Both halves of the R-113 conjunction are path-presence tests: GuestSeesMount
(intermediary.go:276) and isHostMountpoint (:394) compare field 5 of a mountinfo
line and never read field 3, so neither can see that the bind and the raw mount
name different devices. Measured BoundUnderParent=TRUE over a namespace that
EIOs on every read and write.
Reproduced 3/3 on a purpose-built scratch LXC on demo-hp; predicates evaluated
by a throwaway probe calling the real localapi code from d4eb259.
Three results that change the shape of the fix:
- Q7: a bind can die in STEADY STATE with no detach/return cycle. The gate
produces no action and nothing is emitted on any channel. A Return-branch fix
cannot reach this half, and a devno comparison does not detect it.
- Q6/R-117d: AttachDrive's normalize leg already performs the repair, and three
call sites already invoke it - including the controller's Return branch before
it restarts apps. All defeated by one early return at :235. Unblock the
existing path; do not add a new one.
- Q1: the device-node change is a CONSEQUENCE, not a precondition. The stale
bind pins the dead superblock, forcing the returning device onto a new number.
Control test: released, the letter is reused.
Not established: the hang case. Venue and probes built, run lost to a site
internet outage; the thread-leak hypothesis is not claimed as a result.
Teardown of the spike venue is owed - commands in the findings doc; nothing
fenced was touched and no hub-side record was created.
