core: give the pass verdict one definition

[fosskar]

Found by an architecture review of the engine loop, then validated by ablation — deleting each guard and running the whole suite — before any code changed.

The problem

One question — "were this agent's sessions fully seen this pass?" (issue #49) — was written out four times in SessionFilesystem:

fn frozen(key)             → incomplete_agents.contains(agent) || resolver.agent_failed(agent) || excluded_parts(..)
fn tombstone_withheld(key) → incomplete_agents.contains(agent) || resolver.agent_failed(agent)
fn state_retained(key)     → incomplete_agents.contains(agent) || resolver.agent_failed(agent)
fn pass_complete()         → incomplete_agents.is_empty() && !resolver.any_agent_failed()

Three were re-exported through SessionPass so Engine::tick_once could remember to call each in the right spot — before executing a tombstone, before settling the recipient fingerprint, before pruning carried state. Forgetting one is silent data loss: a local path-map failure tombstoning healthy sessions on every peer, which is the bug class #49 exists to prevent.

Validation: every engine-side guard was untested

Delete the guard, run cargo test --workspace:

guard	load-bearing?	caught by any test?
frozen (projection)	yes	✅ excluded_projects_neither_publish_nor_materialize
tombstone_withheld (lib.rs:353)	no — unreachable	❌
state_retained (lib.rs:396)	yes	❌
pass_complete (lib.rs:387)	yes	❌

tombstone_withheld can never fire: frozen already strips a blind agent's keys out of the reconcile index, and Action::Tombstone is only emitted for a key that has an index entry (reconcile.rs:275-286). Since begin_pass snapshots before projecting, the two always agree within a pass.

The change

Name the predicate once and express the rest over it:

/// Whether this pass could not see `agent`'s sessions completely: its scan
/// aborted or its path-map resolution failed (#49). The one definition …
fn agent_incomplete(&self, agent: &str) -> bool

• frozen and state_retained are now one line over it; pass_complete keeps its cheap aggregate form, documented as the pass-wide form of the same question.
• tombstone_withheld is removed, along with its SessionPass forwarder and the tick_once guard. Dead code that looks load-bearing is worse than no code: no test can exercise it, so it implies a coverage it does not have. The behaviour it nominally protected is now pinned by a test that survives refactors of either mechanism.
• The session_filesystem tests that asserted tombstone_withheld now assert frozen — the same condition, and the mechanism that actually withholds.

Closing the coverage hole

Three new engine-level tests pin the consequences where they land:

• frozen_agent_does_not_tombstone_a_peers_session
• frozen_agent_keeps_its_carried_state
• incomplete_pass_does_not_settle_the_recipient_set

Each was verified to fail when its mechanism is removed:

ablate state_retained  → CAUGHT by frozen_agent_keeps_its_carried_state
ablate pass_complete   → CAUGHT by incomplete_pass_does_not_settle_the_recipient_set
ablate frozen          → CAUGHT by frozen_agent_does_not_tombstone_a_peers_session

The fixture runs two agents deliberately. With one agent, freezing it empties the local snapshot and reconcile's empty-dir wipe guard suppresses tombstones on its own — the first version of the tombstone test passed without the freeze doing any work. A healthy second agent keeps the snapshot non-empty so the test actually exercises the freeze.

One observation, deliberately not acted on

Ablation also showed the || resolver.agent_failed(agent) half of agent_incomplete is currently redundant: snapshot() mirrors resolver failures into incomplete_agents (session_filesystem.rs:538) in the same pass, so removing the disjunct changes nothing and no test notices.

It stays. It names a real failure mode, and making the verdict depend on that mirroring would couple the definition to an implementation detail of snapshot. Flagging it in case you disagree.

Verification

• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test --workspace -- --test-threads=1 — 258 passed, 0 failed
• nix fmt -- --ci — 0 changed

No version bump: no user-visible behaviour change (refactor plus test coverage).