Consolidate the stub platform guard, and record why it was needed

[b-macker]

Summary

Two commits: the consolidation, and the campaign record of what made it necessary.

1. Consolidate the guard (4bad165)

The 29 guards added in #120 carried pending stall bisect in their comments. The bisect is finished — excluding all 29 took CLI tests — shell suites from a 47-minute hang to 2m04s — so the comments described a hypothesis that had been settled.

Replaces 29 near-copies with one helper:

source "$SCRIPT_DIR/../helpers/stub_platform.sh"
skip_if_no_stub_support "test_quarantine_corroboration.sh"

762 lines removed, 58 added. The line count is not the point. The reason this took four stalls to diagnose is that the finding was recorded in one file's comment, where the 28 other callers of the same launcher could not see it:

"Stub-backed HTTP tests hang on Windows/MSYS2 due to signal propagation and process cleanup issues. Skip entirely — Linux CI validates the behavior."
— test_absorption_degenerate.sh, present before any of this work

The helper states what is known rather than what was suspected, and says plainly that it is a workaround, not a fix — the launcher's signal and cleanup behaviour under MSYS2 is the actual defect and is still open.

2. Record it (642cce5)

docs/governance-campaign-findings.md exists so the next person does not rediscover what was already settled — which is precisely the failure this entry is about. 522 → 613 lines.

New section, "A fix that reached one caller." The same shape had already happened once, in that file's own table: 081f460 fixed the stub's one-shot port pick. Measured, not estimated:

fix	diagnosed in	reached
stub port retry (081f460)	1 suite	2 of 29
Windows/MSYS2 stub guard	1 suite	1 of 29

Cost of the second one: four stalls, three misattributed Linux failures, one incorrect one-commit bisect, and a fix that had to be reverted — all downstream of a correct diagnosis nobody could find.

Two withdrawn proposals, in the section kept because the reasoning against them is the useful part:

• Check allowed_actions in agent.commit() — reported as a gap in the same family as Re-check the standing lease when a proposal is committed #105/Hold the CRITICAL suspension at the commit boundary #114; it does not exist. agentCommit already compares getReloadCount() against the count stamped at propose time, and reload_count_++ fires only on an accepted reload, so any config change that could remove the action has already invalidated the proposal.
• Give the stub launcher a port retry — fixed Linux, hung Windows. The one-commit bisect that appeared to prove it was coincidence: the next commit restored the Windows path byte-equivalently and stalled anyway.

Fifth method note — "A grep defines what you are able to see." Three wrong conclusions in one session, tabulated with what each pattern hid: the reload_count guard, 20 of 29 stub suites, and the second taint violation message format. Absence from a grep result reads exactly like absence from the code.

One overstatement corrected while writing: the platform guard is now one definition, but the launcher is still 29 near-copies and the port retry still reaches only some of them. Deliberately not consolidated — the correct Windows behaviour of that code is what remains unknown, and consolidating would freeze one guess into 29 callers. Left recorded as an open exposure rather than rounded up.

Test Plan

• Ran bash run-all-tests.sh with no new failures — 441 tests, 0 unexpected failures (total unchanged)
• bash tests/security/test_error_msg_leaks.sh — 874 checks, 0 failures
• Added/updated tests for new functionality — n/a, test infrastructure and documentation only
• Tested manually in the REPL — n/a

Both directions verified, since a guard that never fires and a guard that always fires look identical from a green suite:

condition	result
simulated MINGW64_NT uname	all 29 observed taking the skip
$WINDIR set, normal uname	skip taken — second signal works independently
Linux, neither signal	guard does not fire; test_quarantine_corroboration.sh still 5/5

Every figure in the documentation was checked against the tree: 1 of 29, 2 of 29, 29 launchers, H-01/H-02 present. No pending stall bisect text remains in tests/.

build-windows has now passed three consecutive times since the exclusion (e5c6f00, 4bad165, 642cce5).

Follow-ups not in this PR

• Fixing the launcher's MSYS2 signal/cleanup behaviour so the suites can run on Windows again — the honest fix, of which this is the workaround.
• The launcher itself is still 29 copies; consolidating it is blocked on knowing what its Windows behaviour should be.
• test_absorption_degenerate.sh retains an IS_WINDOWS branch at ~line 265 that is now unreachable. Left alone rather than widening this change.

Related Issues

Follow-up to #120, which established the result this PR records.

---

Generated by Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}