The planner minted an empty Spark schedule unconditionally: the observation carries its projection, the rows become an axis product, and the artifact stops answering for a plan it never made (P0-C3, dry)

DESIGN.md

@@ -202,6 +202,7 @@ One row per class, each carrying its recognition rule and its receipts, in [docs
 - `remediation_mutated_view`
 - `diagnostic_name_mechanism_silent`
 - `identity_absent_graph_traversal`
+- `resolved_reference_outside_execution_closure`
 - `surface_shorthand_preempts_resolved_identity`
 - `meaning_fork`
 - `externalized_degradation`

dag/gunbc/endpoint_authority_replacement_cut.dag

@@ -172,11 +172,6 @@ fn external_consumers() -> List<BoundaryConsumer> {
       decl_name: "spark_serving_converge_slice_wet_host_report",
       justification: "wet slice host report addressing",
     ),
-    endpoint_consumer(
-      module_path: "gunbc.spark.serving_observe",
-      decl_name: "spark_serving_probe_leg",
-      justification: "serving observation probe endpoint",
-    ),
   ]
 }
 

dag/gunbc/fleet/fleet_converge_plan.dag

@@ -7,6 +7,7 @@ import std.dissolution { DissolutionCondition, dissolution_description, unbound_
 import std.disposition { Disposition, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.content_hash {
+  content_hash_atom,
   content_hash_of_value,
   serialize_content_hash,
   Fnv1a64StructuralDigestHex,
@@ -122,7 +123,17 @@ import gunbc.fleet_posix_accounts {
   fleet_posix_ci_runner_principal, grounded_posix_principal_name,
   ci_runner_sudo_binary_path, SudoInstall, SudoSystemctl,
 }
-import gunbc.spark.serving_execution_schedule { ScheduledRows, scheduled_rows_empty, scheduled_rows_list }
+import gunbc.spark.serving_execution_schedule {
+  ScheduledRows,
+  scheduled_rows_empty,
+  scheduled_rows_list,
+  SparkServingAxisDisposition,
+  SparkServingAxisNotApplicable,
+  SparkServingAxisUnobserved,
+  SparkServingAxisRefused,
+  SparkServingAxisPlanned,
+}
+
 import gunbc.fleet_converge_timer {
   fleet_converge_service_unit_name,
   fleet_converge_timer_unit_name,
@@ -162,7 +173,7 @@ import extdeps.github.actions_runner {
   actions_runner_binary_artifact_for_arch,
 }
 import extdeps.cpu.ampere { altra_max_m12830_catalog }
-import product.placement_supply { HostIdentity }
+import product.placement_supply { HostIdentity, host_identity_eq }
 import gunbc.runner_host_deploy {
   RunnerHostDeployFound,
   RunnerHostDeployUnmodeled,
@@ -2322,16 +2333,184 @@ fn fabric_cell_apply_executable_lines(
   }
 }
 
