An empty partition is blank: lsblk's PTTYPE on a partition is the parent's (R-1093, unreleased)

lsblk prints the disk's table type on every partition, so InspectDevice read an empty partition as
"device has a partition table" and the format path asked the typed erase confirmation. lsblk's
PTTYPE is now set aside only when blkid -p on the partition itself proved it read the device and
that it is a partition of a table of that exact type (PART_ENTRY_NUMBER + matching
PART_ENTRY_SCHEME). A filesystem or a nested table in the partition, a silent blkid, a whole disk
or a different scheme keep the data-bearing reading. Same allow-listed argv, no sudoers change.
Test TestInspect_R1093_PartitionVerdicts, red-proved against the old predicate.

internal/storage/hostops.go

@@ -420,7 +420,8 @@ func (h *SudoHostOps) InspectDevice(ctx context.Context, device string) (DeviceP
 	// on (blkid exits 2 on a blank device) — output presence is what matters. A broken/empty
 	// blkid simply adds no positive evidence; lsblk (below) is the read-success authority.
 	bout, _, _ := h.runner.Run(ctx, h.bins.Blkid, "-p", "-o", "export", device)
-	for k, v := range parseBlkidExport(bout) {
+	blk := parseBlkidExport(bout)
+	for k, v := range blk {
 		switch k {
 		case "TYPE":
 			probe.HasFilesystem = true
@@ -456,13 +457,32 @@ func (h *SudoHostOps) InspectDevice(ctx context.Context, device string) (DeviceP
 				probe.FSType = fstype
 			}
 		}
-		if pttype != "" {
+		if pttype != "" && !inheritedPartitionTable(blk, pttype) {
 			probe.HasPartitionTable = true
 		}
 	}
 	return probe, nil
 }
 
+// inheritedPartitionTable reports whether lsblk's PTTYPE for the probed node is only the PARENT disk's
+// table (R-1093). lsblk prints the disk's table type on every one of its partitions, so an EMPTY
+// partition read as "device has a partition table" and asked for the typed erase confirmation.
+//
+// The partition's OWN signatures come from `blkid -p` on the partition itself (above): a nested table
+// inside it is its PTTYPE, a filesystem is its TYPE. So lsblk's value is set aside ONLY when blkid
+// positively proved two things — that it read the device (it printed output), and that the device is a
+// partition of a table of exactly that type (PART_ENTRY_NUMBER + PART_ENTRY_SCHEME == lsblk's PTTYPE).
+// Anything else keeps the old, safe reading: a blkid that failed or printed nothing, a whole disk, or a
+// scheme that differs from lsblk's (then lsblk sees a table blkid did not attribute to the parent).
+// Pinned by TestInspect_R1093_* (hostops_disk_test.go).
+func inheritedPartitionTable(blkid map[string]string, lsblkPTType string) bool {
+	if blkid["PART_ENTRY_NUMBER"] == "" {
+		return false
+	}
+	scheme := blkid["PART_ENTRY_SCHEME"]
+	return scheme != "" && strings.EqualFold(scheme, lsblkPTType)
+}
+
 // Format runs mkfs.<fstype> on a validated device. The caller is responsible for authorization
 // (8C: only after classifying the device non-data-bearing, or via a slice-10 operator signature).
 func (h *SudoHostOps) Format(ctx context.Context, device, fstype string) error {