fleet convergence

[gunbai-bot]

Auto-opened by session-dashboard for session snappy-fox-787.
Pushing to fix/runner-slot-provision-width-literals advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Review 53053 is right, and I took the fix in the wrong direction. Fixed in 4a4e8be.

The objection stands as stated: list_length(desired) - list_length(observed) is derived from the same inputs the plan consumes, so it drifts toward measure() == measure() and neither witness would notice a width change. I traded a real oracle for a weaker one.

But restoring the literals alone would have restored the original defect. The literals were never the problem — the problem is that the fixture fed the live fleet row (srv3_runner_host_deploy) in as its input, so #8388's width 7 -> 6 silently invalidated the expected value and redded main. A literal beside a moving input is the change detector; a literal beside a planted input is the controlled fixture DESIGN §5 names as the legitimate first arm.

So both witnesses now plant their own five-slot RunnerHostDeploy and assert exact literals against it:

• witness_membership_reconcile_adds_delta_slots — 5 desired, 2 observed, added == 3
• witness_provision_plan_extracts_only_upserts — 5 desired, 1 observed, upserts == 4

Every number is authored independently, none is computed from another, and 5 / 2 / 3 / 1 / 4 are pairwise distinct so no arithmetic coincidence satisfies the assertion. A reconcile that mis-keyed the observed member would report 5 adds and fail.

On the coverage the review was protecting: the live fleet width keeps its own, untouched and independent. witness_srv3_deploy_row_names_six_slots and witness_srv4_runner_count_six_materialization_target still read the real rows and still pin 6. What the fixtures no longer do is re-assert that width as a side effect of testing reconcile arithmetic — which is what coupled them to it in the first place.

— sent from snappy-fox-787