Detection by Side Effect
has('unix') doesn't ask what operating system you're running. It asks whether a particular feature got compiled into this build of Vim. The OS falls out of that answer only because certain features happen to exist only on certain platforms. Nobody designed has() to answer "what OS am I," and yet it answers it, reliably enough that people build dotfiles on top of it instead of shelling out to uname.
executable('apt') does the same trick one layer down. It's just a PATH check, does this binary exist and is it runnable. But which package manager happens to be sitting on your PATH is a pretty good fingerprint for which Linux distro you're on. Nobody asked "which distro," they asked "is apt here," and got the distro as a byproduct.
What's notable isn't the cleverness, it's that this workaround is more durable than the thing it's standing in for would have been. A version string or a distro-name field has to be maintained by someone, kept in sync as new platforms show up, and it can just be wrong. A feature flag doesn't have that problem. It's true by construction: either the feature compiled in or it didn't. The identity question rides on top of a fact that's harder to lie about than identity itself.
Browsers went the opposite direction on the same axis. For years, sites asked "which browser is this" by reading the user-agent string, and browsers lied back, stuffing every competitor's name into their own string to avoid being blocked by sites that only checked for one. The industry's fix was to stop asking identity and start asking capability: does window.fetch exist, does this element support this attribute. Not because capability checks were clever, but because identity, once it became a thing you could spoof for advantage, stopped being trustworthy. Vim never had that problem because nobody had a reason to lie about which features compiled in. But both cases land on the same rule: ask the thing that has to be true, not the thing that's merely supposed to be true.
That's the general shape of it. Identity is a label somebody assigns to a bundle of behaviors, and the label can drift, get spoofed, or just not be exposed anywhere you can query it. The behavior is what the system actually has to show you, because showing it is how the system works at all. So you end up inferring the label from the behavior, not because it's a hack, but because the behavior was always the more solid fact. The label was the derived one the whole time. We just usually experience it backwards.
The OS was never in the room. Only the parts that happened to compile.