+// THE ARTIFACT'S OPTIONAL CARRIED A FACT THAT CANNOT HAPPEN, so it is dissolved rather than reused.
+//
+// It answered `Absent` when `content_hash_of_value` did not return the Fnv1a64 arm -- an absorbing
+// arm in the narrowing direction, since a hash the match did not recognize became "there is no plan
+// artifact", which every caller reads as nothing to converge rather than as could-not-classify. The
+// Spark plan builder repaired exactly this in its own copy and this one was left behind.
+// `content_hash_atom` returns Fnv1a64Structural directly -- the same digest, since
+// `content_hash_of_value` is that function wrapped in the union -- so there is no union to match and
+// no arm to get wrong.
+//
+// The outcome stays a sum because assembling a plan IS refusable, and the Refused arm now has a real
+// producer: a SparkServingAxisRefused disposition propagates here instead of being laundered into an
+// empty schedule. An earlier revision made the artifact total and left this arm with nothing
+// constructing it -- a permanently-green arm carrying no information, which DESIGN §4b calls worse
+// than absent because it gets cited as coverage.
+type FleetConvergePlanArtifactOutcome
+  = FleetConvergePlanArtifactReady { artifact: FleetConvergePlanArtifact }
+  | FleetConvergePlanArtifactRefused { refusal: FleetConvergePlanArtifactRefusal }
+
+// THE REFUSAL IS A COPRODUCT BECAUSE A DOWNSTREAM CONSUMER CANNOT ASK PROSE WHICH THING WENT WRONG.
+//
+// Rendering all four non-success situations into one `cause: String` repeated the C2
+// producer-versus-renderer mistake one layer later: "the axis does not apply", "the axis applies but
+// nobody observed it", "planning ran and refused", and "this axis belongs to another host" are four
+// different facts with four different operator responses, and a string is a second, lossy naming
+// scheme for a distinction the disposition already carries. The CLI renders this to prose at its
+// receipt boundary, which is where rendering belongs.
+type FleetConvergePlanArtifactRefusal
+  = SparkAxisSubjectHostMismatch { axis_host: HostIdentity, subject_host: HostIdentity }
+  | SparkAxisUnobservedRefusal { host: HostIdentity }
+  | SparkAxisPlanningRefused { host: HostIdentity, cause: String }
+
+fn fleet_converge_plan_artifact_refusal_text(r: FleetConvergePlanArtifactRefusal) -> String {
+  match r {
+    SparkAxisSubjectHostMismatch { axis_host: ah, subject_host: sh } =>
+      join([
+        "SparkAxisSubjectHostMismatch — the spark axis is tagged for host ",
+        ah as String,
+        " but the plan subject is ",
+        sh as String,
+        "; the plan would carry one host's serving rows under another host's baseline and lease",
+      ], "")
+    SparkAxisUnobservedRefusal { host: h } =>
+      join([
+        "SparkAxisUnobserved — ",
+        h as String,
+        " is an enrolled Spark and its serving axis was never observed, so a plan built here would",
+        " claim a completeness that was never measured",
+      ], "")
+    SparkAxisPlanningRefused { host: h, cause: why } =>
+      join(["SparkAxisPlanningRefused — on host ", h as String, ": ", why], "")
+  }
+}
+
+// P0-C3: THE SPARK AXIS ARRIVES AS ONE ALREADY-PLANNED PRODUCT.
+//
+// THE MEMBERS AND THE ROWS ARE ONE PARAMETER BECAUSE THEY ARE ONE FACT. A first cut took
+// `observed_spark` and the schedule separately, so a caller could hand members from one observation
+// and rows planned from another. `observed_spark` feeds the observed BASELINE, and the baseline is
+// what apply re-checks to decide the plan still applies -- so that disagreement would have been
+// invisible at exactly the moment it mattered. SparkServingAxisProduct is sole_constructor and only
+// the row producer mints it, so the members that fingerprinted the baseline are the members the
+// schedule was planned from.
+//
+// `spark_serving_typed_actions: scheduled_rows_empty()` stood here unconditionally, so the
+// production full-host plan could not emit a Spark row even when handed a real observation. That is
+// one of two independent breaks that made P0-WET unreachable -- the other being that the CLI passed
+// `observed_spark: []` -- which is why repairing either alone changed nothing.
+//
+// THE ROWS ARE A PARAMETER AND NOT SOMETHING THIS FUNCTION PLANS. A first attempt had the artifact
+// call the Spark row producer directly, and the substrate refused it with a circular dependency:
+// gunbc.fleet_converge_plan -> gunbc.spark.serving_converge_apply -> gunbc.spark.serving_converge_plan
+// already runs the other way. That refusal was correct and load-bearing. Artifact assembly consumes
+// already-planned axis products -- timer plan, cap plan, slot plan, fabric plan, activation plan --
+// and the Spark schedule is one more of them, not an exception this module reaches down to compute.
+// THE AXIS CARRIES A HOST AND SO DOES THIS ARTIFACT, AND NOTHING JOINED THEM.
+//
+// Putting the host inside the disposition stopped it disagreeing with the OBSERVATION that produced
+// it. It did not stop it disagreeing with the SUBJECT being planned: an axis tagged srv6 could be
+// handed to an artifact whose subject is srv5, and the resulting plan would carry srv6's retirement
+// rows under srv5's baseline and lease. Third instance of the class #9754 opened -- a host carried
+// twice, joined by convention -- and this function refuses on the disagreement rather than making it
+// unrepresentable, because the two hosts are genuinely two facts until the comparison is made.
+// ONE EXHAUSTIVE MATCH ON THE AXIS, NOT THREE PROJECTIONS THAT AGREE BY CALLER ARRANGEMENT.
+//
+// The first cut asked the disposition three separate questions -- members, rows, refusal -- and was
+// safe only because the caller happened to consult the refusal before using the other two. Both
+// Unobserved and Refused projected to an empty member list and an empty schedule, so a caller that
