mariadb: align primary roleProbe marker contract

[weicao]

Problem

Fresh diagnostic r12 on addon 3e51be9bebd950b26405399966243fba64d5596b and syncer 7502b58f45efd4fe8f2b06e5313230d9aec69510 narrowed the post-commit repair loop to one directly conflicting predicate:

2026-07-15T04:50:15Z primary-write-commit rc=0 authority=fresh-lease-cas
2026-07-15T04:50:18Z runtime-primary-listener-reconcile-repair-begin primary_ready=present remote_root_fence=present master_info=absent listener_wildcard=present

The entrypoint clears .remote-root-fence-role before authoritative commit and treats marker absence as part of the committed-primary invariant. The roleProbe then calls apply_remote_root_fence "primary" and writes primary back to that marker, causing the runtime repair path to retract readiness and fence the database.

Canonical evidence:

• outer SHA256: f953215c36658cf9564294f8842b3dc4df915aaec60fca65856efcbccc4758a2
• inner SHA256SUMS SHA256: 9bd27dc268c3a5338cfefdbb08f030f40e3e047b337b8057549ac064f57a56fd
• 22/22 payload files verified; scene remains frozen, repair/cleanup 0

This is exact-source N=1 evidence. It proves the first observed conflicting predicate for this run, not fleet frequency.

Change

Give .remote-root-fence-role one durable meaning:

• secondary present: secondary remote-root fence is active
• absent: committed primary remote-root state

An already-accepted primary with no marker no longer rewrites grants or recreates the marker. A secondary-to-primary transition still applies the primary grant set, then removes the marker. If that transition fails, it preserves the secondary marker so the entrypoint observes and repairs the drift instead of hiding it. Secondary behavior is otherwise unchanged.

TDD

Production RED on the old source: 50 examples, 3 failures, 1 historical pending:

1. accepted primary with absent marker failed because roleProbe tried to recreate primary state;
2. successful secondary-to-primary transition left a primary marker;
3. failed transition erased the existing secondary fence marker.

GREEN:

• focused roleProbe: 50 examples, 0 failures, 1 historical pending
• related roleProbe + merged recovery + semisync fence: 153 examples, 0 failures, 1 historical pending
• full MariaDB ShellSpec: 770 examples, 0 failures, 9 historical pendings
• POSIX sh -n
• ShellCheck error-level
• Helm lint and default render, including rendered marker-contract source
• git diff --check

Runtime boundary

No patched runtime result exists yet. The diagnostic r12 scene remains frozen and the full suite remains NO-LAUNCH. The next runtime gate must use a newly audited current-head combined source and run focused initial-authority convergence before any full-suite decision.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (3e51be9) to head (ccd5c0e).

Files with missing lines	Patch %	Lines
...iadb/scripts-ut-spec/replication_roleprobe_spec.sh	0.00%	30 Missing ⚠️

Additional details and impacted files

@@                             Coverage Diff                             @@
##           helen/mariadb-r11-primary-drift-diagnostics   #3215   +/-   ##
===========================================================================
  Coverage                                         0.00%   0.00%           
===========================================================================
  Files                                              154     154           
  Lines                                            24270   24296   +26     
===========================================================================
- Misses                                           24270   24296   +26     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.