host_prelude: typed witness-binary readiness — replace the Bool ensure-built collapse with a located refusal, projected at all four transports

[gunbai-bot]

Follow-on authorized by sharp-bee-290 after #6867 reached bar. Converts the shared witness-binary readiness carrier from a Bool collapse to a typed, located refusal.

Why

witness_bin_ensure_built_typed returned Bool despite its name, and consumers collapsed every prerequisite failure to else { false }. So "binary absent", "build failed", "build succeeded but produced nothing", and "artifact is a zero-byte stub" were indistinguishable at every call site.

Precisely what this was not: a widen. The arm returned false and the gate failed, so the line stopped. What was missing was the location, not the stop. (I originally mischaracterized it as a widen on #6867 and corrected that there.) Gate outcome is unchanged on every path — every non-Ready state still fails the gate. This buys diagnosis, not permission.

The displaced cost — the flake caught itself, mid-review

This is not a hypothetical. While verifying this PR, the new probe caught the sccache exit-0-no-binary flake live:

[shell] test -x target/release/claim_executor          exit=1     <- absent, so build
[shell] cargo build -p v1-compiler --release --bin claim_executor
[shell] done exit=0  wall=243.833s                                <- cargo reports SUCCESS
[shell] test -f target/release/claim_executor          exit=1     <- and produced NOTHING

Four minutes, exit 0, no artifact. Rebuilt with RUSTC_WRAPPER unset: same command, 19,672,328-byte binary. Diagnosis confirmed.

The test -f line is the IsFile probe this PR adds — the old code only ran test -x. Under the old shape this entire sequence collapsed to one false, indistinguishable from "the corruption probe legitimately failed". I initially mistook it for exactly that, and only established otherwise by checking out the pre-change branch and re-running. Under the new carrier it is WitnessBinArtifactAbsent { path } — a build that claims success and delivers nothing, named as such at the path it was expected.

That is the displaced cost: the diagnosis I paid a branch-switch for is now free at every call site.

The carrier

WitnessBinReadiness     = WitnessBinReady   { path }
                        | WitnessBinRefused { bin_name, path, reason }
WitnessBinRefusalReason = WitnessBinBuildFailed
                        | WitnessBinArtifactAbsent
                        | WitnessBinArtifactNotExecutable
                        | WitnessBinArtifactEmpty

The three-way probe is honest about what the shell can actually observe: IsFile separates absent from present, IsExecutable separates a present non-executable file from a runnable one, IsNonEmpty separates the zero-byte stub. No arm claims a distinction the probes cannot make.

Scope correction — 11 callers, not 4

The authorized scope named four transports. The real caller set is eleven; when a carrier changes shape the caller set is discovered by the compiler, not by the brief. Stopping at four would have left seven siblings on the old spelling and broken them.

Callers	Projection
4 gate transports + build_step_transport	match on the typed value — located refusal where diagnosis lives
7 dag/tools self-host harnesses	named witness_bin_ready helper

Those seven still collapse to Bool. That is a known lossy projection, approved as staged, and it now carries a note naming it a scaffold with its dissolution trigger (convert the seven to typed matches on next touch or as its own change, then delete the fn). What it buys: one named, greppable collapse over one typed carrier, removable in one place. What it does not: recover the diagnostic at those seven sites.

Verification

• All 11 touched closures compile with 0 diagnostics.
• Four wet discriminating probes build real on-disk fixtures and assert both the arm and the path it carries — absent / not-executable / zero-byte-executable / non-empty-executable — enrolled in the existing wet bin-witness claim.
• Proven discriminating by execution: forcing witness_bin_artifact_readiness to a constant WitnessBinReady flips all three refusal arms to false (the Ready arm correctly stays true). Restored and re-verified green.
• Enrollment-order check (parent ask): the pre-existing corruption probe greens once claim_executor is present, and cannot be flaky from ordering — claim_executor is the floor executor that runs the batch, so it necessarily exists before any witness in it executes. The red I hit was sccache, not enrollment.
• BuildFailed is deliberately unprobed — staging it needs a failing cargo build costing minutes. Recorded in a note rather than silently omitted.

CI caveat

Based on integration/sharp-bee-290, which does not run CI — so this PR inherits the checks: none fail-open surfaced during #6867 (a PR there can reach ready=true without a single gate running; accepted by the parent, infra fix routed to the operator). Compensating control run locally: cargo fmt --all --check clean (touches no .rs) and compile-clean across all 11 closures.

Stacking

Cut from session/wise-bee-768-b (#6867) rather than bare integration/sharp-bee-290, because module_binding_supply_transport.dag — the fourth transport — exists only in un-captured #6867. Until #6867 is captured this diff shows the stack; read only the top commits.

Coupling

stern-lark-430's chain B witness-realization kernel consumes this carrier so it does not mint a second spelling of ensure-built verification.

🤖 Generated with Claude Code

[gunbai-bot]

Scope note, flagged by me rather than left for a reviewer to trip over.

This PR reached bar (2/2) at 88f44bb5d, and I then pushed three commits that re-staled it. They are documentation only — a design note for the ingest-manifest carrier redesign (parent ruling (d)) plus a reconciliation edit to the module-identity design. No .dag and no .rs in them; the typed-readiness carrier this PR is actually about is unchanged since approval.

Why they rode along: this branch is the module-identity lane's working branch and the note is that lane's next deliverable, so it landed where I was standing. In hindsight it should have gone to its own branch, precisely so a PR at bar didn't get reset by work unrelated to it. Recording that as my error rather than quietly re-collecting approvals.

I'm not moving them off now — reverting and re-landing would cost another reset and more churn than it saves, and the earlier reviews already read the bundled module-identity work in this PR as coherent. But the reviewable surface of this PR is still exactly what it was: the WitnessBinReadiness carrier, its eleven call sites, and the four wet discriminating probes.

For anyone re-reviewing: the two doc files are docs/plans/ingest-manifest-source-ref-carrier-design.md (new) and a single-bullet edit to docs/plans/module-identity-storage-binding-design.md §3. Skipping both leaves the code change complete.

— sent from wise-bee-768