Read a filesystem that could not be named as unknown, never as a move (hq ADR 0325 sixth review)

A name read that timed out gave an empty name, which differed from the recorded one
and so reset the record: a folder kept while empty asked again, a warranted one was
walked again. An unnamed filesystem now leaves the folder exactly as it is, the
access is said not known for that look, and it resumes once it is named.

internal/apply/keep.go

@@ -189,6 +189,8 @@ const (
 	folderWaitDisk = "wait-disk"
 	// folderRoot is root's data on its placed filesystem: never kept.
 	folderRoot = "root"
+	// folderUnknown is a folder whose filesystem could not be named: left as it is until it is.
+	folderUnknown = "unknown"
 )
 
 // folderVerdict is the judgement of one folder, with what it read.
@@ -249,6 +251,13 @@ func assessFolder(ctx context.Context, path string, rec store.KeptFolder, taken
 	// Another filesystem at the same mount point (another pool, another disk) is a move too. A record from an earlier
 	// build names its filesystem another way, and is not compared: the next keep names it this way.
 	here := PlacedID(pl.Mount)
+	// **A filesystem that cannot be named now is unknown, never a move** (a name read that did not answer, a
+	// filesystem with no UUID, id or source): the folder holds what it is — nothing walked, nothing newly kept,
+	// nothing reset — and is judged again when it is named. One never kept is so never kept: it fails closed.
+	if here == "" {
+		return folderVerdict{kind: folderUnknown, mount: pl.Mount, unnamed: true,
+			why: "its filesystem could not be named this time (no UUID, filesystem id or source answered)"}
+	}
 	moved := pl.Moved || (rec.Fs != "" && rec.Mount == pl.Mount && rec.Placed != here)
 	facts, err := readFolder(path)
 	if err != nil {
@@ -257,11 +266,6 @@ func assessFolder(ctx context.Context, path string, rec store.KeptFolder, taken
 	if why := rootOwned(facts.UID, facts.GID); why != "" {
 		return folderVerdict{kind: folderRoot, mount: pl.Mount, why: "it is " + why}
 	}
-	// A filesystem that cannot be named is never kept: what is there could be anyone's (§8).
-	if here == "" {
-		return folderVerdict{kind: folderWaitKeep, mount: pl.Mount, moved: moved, unnamed: true,
-			why: "its filesystem cannot be named (no UUID, no filesystem id, no source)"}
-	}
 	// The controller's word that the folder was taken holds for the filesystem the warrant was carried out on: a
 	// folder moved to another is not taken, and asks again (§8).
 	takenHere := taken && (rec.TakenOn == here || (rec.TakenOn == "" && !moved))
@@ -520,6 +524,10 @@ func applyAccessFolder(ctx context.Context, r *declaration.Access, in inputs) (O
 		note += "; its grant is no longer acted on: the mesh puts no account in a group for data (novox/hq ADR 0325 §5)"
 	}
 	switch v.kind {
+	case folderUnknown:
+		out.Action = "waiting"
+		out.Detail = v.why + ": the folder is left exactly as it is, and judged again on the next apply" + note
+		return out, nil
 	case folderWaitDisk:
 		out.Action = "waiting"
 		out.Detail = "the disk that holds it is not there: nothing is made, and nothing mounts it until it is " +
@@ -792,6 +800,8 @@ const (
 	VerdictWaitDisk = "wait-disk"
 	VerdictRoot     = "root"
 	VerdictBroken   = "broken"
+	// VerdictUnknown is a folder whose filesystem could not be named this look: neither kept nor faulted.
+	VerdictUnknown = "unknown"
 	// VerdictNobody is a folder no identity uses: nothing is kept, and only a missing disk is said.
 	VerdictNobody = "nobody"
 )
@@ -813,6 +823,8 @@ func AccessVerdict(ctx context.Context, path string, taken, used bool) AccessJud
 		return AccessJudgement{Kind: VerdictBroken, Why: pathless(v.err)}
 	case v.kind == folderWaitDisk:
 		return AccessJudgement{Kind: VerdictWaitDisk}
+	case v.kind == folderUnknown:
+		return AccessJudgement{Kind: VerdictUnknown, Why: v.why}
 	case !used:
 		return AccessJudgement{Kind: VerdictNobody}
 	case v.kind == folderRoot: