Diagnose linux-auth-observe unreadable-input CLI behavior

[stacknil]

Context

linux-auth-observe normalize documents resilient per-line handling for unsupported or malformed records. The observable CLI contract for a top-level input that is missing or cannot be read is less explicit. This issue asks for evidence and classification before any implementation proposal.

Relevant paths on the default branch:

• projects/linux-auth-observe/README.md
• projects/linux-auth-observe/src/linux_auth_observe/cli.py
• projects/linux-auth-observe/tests/test_cli.py

Diagnostic question

For a missing input path, and for an unreadable regular file when the platform can create one safely, what does the current CLI expose through exit status, stdout, and stderr? Is that behavior an intentional contract, a documentation/test ambiguity, an environment-specific limitation, or a defect?

Evidence required

• Current default-branch commit, OS, Python version, and exact commands.
• A synthetic missing path; optionally, a disposable unreadable file if the platform supports that case reliably. Do not simulate permissions with a real system log.
• Exit status and a concise stdout/stderr description, including whether a Python traceback is exposed.
• The control flow in cli.py that produces the result, compared with the README and existing CLI tests.
• A small behavior matrix that distinguishes startup/input-open failures from per-line parse failures.

Please post the evidence and classification first. Do not open a PR until the observed behavior shows a concrete defect or a missing public contract.

Change threshold

• If current behavior is intentional but undocumented, propose the smallest documentation or contract test.
• If it is defective, propose a focused CLI/test correction with explicit exit and diagnostic semantics.
• If behavior is platform-specific, document the limitation and stop unless a portable contract can be justified.

Behavior that must remain unchanged

• Unsupported or malformed records continue to fail clearly per line without stopping the batch.
• --error-output remains the structured path for per-record parse failures.
• Source detection and normalize -> filter -> summary semantics do not broaden silently.

Boundaries

• Use synthetic files in a disposable directory only.
• Do not read or publish real auth logs, usernames, hostnames, IP addresses, or absolute machine paths.
• No parser expansion, new input family, or logging framework is in scope.