amadan

carlos / platform Public

← Commits · feat/claim-root-trusted-state-p3

CI failed 6m 52s

Branch
feat/claim-root-trusted-state-p3
Commit
eed765af Paul Campbell
Runner
ci-aws~paul@keymail.dev/ip-172-31-16-104
Reported by
ci-aws~paul@keymail.dev/ip-172-31-16-104
Queued
Started
Waited for a runner
3s
Last change
Attempt
1 of 2

Steps run in order, one after another.

  1. gate failed 6m 51s 
    cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	287.476s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.689s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.314s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.715s
ok  	github.com/carlosframework/platform/internal/activator	248.714s
ok  	github.com/carlosframework/platform/internal/agentsock	0.014s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.018s
ok  	github.com/carlosframework/platform/internal/appconfig	2.472s
ok  	github.com/carlosframework/platform/internal/apperr	0.071s
ok  	github.com/carlosframework/platform/internal/applog	0.122s
ok  	github.com/carlosframework/platform/internal/awsinv	0.003s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.793s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.011s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.699s
ok  	github.com/carlosframework/platform/internal/changelog	0.300s
ok  	github.com/carlosframework/platform/internal/clamd	0.054s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	389.157s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.288s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.005s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.002s
ok  	github.com/carlosframework/platform/internal/docsite	0.004s
ok  	github.com/carlosframework/platform/internal/domains	2.365s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	26.697s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.131s
ok  	github.com/carlosframework/platform/internal/gate	1.671s
ok  	github.com/carlosframework/platform/internal/genselect	0.014s
ok  	github.com/carlosframework/platform/internal/geo	0.019s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.152s
ok  	github.com/carlosframework/platform/internal/host	143.303s
ok  	github.com/carlosframework/platform/internal/hostactors	0.471s
ok  	github.com/carlosframework/platform/internal/hostbox	2.275s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.499s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.006s
ok  	github.com/carlosframework/platform/internal/hostexec	4.780s
ok  	github.com/carlosframework/platform/internal/hostfence	0.035s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.517s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.012s
ok  	github.com/carlosframework/platform/internal/hostguard	1.037s
ok  	github.com/carlosframework/platform/internal/hostops	1.548s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.003s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.433s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.148s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.002s
ok  	github.com/carlosframework/platform/internal/instancectl	4.169s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.718s
ok  	github.com/carlosframework/platform/internal/instancefs	0.017s
ok  	github.com/carlosframework/platform/internal/instancekey	0.015s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.018s
ok  	github.com/carlosframework/platform/internal/layout	1.524s
ok  	github.com/carlosframework/platform/internal/lease	9.812s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.018s
ok  	github.com/carlosframework/platform/internal/ledger	0.015s
ok  	github.com/carlosframework/platform/internal/mail	0.169s
ok  	github.com/carlosframework/platform/internal/maintenance	0.077s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.553s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.084s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.289s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.780s
ok  	github.com/carlosframework/platform/internal/objstore	0.182s
ok  	github.com/carlosframework/platform/internal/ops	0.177s
ok  	github.com/carlosframework/platform/internal/park	0.207s
ok  	github.com/carlosframework/platform/internal/privatefile	0.012s
2026/10/15 17:19:55 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/15 17:19:55 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/15 17:19:55 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/15 17:19:55 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/15 17:19:55 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/15 17:19:55 provision: an app's records could not be listed: they are skipped
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:19:55 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/15 17:19:55 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/15 17:19:55 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/15 17:19:55 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/15 17:19:55 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/15 17:19:55 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/15 17:19:55 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/15 17:19:55 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:19:55 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/15 17:19:55 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/15 17:19:55 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/15 17:19:55 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/15 17:19:55 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/15 17:19:55 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:19:55 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:19:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:55 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:19:55 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:19:55 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:19:55 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:19:55 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:19:56 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/15 17:19:56 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/15 17:19:56 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/15 17:19:56 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/15 17:19:56 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:19:56 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/15 17:19:56 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan14RootInputInventoryCoverage (18.72s)
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	GenerationEvidence.valid	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	loadRollback	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_linux.go	checkedGenerationTree	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	routeWithHost	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.selected	C+G	linux:internal/host/claimmoveaccess.go:claimMoveReadWork.With	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	relocationActivationReader.Read	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	Activation reader obtains a fresh claim and applies typed relocation installation authority before activation.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	RootAuthority.View	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	Root host lock serializes views; quarantine and pending intent deny admission.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.Step	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Worker transitions revalidate claim and fence and consume verified root stop receipts; generic transition timing remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.After	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	rootMovesFloorIdentity	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root-only census reader supplies deployment/box/enrollment; edge mode cannot call it
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Bindings	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	proof_cli.go	runProof	E1	linux:main.go:main	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	newCompletionRuntime	C+D	linux:internal/host/relocatepass.go:NewRelocationRuntime	Completion-only runtime treats registry and journal hostnames as discovery and verifies claim and bound identity before discharge.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	refreshRootSeedsFloor	F	linux:internal/host/seedsfloor.go:systemApplier.armSeedsFloor	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=merges authoritative store floor with denial-only legacy seeds maxima into durable independent root state
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	productionSysOps	D+F	linux:internal/host/agent.go:runAdopt	root-input;kept=D,F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.resolve	B3	linux:internal/host/roothistory.go:openRootHistory	fix1;basis=Binds deployment or root-managed named-unit evidence, trusted unit identity and digest history; registry names are hints only.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback_resume.go	recoverRootRestarts	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	Recover every attempt independently, skip settled writes and remove leftover capabilities.
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	NewRelocationRuntime	C+D	linux:internal/host/relocatepass.go:startRelocationPass	Relocation runtime binds verified enrollment, source, participant and typed stop/fence providers; generic placement stays legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	rootGenerationSource.resolve	E2	linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	restoreLive	C+E1	linux:internal/release/materializeheld.go:publishHeld	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	productionGenerationInventory	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	ToProbing	C	linux:internal/hostrelocate/participant.go:Participant.Step	Probe transition requires exact local-install receipt at target enrollment and install stamp before admission.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_app.go	RootHistory.AppRefusals	E1	linux:internal/release/roothistory_app.go:RootHistory.MintRefusals	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.settle	D	linux:internal/hostexec/rootbroker.go:RootBroker.recoverSettlement	On uncertain ETag or delete conflict require both root and remote expiry, then conditionally delete the current ETag.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorJournalPresent	F	linux:internal/host/guardexec.go:RunSystemGuardExec	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=checked authority-file presence selects recovery without opening a deployment store
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	buildPlans	E4	linux:internal/host/caps_pass.go:capabilityPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartSeed	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Baselines both request logs without applying historical ordinary restarts; signed retry grants remain independently verified.
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleaseStaged	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	recoveryInstallSource	C+G	linux:internal/host/movesrecover.go:recoverRun.install	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.skipRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	heldProofAdmit	C+E1	linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	restartBoundUnit	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_install.go	ClaimRootHTTP.rootLandingRoute	C+E3	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Root derives flat landing row and settings from authoritative record and app policy after target/phase binding.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_containment_linux.go	inspectClaimContainment	C+G	linux:internal/host/claimjournal_containment_linux.go:var claimContainmentInspect	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/refusal.go	ListRefusals	E1+E3	linux:internal/host/refusalwatch.go:refusalWatch.tick	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	readLocalSeedsFloor	F	linux:internal/host/seedsfloor.go:withSeedsFields	rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root); also the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), for its hourly refresh and its edges file: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation.go	productionClaimLocal.participateHost	D	linux:internal/host/claimparticipation.go:productionClaimLocal.participate	Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.write	D	linux:internal/hostexec/rootbroker.go:RootBroker.settle	fix1;basis=Bounds replay to the latest acquisition and preceding settlement, rotates renewal tokens, and holds broker-only OFD liveness.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	passConfig.bindProof	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.heldTarget	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	readLegacyJournals	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorAllowsPrev	F	linux:internal/host/movesfloorgate.go:floorGateMain	rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=signed prev identity satisfies local moves and published seeds bounds, relaxed only when no certified build meets bound; caller checks participation separately
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	scanStopCgroupsMode	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleasePublished	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	productionRootGenerations	E2	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	migrationDenied	C+G	linux:internal/hostguard/rootmigration.go:RootAuthority.CompleteMigrationInventory	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	verifyRootSeedsPublication	F	linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound	rev3=PROPOSED-p3;identity=root protocol readers uid 0; edge advertisements from public root projection uid carlos;basis=verifies canonical root signature, deployment, purpose, schema and protocol minimum; unsigned source cannot arm seeds
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	createClaimEdgeMask	C+G	linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/regionalworker.go	RegionalWorker.runHost	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	enrolled	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_transport.go	ClaimRootHTTP.retire	C+G	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	censusRule.check	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/program.go	ArtifactProgram	E1	linux:internal/release/program.go:ReleaseProgram	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_timer.go	ClaimRootHTTP.verifyInventoryTimer	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	relocationAfter	C	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	Admission dispatch preserves landing handover and delegates relocating probing to its typed after-admission owner.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	StagedPaths.Refers	E2	linux:internal/release/rootgenerationpins.go:passConfig.generationWriteCheck	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationInstall	B2+C+E2	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationBinding	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationTree	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.Park	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	type RootHistoryPass	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartSnapshot	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartRequestLeg	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Reads the new host-retry log while preserving root-signed grant verification and ordinary restart gates.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Durable	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimunit.go	ClaimUnits.cgroupEmpty	C+G	linux:internal/instancectl/claimunit.go:ClaimUnits.Gone	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerationpins.go	type generationPinSource	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.Certify	E2	linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgePrev	F	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=normal adopt combines moves and seeds verdict errors; unpublished seeds remain inert; raised bounds never block recording signed prev
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.Install	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	movesWorker.hostBlocked	C	linux:internal/host/movesfinal.go:movesWorker.sweepFinalJournals	root-input;kept=C;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationBuildAuthority	C+D	linux:internal/host/relocationbuild.go:ClaimAssembly.relocationBuild	Relocation build revalidates operation, captured install stamp, prepared pin and execution participation before writes.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validRequest	E1	linux:internal/historyreadback/workflow.go:Operation.checked	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/registryrows.go	RegistryRows.RetireRowsJournal	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	Disk.Exec	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	ClaimOwnerDispatch.Select	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	lockJournalMigration	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/report.go	ReadEnrollment	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationPhysicalPayloads	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.startRecorded	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.start	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.mintAndLog	E1	linux:internal/host/proofroot.go:proofRoot.around	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournalDir	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.RecordCreation	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/movesland.go	landingRun.checking	C	linux:internal/host/movesland.go:landingRun.step	Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historySync	E1	linux:history_cli.go:historySave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.activationRule	F	linux:internal/host/systemapply.go:systemApplier.activationAllowed	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=preliminary activation refuses against both local protocol bounds before existing hold checks
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAgent	B+C+D+F	linux:internal/host/agent.go:RunAgent	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.Select	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	withMovesFields	F	linux:internal/host/edgesfile.go:edgesFileLoop	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent uses root-owned public projection when participating and its original writable mirror otherwise
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	GenerationVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.census	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=writes through Ledger.MigrationCensus under transaction.lock and preserves revisions on completed replay
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	systemApplier.seedsActivationRefusal	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	PublishHeld	C+E1		root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.holdsLegacyRows	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/claim_identity.go	CheckRouteReleaseIdentity	C+E1	linux:internal/host/claimproduction.go:claimInputPolicy	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecord_claim.go	rootClaimRecord	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.installRemote	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Remote install snapshots old source inventory outside host lock and rechecks revision in hold-only path.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers.go	ClaimStopCoordinator.WritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopHTTP.serveWritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	LinuxStopKernel.VerifyNoProcess	C+G	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	newHeldReleaseRequestID	C+E1	linux:internal/host/movesheldrelease.go:heldReleaseVia.request	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.retained	E3	linux:internal/host/buildstate.go:buildStates.heldTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimassembly.go	ClaimAssembly.Build	C+G	linux:internal/host/claimassembly.go:productionClaimFactory	Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/renewing.go	RenewingLeases.Acquire	C	linux:internal/host/movespass.go:armPhase1	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	ColdRestore.Install	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	publishVersion	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	PinFailover	C	linux:internal/hostrelocate/worker.go:Worker.Step	Failover pinning requires recorded source fence and completed acknowledgement barrier.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.checkHistory	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimInputPolicy	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state.go	Sync	A+F+G	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.systemctl	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationhandover.go	relocationCompletedHandover.completedPrior	C	linux:internal/host/claimhandover_crossbox.go:wireCompletedHandover	Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.RegisterLanding	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.executeWithInventory	C	linux:internal/hostbox/journalservice.go:JournalService.ExecuteRootInventory	Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.floorAllowsForward	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free forward recovery checks both locally retained protocol release minima
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.pointerLoop	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Delegates each iteration to pass; retains ownership of the retry/restriction authority path despite no direct read.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	settingsApply	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloorgate_linux.go	readFloorGateFile	F	linux:internal/host/movesfloorgate_linux.go:floorAllowsPrev	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Prelaunch	C	linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Prelaunch	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	LaunchJournal.UnitReservation	C	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.Monitor	D	linux:internal/hostexec/rootbroker.go:RootBroker.Run	Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	restartVerifiedOrdinaryUnit	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-4;basis=Retain the checked ordinary-unit path for strict census-backed operation.
    plan14_input_inventory_test.go:382: J4	internal/console/boxselect.go	Server.selectMoveBoxes	F	linux:internal/console/apiinstancemove.go:Server.handleAPIInstanceMoveRequest	rev3=PROPOSED-p3;identity=carlos console serve, console.service uid carlos-console;basis=applies accepted/generation refusal only to advertised root-floor participants; legacy selection retains main exactly
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	digest	E1	linux:internal/historyreadback/readback.go:RequestKey	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.around	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Continue minting observations for unaffected routes even when adoption reports a route error.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetired	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	rootFloorLegacy	F	linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=selects existing moves mirror paths for denial-only generic legacy reader
    plan14_input_inventory_test.go:382: J4	internal/registry/importjournal.go	Registry.ImportJournalHosts	G	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	rev3=census-ruling-seeded-instances;basis=its SQLite arm as carlos, in the agent or the registry child (carlos __registry-child); its remote arm in whichever process holds a remote handle, and a root pass does. No caller in the tree yet, outside the child's dispatch: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.gate	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeld	E2	linux:internal/host/movesstage.go:var heldMaterialize	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	makeStartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	processGroup	B3+E1+E3	linux:internal/release/rollback.go:rollbackGroup	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.locked	C	linux:internal/hostguard/fence.go:Guard.CompleteFence	rev3=merge-ruling-4;basis=Only positively unsafe legacy locks durably quarantine; timeout and I/O errors return without changing root installation state.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_maintenance.go	type rootHistoryMaintenance	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	generationRetainedTimers	E2	linux:internal/host/rootgeneration_rows.go:generationRegistryInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	HistoryStatusKey	E1	linux:internal/release/roothistory_status.go:RootHistory.ProjectMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMajor	E2		E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchRecord	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/guardroster.go	readGuardRoster	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.recordLive	B3	linux:internal/host/proofroot.go:proofRoot.around	rev3=merge-ruling-5;basis=Exclude ordinary unstamped and derived routes before pre-pass binding and health observation.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	type HistoryRecovery	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	type generationLaunchPermit	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	var openClaimRootAuthority	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	decodeHeldReleaseRequest	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.ServeHTTP	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	RunSystemJournalMigrate	G	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	coldNamespaceEmpty	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.withRootInventoryHistory	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.record	F	linux:internal/host/rootmovesfloor.go:rootMovesFloors.localBound	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=bounded strict private JSON read requires matching deployment, box and enrollment
    plan14_input_inventory_test.go:382: J4	internal/release/ratchet.go	DigestRatchet.marked	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeldUnderWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.tenant	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.readContainedJournal	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	recoverPending	D	linux:internal/hostexec/pending_linux.go:RecoverPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.verify	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.Start	C+D		Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	rootInventoryArtifacts	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	addRootHealthy	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorBootCandidate	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=selects signed prev under unknown history with no known refusal; always retains certified current executor even when bound exceeds every available build
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	scanClaims	E4	linux:internal/caps/converge.go:Ops.checkClaimsOnDisk	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageAuthority	C+E1	linux:internal/host/heldstage.go:heldStagePass	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	Registry.Upsert	E3	linux:cli.go:runAdd	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged, in the process that holds a remote handle, root passes included: main's body with its insert defaults moved to normalizeRoute and its bind list to routeArgs, and two columns added (seed_source, import_gate); the conflict clause, with the tenant-change rule E3 names, is unchanged; main's E3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	heldShape	C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_authority.go	ClaimLaunchRoot.authorize	D	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	publishRootHistoryReadback	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	environmentNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	recordSettled	B3		root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.refusal	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.gate	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/remote.go	CheckRemote	F	linux:internal/hostexec/controller.go:Config.checkRemoteUpdateIdentity	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartProgress	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.stop	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	productionProofBindingSource	B3	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Root-owned current and previous pointers replace health history as executable authority; cache only record discovery.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfiles.go	relocationPreparedManifest	C	linux:internal/host/movesfiles.go:movesFiles.preparedBinding	Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use.
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	proofBindingSource.needsRestart	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.resolve	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.collectCapturedStop	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.execute	C+D	linux:internal/hostbox/journalservice.go:JournalService.Execute	Delegates journal transaction with original request hashing; root-generated inventory substitution uses the separate internal entry point.
    plan14_input_inventory_test.go:382: J4	internal/activator/workerbuild.go	Service.startWorker	E2	linux:internal/activator/activator.go:Service.doWake	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	installFloorHook	D	linux:internal/host/systemapply.go:RunSystemApply	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/bootstrap.go	bootstrapWith	A+C+G	linux:internal/host/bootstrap.go:RunBootstrap	root-input;kept=A,C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.PrepareState	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationinventory.go	OpenGenerationLaunchReader	E2	linux:internal/host/rootgeneration_inventory.go:openGenerationLaunchInventory	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_proof.go	legacyJournalProof	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	generationHash	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.writeCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.CommitRootInventoryArtifacts	G	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.query	E4	linux:internal/caps/converge.go:Ops.applyUnitState	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemparticipation.go	systemApplier.clearUpdateBegun	D	linux:internal/host/systemparticipation.go:systemApplier.settleUpdateBegun	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-recover.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	writeColdJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	rootRestartKey	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_containment.go	validateClaimJournalContainment	C+G	linux:internal/host/claimjournal_transport.go:ClaimRootHTTP.serveJournal	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	recoveryResultKey	E1	linux:internal/host/rootrollback.go:settleRollbackAttempt	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.retry	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Bound transport retries by original monotonic slack and context; never extend a permit.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-restart.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/bake.go	LoadFirstSeen	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	capabilityPass	E4	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.read	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.start	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.Before	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	routeByHost	E1+E3	linux:internal/host/restartscope.go:restartScopeLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.readRecord	E1	linux:internal/release/roothistory.go:RootHistory.read	Root reconstruction reads exact durable records and preserves pending restrictions during signed replacement. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	const rootGenerationCompletenessLimit	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-stage.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	loadRestartMarks	E1+E3	linux:internal/host/restart.go:restartPass	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.freshObserved	C	linux:internal/hostguard/guard.go:Guard.fresh	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemunits.go	ensureSystemUnits	F	linux:internal/host/agent.go:runAdopt	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationattempts.go	relocationAttemptReader.ReadAttempt	C	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authoritativeAttempt	Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Observe	C+G	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.skipGet	E1+E3	linux:internal/host/agent.go:convergeLegFor	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence_linux.go	lockConsumedPublish	E3	linux:internal/release/consumedfence.go:publishConsumed	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	agentCheckedUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly.go	ClaimRoleAssembly.PreflightLaunch	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalPrepare	C	linux:internal/hostbox/journalservice.go:journalCall	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/release/updatetarget.go	Target	E3	linux:internal/release/adopt.go:settingsTarget	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	HistoryReconstructionKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Request	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/hold.go	ChangeHold	C		root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	VerifyHeldLiveUnder	C+E1	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Under-lock held verification enforces claim-aware shape and delegates root proof validation.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type rootRestartRecord	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	copyLegacyJournal	C	linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	productionRetireGenerations	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	generationDigest	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.read	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	localDir.read	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.guardTransaction	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.record	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	Record key selection uses indexed discovery; local root-managed unit authority is unchanged.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetirementDigest	E1	linux:internal/release/roothistory_retirement.go:RootHistory.recoveryRetired	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartBinding	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/probe_unix.go	probeExisting	D	linux:internal/hostexec/probe_unix.go:probeLifetime	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	readRootHealthy	B+B4	linux:internal/release/healthy.go:ReadHealthy	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatusWithSources	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.inventory	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.localBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	refreshRootMovesFloor	F	linux:internal/host/systemapply.go:systemApplier.armFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal adopt/update combines remote object with independent deny-only legacy evidence under root floor lock
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootSeedsFloorDir	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed seeds namespace separate from moves retained floor
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop.go	ClaimStopCoordinator.witnessNoProcess	C+G	linux:internal/host/claimstop.go:ClaimStopCoordinator.FenceAndStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.write	A+F+G	linux:internal/rootstate/state_linux.go:directory.Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper
    plan14_input_inventory_test.go:382: J4	internal/release/proof.go	FileSHA256	B3	linux:internal/host/proofask.go:mintAsker.stagedSHA	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validStatus	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	type ClaimLaunchRoot	E1+E2	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	SettingsRefs	E2	linux:internal/release/pins.go:BoxPins	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	migrationStopKernel.RecoverStopped	G	linux:internal/host/claimstop_recovery.go:ClaimStopCoordinator.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream
    plan14_input_inventory_test.go:382: J4	internal/host/movesfinal.go	sourceFinal.parkLocal	C	linux:internal/host/movesfinal.go:sourceFinal.run	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.recoverIfNeeded	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.mint	B3+E1	linux:internal/host/proofroot.go:proofRoot.mintAndLog	E1 production uses canonical observed programs and complete root refusal inventory; legacy diagnostics do not grant root mint authority.
