The observer stops being handed a placeholder: the wet acquisition half, and the one operation the boolean vocabulary could not express

[gunbai-bot]

gunbc.fabric_cell_observe has been the pure half of an observer whose other half did not exist. Every production call site passed fabric_cell_observation_unobserved — which says nobody looked, and was honest precisely because nobody did. This is the half that looks.

This body was rewritten at 1c63325f89. Its first version claimed the change added no new host vocabulary and composed five already-declared reads. That premise was disproven during review and would otherwise have been preserved verbatim in the squash record.

Updated at 4c8eb4a29c. A fifth producer defect was found and closed after the above was written: a successful stat that printed nothing was admitted as a positive path kind. The empty string reached the token decoder, which is total — so it decoded to UnknownKind { word: "" } and left as PathOccupiedByNonDirectory, a positive claim that some unnameable object occupies the path. Emptiness is now decided before the decoder by a pure fabric_cell_path_kind_observation(success, output) -> PathKindRead | PathKindReadRefused, and PathMetadataUnread carries the cause so the operator is told which read failed. Law 17 asserts the whole success × output table, with "0" and "weird new thing" asserted read so the rule is a presence test and not a value filter. Two stale test -d annotations retired in the same commit — review named one, checking found the claim spelled twice.

This is the same class as defect 1 below, one operation over: success is a fact about the call, never about whether the output carrying the answer arrived.

The load-bearing finding: no composition of boolean tests can express what the observer needs

The module was built out of boolean path tests twice, and both spellings failed the same way.

test -d plus test -f called everything else absent — so a socket, FIFO, device node or symlink reported a path that cannot be created as one free to create. Replacing that with test -e plus test -L closes the occupancy half and still cannot answer the question, because test -e returns false both for a path that is not there and for one whose parent directory cannot be searched. That is general, not a gap in the choice of tests: every boolean test reports its own failure to observe as a negative answer, and absence versus could-not-look is the pair whose remedies are furthest apart.

So this PR adds exactly one operation — extdeps.tools.stat stat.File.FileType — which reports the type on success and reports only that the read failed otherwise. It never reports absence. Absence comes from where this family's law always said it comes from: the parent enumeration. That forced the cells root to split into parent plus entry name, since it was the one path with no modeled parent to ask, which is exactly why its absence was the case the old code could not get right.

The needing of a new operation is the signal, not a failure: the observation model wanted a fact the declared vocabulary could not express, so it was answered where modeling lives rather than approximated in the producer.

Five producer defects found after the first "done"

1. systemctl show exits zero and prints defaults for a unit that does not exist, so an unprovisioned slice returned a successful read of values no host carries. The observer then saw an address absent from its namespace with a state supplied, refused it as a contradiction, and the cell could never be planned — the exact "first real observation of an unprovisioned host blocked instead of planning" failure the observe module records in its own header, reintroduced by the producer. The slice enumeration now decides whether the read happens at all, and the three answers are not two: holds asks; ran-and-does-not-hold contributes nothing, because absence is the namespace's answer; refused refuses with the namespace rather than inheriting an absence nobody observed.

2. The slice enumeration discovered unexpected units and the observer dropped them. The acquisition was changed to enumerate fabric-cell-*.slice rather than probe one unit by name — precisely so an undesired unit could be found — and gunbc.fabric_cell_observe read that namespace only to answer whether each expected boundary was present. The enumeration produced the evidence and the observer threw it away. Discovery now spans both family-owned namespaces through one classifier, matching by rendering every committed identity forward into that namespace's spelling; a reverse parse would have reported a committed slot's own slice as foreign. Either enumeration failing refuses the whole discovery.

3. One cell root was acquired twice inside one nominal probe — once for the child namespace, once in the address fold. Not a duplicate cost but a consistency hole: if the path changes between the reads, the observer refuses a contradiction its own acquisition layer manufactured, surfacing as host drift that never happened. One acquisition per slot now, projected into both views.

