fix: repair legacy launcher installs whose service runs from the stable slot

[stamp-build]

Problem

Machines with the legacy two-layer layout cannot be repaired. The installed path (~/.local/bin/raft-computer) is an old launcher that execs into K's stable slot, so the running service's executable is ~/.slock/computer/k/slots/stable/artifact.bin. The installer already classifies these installs as broken ("installed executable differs from the stable slot"), which is right. But repair then asks the running product for its pid and requires that pid's executable to be the installed binary. That check fails every time:

• receipt detail.diagnostic: product attestation does not identify a live installed executable
• human line: Raft Computer's current status couldn't be confirmed. Run the same command again to continue.

Rerunning cannot help, because the check is deterministic. Seen on artin's machine: 3 live processes, all /proc/<pid>/exe = slots/stable/artifact.bin; the launcher sha differs from the slot sha. A second machine has the same layout.

Fix

host.rs: product executables are the installed binary plus the stable and experiment slot artifacts (both inside the installer-owned K state directory). They are used in:

• answer(): attesting the status-reported pid (attest_product);
• installed_product_processes(): the processes repair stops and must see gone before quarantine. Previously, legacy slot processes were invisible here, so the "product is still active before quarantine" proof could not see them.

live_evidence(), the post-install proof, still requires the installed binary.

Tests

• verification/test_legacy_layout.py (native, end-to-end): install 1.0.0, replace the binary with an exec launcher into the slot, start the service, then install --version 1.1.0 → outcome repaired, self-version 1.1.0, service running again.
  • RED on origin/main: exit 3 with exactly the field diagnostic above.
  • GREEN with this change.
• host.rs unit tests: a process running from the stable slot is attested and counted as a product process; an unrelated process is not. Mutating product_executables back to the binary only fails the slot test.
• python scripts/verify.py: fmt, clippy, lib tests and native contract (87 tests) all pass.

The new native test is in its own file because any edit to test_native.py is rejected by the Stamp secret scanner (an existing synthetic ghp_… fixture).

Not in this PR

When this failure happens, the human output does not say where the real cause is. test_no_installer_wording forbids naming internal concepts in human output, so that needs a product decision first.

🤖 Generated with Claude Code

---

^{archer opened this pull request through Stamp}