carlos / platform Public

Unblocks #126's readiness probe, which answered ready: false on every box after the 2026-09-12 roll (c1d40ee). Nothing on this branch mints a nested row, so flat fleets behave exactly as today. It changes the namespace nested instances will run in, plus the probe that gates layout migrate.

What changes

1. RestrictSUIDSGID= is dropped from the four templates (instance, seed, sidecar, probe). On systemd 257 it makes openat2 return ENOSYS, and every instancefs open inside the namespace is an openat2. What it guarded is still covered: a capability-less tenant can only make set-id files owned by carlos, NoNewPrivileges= voids them inside the namespace, and no other uid can reach them.
2. control-unreachable now lists the directory and dials the socket instead of calling Lstat. InaccessiblePaths= leaves a mode 000 node that Lstat still answers. The check passes only on permission-denied or not-found.
3. Found in review: PrivateDevices= binds the host's /dev/shm, so all instances shared one. Each unit now gets its own tmpfs there. A root-owned host fixture, /dev/shm/carlos-probe, is created by tmpfiles and checked by the control service, and the new shm-private probe check fails if the unit can see it.

Spec revision 15, §13 R15.

Verified

• go vet, gofmt, darwin and windows builds, and the full go test ./... pass locally. Socket tests need a short TMPDIR outside the sandbox.
• Dev box i-046c7fe43620944bc, running this build with the new probe unit under a scratch name: ready: true. imds-v6 is unverified, as expected on a v4-only box. On the same box, today's templates show the host's /dev/shm. The scratch files were removed.
• An Opus review of the first commit found item 3 and a wrong rationale in item 1. Both are fixed in the second commit.

Not in this branch: plans 4 and 5 (layout migrate/revert, console door). Shared POSIX mqueues and abstract unix sockets are #178.

Rolling it: system apply rewrites the units and re-runs tmpfiles. After the roll, run systemctl start carlos-instance-probe.service; cat /run/carlos-control/probe.out on a box; it should say ready: true.