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	OpenFailureBook	E1+E3	linux:internal/host/updatesroot.go:updatesPassOption	fix1-merge-review;basis=Loads schema-three durable generations and refuses unsafe identity recovery on entropy failure.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.heldGenerationPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationRetirementRecords	E2	linux:internal/host/rootgeneration_parked.go:generationReadRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_other.go	migrateRootClaimAuthority	G	darwin:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=non-Linux offline journal-migrate CLI;basis=unsupported-platform stub returns ErrUnsupported without reading or granting migration authority
    plan14_input_inventory_test.go:382: J4	internal/instancectl/peer_tuple_linux.go	procStart	C+G	linux:internal/instancectl/peer_tuple_linux.go:AuthenticatePeerTuple	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.installedConsoleVersion	B3		fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerationpins.go	productionRootGenerationPins	E2	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationNames	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.completedHold	C	linux:internal/hostbox/reconcile.go:Reconciler.checkOn	Completed relocation catch-up can hold only its recorded old source row and creates no installation authority.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgeMovesPrevWithSource	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizeReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	openGenerationLaunchInventory	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	capabilityPlan	E4	linux:internal/release/adopt.go:adoptHost	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	RelocationSource.Open	C+D	linux:internal/host/claimrelocation.go:openClaimRelocationOwners	Relocation owner wiring binds verified actor, C8 provider and identity-checked requests; admission remains typed.
    plan14_input_inventory_test.go:382: J4	internal/host/adoptlock.go	lockExclusive	C+E1	linux:internal/host/adoptlock.go:lockAdoptPass	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLocalFloor	F	linux:internal/host/movesfloor.go:withMovesFields	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadExactStopInventory	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.seedUnit	E2	linux:internal/activator/backend_exec.go:ExecBackend.Seed	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	readDropIn	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	restartScopePass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Hands historical signed retry entries to the common verifier; unknown selectors do not widen scope.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinstallation.go	rootInstallationHostApp	E2	linux:internal/host/claimstop_run.go:RunInstanceControl	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.registerRemote	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_completed.go	ClaimAssembly.completedRelocationDischarge	C+D	linux:internal/host/claimparticipation.go:productionClaimLocal.cleanup	Completed-relocation discharge requires exact claim completion and verified retirement receipt; unread evidence refuses cleanup.
    plan14_input_inventory_test.go:382: J4	internal/provision/reconcile.go	RouteFor	C+E3	linux:internal/provision/reconcile.go:Reconcile	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos); also root, in the claim root's landing registration (ClaimRootHTTP.rootLandingRoute) and the relocation install (relocationRecord): main's body with one more field: the row's seed column, derived from the record's seed (SeedColumn). Every caller gets it, the two root ones included, so a root-registered row for a seeded record now carries the seed the activator places from; main's C,E3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryOutcomes	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationGroupGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeldVerifiedWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.stageRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.configured	C+E1	linux:internal/host/movesinstall.go:installGeneration	Configured landing now validates root-created registration before render and held publication; source recovery keeps existing typed rebind.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	historyReadbackPublisher.publish	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	cycleWorkers	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	FailureBook.markLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.MarkHoldRan	fix1-merge-review;basis=Advances durable app restriction generations so old grants cannot clear new failures.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Remove	A+B3	linux:internal/host/rootrollback.go:captureRollback	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	Policy.check	C	linux:internal/hostbox/wakepolicy.go:Policy.Check	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	ExecutingHash	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.read	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	D1/D2 decode the retained root participation record; missing or malformed state grants nothing.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_available.go	systemApplier.activationFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	ReadGenerations	E2	linux:internal/release/pins.go:GenerationPins	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	sameProofCandidate	B3	linux:internal/host/proofbinding.go:proofBindingSource.resolve	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	quiesceLegacyClaimJournals	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	type migrationStopKernel	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority
    plan14_input_inventory_test.go:382: J4	history_cli.go	historyCommandWithSave	E1	linux:history_cli.go:historyCommand	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	passConfig.recheckHistory	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.VerifyFile	F	linux:internal/hostfloor/image_linux.go:Disk.Exec	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	readRollbackAttempt	B3	linux:internal/host/rootrollback.go:rootRestartChecks.finish	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closed	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	systemApplier.armSeedsFloor	F	linux:internal/host/systemapply.go:systemApplier.armFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.write	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeldUnder	C+E1+E2	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationReadRetirements	E2	linux:internal/host/rootgeneration_parked.go:productionGenerationRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgePrevWithSource	F	linux:internal/host/movesfloor.go:rootJudgePrev	rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_stale.go	participationCleanupRead.Read	D	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.Run	D+F	linux:internal/host/systemapply.go:RunSystemApply	root-input;kept=D,F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.holdOnly	C	linux:internal/hostbox/reconcile.go:Reconciler.installWithWork	Hold-only write rechecks claim, record and source inventory under local lock without root RPC there.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	withRootFloorGuardCandidate	F	linux:internal/host/guardexec.go:RunSystemGuardExec	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=release then previous-binary exclusion; participation check precedes moves and seeds locks; certified current remains executor fallback
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.collectRetirementStop	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	StagedPaths.addReal	E2	linux:internal/release/pins.go:BoxPins	root-input
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/workflow.go	Operation.Read	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrelocationrelease.go	RelocationReleaseReceipts.Complete	C+G	linux:internal/host/relocationreleases.go:verifyDischargedReceipt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstate_linux.go	claimPrivatePathOwner	C+G	linux:internal/host/claimstate_linux.go:prepareClaimStateDirectory	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.CaptureArtifact	C	linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/shared_linux.go	EnsurePublicDir	A+B4	linux:internal/host/rootrestart.go:productionRootRestartChecks	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	RootHistory.ReceiveRecoveryRetirements	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.FreshInstallation	E1	linux:internal/host/rootgeneration_requirements.go:productionGenerationCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	emptyContainmentAt	C+G	linux:internal/host/claimstop_writers_linux.go:noProcessGroups	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofask.go	mintAsker.stagedSHA	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	acceptRootSeedsPublication	F	linux:internal/host/rootseedsfloor.go:refreshRootSeedsFloor	rev3=PROPOSED-p3;identity=normal carlos adopt and system apply remote floor refresh, uid 0;basis=under stable floor lock, retains only verified nonregressing signed seeds publication; no publisher or activation switch added
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	writeHeldStageRequest	C+E1	linux:internal/host/movesstage.go:heldReleaseReady	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	RouteAccount	B3+E3+E4	linux:cli.go:runRoute	root-route;kept=B3,E3,E4;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_linux.go	productionGenerationKernelCensus	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationRetirements	E2	linux:internal/host/rootgeneration_parked.go:generationPhysicalPayloads	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootProtocolProjection	F	linux:internal/host/rootmovesfloor_source.go:readRootFloorProjection	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.replayed	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.checkLocal	C+G	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckLocal	Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.Census	D	linux:internal/rootparticipation/production.go:ActivationReady	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.retryHost	E1+E3	linux:internal/host/rolloutdeclined.go:rolloutRetryHost	fix1-merge-review;basis=Refuses retry while a failure-book save is owed; verifies the signed current book/epoch grant before clearing.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.layoutReversalReasons	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	recoveryControllerAt	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.invalidateCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_production.go	claimLaunchFor	D	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	Production root runtime receives the unit-aware kernel wrapper before startup recovery.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.Reconstruct	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostops/production_delete.go	ProductionAuthority.StartDeleteClaim	C	linux:internal/hostops/operations.go:Controller.BeginRetire	Production delete obtains verified completed-box fence before permitting claim transition across completion barrier.
    plan14_input_inventory_test.go:382: J4	internal/host/retention.go	buildStatePins	E2	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.armFloor	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	ReadConsumed	E3	linux:internal/host/updatesreport.go:updatesReader	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/refusal.go	ReadRefusal	E1+E3	linux:internal/host/buildstate.go:buildStates.heldWakeInput	root-input
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	restartRouteRows	E1+E3	linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Write	A+F+G	linux:internal/hostexec/rootbroker.go:RootBroker.deny	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=delegates to shared validated durable-write implementation; production syscall behavior unchanged
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_observations.go	claimUnitStopKernel.VerifyWritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopCoordinator.WritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	restartEffectFailed	B3	linux:internal/host/rootrestart.go:restartBoundUnit	E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchhosts.go	LaunchJournal.HostLaunches	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	captureRollback	B3+E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_production.go	NewProductionClaimStopHandler	C+G	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	seedRestartMarks	E1+E3	linux:internal/host/restart.go:restartSeed	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.forHost	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	OpenTrustedFile	A+B3	linux:internal/host/rootgenerations_launch.go:productionRootGenerations	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	readRootExecution	D	linux:internal/host/rootexecution_read.go:rootExecutionRead	Descriptor-checked root opener shared by root Prepare/Check, initial launch authorization and final executable checks; no agent fallback.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.CommitRootInventory	E2		E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRetainedFiles	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.VerifyDigest	C+G	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authorize	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.CheckLegacyMigration	C	linux:internal/host/claimjournal_migration.go:checkClaimJournalMigration	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/participation.go	CheckParticipation	D		Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readBeneathLine	F	linux:internal/host/movesfloor.go:syncLocalFloor	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.Run	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartTarget	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.acceptHealthy	F	linux:internal/host/rootfloor_healthy.go:systemApplier.acceptRootFloorHealthy	rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.unitBinding	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Reads canonical deployment record, claim, unit file identities and systemd facts without assuming a running PID. Existing running/rollback binding uses the same verifier. Fixtures: TestPlan14SignedNamedRecoveryAuthority and TestPlan14ProofBindingProvenance.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_recovery_policy.go	RootHistory.RetireD1	E1	linux:internal/release/adopt.go:adoptHost	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_recovery_policy.go	RootHistory.recoveryDenials	E1	linux:internal/release/roothistory.go:RootHistory.Blocks	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	ActivationReady	D+G	linux:internal/host/claimstop_run.go:RunInstanceControl	Refuse claims activation without complete census and registered verifier; Part 3 G remains mandatory.
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	execBounceable	E1+E3	linux:internal/host/restart.go:bounceExecRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.UpdateID	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Recover	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	rootGenerationSource.reserve	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationReconciler.reconcile	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.refresh	F	linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal refresh ratchets accepted history; unknown history persists only observed denies and never advertises accepted
    plan14_input_inventory_test.go:382: J4	internal/host/moveswakesource.go	movesWakeSources.Open	B2+C	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	type stageCheck	E2	linux:internal/release/adopt.go:type passConfig	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_census.go	rootMigrationCollector.collect	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationStartup	F+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks root-owned migration records and typed journal revisions before issuing startup grants; absent census leaves main path intact
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.stillLive	B3	linux:internal/host/proofroot.go:proofRoot.mintAndLog	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.healthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.capLegacy	rev3=PROPOSED-p3;identity=root health acceptance, normal floor refresh and local seeds-bound readers, uid 0;basis=reads bounded private root health record; missing or malformed record supplies no legacy cap
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	StartRelocation	C		Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrelocation.go	openClaimRelocationOwners	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Relocation owner constructor receives existing serving sources and verified identity inside feature gate.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	BoxPins	E2	linux:internal/release/adopt.go:PassFilter	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	boundRootHistory	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.mutate	C	linux:internal/hostbox/rolelaunch.go:LaunchJournal.CloseWriters	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	agentRollbackUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	CapabilityRoute	E4	linux:internal/host/adopt_advice.go:adviseHostRoleGateMissing	root-route;kept=E4;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_other.go	EnsurePublicDir	A+B4	darwin:internal/host/rootrestart.go:productionRootRestartChecks	fix1;basis=Non-Linux shared-directory setup fails closed.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	Adoptable	C+E3	linux:internal/host/proofask.go:mintAsker.tick	root-route;kept=C,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.StartTime	B3	linux:internal/host/proofobserve.go:proofObserver.observe	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimProbeSocketReady	B3	linux:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecoveryjournal.go	claimRecoveryJournal.successor	C+G	linux:internal/host/claimrecoveryjournal.go:claimCrossBoxHandover.completeRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	retireEndedHeldRefusals	C+E1	linux:internal/host/heldstage.go:heldStagePass	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	ClaimAssembly.relocationReleaseHold	C+D	linux:internal/host/relocatepass.go:newCompletionRuntime	Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RestartTarget.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAdoptWithEnsureSystemUnits	B3+C+D+E1+E2+E3+E4+F	linux:internal/host/agent.go:runAdopt	E1 selects the checked private history, canonical named-unit provider and root mint inventory under release exclusion with claims off or on; reconstruction and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.plan	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.absent	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Retire	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Prelaunch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/generationinventory.go	RootAuthority.generationInstallation	E2	linux:internal/hostguard/generationinventory.go:RootAuthority.GenerationInstallations	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	withRootSeedsFields	F	linux:internal/host/seedsfloor.go:withSeedsFields	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=advertises only checked synced root seeds projection matching deployment and box; no valid projection stays quarantined
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation.go	productionClaimLocal.prepareLegacyWith	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.prepareWith	Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.wakeTarget	E3	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	verifyHeldLive	B2+C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	LaunchJournal.HasHost	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/healthy.go	ReadHealthy	B+B4	linux:internal/host/proofbinding.go:productionProofBindingSource	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.run	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=offline guarded migration reobserves changed claims, retains union of session tuples, publishes only durable completion and verifies completed replay without rewriting census
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	type HistoryRecoveryRetirement	E1	linux:history_cli.go:historyCommandWithSave	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldBuild	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.report	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimServingLaunchSource	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	retirementEvidence	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	validRootRestart	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	generationKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.holdOf	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.heldBuild	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostguard/writerstop.go	operationWriter	C	linux:internal/hostguard/writerstop.go:LandingWriter	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	publishHeld	C+E1	linux:internal/release/materializeheld.go:materializeHeld	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/flock_unix.go	acquire	C	linux:internal/hostguard/guard.go:Guard.locked	rev3=merge-ruling-4;basis=Descriptor checks classify nonregular or foreign-owner locks as unsafe; honest contention waits with bounded exponential backoff.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Fail	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.Exe	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/hold.go	RegistryHoldPolicy	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	scanRebootCgroups	C+G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleaseReady	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/store.go	Read	C+D+G	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input;kept=C,D,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validHex	E1	linux:internal/historyreadback/workflow.go:Operation.checked	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorAllowsPrevIdentity	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=checks local signed prev and independent moves/seeds bounds using root census identity; no remote reads
    plan14_input_inventory_test.go:382: J4	internal/hostguard/writerstop.go	RecoveryWriterStop	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.beginExecutionRecoveryFence	root-input
    plan14_input_inventory_test.go:382: J4	internal/registry/remote.go	serveRemote	E2	linux:internal/registry/remote.go:ServeRemote	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/release/programhistory.go	ReadPrograms	E1+E3	linux:internal/release/adopt.go:adoptHost	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_replace.go	replacementReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationLinkRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationState	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=binds complete root census and durable complete migration record to deployment box enrollment and migration generation
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStateRegions	E3	linux:internal/host/buildstate.go:newBuildStates	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	openDir	D	linux:internal/hostexec/local_unix.go:openLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.writeUsing	C	linux:internal/hostguard/record_unix.go:recordDir.write	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_payload_linux.go	generationPayloadFiles	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	RunSystemApply	D+F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root system apply takes D3 release exclusion only for census participation before normal apply
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction_linux.go	readClaimEvidenceKey	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.activationGuard	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=release exclusion precedes local participation check and moves/seeds locks; final candidate checks preserve repair when every available build is below bound
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationVerifyLocal	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Complete	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventoryscope.go	ReconcileAdapter.retirementRoute	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationStart	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.controllerGone	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.write	E2	linux:internal/release/rootgenerations.go:RootGenerations.Retire	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_authority.go	ClaimRootHTTP.executionAuthority	D	linux:internal/host/rootexecution_migration.go:ClaimRootHTTP.executionAuthorityWithMigration	Fresh claim, deployment binding and root installation authorize participation, including the retained source only.
    plan14_input_inventory_test.go:382: J4	internal/host/guardarm.go	RunSystemGuardArm	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	RootHistory.ReceiveReconstruction	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	logRestartRequestError	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationIDRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartPass	E1+E3	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldHost	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipHost	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.authority	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	rootRestartChecks.allowLegacy	B3+G	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Evaluate the explicit census selector; omitted test selector remains strict.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	passConfig.generationWriteCheck	E2	linux:internal/release/adopt.go:PassFilter	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigrationSnapshot.fingerprint	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=binds exclusion and membership across observations/restart while allowing boot metadata and independently recovered payload revision
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.selector	F	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	controllerProcessStart	D	linux:internal/hostexec/rootprocess_linux.go:ControllerAlive	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootrebind.go	Guard.RebindRootInventory	E2	linux:internal/host/rootrecovery_rebind.go:ClaimRootHTTP.rebindRecoveryInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	relocationAfterAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	Ledger.UpdateRequired	D	linux:internal/rootparticipation/production.go:OpenForUpdate	Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-instance-control.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/registry/remote_dispatch.go	Registry.dispatchRemote	E2	linux:internal/registry/remote.go:serveRemote	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.ProjectMigrationStatus	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	layoutReversalIncomplete	F	linux:internal/host/systemapply.go:systemApplier.layoutReversalReasons	route-and-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartRoute	B3		kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	relocationRecord	C+E3	linux:internal/host/relocatepass.go:relocationRelocatable	Canonical relocation record and update policy derive nested installation shape; source account/incarnation is rechecked by root registration.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	readProvingKey	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.selectRoute	E1	linux:internal/release/adopt.go:PassFilter	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionState	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.reconstructionReady	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.originalRefusal	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	recoverMigrationStop	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	productionProofObserver	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Reuse per-pass record discovery; continue independent observation and root health writes.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	syncFile	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Names	A	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	rootRestartRequests.consume	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.installAuthority	C+G	linux:internal/host/movesinstall.go:installRun.local_	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	RelocationRuntime.finishCompletion	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Completion dispatch requires authoritative completed operation and current executor before discharge.
    plan14_input_inventory_test.go:382: J4	internal/host/guardexec.go	RunSystemGuardExec	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover root units uid 0; edge unit uid carlos; console unit uid carlos-console;basis=root apply/recover selects signed image from local bound; non-root edge bypasses private floor entirely
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.verifyDestination	C	linux:internal/hostbox/typedpark_linux.go:TypedParker.Park	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	Disk.Run	F	linux:internal/host/guardtransaction.go:systemApplier.guardRun	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationreleases.go	ReleaseObligation.Complete	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Release obligation completion reads fresh claim before verifying and recording root stop receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.launch	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	writeGeneration	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	restartOrdinaryUnit	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-4;basis=No-census derived-unit try-restart is unconditional and nonfatal, matching main for absent rows and systemd lookup failures.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	type historyRollbackLink	E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInventoryDigest	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorAdvertisementFor	F	linux:internal/host/rootmovesfloor_refresh.go:withRootMovesFields	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	openDirectory	C	linux:internal/hostguard/flock_unix.go:acquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.trustedBytes	B3	linux:internal/host/proofnamed.go:proofBindingSource.record	fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	VerifyHeldLive	C+E1	linux:internal/host/movesstage.go:heldReleasePublished	Held verification wrapper retains selected held lock and delegates root proof validation of live bytes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstate_linux.go	prepareClaimDatabaseOwner	C+G		root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	retryRequests	E1+E3	linux:internal/host/restartscope.go:applyRetries	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	openParent	C	linux:internal/hostbox/typedpark_linux.go:TypedParker.Park	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.recoverRootInventory	C+E1	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.serveRecoveryRebind	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	recheck	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootRestartRequestSource.creation	E1	linux:internal/host/roothistory_creation.go:rootHistoryCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	type GenerationEvidence	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleaseProbeRelease	C+E1	linux:internal/host/moveswakesource.go:movesWakeSources.Open	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Started	E2	linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.started	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartChecks.runningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Without a census return no running build, so main's cur stays the rollback target and no record is resolved; census-backed retention unchanged.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_run.go	instanceRegistryHostApp	C+G	linux:internal/host/claimstop_run.go:RunInstanceControl	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence.go	publishGate	E3	linux:internal/release/consumedfence.go:publishConsumed	root-route;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalpath.go	checkJournalPath	C	linux:internal/hostbox/launchjournal.go:OpenLaunchJournal	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAdoptUnderRootRelease	B3+E1+E2	linux:internal/host/agent.go:runAdoptWithEnsureSystemUnits	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus. E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	rootRestartChecks.noteLegacy	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	rev3=merge-ruling-4;basis=Log the no-census legacy restart once through the pass-shared diagnostic latch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers.go	ClaimAssembly.WritersStopped	C+G	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	FindRecordByHost	B3+C	linux:internal/host/rootrecord_claim.go:rootClaimRecord	Discovery delegates to the collision-checking index and still reads the selected record afresh.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.started	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.readCensus	D	linux:internal/rootparticipation/ledger.go:Ledger.Census	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historySave	E1	linux:history_cli.go:historyCommand	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimInitialSourceRecovery	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.stopCapturedSession	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	ClaimRootHTTP.verifyInventoryTimers	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	tryExistingPendingLock	D	linux:internal/hostexec/pending_linux.go:recoverPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.persist	F	linux:internal/host/rootmovesfloor.go:rootMovesFloors.refresh	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	ClaimWakeAssembly.Build	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/recoveryfence.go	Guard.PendingFences	C	linux:internal/host/claimstop_recovery.go:ClaimStopHTTP.RecoverPending	Root-only read lock avoids an agent-held legacy lock at startup.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.Begin	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	recordRootProgram	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	repairSibling	E2	linux:internal/release/adopt.go:stageFrom	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	ServeHeldStageRequestsWithPins	E2	linux:internal/host/heldstage.go:heldStagePass	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloorgate.go	floorGateMain	F	linux:internal/host/movesfloorgate.go:RunSystemFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=dispatches explicit root previous gate; legacy argument shape preserved
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	type proofRoot	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.carryRequest	E3	linux:internal/host/buildstate.go:moveCarry	Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_expected.go	StopInventoryDB.SnapshotRequest	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historyReadFile	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	const RootGenerationsDir	E2	linux:internal/host/rootgenerations_launch.go:productionRootGenerations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	migrationExecutionEmpty	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.SessionLaunches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	materializeHeld	C+E1+E2	linux:internal/release/materializeheld.go:MaterializeHeldUnderWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	judgePrevWith	F	linux:internal/host/systemapply.go:systemApplier.notePrev	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live.go	HoldLive	A+D	linux:internal/hostexec/rootbroker.go:RootBroker.write	fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	rootRestartChecks.settleHistory	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootbake.go	RootHistory.LoadBake	E1	linux:internal/release/adopt.go:PassFilter	E1 strict root bake and app completeness revisions; backward clocks refuse and visible records are durably recommitted.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/completion.go	ReadReconstruction	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/bootstrap.go	const tmpfilesConf	A+C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=A,C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootclient.go	requestIdentity	D	linux:internal/hostexec/rootclient.go:RootClient.close	D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently.
    plan14_input_inventory_test.go:382: J4	internal/release/updatetarget.go	NextConsumed	E3	linux:internal/release/adopt.go:settingsTarget	Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy.
    plan14_input_inventory_test.go:382: J4	internal/activator/activator.go	Service.respawnWorkerLocked	E2	linux:internal/activator/activator.go:Service.convergeWorkerLocked	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	publish	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Read	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/provision/reconcile.go	mintHeld	C	linux:internal/provision/reconcile.go:Reconcile	Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	type passConfig	E2	linux:internal/release/adopt.go:BakeDir	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_evidence.go	readMigrationStop	G	linux:internal/host/rootmigration_collect_linux.go:recoverMigrationStop	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	openRootProtocolFloors	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=checked root ancestry and leaf ownership for separate moves or seeds public/private stores
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.beforeExec	E3	linux:internal/host/buildstate.go:buildStateHook	Consumed request is tenant-bound before execution; unread registry refuses before state merge.