4. A completed call that printed nothing was admitted as a reading. systemctl show can exit zero and print an empty line; that entered the digest, differed from the desired one, and would have planned a repair against a property nobody read. Now a pure three-answer projection, with "0" and "infinity" asserted read so the rule is a law rather than a filter that refuses everything.

What else the diff does

• Splits acquisition from adjudication: the wet half produces a probe, never a verdict.
• Hoists the boundary digest spelling into one function both the desired and observed sides consume, so the two cannot fork.
• Plan and apply each acquire once; apply reuses the one decision for both identity checks, so a host changing between two reads of the same run cannot be reported as drift.
• Spark's planner stays unobserved — it is a pure fn that does not read a host and must not claim to.
• Adds no write operation. Every operation reached is readonly.

Receipts

• 4052 file(s) parse-clean
• 63 rows green by execution across test.claim.fabric_cell_acquire_witness (17) and test.claim.fabric_cell_observe_witness (46), re-taken at 4c8eb4a29c against an absolutely-pathed local binary (see the provenance note below)
• Mutation receipts on the laws most at risk of being permanently green, each executed and restored: transposing the digest composition; asking an absent slice anyway; admitting empty property output; projecting the two views from different observations
• Entry-closure compile: gunbc compile --entry dag/gunbc/fleet_converge_plan_cli.dag --target rust → rc=0, 1428s, 486 files, 0 blocking. DESIGN.md records that no required phase emits over a closure reaching call sites, so a green floor cannot establish this
• CI green on the branch: build, floor, witnesses

What this does not do

It applies nothing. Provisioning is the next cut, and it does not begin here.

[gunbai-bot]

Review 56129 is an APPROVE with no actionable items — nothing to push in response.

One receipt worth adding, because it is the gap the previous PR's floor run exposed. On #9185 the floor found three reds in fixtures I had not touched and therefore had not run; an entry-scoped local run only reaches what its entry names, so "I ran the rows I changed" was structurally unable to see them. This time I ran the full roster of every file this change can reach, before the floor did:

file	rows	result
test.claim.fabric_cell_converge_witness	16	16 pass, 0 fail
test.claim.fabric_cell_observe_witness	43	43 pass, 0 fail
test.claim.fleet_converge_plan_witness	57	57 pass, 0 fail

116/116 green by execution, plus the 9 new rows in test.claim.fabric_cell_acquire_witness. Those three files are the ones the digest-spelling split and the CLI wiring can affect; the floor still owns the whole-corpus receipt, and I am not claiming this replaces it — only that the specific blind spot that bit last time was closed deliberately rather than left for CI to find again.

— sent from silent-bear-842

[gunbai-bot]

Both side-chat findings were real and are fixed in 58b2eb5113 — and the first is a live contradiction in the module whose own header claimed the opposite.

1. systemctl show was asked unconditionally. The header says a state read is issued only where the parent said the entry is there. True of the two directory addresses; false of the slice. And the consequence is worse than an inconsistency: systemctl show on a unit that does not exist exits zero and prints defaults, so an unprovisioned slice came back as a successful read of values no host carries. The observer then saw an address absent from its namespace with a state supplied, refused it as a contradiction, and the cell could never be planned — the exact "first real observation of an unprovisioned host blocked instead of planning" failure gunbc.fabric_cell_observe records in its own header, reintroduced by the producer. A success exit is not evidence that a unit exists.

The enumeration now decides, and the three answers are not two: holds → ask; ran and does not hold → absence is the namespace's answer, ask nothing; refused → establishes nothing, so the address refuses with it rather than inheriting an absence nobody observed.

2. "not a directory" is not "is a regular file". The first cut asked test -f after test -d and called everything else absent — so a socket, FIFO, device node or symlink reported a path that cannot be created as one free to create. shell.Test.Exists and shell.Test.IsSymlink are added to extdeps and cited: -e answers the question the two proxies were approximating, and closes every case but one — it follows symlinks, so a link whose target is gone answers false while the link still holds the name and still defeats mkdir; -L sees the link rather than through it.

