fix(outscale, machine, emulator): a filter it cannot read is refused, a decline is a warning, and a refusal carries a marker (#566, #474, #477, #505)

[stephrobert]

Closes #566. Closes #477. Closes #474. Closes #505.

Four issues about how a refusal is spelled. Three share one shape — three
answers folded into two, and the one that disappears is always the one that
produces a silent success. The fourth is a client's defect and closes as
documentation, with the remedy that would have been a fix disproved.

#566 — a filter it cannot read is now refused, and the issue understated it

filters.go has stated the rule in its own preamble for a year: "a filter is
either applied or refused, never ignored." The code beneath it ignored four.

Measured against main@2879888, and wider than the issue said:

VolumeSizes [40]      -> 200, both volumes    (the type the API declares)
VolumeSizes ["40"]    -> 200, the 40 GiB one  (a type it does not)
VolumeIds   "vol-x"   -> 200, both volumes    (a string where an array goes)
Progresses  [7]       -> 200, four snapshots at Progress 100
AccountIds  ["…000"]  -> 200, four snapshots at AccountId …001

The only shape this pack could read was the one the API does not declare. A
client conforming to the contract was filtered to nothing; a client sending the
wrong type was served correctly.

And AccountIds is a plain array-of-strings filter — perfectly decodable —
that nothing compared: snapshotFilters named three filters snapshotMatches
never mentioned, so no decoder, no kind check and no contract check could ever
have caught it. A different mechanism, invisible to the issue's framing.

After: [40] selects one, ["40"] and the bare string are 400s naming the
filter and its declared shape, Progresses and AccountIds discriminate. octl
drives all of it, because it sends integers.

A fifth defect fell out of the new control: ReadVms served VmStates,
which belongs to FiltersVmsState. It refused the real VmStateNames and
applied an invented name — and TestTheServedFiltersFilter drove the invented
one, the emulator proving itself against itself. Fixed; nothing outside the
pack's own tests used it.

#474 — a decline is a WARN, and 47 of 48 sites were already right

Fourteen level=ERROR lines over fifteen stack replays were all one deliberate,
documented refusal. The instinct is to change the level; the work was to inventory
the 48 error sites, find that 47 said something true, and correct the one that
called a decline a failure.

The rule is now written where it is applied: an ERROR is something this emulator
did not do that it was built to do; a WARN is something it deliberately declines
and documents, where the API answer stays honest. An ERROR one learns to ignore
disarms the reading of a log exactly as a gate one learns to skip disarms the
hooks.

#477 — the marker moves out of band, because the obvious remedy fails a real client

A route feint does not serve answered a bare 404, which the official client reads
as an ordinary empty answer. Three refusals sat inside a fully green stack.

The issue's preferred remedy — answer 501, the shape not_emulated this
emulator already has — is refused, with the measurement: 501 costs exo
nothing in latency (22/21/19 ms against a 19 ms baseline) but fails
exo compute instance create, which reads GET /v2/reverse-dns/instance/{id}
after every create and treats anything but 404 as fatal. The exo-cli leg died at
"instance create rejected" under 501 and passes under 404.

So no status and no body can carry the marker there. It moved to
X-Feint-Not-Emulated, set once in handleUnrouted for all three packs, beside
the existing X-Feint-Fault and X-Feint-Probe.

This is the polar star arbitrating in the direction people forget: a louder
refusal that breaks a client the real cloud would have served is a defect too,
and symmetrical.

#505 — documentation, and remedy (1) disproved

scw 2.56.3 panics (recovered, rc=0) on every successful lb acl delete. The
only remedy that would have been a real fix — the emulator answering something
that does not trigger the faulty assertion — is false, read and then measured:
ZonedAPI.DeleteACL decodes the body into nil, so nothing the emulator answers
reaches the faulty path; Run returns success unconditionally on a nil error;
and the interceptor asserts *ZonedAPIDeleteCertificateRequest on a
*ZonedAPIDeleteACLRequest, so getACL is nil everywhere. The only lever is
failing a delete that worked — measured with PUT /_feint/faults: no panic, and
the ACL survives.

Filtering the line was refused too: it would hide a real upstream defect. What
ships is the honest half — scw-cli.sh now reads the ACL list back, so "rc=0
with a panic on stderr" is measured rather than trusted.

Source of every changed shape

• filter types and VmStateNames — contracts/outscale.json and osc-sdk-go's
  FiltersVm/FiltersVolume/FiltersSnapshot, cross-checked;
• the 400 body — the pack's existing badRequest, unchanged;
• Exoscale's 404 and bare message — unchanged; egoscale.APIError requires
  message only, and corpus/exoscale/exo-refusals.jsonl records exactly that;
• X-Feint-Not-Emulated — feint's own namespace;
• the WARN level — the rule A load balancer whose backends are on another subnet is accepted by the API and refused by OVN #457 already states at the balancer's sibling refusal.

An instrument lied, and two silent defects were cancelling out

The corpus gate went red on ReadKeypairs, and the recorded request is what is
wrong: oapi-cli sent Filters.KeypairNames as an array, the proxy's redaction
flattened it to one string, and until now the pack read the undecodable filter as
absent and answered 200. Two silent defects cancelled out, and that gate had been
passing by accident. redactValue now keeps a list of scalars a list; the two
legacy lines are in corpus/accepted.json with their citation, and the staleness
rule deletes them when that corpus is re-recorded.

The comment that over-claimed, corrected rather than defended

Three mutations written for this lot did not bite: the matchers'
err != nil → return false branches are defence in depth, not the guard —
json.Unmarshal leaves the slice empty, so a present filter with no accepted
values already matches nothing. filters.go now says that, instead of citing a
test it cannot redden, and those three are not declared in the spec.

Gates

prepush 0 — read as its own exit code, not a pipeline's. Legs probe,
exo-cli, octl (147.9 s), scw-cli, fields (215.7 s), terraform — all
green. limits:check 0 on this branch and 2 on main, which is the next
section.

falsify -- refusals-are-legible.json: 7 of 7 bite, compiled=yes on each,
green after restoration.

The ledger line, and why it is here

limits:check is red on main right now, on the section "A machine's route out"
— not because of anything in this tree, but because that section's body cites
#514, which closed at 09:33Z today, the same minute as 2879888. The clock
made it stale, not a change. The section was read before its acknowledgement was
re-dated, and the commit body says that rather than the false reason it first
gave.

Worth recording about the instrument itself: limits-acks.py queries GitHub live,
so its verdict depends on a clock and on network state, and two runs minutes
apart can legitimately disagree — one did, during this review. A verdict that
depends on time reads exactly like a verdict about a checkout.

What was not obtained

• FEINT_VM=incus-ovn conformance:leg -- runtime, which testplan
  prescribed because the diff touches internal/core/machine/binding.go — where
  the only change is slog.Error → slog.Warn. No runtime behaviour branches on
  a log level. testplan erring on the expensive side again: it routes on
  paths, not on what a change does.
• An Exoscale operation feint declines is refused with a bare 404 the official client reads as an ordinary empty answer: three refusals inside a fully green stack #477's other half. A header is invisible to Terraform and to a human
  reading an apply, so a run can still be green while three declined operations
  were called. Telling an operator needs a surface feint status does not have.
  Documented in docs/architecture.md and at Pack.NotFound as the open
  remainder rather than left implied.
• No real-cloud measurement anywhere: no account, and corpus/ holds no
  reverse-DNS exchange, so "the real cloud answers 404 when an elastic IP has no
  reverse record" stays the issue's deduction, and limits.md now labels it as
  one.