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	stagedManifestOfLiveVersion	E4	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	loadPinned	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.VerifyEmptyDirectory	C	linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.openRecord	C	linux:internal/hostguard/record_unix.go:recordDir.read	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	upstream	B3	linux:internal/release/rollback.go:processGroup	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.hold	B3	linux:internal/release/proofgate.go:ProofGate.admit	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/link_linux.go	directory.readLink	A+E1	linux:internal/rootstate/link_linux.go:ReadTrustedLink	Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.capturedVersion	B3		fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	ResponseKey	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	type generationRetirement	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_transport.go	ClaimRootHTTP.serveJournal	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	JournalRelease	C	linux:internal/hostrelocate/participant.go:Participant.Step	Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartGenPass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	fastConvergeLoop	B3	linux:internal/host/agent.go:runAgent	rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadStopInventory	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.Begin	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/recoveryfence.go	Guard.recordNames	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.prepareRollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	trusted deployment record and root unit binding; durable per-attempt rollback and recovery
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	relocationInstallAuthority	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.local_	C+G	linux:internal/host/movesinstall.go:installGeneration	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.WithParticipation	D	linux:internal/hostfloor/disk.go:Disk.Begin	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	checkLegacySchema	C	linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	heldReleaseVia.publish	C+E1	linux:internal/host/movesstage.go:heldReleasePublished	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.checkHeldInventory	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckHeld	Held-inventory validator requires exact box/enrollment, ownership and single materialized route.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	checkedUnitRestart	B3+E1	linux:internal/host/rootrestart.go:rootRestartRouteWith	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.EndUpdate	D		Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	PublishHistoryRecoveryRetirement	E1		Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RestartBinding.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.read	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartIntent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	openRootMovesFloors	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed moves namespace then delegates checked root store opening
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootLegacyProtocolJSON	F	linux:internal/host/rootmovesfloor_source.go:rootProtocolLegacy	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	withSeedsFields	F	linux:internal/host/edgesfile.go:edgesFileLoop	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	GenerationProcess.valid	E2	linux:internal/release/rootgenerations.go:validGeneration	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	Guard.fenceLocked	C+G	linux:internal/hostguard/recoveryfence.go:Guard.ResumeFence	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.Route	C+G	linux:internal/host/moveswakesource.go:movesReadRoute	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.decidePrev	F	linux:internal/host/systemapply.go:systemApplier.install	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.JournalTail	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	activationReader.Read	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.target	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	type rootRestartRequestSource	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.recoveryEvidence	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationUnescape	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.localStopIdentity	C+G	linux:internal/host/claimparticipation.go:productionClaimLocal.bind	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-update.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalPrune	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_install.go	landingRegistrationMatches	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	migrateRootClaimAuthority	G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=under offline exclusion dispatches signed import or fresh root-journal collection before publishing retained completion; legacy importer remains signature-gated
    plan14_input_inventory_test.go:382: J4	internal/host/claimcleanup_identity.go	verifyClaimCleanupEnrollment	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.deny	D	linux:internal/hostexec/rootbroker.go:RootBroker.Close	D2 compares the current root token before durable loss and live-lock revocation; cleanup is bounded independently of request cancellation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMinor	E2		E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	writeGroupRefusals	E1	linux:internal/release/adopt.go:adoptHost	E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.RetireRecovery	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_linux.go	openAuthorityFile	E2	linux:internal/rootstate/authorityfile_linux.go:OpenAuthorityFile	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	Server.handleAPIRestartScope	E1+E3	linux:internal/console/authcli.go:Server.registerCLIRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.guardRun	F	linux:internal/host/systemapply.go:systemApplier.onDiskBuild	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	sweepStagedVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersionsPass	root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	verifyStopKernelMounts	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	dispatchBoundedWakes	E1+E3	linux:internal/host/restart.go:cycleWorkers	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	makeRestartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveparks.go	refusingClaimMoveWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/heldwake.go	DecideHeldWake	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.checkStateDirShape	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemparticipation.go	systemApplier.beginExecutableChange	D	linux:internal/host/systemapply.go:systemApplier.install	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocating.go	ConvertCommittedLanding	C	linux:internal/hostrelocate/worker.go:Worker.ConvertLanding	Committed landing conversion verifies exact target termination fence and record commit before transferring installation authority.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.EndUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.EndParticipation	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.pass	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pointerLoop	fix1-merge-review;basis=Saves the failure book before processing pointer retries; preserves signed retry and restriction checks.
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	var randRead	E1+E3	linux:internal/rollout/failures.go:newBookID	fix1-merge-review;basis=Names the cryptographic entropy source for failure-book identity; remains retry replay authority.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/regionalworker.go	RegionalWorker.Census	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	syncDir	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.liveFile	A+D	linux:internal/rootstate/live_linux.go:directory.HoldLive	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/host/edgesfile.go	edgesFileWriteClaims	F	linux:internal/host/edgesfile.go:edgesFileLoop	root-route;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.write	C	linux:internal/hostguard/root.go:Guard.AbandonRootInventory	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.AbandonRootInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	type RootGenerationPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/migration_census_other.go	CheckMigrationRoots	G		rev3=PROPOSED-p3;identity=non-Linux unsupported stub; no production caller on this checkpoint;basis=returns ErrUnsupported without scanning or granting migration authority
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckLocal	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Create	C	linux:internal/hostbox/launchjournal.go:LaunchJournal.Prelaunch	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	GenerationPins	E2	linux:internal/release/adopt.go:PassFilter	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	relocationBefore	C	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	Before-admission dispatch binds relocation executor and probe phase before typed handover.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	stageFrom	E2	linux:internal/release/adopt.go:ensureStagedDigest	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorJudge.permits	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=root guard-exec apply/recover selection and carlos.prev floor-allows-prev, uid 0;basis=signed current, retained prev and fixed staged candidate determine whether a below-bound candidate must be refused; no available qualifying build preserves recovery
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.resumeReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Observe	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retireAll	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	productionGenerationRetirements	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimcleanup_identity.go	claimCleanupEnrollment.configureSigner	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	bounceScopedRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.recheck	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.launchDigest	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	Open	A	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootLegacyFloorJSON	F		rev3=PROPOSED-p3;identity=test-only compatibility wrapper; production uses readRootLegacyProtocolJSON from adopt/apply uid 0;basis=selects moves JSON for bounded denial-only reader; no recovery or boot call
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	RootAuthority.write	C+G	linux:internal/hostguard/record_unix.go:recordDir.write	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record
    plan14_input_inventory_test.go:382: J4	internal/hostexec/clock_linux.go	BootID	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	stageHeld	C+E1+E2	linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation_probestop.go	RecordProbeStop	C	linux:internal/hostrelocate/participant.go:Participant.Step	Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.mintRefusals	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	passConfig.recordRefusal	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	readRootFloorBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartChecks.live	B3+E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerationpins.go	generationPinSource.StagedPins	E2	linux:internal/release/adopt.go:PassFilter	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimbackfill.go	newClaimBackfill	C+G	linux:internal/host/agent.go:instancesLoop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/roleintention_linux.go	LaunchJournal.ResolveRoleIntentions	C	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.resolveRoleIntentions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_linux.go	readHeldRenderHash	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorBinary.supports	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	readRootSeedsBinary	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=carlos adopt seeds judgement and root system apply/recover candidate checks, uid 0;basis=delegates checked signed executable read then selects seeds protocol
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.stopRetryAttempt	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.bindClaimWakeStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	NewJournalService	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	type historyReadbackPublisher	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.ensureUser	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootread.go	ReadRoot	D	linux:internal/host/rootexecution_read.go:readRootExecution	fix1;basis=Queries broker OFD lock ownership without acquiring a lock; rechecks unchanged durable evidence and monotonic expiry.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.read	E1	linux:internal/release/roothistory.go:RootHistory.RecordInstalledProgram	Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedretire.go	writeJournal	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_payload_other.go	generationPayloadFiles	E2	darwin:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/retirement.go	Guard.WithNoInstallation	C	linux:internal/host/claimproduction.go:claimAdminTokens.With	Use the already-held root host lock for empty-installation authority checks.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalIdentity	C	linux:internal/hostbox/generationinventory.go:LaunchJournal.GenerationLaunches	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.write	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootFloorBinary.forSeeds	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=projects signed SeedsProtocol (zero when absent); comparisons are gated by verified signed publication and available certified builds
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	productionClaimRegional.Authorize	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	BuildStateCopy.Read	E3	linux:internal/release/heldwake.go:DecideHeldWake	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.ConvertLanding	C	linux:internal/host/relocatepass.go:convertFencedLanding	Landing conversion requires verified local worker and termination-fence authority before claim conversion.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.CompleteAttempt	B3+E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	ReadStatus	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	readEffectiveSeedsFloor	F	linux:internal/host/rootseedsfloor.go:systemApplier.seedsActivationRefusal	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census selects verified signed publication plus capped retained deny; unpublished seeds impose no bound; no census retains legacy reader
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	Open	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_other.go	claimProbeSocketReady	B3	darwin:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.beginGuard	D	linux:internal/host/systemapply.go:systemApplier.Run	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.checkGuardRecovery	D	linux:internal/host/systemapply.go:systemApplier.Run	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_state_linux.go	ClaimRoleAssembly.prepareStateInventory	C	linux:internal/host/rootinventory_state_linux.go:ClaimRoleAssembly.prepareStateRemote	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLine	F	linux:internal/host/movesfloor.go:withMovesFields	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	heldReleaseVia.claim	C+E1	linux:internal/host/movesheldrelease.go:heldReleaseVia.request	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/caps.go	ValidCapabilities	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationreleases.go	ReleaseObligation.Queue	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Queues exact relocation release retirement obligation and preserves already discharged receipt replay.
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	routeArgs	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever a route is inserted: Upsert, the cold handover restore and the import journal's inserts: the bind list from Registry.Upsert's body (and RestoreClaimRows'), with seed_source and import_gate added; E3, the same family as Registry.Upsert, whose body it came from
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	restartIntentID	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.readLocked	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	Read-only access takes only the root host lock.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationReservation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.rollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	type GenerationCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationinventory.go	LaunchJournal.GenerationLaunches	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.controllerGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/registry/artifacthosts.go	Registry.ArtifactHosts	E2	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	migrateClaimJournalsWith	G	linux:internal/host/claimjournal_migration.go:RunSystemJournalMigrate	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	migrationAdmissionDenied	G	linux:internal/hostguard/root.go:Guard.CommitRootInventoryArtifacts	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	type rootFloorHealthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.healthy	rev3=PROPOSED-p3;identity=root system apply/adopt health or floor decision uid 0; recovery readers uid 0;basis=binds a root health observation to deployment, box, enrollment and signed binary identity
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	ClearStale	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/restartscope.go	RestartScope.Selects	E1+E3	linux:internal/host/restartscope.go:scopedHosts	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_other.go	productionGenerationAbsence	E2	darwin:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: non-Linux production generation retirement refuses. Darwin, Windows and Linux ARM64 compile gates; no non-Linux retirement authority.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Install	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Configure	Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths.
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimParentPID	B3	linux:internal/host/claimready_linux.go:claimProbePeer	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	ClaimWakeAssembly.readiness	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.observeAndRecord	B3+E1	linux:internal/host/proofroot.go:proofRoot.mintAndLog	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	backfillManifestDigest	E2	linux:internal/release/adopt.go:adoptHost	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	rootHealthyStore	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	fix1;basis=Normalizes the no-account operator app to the existing ops namespace before opening the root-owned public history.
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	sweepStagedVersionsPass	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation.go	productionClaimLocal.Prepare	D	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventoryscope.go	ValidateAgentInventory	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.admit	B3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageRow	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.installWithWork	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	Install dispatch preserves serving registration and distinguishes hold-only relocation from installation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	type rootRestartRequests	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.rebindRecoveryRows	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.installRecoveryInventory	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.idle	D	linux:internal/rootparticipation/ledger.go:Ledger.RecoverAcquisition	D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootRefreshAndJudgeMovesPrev	F	linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.retireIntended	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.publishRelease	C+E1+E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckRootRegisteredRow	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Crash census exception admits only the row named by root pending registration; all other census checks remain required.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Begin	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	RootGenerationPins.StagedPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.stageRelease	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartRouteWith	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.MintHeldUnder	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/relocationrows.go	RelocationRow	C	linux:internal/hostbox/reconcile.go:Reconciler.rowDecision	Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself.
    plan14_input_inventory_test.go:382: J4	internal/hostops/completion_fence.go	ProductionAuthority.completionFence	C	linux:internal/hostops/production_held_start.go:ProductionAuthority.startAppLifecycle	Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	prepareStatus	E1	linux:internal/historyreadback/workflow.go:PrepareOperation	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInventoryAt	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	descendSync	A	linux:internal/rootstate/state_linux.go:descend	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/containment.go	ExecBackend.spawnInCgroupAtTier	E2	linux:internal/activator/backend_exec.go:ExecBackend.seedChild	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.read	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	WithRootGenerationPins	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	movesDir.removedDuringOpen	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageCheck	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	withPrevLock	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_install.go	rootLandingIdentity	C	linux:internal/host/rootinventory_install.go:ClaimRootHTTP.rootLandingRoute	Landing target identity binds executor, participants, enrollment and region before first root registration.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	CompleteRelocation	C	linux:internal/hostrelocate/worker.go:Worker.Step	Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.installation	E1	linux:internal/host/roothistory_creation.go:rootRestartRequestSource.creation	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.Activate	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	Pending intent and durable quarantine remain denial conditions.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeldVerified	C+E1+E2	linux:internal/host/movesstage.go:var heldStageVerified	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.complete	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.ReconstructionStatus	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatus	E1	linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	type generationMount	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	productionGenerationCreation	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	refusingRootWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartCandidates	E1+E3	linux:internal/host/restart.go:restartApps	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/relocationwake.go	RelocationWakeInputs.Select	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Relocation wake binds prepared generation, release receipt and install stamp before admission; launch payload selection remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	CheckPublicConfig	A+B3	linux:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Checks root:root ownership, exact 0644 mode and single-link regular-file identity on the already opened operator configuration descriptor.