This PR claimed as a virtue that it added no host vocabulary. It does now, and the reason is the signal I said to watch for: the observation model wanted a fact the declared vocabulary could not establish. That is a modeling question, answered in extdeps rather than by composing two tests that don't add up to the third.

3. A third finding the first two turned up, about my evidence rather than my code. The first version of the ask/don't-ask law had to reach the arm that asks in order to establish the contrast — and that arm performs a host effect. It passed. It passed because claim_batch runs hermetically and systemd's operation carries a declared mock_response, so the row was asserting a law about acquisition against authored data. The same row under gunbc run errored: failed to execute 'systemctl'. Two runners disagreeing about one row is what exposed it.

The decision is now its own named fact — FabricCellBoundaryStanding — with the effect strictly downstream. Both rows are pure, no mock participates, and the receipt is that they now pass under the runner that errored on them before.

Mutation receipt: making the does-not-hold branch ask anyway reds the law. 11/11 green after restoring; 4052 file(s) parse-clean.

— sent from silent-bear-842

[gunbai-bot]

Review 56184 is correct and the two orphan operations are deleted in 3f784b2b0e, along with a third side-chat finding.

On the orphans — the review found a real one and named the shape exactly. shell.Test.Exists and shell.Test.IsSymlink were added in 58b2eb5113 and made unreachable in cd21751bfa, when the boolean approach was replaced by stat -c %F. That leaves declared surface with no consumer, standing beside a module header explaining why that primitive doesn't work — the unmarked-scaffold shape. Deleted. I also corrected the header that claimed this module "adds no new host vocabulary": it now reaches four declared readonly operations and added one, stat.File.FileType, and the reason it added one is the finding — no composition of boolean tests can express not there versus could not look, because every boolean reports its own failure to observe as a negative answer. That gap belonged in extdeps, not approximated in the producer.

Worth noting for calibration: review 56180 approved the very commit this one rejects part of. It praised Exists/IsSymlink for letting the module "distinguish the four honest directory states" — and the deeper analysis showed test -e still can't, because it returns false for an unsearchable parent too. Two approvals and a request-changes on the same code, and the request-changes was right. Approvals are a hygiene check, not acceptance.

The third finding, which is the largest of the three. The acquisition layer was changed to enumerate fabric-cell-*.slice rather than probe one expected unit by name — for the stated reason that probing desired names can never discover an undesired one. But gunbc.fabric_cell_observe read the slice namespace only to answer whether each expected boundary was present; discovery was driven by the cells-root listing alone. So fabric-cell-srv3-07.slice on a host that doesn't declare srv3-07 was enumerated, matched against nothing, and dropped — no output position, no refusal, no baseline row. The enumeration produced the evidence and the observer threw it away, leaving the old blindness one layer downstream of its own fix.

Discovery now spans every family-owned namespace through one classifier, distinguished only by how a slot spells itself there. Every committed identity is rendered forward into the namespace's spelling and compared — no identity is parsed back out of an observed name, which would report a committed slot's own slice as foreign. And either enumeration failing refuses the whole discovery: a half-enumerated population is not a population.

Seven existing rows went red on exactly that — all probes supplying a cells-root listing and no slice enumeration, written when the slice namespace answered a narrower question. They now supply both, which is what a fully-read host means.

60 rows green by execution across the two witness files; 4052 file(s) parse-clean.

— sent from silent-bear-842

[gunbai-bot]

The entry-closure compile is done, and it is the acceptance-set item I have been reporting as outstanding.

I have repeatedly said this PR has "the CLI closure resolves" and not "the CLI closure compiles", and declined to call the first the second. It now has the second:

gunbc compile --source-root dag --source-root src/v2 \
  --entry dag/gunbc/fleet_converge_plan_cli.dag --output-dir <tmp> --target rust

rc=0  elapsed=1428s  emitted_files=486
0 blocking error(s), 827 advisory diagnostic(s) (policy: gunbc.compile_clean_diagnostic_policy)

Zero blocking diagnostics over the production closure, fresh binary, emitting Rust. DESIGN.md records that no required phase emits over a closure reaching call sites, so a green floor cannot establish this and nothing else in CI would have.

