the observe/apply gap has two more instances

[haribo]

Two more defs report already over a machine their own apply would have changed. Same
mistake as #594, in defs that epic did not look at.

Found by an external review; each verified in the files.

def	apply guarantees	observe asks
htpasswd.entry	the user's line and the file at 0600	does the stored hash verify
system.timezone	/etc/localtime and /etc/timezone	what does the link point at

htpasswd.entry is the sharper one: the file it leaves at 644 holds credentials, and the
def's own apply carries the comment "A credentials file readable by anyone is the
credential leaked." Its observe never checks that the chmod happened.

sudo.write and sshd.config — the two defs shaped like it — both observe a secured
field beside their content field. htpasswd.entry observes one field.

Why this is an epic and not two bugs

Because it is the third time. #486 and #480 were the first, #594 the second with four
defs, and here are two more the sweep missed. The fixes are small; the question worth
answering at the end is not.

test/e2e/adverse-cases.md names the category ("right-shaped but wrong") and holds five
worked examples. What it does not have is a way to find the next one without a human
reading every def. Candidates, to weigh rather than assume:

• a check that every field an apply writes has a matching field in the observe — not
  decidable in general, but a def whose apply runs chmod and whose observe never reads a
  mode is a shape a linter can see;
• a sweep asserting, per def, that each of its adverse cases fails when the observe is
  weakened — expensive, and closer to mutation testing than to a gate;
• or accepting that this is a review discipline and writing it as one, which at least stops
  it being rediscovered by an outside reader every few weeks.

Sub-issues

• htpasswd.entry does not observe the mode its apply sets
• system.timezone does not observe /etc/timezone

Locked decisions

• Each fix arrives with an adverse case verified red first — a weak observe passes its
  unit test by construction, so only a machine in the wrong state proves anything.
• The observe changes, never the apply. Both applies are correct.

[haribo]

Audit

Both sub-issues verified against the code — see the comments on #635 and #636. The two central
claims hold; three secondary claims were wrong and are corrected there, one of them a proposed
fix that would not have converged.

Also wrong in this epic's table: it says the existing adverse cases do not assert the thing that
is missed. They do — adverse-htpasswd.entry.shellf:38 asserts mode 600,
adverse-system.timezone.shellf:13 asserts /etc/timezone. Both assertions are unreachable as
evidence, because each case breaks enough state that the apply runs anyway. That is a sharper
finding than the one written here: an adverse case that never lets the observe converge cannot
test the observe at all. It is worth a line in adverse-cases.md, next to the rule that a case
of the third kind must have been seen red.

On the third bullet — finding the next one

The first candidate mechanism was measured rather than assumed. Rule: a def whose apply sets
a mode and whose observe reads none. Run over the 49 stdlib defs, it returns three:

def	verdict
htpasswd.entry	real — this epic
archive.extract-member	false positive — its chmod preserves the destination's existing mode (archive.shellf:79), it does not guarantee one
file.download	false positive — same shape (file.shellf:154)

1 true, 2 dismissible by reading one line each. That is a usable signal, and it does not
generalise: the rule works because chmod/stat are a closed vocabulary. system.timezone's
defect — a second path written and not observed — is not found by it, and no equally cheap rule
was found for that shape.

So the honest answer to the bullet is probably: not a gate. Neither candidate deserves CI.
What is buildable today is the adverse-case rule above, which turns "the observe must converge in
at least one case" into something a reviewer can check.

[haribo]

Both sub-issues delivered in #644 (e30fe0a), each with its adverse case verified red on a
real machine before the fix. The locked decisions held: the observes changed, both applies
were already correct.

The third bullet, answered

No CI gate. The two candidate mechanisms were weighed against the code rather than
imagined:

• "an apply that sets a mode, an observe that reads none" — measured over the 49 stdlib
  defs: 1 true positive (this epic), 2 dismissible in one line each (archive.extract-member,
  file.download, whose chmod preserves an existing mode rather than guaranteeing one).
  A usable probe, but it does not generalise: system.timezone's defect — a second path
  written and never read — is invisible to it, and no equally cheap rule was found for that
  shape.
• mutation-testing the observes — closer to a research project than a gate, for a defect
  class of six instances in a year.

What shipped instead is the rule this pair actually taught, in test/e2e/adverse-cases.md:

the apply must not run for any other reason. A third-kind case tests the observe,
so the state it builds has to be one the def would call converged.

Both defects already had an assertion sitting beside them — adverse-htpasswd.entry.shellf:38
asserts mode 600, adverse-system.timezone.shellf:13 asserts /etc/timezone — and both
passed, because each case broke enough state that the apply ran regardless. That is the
mechanism by which this class keeps surviving its own tests, and it is now written down where
the next case gets written.

Closing. A seventh instance reopens the question with better evidence than a fourth epic.