    plan14_input_inventory_test.go:382: J4	internal/instancectl/peer_tuple_linux.go	AuthenticatePeerTuple	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.boot	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/console/browserrestart.go	Server.handleBrowserRestart	E1+E3	linux:internal/console/browserrestart.go:Server.handleAppRestart	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	serveHeldStageRequest	E2	linux:internal/release/materializeheld.go:ServeHeldStageRequestsWithPins	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback_resume.go	resumeRootRestart	B3+E1	linux:internal/host/rootrollback_resume.go:recoverRootRestarts	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	fenceTargetStuck	C	linux:internal/hostclaim/relocation.go:FenceExhaustedTarget	Exhausted-target transition verifies fence and revokes only dead target execution, preserving another live source.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	installationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:rootInstallationCoverage	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	OpenProtected	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationflush.go	ReleasePositionsFile.Recorded	C	linux:internal/host/relocationeffects.go:RelocationEffects.flushStopped	Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_client.go	productionClaimLocal.prepareWith	D	linux:internal/host/claimparticipation.go:productionClaimLocal.Prepare	Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	rootRestartRequests.run	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	movesDir.names	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalnamespace_linux.go	prepareJournalDirectory	C+G	linux:internal/hostbox/journalnamespace_linux.go:PrepareRootJournalDirectory	rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains
    plan14_input_inventory_test.go:382: J4	internal/host/relocationeffects.go	RelocationEffects.EnsureLocal	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	resumeHistoryRestart	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	GenerationBinding.valid	E2	linux:internal/release/rootgenerations.go:RootGenerations.Read	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	scanStopDescriptors	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	settingsPins	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_other.go	Open	A	darwin:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.capLegacy	F	linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh and local seeds-bound readers in apply/recover/guard, uid 0;basis=caps service-written protocol and release minima by highest root-observed healthy build; absent observation supplies no bound
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.LiveHeld	A+D	linux:internal/rootstate/live.go:LiveHeld	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_other.go	productionGenerationKernelCensus	E2	darwin:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/release/versions.go	PointLive	B3+E2	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Compare resolved current and previous paths before retaining the running build; preserve repoint errors and canonical retained pointers.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.recovered	B3+E1	linux:internal/host/rootrestart.go:productionRootRestartChecks	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	productionRestartRequestPass	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	productionGenerationAbsence	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.Replay	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.verifyInventoryPath	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.install	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=root verifies staged signature and final locked bounds before rename, then records root accepted floor history only after health succeeds
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.retainRecoveryHistory	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.mintRefusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	systemApplier.acceptRootFloorHealthy	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=reads signed installed bytes after the system health gate; writes independent moves and published-seeds root observations
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	stampDBPaths	E4	linux:internal/host/caps_pass.go:capabilityPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	inventoryTimerNames	E2	linux:internal/host/rootgeneration_requirements.go:generationRequiredInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeld	C+E1		root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	withRootMovesFields	F	linux:internal/host/movesfloor.go:withMovesFields	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	judgeSeedsPrev	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) through notePrev, and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root) through rootJudgeSeedsPrev: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Verify	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	RootAuthority.Installation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	currentClaimEdgeMaskAt	C+G	linux:internal/host/claimjournal_migration_linux.go:claimEdgeMaskStillOwned	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	type historyRecoveryRecord	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/generationinventory.go	RootAuthority.GenerationInstallations	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery_pass.go	namedUnitRecovery.passOption	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Production recovery wrapper preserves main exit status for per-host failures; only remaining named routes can probe the census for history selection. Ordinary routes make no census or binding-store reads. Fixtures: TestPlan14ERecoveryOrdinaryPass, TestPlan14Fix4AdoptPerHostFailureExitsZero, TestPlan14Fix5MainEquivalence.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootSeedsAllowsBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=compares signed seeds protocol to published root bound only while a certified current, prev or staged candidate meets it; no remote reads
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.report	E1+E3	linux:internal/host/rollout.go:rolloutStatusProbe	fix1-merge-review;basis=Reports only durable published restriction epochs and the supported retry protocol; reports do not grant authority.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.Completeness	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	const generationCompletenessKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationReceipt	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Local-install receipt reader refuses malformed operation materialization; claim receipt digest is checked by its consumers.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live.go	LiveHeld	A+D	linux:internal/hostexec/rootread.go:ReadRoot	fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	stageGenerationSibling	E2	linux:internal/release/adopt.go:backfillManifestDigest	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	Controller.authority	D	linux:internal/hostexec/controller.go:Open	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	settingsTarget	E3	linux:internal/release/adopt.go:adoptHost	Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofRouteReady	B3	linux:internal/host/proofobserve.go:productionProofObserver	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/release/bake.go	LoadFirstSeenMigrating	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	claimUnitContent	E1	linux:internal/host/bootstrap.go:bootstrapWith	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	type generationKernel	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/activator/rolelaunch_linux.go	RoleLaunch.prepareRoleReservation	C		root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	productionClaimRoster.Actor	C+G	linux:internal/hostbox/identity.go:IdentityProvider.Verify	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionImages	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationpayload.go	LaunchJournal.GenerationPayloads	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	hostNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	recoveryHistoryOutcome	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.Step	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Participant re-reads claim and installation identity around effects; root stop receipts and fresh participation bound probes, with generic orchestration retained.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Scope	E1	linux:history_cli.go:historyCommandWithSave	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/console/seedfloor.go	Server.seedRegionReady	F	linux:internal/console/apiinstanceimport.go:Server.handleAPIImportStopped	rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	rootProtocolLegacy	F	linux:internal/host/rootmovesfloor_source.go:rootFloorLegacy	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded agent-writable JSON and line mirrors contribute only increasing denies; neither can establish accepted state
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop.go	ClaimStopCoordinator.FenceAndStop	C+G	linux:internal/host/claimstop_transport.go:ClaimStopHTTP.ServeHTTP	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMounts	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.Launch	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.Launch	C+G	linux:internal/host/moveswakesource.go:movesReadLaunch	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	claimSameWriter	C+G	linux:internal/host/claimretire_local.go:claimArtifactRetirement.Recover	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.cleanupExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveLaunchSource	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	openMovesDir	F	linux:internal/host/movesfloor.go:withFloorLock	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	RelocationRuntime.once	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.Run	Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.copyRecoveryHistory	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	RootGenerations.Reservations	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	judgeRootSeedsPrev	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	agentUnitCgroup	C+G	linux:internal/host/claimstop_kernel_linux.go:newProductionStopKernel	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	StoreReader.Read	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	FenceSource	C	linux:internal/hostrelocate/worker.go:Worker.Step	Source-loss transition independently verifies termination fence and enrollment before revoking its participation.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	type namedUnitRecovery	E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	generationRequiredInventory	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.journalMigrationMarker	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	Identity	A+B3	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.repair	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.Sweep	C+D		Sweep reads fresh claim before retiring a participant; absence never manufactures a local discharge.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizedReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimAdminTokens.With	C+G	linux:internal/host/claimproduction.go:claimServingLaunchSource	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	rootJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=census-ruling-seeded-instances;basis=the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root): seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.bind	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	restartScopeLeg	E1+E3	linux:internal/host/restart.go:restartPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	normalizeRoute	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever Upsert's SQLite arm and the import swap run: the insert defaults from Registry.Upsert's body; E3, the same family as Registry.Upsert, whose body they came from
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.verifyPointer	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopjournal_reader.go	LaunchJournal.ReadStopKernelJournal	C	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	adoptHost	B3+E1+E2+E3+E4	linux:internal/release/adopt.go:PassFilter	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	RootAuthority.viewLocked	C+G	linux:internal/hostguard/rootview.go:RootAuthority.Installation	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	Respond	E1	linux:internal/host/roothistory_readback.go:historyReadbackPublisher.publish	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.heldWakeInput	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	Held wake reads tenant-bound consumed decisions, refusal ledger and installed release; no downgrade to diagnostic.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_maintenance.go	rootHistoryMaintenance.run	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	claimSocketReady	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	rootRecordRoute	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	trusted deployment record and root unit binding; durable per-attempt rollback and recovery
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	applyRetries	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Verifies the deployment-root signature and account/app/host/book/epoch before lifting a restriction.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery_active.go	namedUnitRecovery.recover	B3+E1	linux:internal/host/namedrecovery_pass.go:namedUnitRecovery.passOption	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	checkUnresolvedRecoveries	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldRoute	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.ownedRow	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Extracted row writer retains complete typed inventory and immutable route identity around guarded write.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/link_linux.go	ReadTrustedLink	A+E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	PublishHistoryReconstruction	E1		Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationPayloadBindings	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/program.go	FileProgram	E1	linux:internal/release/adopt.go:adoptHost	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_production.go	WithProductionMovesHeldRelease	B2+C+E1+E2	linux:internal/host/claimstop_run.go:RunInstanceControl	Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdate	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/guardarm.go	guardArmIdle	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	legacyGuardEntries	D	linux:internal/host/guardtransaction.go:installFloorHook	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	WakePhase	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	stopIdentity	C+G	linux:internal/host/claimstop_kernel_linux.go:scanStopCgroupsMode	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/caps.go	Set.UnmarshalJSON	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemctlVerb	B3	linux:internal/host/unitsettle.go:systemdUnits.ResetFailed	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	rootRestartRecord.advance	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	armPhase1	B2+C	linux:internal/host/movespass.go:armMovesPass	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the S1 probe hook refusing a row whose import gate is set; main's B2,C authority retained
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_run.go	RunInstanceControl	C+D+G	linux:main.go:main	Refuse premature claim activation and continue serving recovery after per-host startup failures.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecovery_remote.go	claimCrossBoxHandover.installRecoveryRemote	C	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacySettleOptions	B3	linux:internal/host/legacyrestart.go:legacyRollbackRestart	rev3=merge-ruling-4;basis=Legacy settle uses main readiness inputs and limits; these do not authorize root health history.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationpayload.go	type GenerationPayload	E2	linux:internal/host/rootgeneration_inventory.go:generationPayloadBindings	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_linux.go	OpenAuthorityFile	E2	linux:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.checkClaimsOnDisk	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closure	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	readGeneration	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	type InstallationArtifacts	E2	linux:internal/hostguard/root.go:type RootInstallation	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMaps	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	type RootInstallation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	backfillManifest	E2	linux:internal/release/adopt.go:backfillManifestDigest	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootHistoryInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readEffectiveMovesFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	syncSibling	E2	linux:internal/release/adopt.go:stageFrom	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.findRecord	B3	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Cache index success or failure once per pass; selected records and ETags remain freshly read.
    plan14_input_inventory_test.go:382: J4	internal/hostops/move_fence_release.go	MoveRecoveryGrant.ReleaseFencedTarget	C+D	linux:internal/console/movesrecovery.go:Server.movesRecovery	Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	randomMigrationID	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=cryptographic nonce identifies newly collected stop evidence, never authorizes a stop
    plan14_input_inventory_test.go:382: J4	internal/host/retention.go	retentionPass	E2	linux:internal/host/agent.go:retentionLoop	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/report.go	Disk.Running	F	linux:internal/console/hostreports.go:Server.localHostReport	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.MigrateLegacy	C	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RootRestarts	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/instancectl/legacy_claim_cleanup.go	Server.clearLegacyClaimLaunch	C+G	linux:internal/instancectl/server.go:Server.handleStart	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	FailureBook.recordLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.reconcileLocked	fix1-merge-review;basis=Marks restriction state dirty and advances its generation before publication.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.beginExecutionRecoveryFence	D	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	OpenForUpdate	D	linux:internal/host/rootmovesfloor_source.go:rootMovesFloorIdentity	Unactivated absent census does not block update or recovery; retained census remains authoritative.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.Load	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.With	C	linux:internal/hostbox/work.go:selectedWork.With	Recheck remote root denial immediately before the protected effect.
    plan14_input_inventory_test.go:382: J4	internal/release/signedhead.go	StageSignedHead	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	type rootGenerationSource	E2	linux:internal/host/claimlaunch_root.go:type ClaimLaunchRoot	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationRetained	F+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	recoverLegacyClaimEdgeMask	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	readGenerationsSeq	E2	linux:internal/release/pins.go:ReadGenerations	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	FenceView.admit	G	linux:internal/hostguard/guard.go:Guard.With	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=read-only root view applies same predecessor-completion requirement as locked admission
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootserving.go	RootBroker.servingView	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootProtocolBound	F	linux:internal/host/rootmigration_startup.go:verifyRootMigrationFloors	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	UpdateIdle	F	linux:internal/host/claimreport.go:claimReport	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	treeStats	E2	linux:internal/release/sweep.go:SweepStaged	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	migrateClaimJournals	G		rev3=PROPOSED-p3;identity=test-only wrapper; production offline uid 0 CLI calls migrateClaimJournalsWith with full=true;basis=retains legacy import/mask behavior for tests; no production caller
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	type rootSeedsPublication	F	linux:internal/host/rootseedsfloor_publication.go:verifyRootSeedsPublication	rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.serving	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	bounceExecRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	proofObserver.recordSettled	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-5;basis=Ordinary unstamped and derived routes do not resolve deployment records for post-restart health observation.
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence.go	publishConsumed	E3	linux:internal/release/adopt.go:settingsTarget	root-route;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	armMovesPass	B+C	linux:internal/host/agent.go:runAgent	Agent moves construction passes registration client and existing guarded publication and park providers.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	Open	D	linux:internal/rootparticipation/production.go:ActivationReady	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.reconstruct	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires private root-issued box/generation/nonce token and refuses weakening; no production caller installed
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Sync	A+F+G	linux:internal/rootstate/state.go:Sync	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	relocationProbe	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	ServeHeldStageRequests	E2		E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.floorArmed	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.acquire	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Retry conditional writes and authority reads within original monotonic cutoff; reconcile uncertain writes by exact bytes.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	HistoryRecoveryRetirementKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/safefile/file_linux.go	writeAtSteps	A+F+G	linux:internal/safefile/file_linux.go:writeAt	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/host/claimcensus.go	claimUnitCensus	C+G	linux:internal/host/claimcensus.go:claimGlobalSharedPaths	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.Blocks	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	type HistoryMigrationStatus	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.self	C+D	linux:internal/hostrelocate/worker.go:Worker.ConvertLanding	Worker identity requires current active directory enrollment, home-region match and termination-fence check.
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.bind	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	rootExecutionRead	D	linux:internal/host/rootexecution_read.go:productionClaimLocal.checkRootParticipation	Production root observer selects the descriptor-checked participation reader.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Receipt	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration_inventory.go	RootAuthority.MigrationInstallations	C+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0; also root claim startup uid 0;basis=read-only root installation enumeration includes incomplete records and never repairs before preflight
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	validHistoryRetirement	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Read	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRootTask	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.afterRecovery	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	productionRootRestartChecks	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	var openRootMigrationParticipation	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=fixed production participation opener remains rootparticipation.OpenForUpdate; package tests substitute explicit no-census fixtures without accessing the machine store
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.installRecoveryInventory	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.MintHeld	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.MintHeldUnder	Local held-row mint requires matching nested installation ownership and operation; production remote path uses separate registration.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	install	C	linux:internal/hostclaim/relocation.go:ToInstalling	Install transition allocates authoritative stamp and pinned release, records target before effects and removes prior local receipt.
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	IndexRecords	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Discover hosts once, reject duplicate keys, and classify partial discovery as retry rather than permission refusal.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	RequestKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootHistoryCreation	E1	linux:internal/host/roothistory.go:openRootHistory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Reserve	E2	linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	claimConstructionProcessStart	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	nextGenerationsSeq	E2	linux:internal/release/pins.go:WriteGenerations	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	proofBindingSource.claimIdentity	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.projection	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum
    plan14_input_inventory_test.go:382: J4	internal/activator/workerswap.go	Service.ReplaceWorker	E2	linux:internal/rollout/worker.go:scheduler.executeWorker	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	restartValue	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.refresh	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	Consumed.ForeignTo	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	ForeignTo binds consumed decisions to account/app before root release history can be reused.
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	rollbackGroup	B3+E1+E3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyRootRestart	B3+G	linux:internal/host/roothistory_creation.go:productionCreationHistory	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationPathRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartEligible	E1+E3	linux:internal/host/rollout.go:feedRestarts	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	readClaimUnitSettings	C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	LaunchJournal.HasInstallationEffects	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_production.go	WithProductionClaimLaunch	E1+E2	linux:internal/host/claimstop_run.go:RunInstanceControl	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/proofpolicy.go	LoadProofPolicy	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.rebindRecoveryInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Retain fresh claim and inventory checks and refuse a box listed Lost.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_runtime.go	var openClaimExecutionAuthority	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Instance-control owns broker, checked store, monitor and bounded cleanup lifetime.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.RecoveryRetired	E1	linux:internal/host/recoveryrefusals.go:checkUnresolvedRecoveries	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/roleintention_linux.go	resolveRoleIntention	C	linux:internal/hostbox/roleintention_linux.go:LaunchJournal.ResolveRoleIntentions	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.recoverSettlement	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	Recovery serializes settlement with in-flight requests and requires cleanup, exact conditional release and CC9. TestPlan14ExecutionRecoverySettlesWithoutControllerToken and TestPlan14ExecutionRecoveryJoinsRemoteWrite.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_relocation.go	productionClaimLocal.Acknowledged	D	linux:internal/host/relocatepass.go:NewRelocationRuntime	Relocation acknowledgement waits for bound controller readiness; participates in execution admission.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	rootInstallationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:verifyNoProcessAt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	heldStageable	C+E1	linux:internal/release/materializeheld.go:materializeHeldChecked	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	historyRecoveryKey	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retireAll	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootStartRoute	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Use main systemctl start for legacy non-NotUp recovery while retaining checked rollback when authority binds.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	generationFileIdentity	E2	linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	publishMigrationReceipt	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reconstructs immutable key/digest from original signed receipt bytes without changing evidence time
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakewriters.go	claimWakeAttempt.StopWriters	C+G	linux:internal/host/claimstop_writers.go:ClaimAssembly.writersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	validHistoryRecovery	E1	linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationFloors	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks installed and guard signed binaries against both locally retained protocol bounds without remote access
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Retire	C+E2	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence_linux.go	lockConsumedCarry	E3	linux:internal/release/consumedfence.go:FenceCarry	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	PinAfterRelease	C	linux:internal/hostrelocate/worker.go:Worker.Step	Pin transition verifies source release authority and exact journal phase before removing execution authority.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	historyRestartAttempt	B3+E1	linux:internal/host/rootrestart.go:checkedUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/completion.go	ReadRetirement	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	claimUnitStopKernel.settleUnits	C+G	linux:internal/host/claimlaunch_root.go:claimUnitStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	verifiedClaimExecutable	C+G	linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Launch	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	type rootHistoryAccess	E1	linux:internal/host/claimretire_transport.go:type ClaimRootHTTP	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	materializeHeldChecked	E2	linux:internal/release/materializeheld.go:serveHeldStageRequest	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	type generationReconciler	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	movesWorker.liftFences	C	linux:internal/host/movespass.go:movesPass	root-route;kept=C;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	routeReady	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rollbackUnitRestart	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-update.path	external	F	linux:internal/host/bootstrap.go:var unitsFS	root-input
    plan14_input_inventory_test.go:382: J4	internal/safefile/file_linux.go	writeAt	A+F+G	linux:internal/safefile/file_linux.go:Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	readProductionRosterRow	C+G	linux:internal/host/movessources.go:productionRosterRegion	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	type HistoryHostStatus	E1	linux:internal/release/roothistory_status.go:type HistoryMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	strictRoleLaunch	C	linux:internal/hostbox/rolelaunch.go:DecodeRoleLaunchRequest	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	linkRootHistory	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/work.go	Serving	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_runtime.go	newClaimExecutionRuntime	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.settleExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	type generationInventory	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.inventoryVersion	C	linux:internal/hostbox/inventory_expected.go:StopInventoryDB.Snapshot	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.Execute	D	linux:internal/host/rootexecution_transport.go:ClaimRootHTTP.serveExecution	Retry transient authority reads within existing admission slack; bounded replay and permanent mismatches remain enforced.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBinding.authorizedRecovery	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_transport.go	type ClaimRootHTTP	E1	linux:internal/host/claimstop_run.go:RunInstanceControl	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	var claimSystemctl	C+G	linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryRefusals	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.spawnInCgroupGated	E2	linux:internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	proofObserver.observe	B3	linux:internal/host/proofobserve.go:proofObserver.recordSettled	fix1;basis=Observes only the canonically bound unit, executable and readiness, including the installed console guard wrapper.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_other.go	CheckPublicConfig	A+B3	darwin:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Non-Linux descriptor checks fail closed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRead	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.boot	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimProbePeer	B3	linux:internal/host/claimready_linux.go:claimProbeSocketReady	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.commitRootInventoryPending	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.withRootInventoryHistory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	OpenProductionClaimAssembly	G	linux:internal/host/claimconstruction.go:ensureProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	LivePins	B3+E2	linux:internal/host/versionsweep.go:sweepStagedVersions	Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	resolveRestartScope	E1+E3	linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartApps	E1+E3	linux:internal/host/restart.go:restartPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	scopedHosts	E1+E3	linux:internal/host/restartscope.go:bounceScopedRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofExecPath	B3	linux:internal/host/proofobserve.go:proofObserver.observe	fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/shared_linux.go	ensurePublicChild	A+B4	linux:internal/rootstate/shared_linux.go:EnsurePublicDir	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootFloorProjection	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=selects moves public root projection for checked advertisement reader
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.notePrev	F	linux:internal/host/systemapply.go:systemApplier.decidePrev	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.restoreVersion	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	RecordIndex.Find	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Use cached key identity but read and validate current record body and ETag.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.task	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	RootAuthority.RetainMigrationDeny	C+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_available.go	rootFloorAvailable	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.ConsumeCreation	E1	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	ProductionClaimOwnerProvider.OpenClaimOwners	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Production owner factory wires bounded C8 and relocation providers and closes partial construction on error.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	OpenLaunchJournal	C	linux:internal/host/claimjournal_migration.go:var openClaimRootJournal	root-input
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	RequestStatus	E1		E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_identity.go	rememberRootFloorSystemIdentity	F	linux:internal/host/systemapply.go:systemApplier.verifyPointer	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=re-fetches and verifies signed pointer equality before retaining its executable identity
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	withEffectiveMovesFloorLock	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover final activation, uid 0;basis=locks moves then seeds private root stores across final activation; no census uses unchanged legacy lock
    plan14_input_inventory_test.go:382: J4	internal/release/ratchet.go	DigestRatchet.note	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.Recover	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	A provably superseded cold admission can abandon its barrier without discarding its receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationTaskFDs	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/migration.go	Ledger.MigrationCensus	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.refreshAll	E3	linux:internal/host/agent.go:fastConvergeLoop	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_linux.go	generationKernel.census	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_stopped_linux.go	verifyMigrationStopped	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery
    plan14_input_inventory_test.go:382: J4	internal/host/proofask.go	mintAsker.tick	B3	linux:internal/host/agent.go:fastConvergeLoop	route-and-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	ReplaceTarget	C	linux:internal/hostrelocate/worker.go:Worker.replace	Replacement verifies target termination fence and allocates a new install stamp, preserving unopened prepared build reuse.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.refresh	F	linux:internal/host/rootmovesfloor_refresh.go:rootRefreshAndJudgeMovesPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Finish	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/activator/containment.go	ExecBackend.startRole	E2	linux:internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Launch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	readRootSeedsBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh, system apply/recover and guard floor readers, uid 0;basis=unpublished seeds supplies no bound; verified retained publication and root-capped denies determine the bound
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	claimLaunchProcessIdentity	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	LaunchJournal.UnitIntentions	C	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.bindRecording	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	newBookID	E1+E3	linux:internal/rollout/failures.go:OpenFailureBook	fix1-merge-review;basis=Uses the named entropy source and propagates failure; retains authority classification despite no scanner-recognized direct read.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/participation.go	checkLegacyParticipation	D	linux:internal/hostfloor/disk.go:Disk.Begin	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state.go	type Store	A+B3	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgeMovesPrev	F		rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt-only wrapper delegates to root-aware moves judge; no direct input reads
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.Refusals	E1	linux:internal/release/roothistory_app.go:RootHistory.MintRefusals	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	type generationRecord	E2	linux:internal/host/rootgeneration_inventory.go:type generationInventory	E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorPrevVerdict	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorBootCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches actual signed previous binary to identity and accepted generation before allowing its gate
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	keepsBuildState	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.restoreFiles	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	legacyJournalFiles	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/rolelaunch_root_linux.go	RoleLaunch.startIsolated	C	linux:internal/activator/rolelaunch_linux.go:RoleLaunch.Start	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	newBuildStates	E3	linux:internal/host/agent.go:runAgent	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	wireClaimAdmission	C+D	linux:internal/host/claimhandover_crossbox.go:wireProductionAdmission	Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/coldhandover.go	Guard.AbandonColdHandover	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-adopt.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.CaptureInventory	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.RegisterLanding	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.RetainRecovery	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmovefence.go	claimBoxFenceVerifier	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.recoverAfterReboot	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	validGeneration	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	rootMigrationLegacySuspects	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_execpermit.go	ClaimLaunchRoot.execPermit	D	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	systemApplier.rootProtocolAllowsBinary	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	openRootHistory	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	restartRequestPass	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigrationSnapshot.preflight	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationState	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refuses active moves, unfinished seeds, incomplete inventories or mismatched migration identity before effects
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.Show	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/participation.go	PreinstallationParticipant	D	linux:internal/host/rootexecution_authority.go:ClaimRootHTTP.executionAuthority	D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	productionClaimLocal.checkRootParticipation	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.Check	Root observer binds participation to enrolled actor; TestPlan14ExecutionRootLocalIgnoresAgentAbsence.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	trusted	A	linux:internal/rootstate/file_linux.go:OpenTrustedFile	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_rows.go	generationRegistryInventory	E2	linux:internal/host/rootgeneration_rows.go:productionGenerationRegistryInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorDowngradeIdle	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=under participation exclusion checks local root generation/installation/launch/retirement inventory and kernel census; no recovery store read
    plan14_input_inventory_test.go:382: J4	internal/hostops/backfill_seeds.go	CollectCensusSeeds	G	linux:internal/host/rootmigration_census.go:rootMigrationCollector.collect	rev3=census-ruling-seeded-instances;basis=no caller in the tree yet; G wires the census collector that will call it: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveparks.go	openProductionClaimMoveWake	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.begin	E1	linux:internal/release/adopt.go:adoptHost	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	const RootHistoryStatusDir	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validScope	E1	linux:internal/historyreadback/readback.go:enrolled	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/work.go	WorkSource.Select	C	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_other.go	Disk.Exec	F	darwin:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/instancectl/server.go	runWithClaim	C+D+G	linux:internal/instancectl/claim.go:RunWithClaim	Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyRollbackRestart	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	rev3=merge-ruling-6;basis=Restore main reset-failed, restart and D1 settle even after an operator reset; retain main error wrapping and diagnostics.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	WithRunningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=fix3-Astra-P2;basis=Root-only hook supplies verified current or previous running authority before replacing pointers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction_linux.go	productionStopControllers.VerifiedController	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	localDir.write	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStagePass	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	const RootRestartsDir	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	SweepStaged	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	productionCreationHistory	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type RootGenerations	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	type movesHeldReleaseRoot	E2	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_migration.go	ClaimRootHTTP.executionAuthorityWithMigration	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_recovery.go	recoverRootExecution	D	linux:internal/host/guardtransaction.go:var recoverPendingControllers	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_stale.go	productionClaimLocal.clearUntracked	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	Untracked participation cleanup now carries exact controller binding into retirement before stale-state clearing.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/park.go	Regional.observe	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.runHost	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.sameInstallation	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	pointerBoundUnit	B3	linux:internal/host/rootrestart.go:restartBoundUnit	rev3=merge-ruling-4;basis=Only PID-zero stopped or restarting states may bind without process identity; inactive units are never woken.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.sourceEvidence	C+G	linux:internal/host/claimhandover_crossbox.go:claimCrossBoxHandover.After	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-config-sync.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	checkTrustedJournalDir	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/begun.go	ReadBegun	F	linux:internal/host/guardtransaction.go:systemApplier.guardFinished	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	relocationBeforeAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_other.go	OpenAuthorityFile	E2	darwin:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/floor.go	Read	F	linux:internal/host/hostfencepass.go:hostFenceOnce	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationProcess	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	const RootRestartAbsent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	declinedClaimGate	C+G	linux:internal/host/claimmoveaccess.go:claimMoveLaunchSource	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootRefreshAndJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path
    plan14_input_inventory_test.go:382: J4	internal/hostguard/fence.go	StopAuthorityMatches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectCapturedStop	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	record.admits	G	linux:internal/hostguard/guard.go:Guard.With	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	settleRollbackAttempt	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	RemoveDurable	F	linux:internal/hostfloor/disk.go:Disk.Begin	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	OpenStopInventoryDB	C		root-input
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyCheckedUnitRestart	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-6;basis=Restore main stamped-unit restart and D1 settle, including diagnostics; only clock, readiness and health-hook adapters differ.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_launch.go	ClaimLaunchRoot.rootInstalledProgram	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.startSidecarUnitFrom	E2	linux:internal/activator/genbackend.go:ExecBackend.StartSidecarGen	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLineFrom	F	linux:internal/host/movesfloor.go:readLine	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	PassFilter	B3+E1+E2+E3	linux:internal/release/adopt.go:Pass	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	BuildStateKept	E2	linux:internal/release/pins.go:SettingsRefs	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.judge	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=PROPOSED-p3;identity=carlos adopt normal refresh and carlos system apply notePrev, uid 0;basis=observes participation before floor lock; writes identity-bound current/prev verdict even under unknown history without blocking repair executor
    plan14_input_inventory_test.go:382: J4	internal/caps/render.go	RenderService	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.Execute	C	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.binding	B3	linux:internal/host/proofbinding.go:proofBindingSource.forHost	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/guardexec.go	recoverLockHeld	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.member	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.PrepareState	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimexec.go	ClaimUnits.prepareExecGate	C+G	linux:internal/instancectl/claimunit.go:ClaimUnits.start	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimexec_socket_linux.go	claimListenExecSocket	C+G	linux:internal/instancectl/claimexec.go:ClaimUnits.prepareExecGate	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/controllers_linux.go	EnsureControllerDir	F	linux:internal/host/guardarm.go:guardArmControllers	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	requireReceiptOfInstallation	C	linux:internal/hostclaim/relocation.go:RecordLocalInstall	Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation.
