Sweep: exit codes and status values that are documented and consumed but never emitted (found via hub-db-backup exit 7)

ORIGIN: fixed instance shipped as hub-db-backup.sh v1.3, commit ce767ea, 2026-08-31. This item is the SWEEP for other instances, not the fix - the fix is done. THE DEFECT CLASS: an exit code / status / field is DOCUMENTED and CONSUMED, but no code path ever produces it. Every consumer is correct, so nothing looks broken; the producer simply never speaks the value they are listening for. THE MEASURED INSTANCE. hub-db-backup.sh documented exit 7 = "backup fine, retention prune failed" at line 30. Two consumers were built against it: SuccessExitStatus=7 in hub-db-backup.service (so a failed prune would not be reported as a failed backup) and a dedicated 7) case in hub-db-backup-notify.sh ("backup succeeded, only retention prune failed - visible in journal, not paged"). Both correct. But the prune loop ran `trash "$f" || rm -f "$f"` then incremented its counter UNCONDITIONALLY, and the loop ended in an unconditional exit 0. Measured before the fix with two chattr +i artifacts and KEEP=1: rm printed "Operation not permitted" twice, the run logged "pruned 3 old artifact(s)", both files were still on disk, EXIT=0. A dest dir that never drains, reporting green every day, with the only signal being an rm stderr line that the script s own header already documents as lost under a unit that discards stdout. TWO GENERALISABLE RULES: 1. CONSUMERS OF A CONTRACT ARE NOT EVIDENCE THE CONTRACT IS HONOURED. Three artifacts agreeing about a value (header, unit, notifier) does not mean anything ever emits it. Grep the PRODUCER for the value, not the readers. 2. A LONG-STANDING "UNTESTED" ITEM IS A HYPOTHESIS ABOUT THE TEST HARNESS. This one had been carried as "exit 7 still untested by either of us". It was untestABLE. Before writing a test for a branch nobody has exercised, check the branch is reachable at all - the reason nobody produced it is often that nothing can. Also: `rm -f` exits 0 on an absent path, so `rm -f "$f" && n=$((n+1))` would have been equally false. Each branch now ends `&& [[ ! -e "$f" ]]` - that test, not the exit status, is what makes a count a receipt rather than a claim. THE SWEEP (this item s actual work): across sh.git and the fleet s systemd units, find every declared-but-unemitted status contract. - For each unit carrying SuccessExitStatus=, RestartPreventExitStatus= or an ExecStopPost hook that switches on EXIT_STATUS: grep the ExecStart script for an actual `exit <that code>`. Any code named by a consumer and absent from the producer is a hit. - Same for scripts documenting exit codes in a header comment: every documented code must appear in an assignment. - Same shape one level up in data: a JSON/status field a reader branches on that no writer ever sets. Report each hit as a finding with the producer path, the consumer path, and whether the branch is reachable. Fix or file per-hit; do not batch-fix without saying so.