Why the earlier attempts read as "clean" and were not: they were budgeted at 900s and this closure takes 1428s. Exit 124 with no diagnostic line is byte-identical to a clean run through any grep for errors, which is exactly the instrument defect from earlier in this lane. This run captured rc first, elapsed beside it, and emitted_files as a positive self-denominating line, so a timeout could not have been reported as a pass.

One correction to my own instrument, worth stating rather than quietly dropping. My wrapper's derived count printed blocking=1. That is a grep artifact: the string it matched is the compiler's own summary line, "0 blocking error(s)". The compiler's summary is the authority and my derived count was wrong — the same shape as the digest law earlier in this PR, where the measurement I assumed and the measurement I took disagreed and the tool was right. Verified directly: no line in the output matches BLOCKING or begins with error.

The 827 advisories are pre-existing corpus-wide classes, not this change: 632 where-refinement unenforced and 185 unlisted, spread across the whole closure.

This does not change what the PR claims to do, and it does not license running the provisioning apply — that remains gated on its own work. It closes the gap between resolves and compiles that I had left open in the receipts.

— sent from silent-bear-842

[gunbai-bot]

All three of the side chat's remaining findings are addressed — two code defects in 1c63325f89, plus the stale body, which is rewritten.

1. One cell root was acquired twice inside one nominal probe. Confirmed exactly: fabric_cell_probe_wet observed it while building the child-namespace entry, and the address fold observed it again. Not a duplicate cost but a consistency hole — if the path changes between the reads, the observer receives a namespace derived from read A and address evidence derived from read B and refuses a contradiction its own acquisition layer manufactured. It fails closed, which is why it would have surfaced as host drift that never happened rather than as a false ADD — and that is the worse diagnostic outcome, because the search starts on the host instead of in the producer. One FabricCellSlotAcquisition per slot now, projected into both views. Same law the plan and apply paths already obey one level up; stated at slot grain because that is where a second read is cheapest to write and hardest to see.

2. A completed call that printed nothing was admitted as a reading. systemctl show can exit zero and print an empty line, and the reader took every success=true as a value — so an empty string entered the digest, the digest differed from the desired one, the boundary reported MemberChanged, and a repair would have been planned against a property nobody read. It is the exit-zero-with-defaults defect in its other half: there the unit did not exist, here the question was not answered. Now a pure three-answer projection. The positive controls are what make it a law rather than a filter — a reader that refused everything would satisfy the empty-output row and break every real host, so "0" and "infinity" are asserted read: "0" because it is falsy-looking and a plausible accidental filter, "infinity" because it is what systemd prints for an unset cap and is therefore the most common real value.

Mutation receipts, both executed and restored: admitting empty output again reds law 15; projecting the namespace from a different observation than the addresses reds law 16. 62 rows green after restoring.

3. The body is rewritten, and the reason it mattered is worth stating: the squash record would have preserved the exact premise review disproved — "adds no new host vocabulary". The new body leads with the finding instead, that no composition of boolean tests can separate absence from could-not-look because every boolean reports its own failure to observe as a negative answer, and that needing one operation is the modeling signal rather than a failure. It carries a dated note saying it was rewritten and why, so the correction is visible rather than silent.

— sent from silent-bear-842

[gunbai-bot]

Fourth-round finding closed: successful-but-empty stat output no longer names a kind

Fixed at 4c8eb4a29c, with an executed mutation receipt.

The defect, confirmed as described. stat -c %F exits zero and prints nothing; the reader took every success=true as a reading, so the empty string reached fabric_cell_path_kind_of. That decoder is total, which is precisely what made this reachable — an empty %F is just a word it has never met, so it decoded to UnknownKind { word: "" } and left as PathOccupiedByNonDirectory: a positive claim that some unnameable object occupies the path. It fails closed for provisioning and still sends the operator to the opposite remedy.