    plan14_input_inventory_test.go:382: J4	internal/host/claim_evidence_producer.go	ConfigureStopEvidence	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimlaunch_snapshot_linux.go	claimRootDir	C+G	linux:internal/instancectl/claimlaunch_snapshot.go:ClaimUnits.freezeLaunch	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchLocked	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.applyPointers	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pass	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.write	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Read	A	linux:internal/rootparticipation/ledger.go:Ledger.Acquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckHeld	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Hold-only source checks its own row-owned installation inventory rather than the target holder stamp.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.Acquire	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Check	E2	linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.check	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/migration_census_linux.go	CheckMigrationRoots	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=offline scan requires every managed payload to match independent retained inode/type inventory or explicit shared path rules
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_transport.go	retirementAcknowledgement	C+G	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecoveryreceipt.go	claimCrossBoxHandover.recoveryStopReceipt	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.recoveryEvidence	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	tryAcquireNamed	D	linux:internal/hostexec/local_unix.go:tryAcquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	RootAuthority.CompleteMigrationInventory	C+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root completed fence receipt and retained session deny required before installing recovered inventory revision
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	RootAuthority.read	C+G	linux:internal/hostguard/root.go:Guard.Capture	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	historyRecoveryDigest	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	var readClaimUnitFile	C+G	linux:internal/host/claimunit.go:readClaimUnitSettings	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	historyRetirementKey	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.check	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/writer.go	Writer.Published	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.HoldLive	A+D	linux:internal/rootstate/live.go:HoldLive	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/retirement_timers.go	retirementWithTimers	C+E2	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:389: family E3 missing erasure fixture 
    plan14_input_inventory_test.go:389: family E3 missing hostile fixture 
    plan14_input_inventory_test.go:389: family E3 missing positive fixture 
    plan14_input_inventory_test.go:389: family E3 missing rename fixture 
    plan14_input_inventory_test.go:389: family E3 missing retry fixture 
    plan14_input_inventory_test.go:389: family E4 missing erasure fixture 
    plan14_input_inventory_test.go:389: family E4 missing hostile fixture 
    plan14_input_inventory_test.go:389: family E4 missing positive fixture 
    plan14_input_inventory_test.go:389: family E4 missing rename fixture 
    plan14_input_inventory_test.go:389: family E4 missing retry fixture 
    plan14_input_inventory_test.go:389: internal/activator/rolelaunch_linux.go:RoleLaunch.prepareRoleReservation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/historyreadback/readback.go:RequestStatus: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/claimjournal_migration.go:migrateClaimJournals: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/claimstate_linux.go:prepareClaimDatabaseOwner: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/movesfloor.go:rootJudgeMovesPrev: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofnamed.go:proofBindingSource.capturedVersion: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofnamed.go:proofBindingSource.installedConsoleVersion: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofobserve.go:recordSettled: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootgeneration_kernel_linux.go:generationMajor: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootgeneration_kernel_linux.go:generationMinor: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor.go:rootMovesFloors.reconstruct: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizeReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizedReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_source.go:readRootLegacyFloorJSON: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootrestart.go:rootRestartRoute: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/hold.go:ChangeHold: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/migration_census_other.go:CheckMigrationRoots: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/stopinventory_db.go:OpenStopInventoryDB: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostclaim/relocation.go:StartRelocation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostfloor/participation.go:CheckParticipation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostguard/root.go:Guard.CommitRootInventory: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostrelocate/participant.go:Participant.Sweep: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostrelocate/worker.go:Worker.Start: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:PublishHeld: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:ServeHeldStageRequests: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:StageHeld: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/roothistory_delivery.go:PublishHistoryReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/roothistory_delivery.go:PublishHistoryRecoveryRetirement: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/rootparticipation/ledger.go:Ledger.EndUpdate: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:393: authority coverage: 16403 reachable declarations; 569 failures
2026/10/15 17:20:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/15 17:20:20 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io status-named false -> true
2026/10/15 17:20:20 provision: converged acme.go.tito.io status-named true -> false
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/15 17:20:20 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 17:20:20 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 17:20:20 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:20 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/15 17:20:20 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/15 17:20:20 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/15 17:20:20 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/15 17:20:20 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io seed
2026/10/15 17:20:20 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged owned.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged owned.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: removed retired static route site.go.tito.io (record gone)
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/15 17:20:21 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/15 17:20:21 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 17:20:21 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 17:20:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:21 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 17:20:21 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/15 17:20:21 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 17:20:21 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:20:21 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 17:20:21 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/15 17:20:21 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/15 17:20:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:21 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/15 17:20:21 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/15 17:20:21 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 17:20:21 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/15 17:20:21 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/15 17:20:21 provision: a.shop.example.com: swapped for import sd_d2wzkehe47enqzudxyzyucxo5y (the original route is journaled)
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d2wzkehe47enqzudxyzyucxo5y committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:21 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu rolled back to its original route
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu is cleaned up and its journal row retired
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy rolled back to its original route
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy is cleaned up and its journal row retired
2026/10/15 17:20:21 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_2gxktx6c5wi2vbcmtpa2trdt3y
2026/10/15 17:20:21 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/15 17:20:21 provision: dry-run: would converge a.shop.example.com seed source
2026/10/15 17:20:21 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_a3v5jojikmbzifnbiepgbz3odi cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_2phcbumgyvcabmazn3xxirgi2q cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_r76hef4zddpxf5ypsrksotfpdm is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_npmjstmtsvuq7tayg5iyi5cqca is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_5nbvox734efznvpgrjj5kxhdse is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/15 17:20:21 provision: b.shop.example.com: import sd_4yxba4attk23dr7xqpcphhqrsy left alone this pass: the import journal could not be read
2026/10/15 17:20:21 provision: c.shop.example.com: import sd_urxrgjl5g5zjbciyj7jswgpcku left alone this pass: the import journal could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wdqfrjqvucozepsqq6fjzqxxfy committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_vcpendyj3ekep56jtxec5vh4oq: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_rg72nydybcygurlgpoypdhbu44: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_u7xpyp5pkzdyjq6o6vp4b6dj4e: it is placed but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_ouy2w7jbtgmihg5timb4q3m3uy: it is placed but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_sa752qpqq5owo45g674adi6sna committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_vkvigu6e7mq3rykhk2zlurhvcy: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_vkvigu6e7mq3rykhk2zlurhvcy rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: removed instance route acme.go.tito.io (its seed sd_bjqcxdaqqhhbnv4otbiblwh4pi was aborted); the next pass rolls it back
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_bjqcxdaqqhhbnv4otbiblwh4pi: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_bjqcxdaqqhhbnv4otbiblwh4pi rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_qjwlviwh525pcdkydg55quxqt4 has a row this pass may not remove; leaving the seed aborted
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_4xsvjf3yuyh3tg4kpq2jmqdljy rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: removed instance route acme.go.tito.io (its seed sd_3dbnnzwe7lae756gulxw6ac5l4 was aborted); the next pass rolls it back
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_3dbnnzwe7lae756gulxw6ac5l4 has no route on this box: its local data is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_3dbnnzwe7lae756gulxw6ac5l4 rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_wfh7xhlee53abvazskpdeaemam (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wfh7xhlee53abvazskpdeaemam rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wfh7xhlee53abvazskpdeaemam is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_n7mmjgo243vkjj3jj2awcs4mfq (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_n7mmjgo243vkjj3jj2awcs4mfq rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_n7mmjgo243vkjj3jj2awcs4mfq is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_hd4n6ydnqxunukkfakbffw6pk4 (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4 rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4: the host's replica is left alone: its record no longer names this seed
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4 is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_je3awsfss5ytj7mkxv7b63ri4a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_ol3zvsl5q65jukufosdwnftrhm (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_ol3zvsl5q65jukufosdwnftrhm rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_pqaaxjler7x67psvvztvhi3q7m (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_pqaaxjler7x67psvvztvhi3q7m is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_54bkeyqslifsfhyng3etbgwfkq (the original route is journaled)
2026/10/15 17:20:22 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_54bkeyqslifsfhyng3etbgwfkq left alone this pass: its record could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_axqidivqga6h67lik2ykuroxyq (the original route is journaled)
2026/10/15 17:20:22 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_axqidivqga6h67lik2ykuroxyq left alone this pass: its record could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_mlxti7anaix3fanzko6ckjkgsu (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu: close the import gate: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_blu3umnpfhzmjuq3oesbqyoe7u (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u: close the import gate: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_px36e3jjyclpc6hbuyee54bnhi (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_zabycs3s52lsvbb472jqimik5a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zabycs3s52lsvbb472jqimik5a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zabycs3s52lsvbb472jqimik5a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_spz67n2dsfngzt73boypxbln4i (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i: retire its instance key: injected failure at retire-key
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_mif225md4hwlka4xb2cwechh7y (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mif225md4hwlka4xb2cwechh7y rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mif225md4hwlka4xb2cwechh7y is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_zlggih4vs2micrnebd3ba4vdfy (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy: remove its local data: injected failure at remove-local
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_uqbmmpjd5vpu7lqmo75zyam3ba (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_uqbmmpjd5vpu7lqmo75zyam3ba rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_uqbmmpjd5vpu7lqmo75zyam3ba is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_xwd4grm4abmhrqslbe3iaovl4e (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e: remove its local data: injected failure at remove-local-done
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_hn622yzfvykfasfauvvlbjh26a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hn622yzfvykfasfauvvlbjh26a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hn622yzfvykfasfauvvlbjh26a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_abolhlwcckmviqvgpesxwpgoza (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza: restore the original route: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_qp4cm5pfbhdypz2oiailhq6gee (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee: restore the original route: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_nwbr3uobwguwauedw2z7canjkm (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_nwbr3uobwguwauedw2z7canjkm is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_l6nv5kamjoyetm7cybbthitnme (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme: delete its snapshot: injected failure at delete-snapshot
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_qis57l6zkwsec6ljd4rudg4e6u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qis57l6zkwsec6ljd4rudg4e6u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qis57l6zkwsec6ljd4rudg4e6u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_mm75yvl3evpliyx2h4icvi4azq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq: delete the host's replica: injected failure at delete-replica
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_q6y466hywb5mofqcrzexf5cygm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_q6y466hywb5mofqcrzexf5cygm rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_q6y466hywb5mofqcrzexf5cygm is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_4nq767p3mfei2r3co2d7dztfqq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq: retire its journal row: constraint failed: injected (1811)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_hi67xntrhx22a36qonirz5e7ny (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny: retire its journal row: constraint failed: injected (1811)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_hq4icf4a5t47wkiaks67hci7oy (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hq4icf4a5t47wkiaks67hci7oy rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hq4icf4a5t47wkiaks67hci7oy is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: mark import sd_hq4icf4a5t47wkiaks67hci7oy rolled back: injected failure at cas
2026/10/15 17:20:23 provision: a.shop.example.com: aborted seed sd_hq4icf4a5t47wkiaks67hci7oy rolled back (no box had swapped it)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_d5r7awuhoetfrzjivy7u6gcngq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_d5r7awuhoetfrzjivy7u6gcngq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_d5r7awuhoetfrzjivy7u6gcngq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: aborted seed sd_d5r7awuhoetfrzjivy7u6gcngq rolled back (no box had swapped it)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ue3w5lbawwqkditgy62eo4xmwq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_a7nibfiezkee55aukmespb5jya (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_a7nibfiezkee55aukmespb5jya rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_a7nibfiezkee55aukmespb5jya is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_po4jqkdombb5fbaos6y73edqsu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_po4jqkdombb5fbaos6y73edqsu rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_po4jqkdombb5fbaos6y73edqsu is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_xhtcookwntbrdc5ikswwae4wca (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xhtcookwntbrdc5ikswwae4wca rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xhtcookwntbrdc5ikswwae4wca is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_62rtxgbrjzb3cvmny47l3jjhia (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_62rtxgbrjzb3cvmny47l3jjhia rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_62rtxgbrjzb3cvmny47l3jjhia is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_2othqgjkpltv74tvvn4zvqbzxe (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2othqgjkpltv74tvvn4zvqbzxe rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2othqgjkpltv74tvvn4zvqbzxe is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_eeacva6dx3o5rjduh4dq5eogzq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_eeacva6dx3o5rjduh4dq5eogzq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_eeacva6dx3o5rjduh4dq5eogzq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_tyjigtzdws4j5sktwmailgxqzm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_tyjigtzdws4j5sktwmailgxqzm rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_tyjigtzdws4j5sktwmailgxqzm is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_wsggm2f2e2dlwys535ie7ssb7y (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_wsggm2f2e2dlwys535ie7ssb7y has no route on this box: its local data is removed and no route is put back
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_wsggm2f2e2dlwys535ie7ssb7y is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_uhtulanwpkzgqyqa22aficciqa (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_bgnun5ym4p6mcikvass6yql6rm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_zywyzgflrv7njvkwpmtppxld5m (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_zywyzgflrv7njvkwpmtppxld5m cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ycs6kpfdx6szl7pywbbp4soevu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ycs6kpfdx6szl7pywbbp4soevu is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/15 17:20:23 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/15 17:20:23 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_45e3z2d664sinr5yugtt3eaga4 (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_fjqxap4omkgwgy4qak2ka2z5ka (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_3shooktns2d3pkjxz3gipscm24 (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_gvc3gbuhpcuvwvdipih64uq3ou (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_axk4q3l2jcrjzemnfmwbkkxwmm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_axk4q3l2jcrjzemnfmwbkkxwmm rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_3k5d56v45ek2i4rkswulgez6ia (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3k5d56v45ek2i4rkswulgez6ia has no route on this box: its local data is removed and no route is put back
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3k5d56v45ek2i4rkswulgez6ia is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_w5g23uu63lktzavlbo5xwlct6a (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w5g23uu63lktzavlbo5xwlct6a: remove its local data: injected failure at remove-local
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w5g23uu63lktzavlbo5xwlct6a is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_zgehnrm2smexleyofjnyaiw5ka (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_zgehnrm2smexleyofjnyaiw5ka: a route appeared at the host, so its local database is left and the rollback waits
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_dzka4ny2nzwratkv56lricpbly (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_dzka4ny2nzwratkv56lricpbly rollback deferred: no fence generation: registry busy
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_75ji44by2mjqtchetrrat4ucpu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_75ji44by2mjqtchetrrat4ucpu rollback deferred: no fence generation: the generation source answered 0
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_4nxy2ztuplb5cvnzmuzawfzrvq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_pnwibyfdysfyztaxwrt43gfqli (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ewipbp3bsalsnyqjglagyh5ebu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/15 17:20:23 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_saqxdfv3ythlc36blevtk3442u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_saqxdfv3ythlc36blevtk3442u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_saqxdfv3ythlc36blevtk3442u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_xdt4egyjllb3ngbksmscwkt34i (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xdt4egyjllb3ngbksmscwkt34i rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xdt4egyjllb3ngbksmscwkt34i is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ug6qw3rzerlgzhhuwjqdsjl4xu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ug6qw3rzerlgzhhuwjqdsjl4xu rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ug6qw3rzerlgzhhuwjqdsjl4xu is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ituvurf4snggz4hqycabdouv7u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u: retire its instance key: the env file is a symlink
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_pad7sartgyfsp2g7evdft2vfei (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_cnr2smscciopxvebizini7xnfy (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_vxuyrx4s2wati55jmxmqast2zi refused: there is no route at a.shop.example.com to replace
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3fc4sxgivjx7e5gysyvsyj5fhe refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mzmzjmer45nt7qd45i5nsqllqy refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2eowv2744rtam7m5himgpzbgwe refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_aezbjo7dz2o2iicimu6mz2pwim refused: the route belongs to app other
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_oqtmrenk36xkn54dazu5ciadpu refused: the route is filed under another account
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2erslwxozyejkmtforecnzrgja refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ad2i4swjk3pgndrk4tosxmvmne refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w3nr7guwlogp4yho6yhb2yhjhi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_vb7fzrzx322l2vxtk62xdohpqe refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_dyt3egs5ezmffdh7kii2pikiua refused: the route is not an address route this import can take over (socket)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_z7u53loy77ucfwxyzibmraytcu refused: the route is not an address route this import can take over (no address)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_fuy555rx22qriomlwgurtuvs5m refused: the route is not an address route this import can take over (provisioned)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xy4s5llzeutes7sv4aqmojyysi refused: the route is not an address route this import can take over (kind static)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_oabqrub3ydeghmlsbxiivo2im4 refused: the route is not an address route this import can take over (backing)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qrzp3jpscmah74twmcor47gixm refused: the route is not an address route this import can take over (tunnel)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_bkejstskl6toxz2rpvqt7csqqi refused: the route is not an address route this import can take over (caps)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_vowdmmnd5pm2s25fmlrzfti2km refused: the route is not an address route this import can take over (platform)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_ftij6w5wkoqvcip7hfiteqdjpu refused: the route is not an address route this import can take over (canary)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_n5u2wshreydxzn2ognz2oiewwm refused: the route is not an address route this import can take over (kind sidecar)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_cbqnzso3ejgvkjfargdjo2ru7u refused: the route is not an address route this import can take over (region)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_fixgrrx5jol4juudhcujbuuarq refused: the route is not an address route this import can take over (fleet_box)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_zlq4wdjvyigyqxxw6taml2b7oy refused: the route is not an address route this import can take over (hibernate)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_inmyyklz4ogct2imdy7b47pbc4 refused: the route is not an address route this import can take over (claim_owner)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_nzifpmywvvy5ibqhmbjw3t7mme refused: this box does not run instances nested
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_a2b3w5sfojvfftojw6jlo4i2pa refused: this box does not run instances nested
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_n6ahhi2ofy6uif4tdn4pzmih7u refused: claim control is on for this box
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_xsonccdr7gp43jyfvzeqzr5nya (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_nsyfvfidzsy7gkg3u43fdmm64q (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_3gsgza5nbppfo57yg5nrojpo3u: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_3bmxmkgm7kl7brnt2xnihbthl4: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_fmczlqsgrcffhab5zwtmzgg54m: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/15 17:20:24 provision: A.shop.example.com/..: not swapping for import sd_e4lcasvxchk57jnh7r6vuna3vm: its host or seed id is malformed (seeds: not a host)
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_yioae2ltbsylg5gql4x2gudtle: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_tsuxur6ukyp2damfnjhqmwz3oa: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_rsjnbwsigfmkwzijhse7mdylom: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_4mytsxlol37igxyyxh2z7wixum: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_5x6szaz3o6fcoc2rmzug4y62tu (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_dya56b6xovoybavacc3mn5bmkq (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_e2g3sxotvf7wrmtxuxfbm7jwku (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/15 17:20:24 provision: dry-run: would consider swapping a.shop.example.com for import sd_22lue6qofeofetyni3npccbopm
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e rolled back to its original route
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e is cleaned up and its journal row retired
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_hizshfznj6mi6b7kdpqew67uwa left alone: the import journal holds seed sd_ylwdybfriuqcvuhnoq2bsdhmju at swapped
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_q4236ly2psukiwxedqj746xjlu: it is swapped but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_bigf2fd575uebqkl5eo54pwsmy: it is placed but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_o53pchuwoxu3g3d5t2dr5irgha (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_o53pchuwoxu3g3d5t2dr5irgha: it is swapped but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_o53pchuwoxu3g3d5t2dr5irgha: it is placed but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:24 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/15 17:20:24 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/15 17:20:24 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 17:20:24 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/15 17:20:24 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/15 17:20:24 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/15 17:20:24 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	29.511s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.349s
ok  	github.com/carlosframework/platform/internal/relay	7.237s
ok  	github.com/carlosframework/platform/internal/release	21.455s
ok  	github.com/carlosframework/platform/internal/rollout	3.689s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.005s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.578s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.462s
ok  	github.com/carlosframework/platform/internal/seeds	0.010s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.259s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.519s
ok  	github.com/carlosframework/platform/internal/status	0.039s
ok  	github.com/carlosframework/platform/internal/steering	0.009s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.265s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.554s
FAIL
make: *** [Makefile:18: test] Error 1

amadan: step gate failed: exit status 2
  2. cross not run

    No output.

