NK-WP-0056-T06: executor waits for every endpoint; errors named by phase, never mislabelled as no-effect

Two live runs of BEA-2026-0002 ended setup:URLError while four read-only diagnostic pods (same
image, labels, mounts and config) reached every endpoint. Likely cause: a fresh Job pod reaches
OpenBao before the sso/approval-engine ingress rules admit it (NetworkPolicy is programmed per
destination). Now:
- build waits until OpenBao, KeyCape, approval-engine, audit-core and LLDAP all answer HTTP
  (one shared 30 s budget); an unreachable one is named: setup:<name> not reachable.
- a preflight error is a refusal named preflight_error:<Type> (preflight has no effect).
- an error in the consume read-back is outcome unknown, consume_unconfirmed:<Type>, alerted;
  before, any exception after setup was reported as 'refused, no effect' even after consume.
- any other escaping error after setup is outcome unknown (exit 5), never 'no effect'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

bounded-executor/tests/test_executor.py

@@ -402,6 +402,30 @@ class FailureTests(Base):
         self.assertIn("restore-kv", self.ops())
         self.assertNotIn("deliver", self.ops())
 
+    def test_preflight_error_is_a_named_refusal(self):
+        def broken(_id):
+            raise ConnectionRefusedError()
+        self.w.carrier.get = broken
+        result = self.run_it()
+        self.assertEqual((result["outcome"], result["reason"], result["effects"]),
+                         ("refused", "preflight_error:ConnectionRefusedError", False))
+        self.assertEqual(self.w.carrier.consumes, 0)
+
+    def test_consume_read_back_error_is_unknown_never_no_effect(self):
+        real_get, calls = self.w.carrier.get, []
+        def get(approval_id):
+            calls.append(approval_id)
+            if len(calls) > 1:  # preflight reads once; the consume read-back fails
+                raise ConnectionResetError()
+            return real_get(approval_id)
+        self.w.carrier.get = get
+        self.w.carrier.raise_on_consume = True
+        result = self.run_it()
+        self.assertEqual((result["outcome"], result["reason"], result["effects"]),
+                         ("unknown", "consume_unconfirmed:ConnectionResetError", "consume-unknown"))
+        self.assertIn("consume_unconfirmed", self.w.alerts)
+        self.assertEqual(self.w.events, [])
+
     def test_stop_before_consume_spends_nothing(self):
         self.w.stop_after = 0
         result = self.run_it()