The repair. Emptiness is decided before the decoder, not inside it:

fabric_cell_path_kind_observation(success, output)
  -> PathKindRead { kind } | PathKindReadRefused { cause }

PathMetadataUnread now carries that cause, threaded through the parent-routed refusal — otherwise the new cause would have been a dead field. The parent still decides absence-versus-unreadable exactly as before; nothing turns a failed read into an absence on its own authority.

Law 17 asserts the full success × output table. "0" and "weird new thing" are asserted read, so the rule is a presence test rather than a value filter.

Receipt: mutation → FAIL, restore → PASS, source byte-identical after restore (diff -q in the same dispatch).

Annotation. The header credited test -d as the separating mechanism while the same source explains four paragraphs down why every boolean construction was retired. The review named one instance; checking found the claim spelled twice — the second at the host-effects boundary — and both are rewritten. The surviving test -d mentions are the historical narrative of why the current shape exists, correct in the past tense.

63 rows green (17 acquire + 46 observe), 4052 file(s) parse-clean.

---

A measurement-provenance note on the numbers above

The previous head's local figures were taken through gunbc on PATH, which resolves to a shim that — inside a gunbc checkout — execs the baked image binary, not this tree's build output. So those were measurements of (tree × unidentified binary). Every figure in this comment was re-taken against ./target/release/gunbc invoked by absolute path, freshly built locally, with the binary's mtime and size recorded before and after the run (unchanged, so nothing swapped the instrument mid-measurement).

No figure turned out to be wrong — but that is now evidence rather than an assumption. Unrelated to this PR's content; noted because the numbers are cited as its receipts.

— sent from silent-bear-842

[gunbai-bot]

Durable-record corrections applied, and the invocation receipt for this head

Both body corrections are in. The receipt line read 62 rows / 16 acquire + 46 observe and the section heading read Four producer defects while the update above it described the fifth. Now 63 rows / 17 acquire + 46 observe and Five producer defects. This is the second time the body has lagged the implementation, which is the argument for correcting it before squash rather than after.

Current-head CI has since completed — at the time the review was taken, floor was still running and the dependent witnesses check had not yet appeared. All three are now green on 4c8eb4a29c: build (21m31s), floor (50m02s), witnesses (4s, the aggregator that is the gating context). mergeStateStatus: CLEAN, and a merge-tree dry run against the advanced main produces no conflicts.

Invocation receipt

Adopting the proposed standard, with the content digest as the load-bearing field:

source_revision  4c8eb4a29c2611774a9e68781dd07d834bfee083
binary_path      /home/briansrls/.worktrees/silent-bear-842/target/release/gunbc
binary_sha256    6ff261418fd75a29fef47dbcaa2eba9ff5a9b1d446edb3b4d84737d13ed2becc
binary_size      25477104
binary_mtime     2026-08-26 15:55:10 +0000   (unchanged before and after the run)
command          <binary> run --source-root dag --source-root src/v2 --claim-run \
                   --entry dag/test/claim/fabric_cell_{acquire,observe}_witness_test.dag \
                   --function <each row>
result           63/63 PASS

sweep_path       /home/briansrls/.worktrees/silent-bear-842/target/release/v1_src_dag_parse
sweep_sha256     77b58bb81825a544e44ed5f6eb7b4b9b076a7d16087e92b306ab292405411881
result           4052 file(s) parse-clean

The digest point is right and I can show why from this incident rather than in principle: the two sweep binaries I ran differed in output (the newer one reports the declaration index) while returning the same 4052 count. Size and mtime would have flagged that pair, but a measurement whose value is identical across two vintages is exactly the case where only a digest distinguishes which one answered. A bare gunbc through PATH inside a gunbc checkout is not evidence, and I am treating that as standing rather than as a fix for this PR.

— sent from silent-bear-842