Rectify staged output pin inspection typing

[lamemustafa]

Problem

The statement writer can leak a raw OSError if staged .part pin inspection fails immediately before replacement, despite adjacent ownership checks returning typed output_path_changed.

Acceptance

• Translate the staged-pin inspection boundary to the stable typed refusal.
• Preserve conservative cleanup and add deterministic injected-fstat coverage.

Discovered on PR #320 and deferred under the owner-authorized P1-only stopping rule.

[lamemustafa]

Taking this together with the sibling issue — #352 and #353 are the same boundary (a pin fstat leaking a raw OSError where the adjacent code returns typed output_path_changed) at two different points, so one change and two controls. Will post findings before changing anything.

[lamemustafa]

No change needed — this is already done. Verified against origin/master rather than inferred.

Both staged inspections in write_outputs already convert OSError to the typed refusal:

• scripts/bank_statement_import.py:2708 — the staged path identity: except OSError: staged_entry_unchanged = False, then raise Refusal("output_path_changed", "... staged output changed before replacement").
• :2718 — the staged pinned digest: except OSError: staged_digest_matches = False, then the same typed refusal.

So the acceptance criterion "translate the staged-pin inspection boundary to the stable typed refusal" is met at both boundaries, and the conservative cleanup is unchanged.

The second criterion — "deterministic injected-fstat coverage" — is partly met: test_pre_replacement_original_pin_fstat_failure_is_a_typed_path_change and the backup-pin regression both inject fstat failures deterministically and assert the typed refusal, though neither targets the staged digest pin specifically. That is a coverage gap rather than a defect, and a small one given the code path is three lines long and shares its shape with two tested siblings.

Its sibling #353 was real, and is fixed in #425. The difference is instructive: the final validation loop wrapped the same family of helper in except Refusal only, so an os.fstat failure escaped as a raw OSError — and it escaped at the point where every swap has already committed. #353 also correctly predicted that the existing regression could not reach that path; my own first attempt at a control could not either, and passed against the unfixed code.

Suggest closing this as already-rectified. Not closing it myself since it is not mine to close.

[lamemustafa]

Both acceptance criteria are now met, so this is ready to close.

1. "Translate the staged-pin inspection boundary to the stable typed refusal" — already done on master before this issue was picked up. Both staged inspections in write_outputs convert OSError to output_path_changed:

• the staged path identity: except OSError: staged_entry_unchanged = False
• the staged pinned digest: except OSError: staged_digest_matches = False

2. "Add deterministic injected-fstat coverage" — this was the residual, and #430 closes it.

I originally argued the gap was acceptable because the staged-digest path is three lines sharing its shape with two tested siblings. That is the same argument that failed on the sibling #353, where the same family of helper was wrapped in except Refusal only, and an os.fstat failure escaped raw at the point where every swap had already committed. A shape shared with a tested neighbour is not a test.

test_pre_replacement_staged_digest_failure_is_a_typed_path_change injects the failure deterministically and was proven non-vacuous — with the except OSError removed it surfaces a raw OSError: controlled staged pin digest failure.

Independent review of that PR also disproved two claims I made about the control itself, both since corrected: the arming was not consumed on first use (cleanup re-installed it; the finally was what made it safe — it is genuinely one-shot now), and the message assertion could not distinguish the staged-digest boundary from the staged path-identity one, since three sites raise the byte-identical string and Refusal declares its message free to change. A fired flag now pins the refusal to the boundary whose injected failure was actually consumed.

No production code changed for this issue — the defect it described was already fixed; what was missing was the proof.

Suggest closing as rectified.

[lamemustafa]

Closing as rectified: the typed-refusal translation was already on master, and #430 closed the remaining injected-fstat coverage gap on the staged-digest pin.