CLI invocation emission: design note + Wave 0 carrier probe (argument boundaries survive the grammar fold, proven by execution)

dag/extdeps/bmc/openbmc_fan_control.dag

@@ -1,6 +1,7 @@
 module extdeps.bmc.openbmc_fan_control
 
-import std.algebra { trim }
+import std.algebra { Empty, trim }
+import v2.std.diagnostic { Accepted, Rejected }
 
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Https, Uri }
@@ -18,7 +19,21 @@ import extdeps.languages.json.emit {
   json_string,
   serialize_json,
 }
-import extdeps.tools.jq { jq_authority }
+import extdeps.tools.jq {
+  JqInputStdin,
+  JqInvocation,
+  JqProgram,
+  JqProgramExit,
+  JqRawOutput,
+  jq_authority,
+  JqOutcome,
+  JqOutputAbsent,
+  JqOutputPresent,
+  JqExecutionRefused,
+  jq_classify_observation,
+  jq_execute_admitted_plan,
+  jq_invocation_process_plan
+}
 import extdeps.systemd.systemctl { systemctl_authority }
 import extdeps.bmc.openbmc_operation {
   OpenBmcCopyFilePreservingMetadata,
@@ -792,23 +807,6 @@ service openbmc.JsonProjection {
     }
   }
 
-  operation SensorIntegerValue {
-    input { content: String }
-    output {
-      value: String from "stdout"
-      success: Bool from "exit_success"
-      stderr: String from "stderr"
-    }
-    readonly
-    transport shell {
-      argv: ["jq", "-r", "if (.data | type) == \"number\" then (.data | round) else empty end"]
-      stdin: content
-    }
-    exit {
-      0 => Unit
-      nonzero => String "sensor integer projection failed"
-    }
-  }
 }
 
 fn openbmc_read_file(
@@ -881,23 +879,56 @@ type OpenBmcSensorValueResult
   | OpenBmcSensorValueAbsent
   | OpenBmcSensorValueRefused { reason: String }
 
+// exit_code, not `success: Bool`. Two fields for one fact is a second representation: success is
+// exactly exit_code == 0, derived here where the three states are decided rather than carried
+// alongside them.
+// THE PROGRAM IS THE DOMAIN'S, THE FLAGS ARE JQ'S. This module states what it wants extracted;
+// it never spells -r, --raw-output or an argv position. `else empty end` is deliberate and
+// load-bearing: a non-numeric reading emits NOTHING and exits zero, which the decoder below reads
+// as OpenBmcSensorValueAbsent -- a real third state beside Refused and Observed. That is why this
+// path must NOT carry jq's --exit-status: it would collapse Absent into Refused on a live sensor.
+data openbmc_sensor_integer_program: String = "if (.data | type) == \"number\" then (.data | round) else empty end"
+
+// One place builds the sensor projection invocation, so both call sites cannot drift apart.
+fn openbmc_sensor_integer_projection(content: String) -> OpenBmcSensorValueResult {
+  match jq_invocation_process_plan(invocation: JqInvocation {
+    program: JqProgram { source: openbmc_sensor_integer_program },
+    bindings: Empty,
+    input: JqInputStdin { content: content },
+    output_encoding: JqRawOutput,
+    exit_policy: JqProgramExit,
+  }) {
+    Rejected { diagnostics: _ } =>
+      OpenBmcSensorValueRefused { reason: "sensor value projection could not be lowered to a jq invocation" }
+    Accepted { value: plan, diagnostics: _ } => {
+      let observed = jq_execute_admitted_plan(plan: plan)
+      openbmc_sensor_integer_projection_result(
+        outcome: jq_classify_observation(plan: plan, observation: observed),
+      )
+    }
+  }
+}
+
+// THIS DECODER NO LONGER READS AN EXIT CODE, and that is the point of the arm it matches instead.
+// It previously took exit_code/stdout/stderr and mapped every nonzero exit to a refusal -- correct
+// under JqProgramExit, silently wrong under any other exit policy, and nothing connected the two.
+// jq_classify_observation now owns that reading, against the policy carried on the plan, so this
+// function decides only what OpenBMC alone can decide: whether a present projection is an integer.
 fn openbmc_sensor_integer_projection_result(
-  success: Bool,
-  value: String,
-  stderr: String,
+  outcome: JqOutcome,
 ) -> OpenBmcSensorValueResult {
-  if !success {
-    OpenBmcSensorValueRefused { reason: stderr }
-  } else if trim(value) == "" {
-    OpenBmcSensorValueAbsent
-  } else {
-    match parse_int(s: trim(value)) {
-      Absent =>
-        OpenBmcSensorValueRefused {
-          reason: "sensor value projection is not an integer",
-        }
-      Present { value: parsed } => OpenBmcSensorValueObserved { value: parsed }
-    }
+  match outcome {
+    JqExecutionRefused { exit_code: _, stderr: stderr } =>
+      OpenBmcSensorValueRefused { reason: stderr }
+    JqOutputAbsent => OpenBmcSensorValueAbsent
+    JqOutputPresent { text: text } =>
+      match parse_int(s: trim(text)) {
+        Absent =>
+          OpenBmcSensorValueRefused {
+            reason: "sensor value projection is not an integer",
+          }
+        Present { value: parsed } => OpenBmcSensorValueObserved { value: parsed }
+      }
   }
 }
 
@@ -1025,14 +1056,7 @@ fn openbmc_sensor_value(
   if !remote.success {
     OpenBmcSensorValueRefused { reason: remote.stderr }
   } else {
-    let extracted = openbmc.JsonProjection.SensorIntegerValue(
-      content: remote.stdout,
-    )
-    openbmc_sensor_integer_projection_result(
-      success: extracted.success,
-      value: extracted.value,
-      stderr: extracted.stderr,
-    )
+    openbmc_sensor_integer_projection(content: remote.stdout)
   }
 }
 
@@ -1059,12 +1083,7 @@ fn openbmc_sensor_threshold_result(
   if !remote.success {
     OpenBmcSensorValueRefused { reason: remote.stderr }
   } else {
-    let extracted = openbmc.JsonProjection.SensorIntegerValue(content: remote.stdout)
-    openbmc_sensor_integer_projection_result(
-      success: extracted.success,
-      value: extracted.value,
-      stderr: extracted.stderr,
-    )
+    openbmc_sensor_integer_projection(content: remote.stdout)
   }
 }