Model the full durable allocation-store directory chain

[gunbai-bot]

FCI-1 prerequisite: model and positively observe both /var/lib/gunbc/fabric and its allocation leaf before convergence. The production plan emits two ordered root-owned 0700 EnsureOwnedDirectory effects, and apply binds the two-level prestate into its subject fingerprint and baseline so an appeared or drifted namespace/leaf refuses before actuation. This branch also closes the exhaustive-match refusals exposed by the typed allocation-store mismatch arm.\n\nThe generated srv3 sudoers projection is intentionally not hand-edited; it must be regenerated from this exact tree after its self-built compiler resolves the closure. No host effect or apply is authorized from this draft.

[gunbai-bot]

Review 57700 identifies two real latent shape issues: the path coordinates remain parallel spellings guarded by validation, and the stat-mode projection assumes the currently frozen 0DDD spelling. I am not changing this exact head because the accepted subject is specifically the two fixed paths at mode 0700, its generated sudoers bytes have been produced and verified, and either recut would require regenerating the authorization identity before the operator install. The path decomposition should become the sole constructor when this substrate gains another path consumer; the mode normalization should move to a modeled parsed mode carrier before any non-0DDD mode is admitted. Neither current witness nor plan claims the broader guarantee. — sent from smart-wren-406

[briansrls]

APPROVED — merge authorization for exact head 7253432bb61f0e6aaf403ef392c8640eba93ea4d, tree 604d7db483a7a43cc7e6953d38fc32d2f5625c9f, conditional on the exact-head fabric-evidence job concluding SUCCESS and the PR head remaining unchanged.

The second Plan B refusal was correct. A single recursive install -d -m 0700 .../allocation would mutate an undeclared intermediate namespace whose mode is not governed by -m. This head removes the one-directory effect variant at its root and replaces it with one AllocationStoreDirectoryChainEnsure that projects exactly two ordered typed operations: first /var/lib/gunbc/fabric, then /var/lib/gunbc/fabric/allocation, both root:root mode 0700. Namespace and leaf prestates are separately observed, enter the request baseline/member fingerprint, and re-observation drift on either becomes a typed apply refusal.

MERGE CONDITION: merge #9780 only from the exact head above, after all required checks including fabric-evidence are SUCCESS. Any push invalidates this authorization.

AUTHORIZED AFTER MERGE — privileged srv3 sudoers re-install, conditional on post-merge main projecting provisioning/srv3/gunbc-ghrunner.sudoers at SHA-256 430ae6d42ed7d715ef430818e0500fd6efb1da18ce7d8fab799ed2439b5bf5c0, exactly 96 lines, with these exact ordered grants:

ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 0700 -o root -g root /var/lib/gunbc/fabric

ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 0700 -o root -g root /var/lib/gunbc/fabric/allocation

Exact authorized host mutation: replace /etc/sudoers.d/gunbc-ghrunner, currently expected at SHA-256 6d43b95c943ffceb3a1a4ee7d51d5176772bd6b1d0de52acc9db18cf8ddc3f02 and 95 lines, with that exact merged-main 96-line artifact. Use the established fail-closed transaction: run as ubuntu; refuse if the installed pre-digest, candidate digest, path type, line count, ordered grants, or candidate parse differs; install through a same-directory temporary at root:root 0440; atomically replace; run visudo -c over the whole tree; independently read back digest, owner/group/mode, line count, grant order, and absence of .new/.old residue; roll back on any post-replacement refusal.

This authorizes only #9780's exact-head merge after green CI and the resulting merged-main sudoers realization. It does not authorize Plan A hash 9f35b486b4dddb8a, Plan A or Plan B apply, either regenerated plan hash, the FCI-1 wet run, #9693 undrafting, or #9693 merge. A different merge head, non-green fabric-evidence, different post-merge artifact digest/population, or different installed prestate invalidates the corresponding authorization.