  3. minio-contract not run

    No output.

Whole run log 
amadan: log truncated — showing the last 495954 bytes of 552593
y.go:generationReconciler.reconcile	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.startRecorded	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.start	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.mintAndLog	E1	linux:internal/host/proofroot.go:proofRoot.around	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournalDir	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.RecordCreation	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/movesland.go	landingRun.checking	C	linux:internal/host/movesland.go:landingRun.step	Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historySync	E1	linux:history_cli.go:historySave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.activationRule	F	linux:internal/host/systemapply.go:systemApplier.activationAllowed	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=preliminary activation refuses against both local protocol bounds before existing hold checks
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAgent	B+C+D+F	linux:internal/host/agent.go:RunAgent	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.Select	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	withMovesFields	F	linux:internal/host/edgesfile.go:edgesFileLoop	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent uses root-owned public projection when participating and its original writable mirror otherwise
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	GenerationVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.census	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=writes through Ledger.MigrationCensus under transaction.lock and preserves revisions on completed replay
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	systemApplier.seedsActivationRefusal	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	PublishHeld	C+E1		root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.holdsLegacyRows	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/claim_identity.go	CheckRouteReleaseIdentity	C+E1	linux:internal/host/claimproduction.go:claimInputPolicy	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecord_claim.go	rootClaimRecord	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.installRemote	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Remote install snapshots old source inventory outside host lock and rechecks revision in hold-only path.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers.go	ClaimStopCoordinator.WritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopHTTP.serveWritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	LinuxStopKernel.VerifyNoProcess	C+G	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	newHeldReleaseRequestID	C+E1	linux:internal/host/movesheldrelease.go:heldReleaseVia.request	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.retained	E3	linux:internal/host/buildstate.go:buildStates.heldTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimassembly.go	ClaimAssembly.Build	C+G	linux:internal/host/claimassembly.go:productionClaimFactory	Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/renewing.go	RenewingLeases.Acquire	C	linux:internal/host/movespass.go:armPhase1	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	ColdRestore.Install	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	publishVersion	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	PinFailover	C	linux:internal/hostrelocate/worker.go:Worker.Step	Failover pinning requires recorded source fence and completed acknowledgement barrier.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.checkHistory	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimInputPolicy	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state.go	Sync	A+F+G	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.systemctl	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationhandover.go	relocationCompletedHandover.completedPrior	C	linux:internal/host/claimhandover_crossbox.go:wireCompletedHandover	Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.RegisterLanding	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.executeWithInventory	C	linux:internal/hostbox/journalservice.go:JournalService.ExecuteRootInventory	Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.floorAllowsForward	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free forward recovery checks both locally retained protocol release minima
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.pointerLoop	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Delegates each iteration to pass; retains ownership of the retry/restriction authority path despite no direct read.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	settingsApply	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloorgate_linux.go	readFloorGateFile	F	linux:internal/host/movesfloorgate_linux.go:floorAllowsPrev	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Prelaunch	C	linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Prelaunch	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	LaunchJournal.UnitReservation	C	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.Monitor	D	linux:internal/hostexec/rootbroker.go:RootBroker.Run	Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	restartVerifiedOrdinaryUnit	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-4;basis=Retain the checked ordinary-unit path for strict census-backed operation.
    plan14_input_inventory_test.go:382: J4	internal/console/boxselect.go	Server.selectMoveBoxes	F	linux:internal/console/apiinstancemove.go:Server.handleAPIInstanceMoveRequest	rev3=PROPOSED-p3;identity=carlos console serve, console.service uid carlos-console;basis=applies accepted/generation refusal only to advertised root-floor participants; legacy selection retains main exactly
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	digest	E1	linux:internal/historyreadback/readback.go:RequestKey	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.around	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Continue minting observations for unaffected routes even when adoption reports a route error.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetired	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	rootFloorLegacy	F	linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=selects existing moves mirror paths for denial-only generic legacy reader
    plan14_input_inventory_test.go:382: J4	internal/registry/importjournal.go	Registry.ImportJournalHosts	G	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	rev3=census-ruling-seeded-instances;basis=its SQLite arm as carlos, in the agent or the registry child (carlos __registry-child); its remote arm in whichever process holds a remote handle, and a root pass does. No caller in the tree yet, outside the child's dispatch: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.gate	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeld	E2	linux:internal/host/movesstage.go:var heldMaterialize	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	makeStartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	processGroup	B3+E1+E3	linux:internal/release/rollback.go:rollbackGroup	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.locked	C	linux:internal/hostguard/fence.go:Guard.CompleteFence	rev3=merge-ruling-4;basis=Only positively unsafe legacy locks durably quarantine; timeout and I/O errors return without changing root installation state.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_maintenance.go	type rootHistoryMaintenance	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	generationRetainedTimers	E2	linux:internal/host/rootgeneration_rows.go:generationRegistryInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	HistoryStatusKey	E1	linux:internal/release/roothistory_status.go:RootHistory.ProjectMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMajor	E2		E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchRecord	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/guardroster.go	readGuardRoster	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.recordLive	B3	linux:internal/host/proofroot.go:proofRoot.around	rev3=merge-ruling-5;basis=Exclude ordinary unstamped and derived routes before pre-pass binding and health observation.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	type HistoryRecovery	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	type generationLaunchPermit	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	var openClaimRootAuthority	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	decodeHeldReleaseRequest	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.ServeHTTP	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	RunSystemJournalMigrate	G	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	coldNamespaceEmpty	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.withRootInventoryHistory	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.record	F	linux:internal/host/rootmovesfloor.go:rootMovesFloors.localBound	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=bounded strict private JSON read requires matching deployment, box and enrollment
    plan14_input_inventory_test.go:382: J4	internal/release/ratchet.go	DigestRatchet.marked	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeldUnderWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.tenant	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.readContainedJournal	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	recoverPending	D	linux:internal/hostexec/pending_linux.go:RecoverPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.verify	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.Start	C+D		Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	rootInventoryArtifacts	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	addRootHealthy	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorBootCandidate	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=selects signed prev under unknown history with no known refusal; always retains certified current executor even when bound exceeds every available build
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	scanClaims	E4	linux:internal/caps/converge.go:Ops.checkClaimsOnDisk	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageAuthority	C+E1	linux:internal/host/heldstage.go:heldStagePass	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	Registry.Upsert	E3	linux:cli.go:runAdd	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged, in the process that holds a remote handle, root passes included: main's body with its insert defaults moved to normalizeRoute and its bind list to routeArgs, and two columns added (seed_source, import_gate); the conflict clause, with the tenant-change rule E3 names, is unchanged; main's E3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	heldShape	C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_authority.go	ClaimLaunchRoot.authorize	D	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	publishRootHistoryReadback	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	environmentNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	recordSettled	B3		root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.refusal	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.gate	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/remote.go	CheckRemote	F	linux:internal/hostexec/controller.go:Config.checkRemoteUpdateIdentity	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartProgress	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.stop	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	productionProofBindingSource	B3	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Root-owned current and previous pointers replace health history as executable authority; cache only record discovery.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfiles.go	relocationPreparedManifest	C	linux:internal/host/movesfiles.go:movesFiles.preparedBinding	Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use.
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	proofBindingSource.needsRestart	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.resolve	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.collectCapturedStop	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.execute	C+D	linux:internal/hostbox/journalservice.go:JournalService.Execute	Delegates journal transaction with original request hashing; root-generated inventory substitution uses the separate internal entry point.
    plan14_input_inventory_test.go:382: J4	internal/activator/workerbuild.go	Service.startWorker	E2	linux:internal/activator/activator.go:Service.doWake	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	installFloorHook	D	linux:internal/host/systemapply.go:RunSystemApply	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/bootstrap.go	bootstrapWith	A+C+G	linux:internal/host/bootstrap.go:RunBootstrap	root-input;kept=A,C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.PrepareState	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationinventory.go	OpenGenerationLaunchReader	E2	linux:internal/host/rootgeneration_inventory.go:openGenerationLaunchInventory	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_proof.go	legacyJournalProof	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	generationHash	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.writeCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.CommitRootInventoryArtifacts	G	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.query	E4	linux:internal/caps/converge.go:Ops.applyUnitState	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemparticipation.go	systemApplier.clearUpdateBegun	D	linux:internal/host/systemparticipation.go:systemApplier.settleUpdateBegun	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-recover.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	writeColdJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	rootRestartKey	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_containment.go	validateClaimJournalContainment	C+G	linux:internal/host/claimjournal_transport.go:ClaimRootHTTP.serveJournal	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	recoveryResultKey	E1	linux:internal/host/rootrollback.go:settleRollbackAttempt	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.retry	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Bound transport retries by original monotonic slack and context; never extend a permit.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-restart.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/bake.go	LoadFirstSeen	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	capabilityPass	E4	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.read	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.start	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.Before	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	routeByHost	E1+E3	linux:internal/host/restartscope.go:restartScopeLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.readRecord	E1	linux:internal/release/roothistory.go:RootHistory.read	Root reconstruction reads exact durable records and preserves pending restrictions during signed replacement. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	const rootGenerationCompletenessLimit	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-stage.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	loadRestartMarks	E1+E3	linux:internal/host/restart.go:restartPass	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.freshObserved	C	linux:internal/hostguard/guard.go:Guard.fresh	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemunits.go	ensureSystemUnits	F	linux:internal/host/agent.go:runAdopt	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationattempts.go	relocationAttemptReader.ReadAttempt	C	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authoritativeAttempt	Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Observe	C+G	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.skipGet	E1+E3	linux:internal/host/agent.go:convergeLegFor	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence_linux.go	lockConsumedPublish	E3	linux:internal/release/consumedfence.go:publishConsumed	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	agentCheckedUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly.go	ClaimRoleAssembly.PreflightLaunch	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalPrepare	C	linux:internal/hostbox/journalservice.go:journalCall	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/release/updatetarget.go	Target	E3	linux:internal/release/adopt.go:settingsTarget	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	HistoryReconstructionKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Request	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/hold.go	ChangeHold	C		root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	VerifyHeldLiveUnder	C+E1	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Under-lock held verification enforces claim-aware shape and delegates root proof validation.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type rootRestartRecord	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	copyLegacyJournal	C	linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	productionRetireGenerations	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	generationDigest	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.read	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	localDir.read	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.guardTransaction	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.record	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	Record key selection uses indexed discovery; local root-managed unit authority is unchanged.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetirementDigest	E1	linux:internal/release/roothistory_retirement.go:RootHistory.recoveryRetired	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartBinding	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/probe_unix.go	probeExisting	D	linux:internal/hostexec/probe_unix.go:probeLifetime	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	readRootHealthy	B+B4	linux:internal/release/healthy.go:ReadHealthy	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatusWithSources	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.inventory	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.localBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	refreshRootMovesFloor	F	linux:internal/host/systemapply.go:systemApplier.armFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal adopt/update combines remote object with independent deny-only legacy evidence under root floor lock
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootSeedsFloorDir	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed seeds namespace separate from moves retained floor
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop.go	ClaimStopCoordinator.witnessNoProcess	C+G	linux:internal/host/claimstop.go:ClaimStopCoordinator.FenceAndStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.write	A+F+G	linux:internal/rootstate/state_linux.go:directory.Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper
    plan14_input_inventory_test.go:382: J4	internal/release/proof.go	FileSHA256	B3	linux:internal/host/proofask.go:mintAsker.stagedSHA	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validStatus	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	type ClaimLaunchRoot	E1+E2	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	SettingsRefs	E2	linux:internal/release/pins.go:BoxPins	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	migrationStopKernel.RecoverStopped	G	linux:internal/host/claimstop_recovery.go:ClaimStopCoordinator.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream
    plan14_input_inventory_test.go:382: J4	internal/host/movesfinal.go	sourceFinal.parkLocal	C	linux:internal/host/movesfinal.go:sourceFinal.run	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.recoverIfNeeded	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.mint	B3+E1	linux:internal/host/proofroot.go:proofRoot.mintAndLog	E1 production uses canonical observed programs and complete root refusal inventory; legacy diagnostics do not grant root mint authority.
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	OpenFailureBook	E1+E3	linux:internal/host/updatesroot.go:updatesPassOption	fix1-merge-review;basis=Loads schema-three durable generations and refuses unsafe identity recovery on entropy failure.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.heldGenerationPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationRetirementRecords	E2	linux:internal/host/rootgeneration_parked.go:generationReadRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_other.go	migrateRootClaimAuthority	G	darwin:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=non-Linux offline journal-migrate CLI;basis=unsupported-platform stub returns ErrUnsupported without reading or granting migration authority
    plan14_input_inventory_test.go:382: J4	internal/instancectl/peer_tuple_linux.go	procStart	C+G	linux:internal/instancectl/peer_tuple_linux.go:AuthenticatePeerTuple	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.installedConsoleVersion	B3		fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerationpins.go	productionRootGenerationPins	E2	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationNames	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.completedHold	C	linux:internal/hostbox/reconcile.go:Reconciler.checkOn	Completed relocation catch-up can hold only its recorded old source row and creates no installation authority.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgeMovesPrevWithSource	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizeReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	openGenerationLaunchInventory	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	capabilityPlan	E4	linux:internal/release/adopt.go:adoptHost	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	RelocationSource.Open	C+D	linux:internal/host/claimrelocation.go:openClaimRelocationOwners	Relocation owner wiring binds verified actor, C8 provider and identity-checked requests; admission remains typed.
    plan14_input_inventory_test.go:382: J4	internal/host/adoptlock.go	lockExclusive	C+E1	linux:internal/host/adoptlock.go:lockAdoptPass	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLocalFloor	F	linux:internal/host/movesfloor.go:withMovesFields	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadExactStopInventory	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.seedUnit	E2	linux:internal/activator/backend_exec.go:ExecBackend.Seed	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	readDropIn	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	restartScopePass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Hands historical signed retry entries to the common verifier; unknown selectors do not widen scope.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinstallation.go	rootInstallationHostApp	E2	linux:internal/host/claimstop_run.go:RunInstanceControl	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.registerRemote	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_completed.go	ClaimAssembly.completedRelocationDischarge	C+D	linux:internal/host/claimparticipation.go:productionClaimLocal.cleanup	Completed-relocation discharge requires exact claim completion and verified retirement receipt; unread evidence refuses cleanup.
    plan14_input_inventory_test.go:382: J4	internal/provision/reconcile.go	RouteFor	C+E3	linux:internal/provision/reconcile.go:Reconcile	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos); also root, in the claim root's landing registration (ClaimRootHTTP.rootLandingRoute) and the relocation install (relocationRecord): main's body with one more field: the row's seed column, derived from the record's seed (SeedColumn). Every caller gets it, the two root ones included, so a root-registered row for a seeded record now carries the seed the activator places from; main's C,E3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryOutcomes	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationGroupGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeldVerifiedWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.stageRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.configured	C+E1	linux:internal/host/movesinstall.go:installGeneration	Configured landing now validates root-created registration before render and held publication; source recovery keeps existing typed rebind.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	historyReadbackPublisher.publish	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	cycleWorkers	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	FailureBook.markLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.MarkHoldRan	fix1-merge-review;basis=Advances durable app restriction generations so old grants cannot clear new failures.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Remove	A+B3	linux:internal/host/rootrollback.go:captureRollback	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	Policy.check	C	linux:internal/hostbox/wakepolicy.go:Policy.Check	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	ExecutingHash	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.read	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	D1/D2 decode the retained root participation record; missing or malformed state grants nothing.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_available.go	systemApplier.activationFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	ReadGenerations	E2	linux:internal/release/pins.go:GenerationPins	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	sameProofCandidate	B3	linux:internal/host/proofbinding.go:proofBindingSource.resolve	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	quiesceLegacyClaimJournals	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	type migrationStopKernel	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority
    plan14_input_inventory_test.go:382: J4	history_cli.go	historyCommandWithSave	E1	linux:history_cli.go:historyCommand	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	passConfig.recheckHistory	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.VerifyFile	F	linux:internal/hostfloor/image_linux.go:Disk.Exec	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	readRollbackAttempt	B3	linux:internal/host/rootrollback.go:rootRestartChecks.finish	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closed	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	systemApplier.armSeedsFloor	F	linux:internal/host/systemapply.go:systemApplier.armFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.write	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	MaterializeHeldUnder	C+E1+E2	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationReadRetirements	E2	linux:internal/host/rootgeneration_parked.go:productionGenerationRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgePrevWithSource	F	linux:internal/host/movesfloor.go:rootJudgePrev	rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_stale.go	participationCleanupRead.Read	D	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.Run	D+F	linux:internal/host/systemapply.go:RunSystemApply	root-input;kept=D,F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.holdOnly	C	linux:internal/hostbox/reconcile.go:Reconciler.installWithWork	Hold-only write rechecks claim, record and source inventory under local lock without root RPC there.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	withRootFloorGuardCandidate	F	linux:internal/host/guardexec.go:RunSystemGuardExec	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=release then previous-binary exclusion; participation check precedes moves and seeds locks; certified current remains executor fallback
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.collectRetirementStop	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	StagedPaths.addReal	E2	linux:internal/release/pins.go:BoxPins	root-input
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/workflow.go	Operation.Read	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrelocationrelease.go	RelocationReleaseReceipts.Complete	C+G	linux:internal/host/relocationreleases.go:verifyDischargedReceipt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstate_linux.go	claimPrivatePathOwner	C+G	linux:internal/host/claimstate_linux.go:prepareClaimStateDirectory	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.CaptureArtifact	C	linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/shared_linux.go	EnsurePublicDir	A+B4	linux:internal/host/rootrestart.go:productionRootRestartChecks	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	RootHistory.ReceiveRecoveryRetirements	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.FreshInstallation	E1	linux:internal/host/rootgeneration_requirements.go:productionGenerationCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	emptyContainmentAt	C+G	linux:internal/host/claimstop_writers_linux.go:noProcessGroups	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofask.go	mintAsker.stagedSHA	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	acceptRootSeedsPublication	F	linux:internal/host/rootseedsfloor.go:refreshRootSeedsFloor	rev3=PROPOSED-p3;identity=normal carlos adopt and system apply remote floor refresh, uid 0;basis=under stable floor lock, retains only verified nonregressing signed seeds publication; no publisher or activation switch added
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	writeHeldStageRequest	C+E1	linux:internal/host/movesstage.go:heldReleaseReady	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	RouteAccount	B3+E3+E4	linux:cli.go:runRoute	root-route;kept=B3,E3,E4;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_linux.go	productionGenerationKernelCensus	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	generationRetirements	E2	linux:internal/host/rootgeneration_parked.go:generationPhysicalPayloads	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootProtocolProjection	F	linux:internal/host/rootmovesfloor_source.go:readRootFloorProjection	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.replayed	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.checkLocal	C+G	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckLocal	Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.Census	D	linux:internal/rootparticipation/production.go:ActivationReady	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.retryHost	E1+E3	linux:internal/host/rolloutdeclined.go:rolloutRetryHost	fix1-merge-review;basis=Refuses retry while a failure-book save is owed; verifies the signed current book/epoch grant before clearing.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.layoutReversalReasons	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	recoveryControllerAt	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.invalidateCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_production.go	claimLaunchFor	D	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	Production root runtime receives the unit-aware kernel wrapper before startup recovery.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.Reconstruct	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostops/production_delete.go	ProductionAuthority.StartDeleteClaim	C	linux:internal/hostops/operations.go:Controller.BeginRetire	Production delete obtains verified completed-box fence before permitting claim transition across completion barrier.
