The observer could not see the host it existed to retire: the observation denominator made physical

[gunbai-bot]

The defect, proven by execution

spark_serving_observe_ci_wet enumerated spark_serving_desired_hosts. Correct while desired named every Spark; wrong the moment #9679 gave desired a role scope. Retirement is planned from members observed and not desired, so scoping observation by desired makes the retirement population unobservable by construction — observed − desired is empty for every host, always.

Evidence	Run	Result
Observer scope	fleet-converge 33296910990 (spark_observe)	observed_hosts=1 — srv5 only; srv6 enrolled in known-hosts, never probed
Ground truth	direct ssh, srv6	unit active + enabled, listener on 11434, ollama serve pid 2349

The module already refused an empty observation list, on the stated ground that emptiness is ignorance rather than a clean fleet. The roster held {srv5}, which is not empty, so the guard never fired. empty_observation_narrow in its non-empty form.

Correction: the 0-byte plan wire is a DIFFERENT defect

An earlier version of this description cited fleet-converge run 33297525985's zero-byte spark_serving_typed_actions.wire as evidence for this defect. That chain is false in the live dataflow. fleet_converge_plan_cli.dag:170 passes observed_spark: [] and fleet_converge_plan.dag:2325 sets spark_serving_typed_actions: scheduled_rows_empty() unconditionally — the live planner reads no Spark observer at all and would have emitted an empty wire whatever this module answered.

The two defects are independent. Welding them into one story would have made a fix here look like a fix there.

What this PR does and does not do

Does: restores the physical observation denominator and supplies the exact-coverage classifier.

Does not: make live retirement planning reachable. The live plan and apply producers remain disconnected from Spark observation, and re-running mode=plan after this lands should still produce a zero-byte wire. Those are the next P0-C obligations.

Why this is a module and not a one-line edit

The obvious repair — union the two role rosters — is rejected here. Both role projections answer through SparkCellRoleUnique and deliberately drop SparkCellRoleAmbiguous and SparkCellRoleAbsent, so their concatenation silently omits a host whose role assignment is broken. An absent or contradictory role says nothing about whether a serving process runs on the metal — and a broken assignment is precisely when stale serving state most needs to stay visible. That repair fixes today's srv6 and preserves the class one input away.

Roles decide what may be done to a host. They do not decide whether it is looked at.

Coverage is a declared replacement, not a completed cutover

SparkObservationCoverage is defined and exercised by claims. serving_observe still terminates on the older cardinality guard and does not consume a coverage value. The two authorities genuinely coexist until the observer's report is built from the join; that cutover is the remaining P0-C obligation and is stated in the module rather than implied.

Terminal policy fix (defect introduced by this PR)

Widening the roster put a retired cell inside it, and a retired cell is structurally SparkServingAbsent. The workstation entry terminated on spark_serving_observation_report_succeeded, under which absent counts as failure — so the exactly-correct final state (srv5 serving, srv6 retired) would have exited non-zero. Both entries now terminate on spark_serving_report_observations_were_made ("did the probe answer").

Evidence standing, stated honestly: spark_serving_observe_witness_test:646 already asserts exactly was_made && !succeeded for an absent host — the control is authored and discriminating, and it does not execute, because that module is test.claim.spark.*, outside the required gate closure. Restating it under the executed v2.test.* prefix was attempted and abandoned on measurement: importing this module to reach the two predicates pulls its 46-import closure and the claim module is killed during resolve with no rows.

Evidence

8 claims under v2.test.*, which the required floor executes — confirmed by the gate's own output, all 8 reported standing=planned-and-passed disposition=planned outcome=passed.

Discriminating control: reinjecting the defect (scope reverted to spark_serving_desired_hosts) reds 5 of 8. The 3 that stay green are the pure coverage-classifier claims, which consult no scope producer and correctly test a different subject.

— sent from eager-pike-541