main (this PR does not touch the sealed dry helpers).

Made with Cursor

[gunbai-bot]

review 38602 — agreed on both points; fixed on 69c8bed.

RungDrop.population is still the §4b(3) English bound for the DESIGN projection (rewriting that field into HostIdentity would fork the drop authority). Admission no longer reads it. drop_covers_superseded_bmc_secure joins the standing row's identity to mtcollins1_bmc_secure_standing_predates_reflash and the host to operator_host_mtcollins1. The duplicate decl_name check inside project_managed_host_admission is gone.

Same-path REDs: w_covering_is_host_identity_and_drop_identity_not_population_prose (srv1 is not covered; empty/unrelated population still covers mtcollins1; a different identity whose prose names mtcollins1 does not). w_a_matching_drop_whose_population_does_not_name_the_host_still_admits_mtcollins1 goes through project_managed_host_admission. Hermetic claim_batch 13/13 PASS on that head's staged tree.

— sent from crisp-eagle-656

[gunbai-bot]

review artifact /api/reviews/77308: verified on 69c8bed — both findings held.

Fixed in f525d7b:

• One fold: managed_host_memberships_projected / managed_host_memberships(). managed_hosts() and managed_hosts_projected map that list; they no longer re-run project_managed_host_admission.
• Production consumers of the drop population match MemberUnderDeclaredDrop before they use the row: managed_host_binding_for, reset roster/reset_subject_for, boot_federation_for/provisioned_boot_federations, boot_subject_admission_for, unit-hold admission/store hosts/maintenance hold, MegaRAC admission, boot-handoff probe, mtcollins1 SMpro read.

Hermetic PASS: drop membership, production roster+federation on that arm, no-drop roster empty, mtjade1 unmanaged.

[gunbai-bot]

Verified against current head (a579dd8b6b) for review 77320.

Drop reaching consumers as silence: real. Matching MemberUnderDeclaredDrop and then doing the ordinary-member body discarded the citation. Consumers now return drop-aware standings:

• ManagedHostFoundUnderDeclaredDrop from managed_host_binding_for
• BootFederationProvisionedUnderDeclaredDrop from boot_federation_for
• ResetRosterHostUnderDeclaredDrop / ResetSubjectAdmittedUnderDeclaredDrop from the reset roster and reset_subject_for

Dispatch still needs host names (reset_roster_hosts); the roster entry itself carries the drop. Hermetic: w_reset_roster_and_boot_federation_match_the_declared_drop_arm.

Generic join hard-coding one host: real. current_subject and covering_drop now live on the admission record (unit mint fills them). Coverage is drop_is_standing_citation — standing row identity joined to the record's cited drop — not (host as String) == operator_host_mtcollins1. Hermetic: w_covering_is_cited_drop_identity_not_population_prose.

— sent from crisp-eagle-656