Staged writes and installs become modeled programs: no here-doc delimiter to collide with, install(1) cited

[briansrls]

Stacked on #8835 (base session/silent-otter-405-argv-quote); retargets to main as the stack merges.

The next cut in this lane's population: after #8835 closed argv → text, gunbc.live_deploy.emit still assembled the program around those commands by hand. Two concepts, each spelled once per use site.

1. Staged files were here-documents

cat > "$_gunbc_stage/gunbc-roadmap.service" <<'GUNBC_UNIT_EOF'
<rendered unit body>
GUNBC_UNIT_EOF

seven times, each with its own delimiter tag. A here-document ends at a line equal to its delimiter, so the delimiter is a value the content could contain — a unit body carrying that tag line ends the document early and the remainder of the body is executed as shell. Choosing a tag nobody expects to appear is a probability argument, not a wall, and the content here is rendered from a model, so nothing bounds what it can contain.

The staged write is now printf %s <content> > <staged path>, modeled and serialized once: as a quoted argument the content has no terminator to collide with. That is the §5 move — the bad state stops being writable rather than being detected.

2. The staging directory was a literal inside seven quotations

"$_gunbc_stage/<name>" was spelled at each use, so each site independently decided how to quote the expansion. It is now one fact, deploy_stage_dir_var, and one word — deploy_stage_path_word builds a variable reference and a literal suffix as two parts of a single concat word, so the grammar decides the quoting, identically at a redirection target and at an install argument. gunbc.host_axis_caps had reached for the same construction privately (deploy_cap_stage_path_word); it is deleted and that module now consumes this one — the same de-fork as #8835, for the same reason.

3. install(1) gets a cited authority

extdeps.tools.gnu_coreutils now carries coreutils_install_file_argv, coreutils_install_file_owned_argv, coreutils_install_directory_argv and coreutils_install_directory_owned_argv, with the flag meanings taken from the GNU coreutils manual (install invocation) — including the upstream behaviour that install does not create missing parents, stated there rather than assumed by callers (serve_binary_parent_was_a_literal_note is the receipt for what assuming it cost). Ten hand-joined sudo -n install … strings across emit.dag now derive from those rows.

The three mode literals are named once each (install_d_shared_mode, install_file_shared_mode, install_executable_shared_mode) instead of appearing inline at ten sites. That is not the derivation install_d_mode_undeviated_note asks for and does not claim to be — the mode is still a shared constant inherited, not computed from a member's declared dependents. Naming it changes no emitted byte; it makes the inheritance visible and gives the eventual derivation one place to land per class.

Witnesses

An earlier revision of this section said every transcribed golden was re-anchored. That was false, and the seven sites it missed are the most useful thing in this PR. It was written after converting the goldens I had touched, and it generalized from those to the file. Both approving reviews repeated the generalization (review 54873: tests "are updated to consume those same helpers rather than transcribed strings") — which is what a confident false summary buys you. The correction is stated here rather than quietly fixed, because after squash-merge this body is the commit message.

What was actually missed, found by reading the floor's failure list rather than by review: seven sites still transcribed pre-routing bytes. Four failed loudly — witness_retract_owned_process_removes_serve_service, twin_apply_creates_its_own_binary_parent_directory, and both belt_tick_receipt_home_witness tests (that last file belongs to another lane; it is touched here because this PR broke it, not as drive-by scope).

Three did not fail, and those are the real finding. They are absence conjuncts — !string_contains(twin_retract, "sudo -n tailscale serve --https=443 off"), and the version wall's two arms asserting an unobserved or too-old client emits no tailscale invocation. They assert that a dangerous command was not emitted. Once quoting moved into the grammar the unquoted pattern became unproducible, so all three held for a reason unrelated to what they check: a decoration in DESIGN.md's sense, worse than an absent check because it is cited as coverage, and it would have gone on passing if the emitter started writing production's teardown into the twin's script. Nothing in the tooling complains about this class — a vacuous green and a real green are the same green.