    plan14_input_inventory_test.go:382: J4	internal/host/retention.go	buildStatePins	E2	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.armFloor	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	ReadConsumed	E3	linux:internal/host/updatesreport.go:updatesReader	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/refusal.go	ReadRefusal	E1+E3	linux:internal/host/buildstate.go:buildStates.heldWakeInput	root-input
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	restartRouteRows	E1+E3	linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Write	A+F+G	linux:internal/hostexec/rootbroker.go:RootBroker.deny	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=delegates to shared validated durable-write implementation; production syscall behavior unchanged
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_observations.go	claimUnitStopKernel.VerifyWritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopCoordinator.WritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	restartEffectFailed	B3	linux:internal/host/rootrestart.go:restartBoundUnit	E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchhosts.go	LaunchJournal.HostLaunches	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	captureRollback	B3+E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_production.go	NewProductionClaimStopHandler	C+G	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	seedRestartMarks	E1+E3	linux:internal/host/restart.go:restartSeed	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.forHost	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	OpenTrustedFile	A+B3	linux:internal/host/rootgenerations_launch.go:productionRootGenerations	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	readRootExecution	D	linux:internal/host/rootexecution_read.go:rootExecutionRead	Descriptor-checked root opener shared by root Prepare/Check, initial launch authorization and final executable checks; no agent fallback.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.CommitRootInventory	E2		E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRetainedFiles	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.VerifyDigest	C+G	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authorize	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.CheckLegacyMigration	C	linux:internal/host/claimjournal_migration.go:checkClaimJournalMigration	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/participation.go	CheckParticipation	D		Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readBeneathLine	F	linux:internal/host/movesfloor.go:syncLocalFloor	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.Run	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartTarget	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.acceptHealthy	F	linux:internal/host/rootfloor_healthy.go:systemApplier.acceptRootFloorHealthy	rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.unitBinding	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Reads canonical deployment record, claim, unit file identities and systemd facts without assuming a running PID. Existing running/rollback binding uses the same verifier. Fixtures: TestPlan14SignedNamedRecoveryAuthority and TestPlan14ProofBindingProvenance.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_recovery_policy.go	RootHistory.RetireD1	E1	linux:internal/release/adopt.go:adoptHost	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_recovery_policy.go	RootHistory.recoveryDenials	E1	linux:internal/release/roothistory.go:RootHistory.Blocks	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	ActivationReady	D+G	linux:internal/host/claimstop_run.go:RunInstanceControl	Refuse claims activation without complete census and registered verifier; Part 3 G remains mandatory.
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	execBounceable	E1+E3	linux:internal/host/restart.go:bounceExecRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.UpdateID	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Recover	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	rootGenerationSource.reserve	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationReconciler.reconcile	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.refresh	F	linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal refresh ratchets accepted history; unknown history persists only observed denies and never advertises accepted
    plan14_input_inventory_test.go:382: J4	internal/host/moveswakesource.go	movesWakeSources.Open	B2+C	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	type stageCheck	E2	linux:internal/release/adopt.go:type passConfig	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_census.go	rootMigrationCollector.collect	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationStartup	F+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks root-owned migration records and typed journal revisions before issuing startup grants; absent census leaves main path intact
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.stillLive	B3	linux:internal/host/proofroot.go:proofRoot.mintAndLog	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.healthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.capLegacy	rev3=PROPOSED-p3;identity=root health acceptance, normal floor refresh and local seeds-bound readers, uid 0;basis=reads bounded private root health record; missing or malformed record supplies no legacy cap
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	StartRelocation	C		Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrelocation.go	openClaimRelocationOwners	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Relocation owner constructor receives existing serving sources and verified identity inside feature gate.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	BoxPins	E2	linux:internal/release/adopt.go:PassFilter	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	boundRootHistory	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.mutate	C	linux:internal/hostbox/rolelaunch.go:LaunchJournal.CloseWriters	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	agentRollbackUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	CapabilityRoute	E4	linux:internal/host/adopt_advice.go:adviseHostRoleGateMissing	root-route;kept=E4;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_other.go	EnsurePublicDir	A+B4	darwin:internal/host/rootrestart.go:productionRootRestartChecks	fix1;basis=Non-Linux shared-directory setup fails closed.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	Adoptable	C+E3	linux:internal/host/proofask.go:mintAsker.tick	root-route;kept=C,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.StartTime	B3	linux:internal/host/proofobserve.go:proofObserver.observe	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimProbeSocketReady	B3	linux:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecoveryjournal.go	claimRecoveryJournal.successor	C+G	linux:internal/host/claimrecoveryjournal.go:claimCrossBoxHandover.completeRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	retireEndedHeldRefusals	C+E1	linux:internal/host/heldstage.go:heldStagePass	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	ClaimAssembly.relocationReleaseHold	C+D	linux:internal/host/relocatepass.go:newCompletionRuntime	Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RestartTarget.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAdoptWithEnsureSystemUnits	B3+C+D+E1+E2+E3+E4+F	linux:internal/host/agent.go:runAdopt	E1 selects the checked private history, canonical named-unit provider and root mint inventory under release exclusion with claims off or on; reconstruction and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.plan	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.absent	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Retire	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Prelaunch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/generationinventory.go	RootAuthority.generationInstallation	E2	linux:internal/hostguard/generationinventory.go:RootAuthority.GenerationInstallations	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	withRootSeedsFields	F	linux:internal/host/seedsfloor.go:withSeedsFields	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=advertises only checked synced root seeds projection matching deployment and box; no valid projection stays quarantined
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation.go	productionClaimLocal.prepareLegacyWith	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.prepareWith	Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.wakeTarget	E3	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	verifyHeldLive	B2+C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	LaunchJournal.HasHost	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/healthy.go	ReadHealthy	B+B4	linux:internal/host/proofbinding.go:productionProofBindingSource	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.run	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=offline guarded migration reobserves changed claims, retains union of session tuples, publishes only durable completion and verifies completed replay without rewriting census
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	type HistoryRecoveryRetirement	E1	linux:history_cli.go:historyCommandWithSave	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldBuild	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.report	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimServingLaunchSource	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	retirementEvidence	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	validRootRestart	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	generationKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.holdOf	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.heldBuild	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostguard/writerstop.go	operationWriter	C	linux:internal/hostguard/writerstop.go:LandingWriter	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	publishHeld	C+E1	linux:internal/release/materializeheld.go:materializeHeld	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/flock_unix.go	acquire	C	linux:internal/hostguard/guard.go:Guard.locked	rev3=merge-ruling-4;basis=Descriptor checks classify nonregular or foreign-owner locks as unsafe; honest contention waits with bounded exponential backoff.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Fail	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.Exe	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/hold.go	RegistryHoldPolicy	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	scanRebootCgroups	C+G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleaseReady	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/store.go	Read	C+D+G	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input;kept=C,D,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validHex	E1	linux:internal/historyreadback/workflow.go:Operation.checked	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorAllowsPrevIdentity	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=checks local signed prev and independent moves/seeds bounds using root census identity; no remote reads
    plan14_input_inventory_test.go:382: J4	internal/hostguard/writerstop.go	RecoveryWriterStop	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.beginExecutionRecoveryFence	root-input
    plan14_input_inventory_test.go:382: J4	internal/registry/remote.go	serveRemote	E2	linux:internal/registry/remote.go:ServeRemote	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/release/programhistory.go	ReadPrograms	E1+E3	linux:internal/release/adopt.go:adoptHost	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_replace.go	replacementReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationLinkRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationState	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=binds complete root census and durable complete migration record to deployment box enrollment and migration generation
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStateRegions	E3	linux:internal/host/buildstate.go:newBuildStates	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	openDir	D	linux:internal/hostexec/local_unix.go:openLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.writeUsing	C	linux:internal/hostguard/record_unix.go:recordDir.write	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_payload_linux.go	generationPayloadFiles	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	RunSystemApply	D+F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root system apply takes D3 release exclusion only for census participation before normal apply
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction_linux.go	readClaimEvidenceKey	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.activationGuard	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=release exclusion precedes local participation check and moves/seeds locks; final candidate checks preserve repair when every available build is below bound
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationVerifyLocal	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Complete	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventoryscope.go	ReconcileAdapter.retirementRoute	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationStart	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.controllerGone	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.write	E2	linux:internal/release/rootgenerations.go:RootGenerations.Retire	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_authority.go	ClaimRootHTTP.executionAuthority	D	linux:internal/host/rootexecution_migration.go:ClaimRootHTTP.executionAuthorityWithMigration	Fresh claim, deployment binding and root installation authorize participation, including the retained source only.
    plan14_input_inventory_test.go:382: J4	internal/host/guardarm.go	RunSystemGuardArm	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	RootHistory.ReceiveReconstruction	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	logRestartRequestError	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationIDRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartPass	E1+E3	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldHost	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipHost	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.authority	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	rootRestartChecks.allowLegacy	B3+G	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Evaluate the explicit census selector; omitted test selector remains strict.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	passConfig.generationWriteCheck	E2	linux:internal/release/adopt.go:PassFilter	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigrationSnapshot.fingerprint	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=binds exclusion and membership across observations/restart while allowing boot metadata and independently recovered payload revision
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.selector	F	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	controllerProcessStart	D	linux:internal/hostexec/rootprocess_linux.go:ControllerAlive	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootrebind.go	Guard.RebindRootInventory	E2	linux:internal/host/rootrecovery_rebind.go:ClaimRootHTTP.rebindRecoveryInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	relocationAfterAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	Ledger.UpdateRequired	D	linux:internal/rootparticipation/production.go:OpenForUpdate	Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-instance-control.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/registry/remote_dispatch.go	Registry.dispatchRemote	E2	linux:internal/registry/remote.go:serveRemote	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.ProjectMigrationStatus	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	layoutReversalIncomplete	F	linux:internal/host/systemapply.go:systemApplier.layoutReversalReasons	route-and-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartRoute	B3		kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	relocationRecord	C+E3	linux:internal/host/relocatepass.go:relocationRelocatable	Canonical relocation record and update policy derive nested installation shape; source account/incarnation is rechecked by root registration.
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	readProvingKey	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.selectRoute	E1	linux:internal/release/adopt.go:PassFilter	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionState	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.reconstructionReady	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.originalRefusal	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_collect_linux.go	recoverMigrationStop	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	productionProofObserver	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Reuse per-pass record discovery; continue independent observation and root health writes.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	syncFile	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Names	A	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	rootRestartRequests.consume	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.installAuthority	C+G	linux:internal/host/movesinstall.go:installRun.local_	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	RelocationRuntime.finishCompletion	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Completion dispatch requires authoritative completed operation and current executor before discharge.
    plan14_input_inventory_test.go:382: J4	internal/host/guardexec.go	RunSystemGuardExec	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover root units uid 0; edge unit uid carlos; console unit uid carlos-console;basis=root apply/recover selects signed image from local bound; non-root edge bypasses private floor entirely
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.verifyDestination	C	linux:internal/hostbox/typedpark_linux.go:TypedParker.Park	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	Disk.Run	F	linux:internal/host/guardtransaction.go:systemApplier.guardRun	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationreleases.go	ReleaseObligation.Complete	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Release obligation completion reads fresh claim before verifying and recording root stop receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.launch	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	writeGeneration	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	restartOrdinaryUnit	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-4;basis=No-census derived-unit try-restart is unconditional and nonfatal, matching main for absent rows and systemd lookup failures.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	type historyRollbackLink	E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInventoryDigest	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorAdvertisementFor	F	linux:internal/host/rootmovesfloor_refresh.go:withRootMovesFields	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	openDirectory	C	linux:internal/hostguard/flock_unix.go:acquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.trustedBytes	B3	linux:internal/host/proofnamed.go:proofBindingSource.record	fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	VerifyHeldLive	C+E1	linux:internal/host/movesstage.go:heldReleasePublished	Held verification wrapper retains selected held lock and delegates root proof validation of live bytes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstate_linux.go	prepareClaimDatabaseOwner	C+G		root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	retryRequests	E1+E3	linux:internal/host/restartscope.go:applyRetries	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	openParent	C	linux:internal/hostbox/typedpark_linux.go:TypedParker.Park	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.recoverRootInventory	C+E1	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.serveRecoveryRebind	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	recheck	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootRestartRequestSource.creation	E1	linux:internal/host/roothistory_creation.go:rootHistoryCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	type GenerationEvidence	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/movesstage.go	heldReleaseProbeRelease	C+E1	linux:internal/host/moveswakesource.go:movesWakeSources.Open	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Started	E2	linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.started	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartChecks.runningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Without a census return no running build, so main's cur stays the rollback target and no record is resolved; census-backed retention unchanged.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_run.go	instanceRegistryHostApp	C+G	linux:internal/host/claimstop_run.go:RunInstanceControl	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence.go	publishGate	E3	linux:internal/release/consumedfence.go:publishConsumed	root-route;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalpath.go	checkJournalPath	C	linux:internal/hostbox/launchjournal.go:OpenLaunchJournal	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	runAdoptUnderRootRelease	B3+E1+E2	linux:internal/host/agent.go:runAdoptWithEnsureSystemUnits	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus. E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	rootRestartChecks.noteLegacy	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	rev3=merge-ruling-4;basis=Log the no-census legacy restart once through the pass-shared diagnostic latch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers.go	ClaimAssembly.WritersStopped	C+G	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	FindRecordByHost	B3+C	linux:internal/host/rootrecord_claim.go:rootClaimRecord	Discovery delegates to the collision-checking index and still reads the selected record afresh.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.started	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.readCensus	D	linux:internal/rootparticipation/ledger.go:Ledger.Census	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historySave	E1	linux:history_cli.go:historyCommand	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimInitialSourceRecovery	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.stopCapturedSession	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	ClaimRootHTTP.verifyInventoryTimers	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/pending_linux.go	tryExistingPendingLock	D	linux:internal/hostexec/pending_linux.go:recoverPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.persist	F	linux:internal/host/rootmovesfloor.go:rootMovesFloors.refresh	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	ClaimWakeAssembly.Build	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/recoveryfence.go	Guard.PendingFences	C	linux:internal/host/claimstop_recovery.go:ClaimStopHTTP.RecoverPending	Root-only read lock avoids an agent-held legacy lock at startup.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.Begin	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	recordRootProgram	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	repairSibling	E2	linux:internal/release/adopt.go:stageFrom	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	ServeHeldStageRequestsWithPins	E2	linux:internal/host/heldstage.go:heldStagePass	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloorgate.go	floorGateMain	F	linux:internal/host/movesfloorgate.go:RunSystemFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=dispatches explicit root previous gate; legacy argument shape preserved
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	type proofRoot	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.carryRequest	E3	linux:internal/host/buildstate.go:moveCarry	Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_expected.go	StopInventoryDB.SnapshotRequest	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning.
    plan14_input_inventory_test.go:382: J4	history_cli.go	historyReadFile	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	const RootGenerationsDir	E2	linux:internal/host/rootgenerations_launch.go:productionRootGenerations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	migrationExecutionEmpty	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.SessionLaunches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	materializeHeld	C+E1+E2	linux:internal/release/materializeheld.go:MaterializeHeldUnderWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	judgePrevWith	F	linux:internal/host/systemapply.go:systemApplier.notePrev	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live.go	HoldLive	A+D	linux:internal/hostexec/rootbroker.go:RootBroker.write	fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	rootRestartChecks.settleHistory	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootbake.go	RootHistory.LoadBake	E1	linux:internal/release/adopt.go:PassFilter	E1 strict root bake and app completeness revisions; backward clocks refuse and visible records are durably recommitted.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/completion.go	ReadReconstruction	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/bootstrap.go	const tmpfilesConf	A+C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=A,C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootclient.go	requestIdentity	D	linux:internal/hostexec/rootclient.go:RootClient.close	D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently.
    plan14_input_inventory_test.go:382: J4	internal/release/updatetarget.go	NextConsumed	E3	linux:internal/release/adopt.go:settingsTarget	Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy.
    plan14_input_inventory_test.go:382: J4	internal/activator/activator.go	Service.respawnWorkerLocked	E2	linux:internal/activator/activator.go:Service.convergeWorkerLocked	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	publish	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Read	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/provision/reconcile.go	mintHeld	C	linux:internal/provision/reconcile.go:Reconcile	Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	type passConfig	E2	linux:internal/release/adopt.go:BakeDir	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_evidence.go	readMigrationStop	G	linux:internal/host/rootmigration_collect_linux.go:recoverMigrationStop	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	openRootProtocolFloors	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=checked root ancestry and leaf ownership for separate moves or seeds public/private stores
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.beforeExec	E3	linux:internal/host/buildstate.go:buildStateHook	Consumed request is tenant-bound before execution; unread registry refuses before state merge.
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	stagedManifestOfLiveVersion	E4	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	loadPinned	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedpark_linux.go	TypedParker.VerifyEmptyDirectory	C	linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.openRecord	C	linux:internal/hostguard/record_unix.go:recordDir.read	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	upstream	B3	linux:internal/release/rollback.go:processGroup	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.hold	B3	linux:internal/release/proofgate.go:ProofGate.admit	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/link_linux.go	directory.readLink	A+E1	linux:internal/rootstate/link_linux.go:ReadTrustedLink	Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.capturedVersion	B3		fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	ResponseKey	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	type generationRetirement	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_transport.go	ClaimRootHTTP.serveJournal	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	JournalRelease	C	linux:internal/hostrelocate/participant.go:Participant.Step	Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartGenPass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	fastConvergeLoop	B3	linux:internal/host/agent.go:runAgent	rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadStopInventory	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.Begin	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/recoveryfence.go	Guard.recordNames	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.prepareRollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	trusted deployment record and root unit binding; durable per-attempt rollback and recovery
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	relocationInstallAuthority	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation.
    plan14_input_inventory_test.go:382: J4	internal/host/movesinstall.go	installRun.local_	C+G	linux:internal/host/movesinstall.go:installGeneration	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.WithParticipation	D	linux:internal/hostfloor/disk.go:Disk.Begin	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	checkLegacySchema	C	linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	heldReleaseVia.publish	C+E1	linux:internal/host/movesstage.go:heldReleasePublished	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.checkHeldInventory	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckHeld	Held-inventory validator requires exact box/enrollment, ownership and single materialized route.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	checkedUnitRestart	B3+E1	linux:internal/host/rootrestart.go:rootRestartRouteWith	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.EndUpdate	D		Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	PublishHistoryRecoveryRetirement	E1		Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RestartBinding.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.read	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RestartIntent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	openRootMovesFloors	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed moves namespace then delegates checked root store opening
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootLegacyProtocolJSON	F	linux:internal/host/rootmovesfloor_source.go:rootProtocolLegacy	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	withSeedsFields	F	linux:internal/host/edgesfile.go:edgesFileLoop	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	GenerationProcess.valid	E2	linux:internal/release/rootgenerations.go:validGeneration	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	Guard.fenceLocked	C+G	linux:internal/hostguard/recoveryfence.go:Guard.ResumeFence	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.Route	C+G	linux:internal/host/moveswakesource.go:movesReadRoute	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.decidePrev	F	linux:internal/host/systemapply.go:systemApplier.install	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.JournalTail	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	activationReader.Read	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.target	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	type rootRestartRequestSource	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.recoveryEvidence	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationUnescape	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.localStopIdentity	C+G	linux:internal/host/claimparticipation.go:productionClaimLocal.bind	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-update.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalPrune	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_install.go	landingRegistrationMatches	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	migrateRootClaimAuthority	G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=under offline exclusion dispatches signed import or fresh root-journal collection before publishing retained completion; legacy importer remains signature-gated
    plan14_input_inventory_test.go:382: J4	internal/host/claimcleanup_identity.go	verifyClaimCleanupEnrollment	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.deny	D	linux:internal/hostexec/rootbroker.go:RootBroker.Close	D2 compares the current root token before durable loss and live-lock revocation; cleanup is bounded independently of request cancellation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMinor	E2		E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	writeGroupRefusals	E1	linux:internal/release/adopt.go:adoptHost	E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.RetireRecovery	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_linux.go	openAuthorityFile	E2	linux:internal/rootstate/authorityfile_linux.go:OpenAuthorityFile	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	Server.handleAPIRestartScope	E1+E3	linux:internal/console/authcli.go:Server.registerCLIRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.guardRun	F	linux:internal/host/systemapply.go:systemApplier.onDiskBuild	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	sweepStagedVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersionsPass	root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	verifyStopKernelMounts	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	dispatchBoundedWakes	E1+E3	linux:internal/host/restart.go:cycleWorkers	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/agent.go	makeRestartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveparks.go	refusingClaimMoveWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/heldwake.go	DecideHeldWake	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.checkStateDirShape	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/systemparticipation.go	systemApplier.beginExecutableChange	D	linux:internal/host/systemapply.go:systemApplier.install	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocating.go	ConvertCommittedLanding	C	linux:internal/hostrelocate/worker.go:Worker.ConvertLanding	Committed landing conversion verifies exact target termination fence and record commit before transferring installation authority.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.EndUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.EndParticipation	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.pass	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pointerLoop	fix1-merge-review;basis=Saves the failure book before processing pointer retries; preserves signed retry and restriction checks.
