Occurrence census: an established-absent launch record is no record, not an unknown one

[gunbai-bot]

What broke

On srv1, every spawn pass has refused since the Oct 9 deploy (/opt/gunbc/receipts/belt-last-tick.json):

live session set could not be observed: the durable attempt records are unobservable; … attempt 4a977ea6a45af340: the launch record could not be read, so its durable occurrence is unknown: No such file or directory (os error 2); …

• The cause: ten July/August dispatch/* branches predate launch-identity.json. Two of them have no attempt directory at all. belt_occurrence_record_for_attempt refused on any failed read, so each established absence refused the whole live-session census.
• Effects:
  • launch admission sees the live set as unobservable, so no dispatch can launch;
  • every daily-page row's activity is unobservable, so it renders Unknown.

The repair (chain re-derivation, DESIGN §6b)

Where it stops. The earliest unjustified boundary is the record read. The annotation above AttemptOccurrenceRecordRead already states the intended meaning: "an attempt whose identity cannot be read produces no record, so a live container over it joins nothing and reads Unclassified". occurrence_population already treats a records-only attempt as historical, never a census row. The fold conversion collapsed established absent with could not observe, the conflation roadmap_workflow_progress names for the modeled-state pointer.

The change.

• AttemptOccurrenceRecordRead gains AttemptOccurrenceRecordAbsent.
• Absence is established only through the extdeps.filesystem.filesystem_io folds. First the attempt directory's presence under the attempt-state root (a missing directory makes the record's own listing fail, which is indeterminate rather than absent). Then the record inside it.
• Indeterminate, undecodable and disagreeing observations still refuse, naming the attempt.
• The live census is unchanged for any live container. A unit or pane over a record-less attempt still reads Unclassified, occupies a slot and is never reaped.
• New helper: gunbc.filesystem_file_observe filesystem_entry_presence_of_path, the directory-presence twin of filesystem_file_observation_of_path, since a directory can't be answered by the file observation's read.

Evidence

• gunbc test //test/claim/belt_occurrence_record_absence_witness:all gives 5 held, 0 not held, on srv1 at 32ff468.
  • Two absence shapes answer Absent (no directory; directory without record). Both would have refused under the old fold.
  • Three still refuse (root unlistable; record listed but unreadable; record undecodable).
• gunbc compile --entry dag/gunbc/roadmap/roadmap_belt_actuate.dag --target dag reports 0 blocking errors.
• Not yet executed: the live route, meaning a belt tick on a deployed instance whose spawn-pass receipt stops refusing. That is the inhabitance reading this PR still owes, and it needs a deploy of main after merge, or a lab instance.

Not in this PR

The standing half of the all-Unknown page (/opt/gunbc/roadmap-events not creatable under root-owned /opt/gunbc) is already fixed on main by #13641's roadmap_event_carrier_directory. srv1 runs 19b12d88, which predates it.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed both dashboard reviews:

• review 78482: the two-instant join and a fixture the real route never emits.
  • Fixed at the root in ba91ac9: the census now observes the launch record only when the attempt directory is listed (AttemptDirectoryStanding), so the absent arm consults no second observation.
  • A directory that vanished after being listed reaches the record observation as a failed listing and refuses. That's the new red control.
  • I didn't use the suggested guard (absent + Indeterminate): FilesystemFileIndeterminate also covers 'listed but unreadable', a disagreeing world it would still admit.
• review 78486: the String-typed absence. In 8441ce0 the arm now carries the sealed FilesystemEstablishedAbsence through unchanged.
• Inhabitance claims: they were UNOBSERVED under the hermetic claim route (HostEffectRefused { operation: List, ground: NoMockResponse }). In e2c1a48 they declare SubstrateInputsOnly and run the real wet producers against the checkout.

gunbc test //test/claim/belt_occurrence_record_absence_witness:all at e2c1a48 on srv1: 9 held, 0 did not hold, 0 unobserved.

— sent from bright-moth-475