All seven now derive from the function the emitter calls. The two version-wall arms cannot be spelled as a derived command, because what they assert is that no tailscale invocation exists at all — there is no particular command whose absence says that; they assert the binary word as the grammar spells it. Reachability, since a green on an absence conjunct proves only that it holds: each of the three has its pattern proven producible by a positive conjunct in the same witness.

Every transcribed golden for a converted site is re-anchored on the builder that produces it, including witness_apply_provisions_attempt_state_root_owned, which keeps comparing against the derived mode (managed_directory_mode_octal) exactly as its note requires. Two new discriminators:

• emit_RED_unit_files_are_not_written_through_here_documents — reds if any of the five converted writes returns to a here-doc, naming each retired delimiter
• emit_staged_unit_body_is_quoted_by_the_posix_authority — the unit body reaches the host as a quoted printf argument

Verified green by execution on a remote runner at this head: both new witnesses, plus witness_apply_script_contains_systemd_and_tailscale, witness_apply_provisions_attempt_state_root_owned, witness_tree_sync_restart_diagnoses_on_failure, witness_apply_script_wires_memory_cap_deploy_consumer, witness_dependency_ensure_is_idempotent, witness_retract_preamble_acknowledges_shared_sudoers_install, witness_apply_emits_no_embedded_preflight_and_only_sudoers, and two host_axis_caps quoting witnesses confirming the stage-path de-fork changed no cap emission.

Scope, stated

Not closed here, and not claimed: the sudoers preamble in gunbc.ci_deploy_sudoers is still a here-doc with a hand-joined install; gunbc.host_effect_realize and the gunbc.spark.* modules carry their own install spellings; and the commands still land in a deploy_raw(command: String) carrier rather than the pipeline holding a modeled program end to end. The if ! … ; then … ; fi composition, which I had expected to be in this cut, turned out to already be a typed If/Not/ExitZero PipelineStep rather than concatenated text — so it needed nothing.

One class this PR does not close, surfaced by the vacuous conjuncts above: nothing detects an assertion whose pattern has become unproducible. The three found here were found because four others went red and sent me into the file. A quoting change that had broken only absence conjuncts would have been entirely silent.

[gunbai-bot]

review 54555 is right on both counts and the file is gone as of 56fd51f5aa — gh pr diff --name-only no longer lists it.

Worth recording how it got there, because the mechanism is more interesting than the slip: I deleted this probe in an earlier commit on this branch (36aad30a55, "Drop the ad-hoc verification probe"), then recreated it to run one more round of witnesses, and the final commit's git rm -f failed silently against the modified file while the git add -A beside it re-added the recreation. So the deletion commit is in the history and the file still shipped. That is the same failure this PR is about, one layer up: a step whose refusal was absorbed instead of stopping the line.

On the second half of the finding — yes, the harness itself was fail-open: set -uo pipefail without -e, || true swallowing a failed build, and grep … | head -4 truncating. It never gated anything (the witness results in the PR body come from reading its output, not from its exit status), but a verification tool that cannot fail is exactly the instrument this repository says not to trust, and I would rather it not exist than exist unmarked.

— sent from silent-otter-405

[gunbai-bot]

Fixed the install_file_command remark from review 54563 rather than leaving it — an unused surface in a PR whose thesis is single authority is a second spelling waiting for its first caller.

It is deleted, and so is coreutils_install_file_argv, which existed only to feed it. Both went because the shape they described — an unowned install -m <src> <dest> — has exactly one site in this module, deploy_stage_install_command, and that site cannot consume an argv of strings: its source is the staged path, a word carrying a variable reference rather than a value known at model time. That seam is now stated where it lives, and the site no longer respells what it can share: the binary name and the mode flag come from the coreutils rows (coreutils_install_binary_name, coreutils_install_mode_flag), and only the two path arguments are placed as words.

Net effect is one fewer function, one fewer argv row, and two fewer hand-typed literals. Re-verified green by execution after the change: both new REDs plus witness_apply_script_contains_systemd_and_tailscale, witness_apply_provisions_attempt_state_root_owned, and witness_apply_script_wires_memory_cap_deploy_consumer.

— sent from silent-otter-405