+// forgot the third question would assemble a perfectly well-formed plan that actuates nothing on a
+// host nobody looked at. A refusal has no rows projection now: the arms that cannot be planned are
+// eliminated here and never reach the assembler, which takes members and rows as ordinary values.
+//
+// The subject-host join is part of the same match rather than a guard beside it: each arm binds the
+// host the axis is tagged for, so there is no second reading of it to disagree with.
 fn fleet_converge_plan_artifact(
+  host: NonEmptyStr,
+  prior_generation: Int,
+  observed_timers: List<TimerRetirementMember>,
+  observed_caps: List<CapMember>,
+  spark_axis: SparkServingAxisDisposition<FleetConvergeSparkServingTypedAction>,
+  observed_slots: List<RunnerSlotMember>,
+  observed_fabric_cells: FabricCellObservationDecision,
+  observed_activation_readiness: RunnerActivationReadiness,
+) -> FleetConvergePlanArtifactOutcome {
+  match spark_axis {
+    SparkServingAxisUnobserved { host: ah } =>
+      if !host_identity_eq(a: ah, b: host as HostIdentity) {
+        FleetConvergePlanArtifactRefused {
+          refusal: SparkAxisSubjectHostMismatch { axis_host: ah, subject_host: host as HostIdentity },
+        }
+      } else {
+        FleetConvergePlanArtifactRefused { refusal: SparkAxisUnobservedRefusal { host: ah } }
+      }
+    SparkServingAxisRefused { host: ah, cause: why } =>
+      if !host_identity_eq(a: ah, b: host as HostIdentity) {
+        FleetConvergePlanArtifactRefused {
+          refusal: SparkAxisSubjectHostMismatch { axis_host: ah, subject_host: host as HostIdentity },
+        }
+      } else {
+        FleetConvergePlanArtifactRefused { refusal: SparkAxisPlanningRefused { host: ah, cause: why } }
+      }
+    SparkServingAxisNotApplicable { host: ah } =>
+      if !host_identity_eq(a: ah, b: host as HostIdentity) {
+        FleetConvergePlanArtifactRefused {
+          refusal: SparkAxisSubjectHostMismatch { axis_host: ah, subject_host: host as HostIdentity },
+        }
+      } else {
+        FleetConvergePlanArtifactReady {
+          artifact: fleet_converge_plan_artifact_assembled(
+          host: host,
+          prior_generation: prior_generation,
+          observed_timers: observed_timers,
+          observed_caps: observed_caps,
+          observed_spark: [],
+          spark_rows: scheduled_rows_empty(),
+          observed_slots: observed_slots,
+          observed_fabric_cells: observed_fabric_cells,
+          observed_activation_readiness: observed_activation_readiness,
+          ),
+        }
+      }
+    SparkServingAxisPlanned { plan: bound } =>
+      if !host_identity_eq(a: bound.host, b: host as HostIdentity) {
+        FleetConvergePlanArtifactRefused {
+          refusal: SparkAxisSubjectHostMismatch {
+            axis_host: bound.host,
+            subject_host: host as HostIdentity,
+          },
+        }
+      } else {
+        FleetConvergePlanArtifactReady {
+          artifact: fleet_converge_plan_artifact_assembled(
+          host: host,
+          prior_generation: prior_generation,
+          observed_timers: observed_timers,
+          observed_caps: observed_caps,
+          observed_spark: bound.observed_members,
+          spark_rows: bound.rows,
+          observed_slots: observed_slots,
+          observed_fabric_cells: observed_fabric_cells,
+          observed_activation_readiness: observed_activation_readiness,
+          ),
+        }
+      }
+  }
+}
+
+fn fleet_converge_plan_artifact_assembled(
   host: NonEmptyStr,
   prior_generation: Int,
   observed_timers: List<TimerRetirementMember>,
   observed_caps: List<CapMember>,
   observed_spark: List<SparkServingMember>,
+  spark_rows: ScheduledRows<FleetConvergeSparkServingTypedAction>,
   observed_slots: List<RunnerSlotMember>,
   observed_fabric_cells: FabricCellObservationDecision,
   observed_activation_readiness: RunnerActivationReadiness,
-) -> FleetConvergePlanArtifact? {
+) -> FleetConvergePlanArtifact {
   let request = FullHostConverge {
     host: host,
     observed_timers: observed_timers,
@@ -2373,6 +2552,12 @@ fn fleet_converge_plan_artifact(
       ["# fabric-cell"],
       fleet_converge_fabric_cell_lines(host: host, observed_fabric_cells: observed_fabric_cells),
       [
+        concat(
+          "# spark-serving-typed-actions:",
+          fleet_converge_spark_serving_typed_actions_wire(
+            rows: scheduled_rows_list(scheduled: spark_rows),
+          ),
+        ),
         concat("# slot-refusals=", to_string(fleet_converge_slot_refusal_count(host: host, observed_slots: observed_slots))),
         concat("# activation-refusals=", to_string(fleet_converge_activation_refusal_count(host: host, readiness: observed_activation_readiness))),
         concat("# cap-refusals=", to_string(membership_refusal_count(plan: cap_plan))),
@@ -2416,21 +2601,15 @@ fn fleet_converge_plan_artifact(
     observed_activation_readiness: observed_activation_readiness,
     terminal: planned_terminal,
   )
-  match content_hash_of_value(value: baseline as NonEmptyStr) {
-    Fnv1a64(structural) =>
-      Present {
-        value: FleetConvergePlanArtifact {
-          subject: subject,
-          prior_generation: prior_generation,
-          plan_lease: lease,
-          apply_terminal: planned_terminal,
-          observed_baseline_hex: structural.digest,
-          plan_body: body,
-          apply_shell: apply_shell,
-          spark_serving_typed_actions: scheduled_rows_empty(),
-        },
-      }
-    _ => Absent
+  FleetConvergePlanArtifact {
+    subject: subject,
+    prior_generation: prior_generation,
+    plan_lease: lease,
+    apply_terminal: planned_terminal,
+    observed_baseline_hex: content_hash_atom(value: baseline as NonEmptyStr).digest,
+    plan_body: body,
+    apply_shell: apply_shell,
+    spark_serving_typed_actions: spark_rows,
   }
 }