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	var randRead	E1+E3	linux:internal/rollout/failures.go:newBookID	fix1-merge-review;basis=Names the cryptographic entropy source for failure-book identity; remains retry replay authority.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/regionalworker.go	RegionalWorker.Census	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	syncDir	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.liveFile	A+D	linux:internal/rootstate/live_linux.go:directory.HoldLive	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/host/edgesfile.go	edgesFileWriteClaims	F	linux:internal/host/edgesfile.go:edgesFileLoop	root-route;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/record_unix.go	recordDir.write	C	linux:internal/hostguard/root.go:Guard.AbandonRootInventory	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	Guard.AbandonRootInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	type RootGenerationPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/migration_census_other.go	CheckMigrationRoots	G		rev3=PROPOSED-p3;identity=non-Linux unsupported stub; no production caller on this checkpoint;basis=returns ErrUnsupported without scanning or granting migration authority
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckLocal	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Create	C	linux:internal/hostbox/launchjournal.go:LaunchJournal.Prelaunch	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	GenerationPins	E2	linux:internal/release/adopt.go:PassFilter	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	relocationBefore	C	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	Before-admission dispatch binds relocation executor and probe phase before typed handover.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	stageFrom	E2	linux:internal/release/adopt.go:ensureStagedDigest	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorJudge.permits	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=root guard-exec apply/recover selection and carlos.prev floor-allows-prev, uid 0;basis=signed current, retained prev and fixed staged candidate determine whether a below-bound candidate must be refused; no available qualifying build preserves recovery
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.resumeReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Observe	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retireAll	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_parked.go	productionGenerationRetirements	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/claimcleanup_identity.go	claimCleanupEnrollment.configureSigner	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	bounceScopedRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.recheck	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.launchDigest	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	Open	A	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootLegacyFloorJSON	F		rev3=PROPOSED-p3;identity=test-only compatibility wrapper; production uses readRootLegacyProtocolJSON from adopt/apply uid 0;basis=selects moves JSON for bounded denial-only reader; no recovery or boot call
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	RootAuthority.write	C+G	linux:internal/hostguard/record_unix.go:recordDir.write	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record
    plan14_input_inventory_test.go:382: J4	internal/hostexec/clock_linux.go	BootID	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	stageHeld	C+E1+E2	linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation_probestop.go	RecordProbeStop	C	linux:internal/hostrelocate/participant.go:Participant.Step	Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.mintRefusals	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	passConfig.recordRefusal	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	readRootFloorBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartChecks.live	B3+E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerationpins.go	generationPinSource.StagedPins	E2	linux:internal/release/adopt.go:PassFilter	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimbackfill.go	newClaimBackfill	C+G	linux:internal/host/agent.go:instancesLoop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/roleintention_linux.go	LaunchJournal.ResolveRoleIntentions	C	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.resolveRoleIntentions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_linux.go	readHeldRenderHash	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorBinary.supports	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	readRootSeedsBinary	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=carlos adopt seeds judgement and root system apply/recover candidate checks, uid 0;basis=delegates checked signed executable read then selects seeds protocol
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakestop.go	ClaimAssembly.stopRetryAttempt	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.bindClaimWakeStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	NewJournalService	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_readback.go	type historyReadbackPublisher	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.ensureUser	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootread.go	ReadRoot	D	linux:internal/host/rootexecution_read.go:readRootExecution	fix1;basis=Queries broker OFD lock ownership without acquiring a lock; rechecks unchanged durable evidence and monotonic expiry.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.read	E1	linux:internal/release/roothistory.go:RootHistory.RecordInstalledProgram	Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/typedretire.go	writeJournal	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_payload_other.go	generationPayloadFiles	E2	darwin:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/retirement.go	Guard.WithNoInstallation	C	linux:internal/host/claimproduction.go:claimAdminTokens.With	Use the already-held root host lock for empty-installation authority checks.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	journalIdentity	C	linux:internal/hostbox/generationinventory.go:LaunchJournal.GenerationLaunches	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigration.write	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootFloorBinary.forSeeds	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=projects signed SeedsProtocol (zero when absent); comparisons are gated by verified signed publication and available certified builds
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	productionClaimRegional.Authorize	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	BuildStateCopy.Read	E3	linux:internal/release/heldwake.go:DecideHeldWake	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.ConvertLanding	C	linux:internal/host/relocatepass.go:convertFencedLanding	Landing conversion requires verified local worker and termination-fence authority before claim conversion.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.CompleteAttempt	B3+E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	ReadStatus	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	readEffectiveSeedsFloor	F	linux:internal/host/rootseedsfloor.go:systemApplier.seedsActivationRefusal	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census selects verified signed publication plus capped retained deny; unpublished seeds impose no bound; no census retains legacy reader
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	Open	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_other.go	claimProbeSocketReady	B3	darwin:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.beginGuard	D	linux:internal/host/systemapply.go:systemApplier.Run	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	systemApplier.checkGuardRecovery	D	linux:internal/host/systemapply.go:systemApplier.Run	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_state_linux.go	ClaimRoleAssembly.prepareStateInventory	C	linux:internal/host/rootinventory_state_linux.go:ClaimRoleAssembly.prepareStateRemote	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLine	F	linux:internal/host/movesfloor.go:withMovesFields	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease.go	heldReleaseVia.claim	C+E1	linux:internal/host/movesheldrelease.go:heldReleaseVia.request	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/caps.go	ValidCapabilities	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationreleases.go	ReleaseObligation.Queue	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Queues exact relocation release retirement obligation and preserves already discharged receipt replay.
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	routeArgs	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever a route is inserted: Upsert, the cold handover restore and the import journal's inserts: the bind list from Registry.Upsert's body (and RestoreClaimRows'), with seed_source and import_gate added; E3, the same family as Registry.Upsert, whose body it came from
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	restartIntentID	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.readLocked	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	Read-only access takes only the root host lock.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationReservation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.rollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	type GenerationCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationinventory.go	LaunchJournal.GenerationLaunches	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.controllerGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/registry/artifacthosts.go	Registry.ArtifactHosts	E2	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	migrateClaimJournalsWith	G	linux:internal/host/claimjournal_migration.go:RunSystemJournalMigrate	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	migrationAdmissionDenied	G	linux:internal/hostguard/root.go:Guard.CommitRootInventoryArtifacts	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	type rootFloorHealthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.healthy	rev3=PROPOSED-p3;identity=root system apply/adopt health or floor decision uid 0; recovery readers uid 0;basis=binds a root health observation to deployment, box, enrollment and signed binary identity
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	ClearStale	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/restartscope.go	RestartScope.Selects	E1+E3	linux:internal/host/restartscope.go:scopedHosts	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_other.go	productionGenerationAbsence	E2	darwin:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: non-Linux production generation retirement refuses. Darwin, Windows and Linux ARM64 compile gates; no non-Linux retirement authority.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Install	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Configure	Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths.
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimParentPID	B3	linux:internal/host/claimready_linux.go:claimProbePeer	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	ClaimWakeAssembly.readiness	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/proofroot.go	proofRoot.observeAndRecord	B3+E1	linux:internal/host/proofroot.go:proofRoot.mintAndLog	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	backfillManifestDigest	E2	linux:internal/release/adopt.go:adoptHost	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/healthy_root.go	rootHealthyStore	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	fix1;basis=Normalizes the no-account operator app to the existing ops namespace before opening the root-owned public history.
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	sweepStagedVersionsPass	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation.go	productionClaimLocal.Prepare	D	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventoryscope.go	ValidateAgentInventory	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.admit	B3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageRow	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile.go	Reconciler.installWithWork	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	Install dispatch preserves serving registration and distinguishes hold-only relocation from installation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	type rootRestartRequests	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.rebindRecoveryRows	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.installRecoveryInventory	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.idle	D	linux:internal/rootparticipation/ledger.go:Ledger.RecoverAcquisition	D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootRefreshAndJudgeMovesPrev	F	linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.retireIntended	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.publishRelease	C+E1+E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckRootRegisteredRow	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Crash census exception admits only the row named by root pending registration; all other census checks remain required.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Begin	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	RootGenerationPins.StagedPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.stageRelease	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootRestartRouteWith	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.MintHeldUnder	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/relocationrows.go	RelocationRow	C	linux:internal/hostbox/reconcile.go:Reconciler.rowDecision	Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself.
    plan14_input_inventory_test.go:382: J4	internal/hostops/completion_fence.go	ProductionAuthority.completionFence	C	linux:internal/hostops/production_held_start.go:ProductionAuthority.startAppLifecycle	Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	prepareStatus	E1	linux:internal/historyreadback/workflow.go:PrepareOperation	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationInventoryAt	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	descendSync	A	linux:internal/rootstate/state_linux.go:descend	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/containment.go	ExecBackend.spawnInCgroupAtTier	E2	linux:internal/activator/backend_exec.go:ExecBackend.seedChild	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.read	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	WithRootGenerationPins	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	movesDir.removedDuringOpen	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStageCheck	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	withPrevLock	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_install.go	rootLandingIdentity	C	linux:internal/host/rootinventory_install.go:ClaimRootHTTP.rootLandingRoute	Landing target identity binds executor, participants, enrollment and region before first root registration.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	CompleteRelocation	C	linux:internal/hostrelocate/worker.go:Worker.Step	Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.installation	E1	linux:internal/host/roothistory_creation.go:rootRestartRequestSource.creation	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.Activate	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	Pending intent and durable quarantine remain denial conditions.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeldVerified	C+E1+E2	linux:internal/host/movesstage.go:var heldStageVerified	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.complete	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.ReconstructionStatus	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatus	E1	linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	type generationMount	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	productionGenerationCreation	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	refusingRootWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartCandidates	E1+E3	linux:internal/host/restart.go:restartApps	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/relocationwake.go	RelocationWakeInputs.Select	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Relocation wake binds prepared generation, release receipt and install stamp before admission; launch payload selection remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	CheckPublicConfig	A+B3	linux:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Checks root:root ownership, exact 0644 mode and single-link regular-file identity on the already opened operator configuration descriptor.
    plan14_input_inventory_test.go:382: J4	internal/instancectl/peer_tuple_linux.go	AuthenticatePeerTuple	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.boot	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/console/browserrestart.go	Server.handleBrowserRestart	E1+E3	linux:internal/console/browserrestart.go:Server.handleAppRestart	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	serveHeldStageRequest	E2	linux:internal/release/materializeheld.go:ServeHeldStageRequestsWithPins	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback_resume.go	resumeRootRestart	B3+E1	linux:internal/host/rootrollback_resume.go:recoverRootRestarts	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	fenceTargetStuck	C	linux:internal/hostclaim/relocation.go:FenceExhaustedTarget	Exhausted-target transition verifies fence and revokes only dead target execution, preserving another live source.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	installationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:rootInstallationCoverage	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_linux.go	OpenProtected	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationflush.go	ReleasePositionsFile.Recorded	C	linux:internal/host/relocationeffects.go:RelocationEffects.flushStopped	Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_client.go	productionClaimLocal.prepareWith	D	linux:internal/host/claimparticipation.go:productionClaimLocal.Prepare	Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	rootRestartRequests.run	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	movesDir.names	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalnamespace_linux.go	prepareJournalDirectory	C+G	linux:internal/hostbox/journalnamespace_linux.go:PrepareRootJournalDirectory	rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains
    plan14_input_inventory_test.go:382: J4	internal/host/relocationeffects.go	RelocationEffects.EnsureLocal	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	resumeHistoryRestart	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	GenerationBinding.valid	E2	linux:internal/release/rootgenerations.go:RootGenerations.Read	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	scanStopDescriptors	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/versionsweep.go	settingsPins	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-route
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_other.go	Open	A	darwin:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.capLegacy	F	linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh and local seeds-bound readers in apply/recover/guard, uid 0;basis=caps service-written protocol and release minima by highest root-observed healthy build; absent observation supplies no bound
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.LiveHeld	A+D	linux:internal/rootstate/live.go:LiveHeld	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_other.go	productionGenerationKernelCensus	E2	darwin:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/release/versions.go	PointLive	B3+E2	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Compare resolved current and previous paths before retaining the running build; preserve repoint errors and canonical retained pointers.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.recovered	B3+E1	linux:internal/host/rootrestart.go:productionRootRestartChecks	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	productionRestartRequestPass	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	productionGenerationAbsence	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.Replay	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.verifyInventoryPath	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.install	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=root verifies staged signature and final locked bounds before rename, then records root accepted floor history only after health succeeds
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.retainRecoveryHistory	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.mintRefusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_healthy.go	systemApplier.acceptRootFloorHealthy	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=reads signed installed bytes after the system health gate; writes independent moves and published-seeds root observations
    plan14_input_inventory_test.go:382: J4	internal/host/caps_pass.go	stampDBPaths	E4	linux:internal/host/caps_pass.go:capabilityPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory_requirements.go	inventoryTimerNames	E2	linux:internal/host/rootgeneration_requirements.go:generationRequiredInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	StageHeld	C+E1		root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	withRootMovesFields	F	linux:internal/host/movesfloor.go:withMovesFields	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	judgeSeedsPrev	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) through notePrev, and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root) through rootJudgeSeedsPrev: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Verify	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	RootAuthority.Installation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	currentClaimEdgeMaskAt	C+G	linux:internal/host/claimjournal_migration_linux.go:claimEdgeMaskStillOwned	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	type historyRecoveryRecord	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/generationinventory.go	RootAuthority.GenerationInstallations	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery_pass.go	namedUnitRecovery.passOption	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Production recovery wrapper preserves main exit status for per-host failures; only remaining named routes can probe the census for history selection. Ordinary routes make no census or binding-store reads. Fixtures: TestPlan14ERecoveryOrdinaryPass, TestPlan14Fix4AdoptPerHostFailureExitsZero, TestPlan14Fix5MainEquivalence.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootSeedsAllowsBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=compares signed seeds protocol to published root bound only while a certified current, prev or staged candidate meets it; no remote reads
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.report	E1+E3	linux:internal/host/rollout.go:rolloutStatusProbe	fix1-merge-review;basis=Reports only durable published restriction epochs and the supported retry protocol; reports do not grant authority.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.Completeness	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationcompleteness.go	const generationCompletenessKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationReceipt	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Local-install receipt reader refuses malformed operation materialization; claim receipt digest is checked by its consumers.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live.go	LiveHeld	A+D	linux:internal/hostexec/rootread.go:ReadRoot	fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	stageGenerationSibling	E2	linux:internal/release/adopt.go:backfillManifestDigest	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostexec/controller.go	Controller.authority	D	linux:internal/hostexec/controller.go:Open	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	settingsTarget	E3	linux:internal/release/adopt.go:adoptHost	Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofRouteReady	B3	linux:internal/host/proofobserve.go:productionProofObserver	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:382: J4	internal/release/bake.go	LoadFirstSeenMigrating	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	claimUnitContent	E1	linux:internal/host/bootstrap.go:bootstrapWith	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	type generationKernel	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/activator/rolelaunch_linux.go	RoleLaunch.prepareRoleReservation	C		root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	productionClaimRoster.Actor	C+G	linux:internal/hostbox/identity.go:IdentityProvider.Verify	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionImages	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationpayload.go	LaunchJournal.GenerationPayloads	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	hostNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	recoveryHistoryOutcome	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.Step	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Participant re-reads claim and installation identity around effects; root stop receipts and fresh participation bound probes, with generic orchestration retained.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Scope	E1	linux:history_cli.go:historyCommandWithSave	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/console/seedfloor.go	Server.seedRegionReady	F	linux:internal/console/apiinstanceimport.go:Server.handleAPIImportStopped	rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	rootProtocolLegacy	F	linux:internal/host/rootmovesfloor_source.go:rootFloorLegacy	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded agent-writable JSON and line mirrors contribute only increasing denies; neither can establish accepted state
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop.go	ClaimStopCoordinator.FenceAndStop	C+G	linux:internal/host/claimstop_transport.go:ClaimStopHTTP.ServeHTTP	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMounts	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.Launch	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.Launch	C+G	linux:internal/host/moveswakesource.go:movesReadLaunch	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	claimSameWriter	C+G	linux:internal/host/claimretire_local.go:claimArtifactRetirement.Recover	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.cleanupExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveLaunchSource	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor_linux.go	openMovesDir	F	linux:internal/host/movesfloor.go:withFloorLock	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocatepass.go	RelocationRuntime.once	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.Run	Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	rootRestartChecks.copyRecoveryHistory	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	RootGenerations.Reservations	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	judgeRootSeedsPrev	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	agentUnitCgroup	C+G	linux:internal/host/claimstop_kernel_linux.go:newProductionStopKernel	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	StoreReader.Read	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	FenceSource	C	linux:internal/hostrelocate/worker.go:Worker.Step	Source-loss transition independently verifies termination fence and enrollment before revoking its participation.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	type namedUnitRecovery	E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	generationRequiredInventory	E2	linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.journalMigrationMarker	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_linux.go	Identity	A+B3	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery.go	namedUnitRecovery.repair	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.Sweep	C+D		Sweep reads fresh claim before retiring a participant; absence never manufactures a local discharge.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizedReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	claimAdminTokens.With	C+G	linux:internal/host/claimproduction.go:claimServingLaunchSource	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/seedsfloor.go	rootJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=census-ruling-seeded-instances;basis=the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root): seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.bind	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	restartScopeLeg	E1+E3	linux:internal/host/restart.go:restartPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/registry/registry.go	normalizeRoute	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever Upsert's SQLite arm and the import swap run: the insert defaults from Registry.Upsert's body; E3, the same family as Registry.Upsert, whose body they came from
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.verifyPointer	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopjournal_reader.go	LaunchJournal.ReadStopKernelJournal	C	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	adoptHost	B3+E1+E2+E3+E4	linux:internal/release/adopt.go:PassFilter	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	RootAuthority.viewLocked	C+G	linux:internal/hostguard/rootview.go:RootAuthority.Installation	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	Respond	E1	linux:internal/host/roothistory_readback.go:historyReadbackPublisher.publish	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.heldWakeInput	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	Held wake reads tenant-bound consumed decisions, refusal ledger and installed release; no downgrade to diagnostic.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_maintenance.go	rootHistoryMaintenance.run	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakeassembly.go	claimSocketReady	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	rootRecordRoute	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	trusted deployment record and root unit binding; durable per-attempt rollback and recovery
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	applyRetries	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Verifies the deployment-root signature and account/app/host/book/epoch before lifting a restriction.
    plan14_input_inventory_test.go:382: J4	internal/host/namedrecovery_active.go	namedUnitRecovery.recover	B3+E1	linux:internal/host/namedrecovery_pass.go:namedUnitRecovery.passOption	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/host/recoveryrefusals.go	checkUnresolvedRecoveries	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.heldRoute	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.ownedRow	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Extracted row writer retains complete typed inventory and immutable route identity around guarded write.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/link_linux.go	ReadTrustedLink	A+E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	PublishHistoryReconstruction	E1		Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	generationPayloadBindings	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/program.go	FileProgram	E1	linux:internal/release/adopt.go:adoptHost	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_production.go	WithProductionMovesHeldRelease	B2+C+E1+E2	linux:internal/host/claimstop_run.go:RunInstanceControl	Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdate	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:382: J4	internal/host/guardarm.go	guardArmIdle	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/guardtransaction.go	legacyGuardEntries	D	linux:internal/host/guardtransaction.go:installFloorHook	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	WakePhase	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	stopIdentity	C+G	linux:internal/host/claimstop_kernel_linux.go:scanStopCgroupsMode	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/caps/caps.go	Set.UnmarshalJSON	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemctlVerb	B3	linux:internal/host/unitsettle.go:systemdUnits.ResetFailed	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	rootRestartRecord.advance	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	armPhase1	B2+C	linux:internal/host/movespass.go:armMovesPass	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the S1 probe hook refusing a row whose import gate is set; main's B2,C authority retained
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_run.go	RunInstanceControl	C+D+G	linux:main.go:main	Refuse premature claim activation and continue serving recovery after per-host startup failures.
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecovery_remote.go	claimCrossBoxHandover.installRecoveryRemote	C	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacySettleOptions	B3	linux:internal/host/legacyrestart.go:legacyRollbackRestart	rev3=merge-ruling-4;basis=Legacy settle uses main readiness inputs and limits; these do not authorize root health history.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/generationpayload.go	type GenerationPayload	E2	linux:internal/host/rootgeneration_inventory.go:generationPayloadBindings	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_linux.go	OpenAuthorityFile	E2	linux:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/caps/converge.go	Ops.checkClaimsOnDisk	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closure	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/restore.go	readGeneration	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	type InstallationArtifacts	E2	linux:internal/hostguard/root.go:type RootInstallation	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationMaps	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	type RootInstallation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	backfillManifest	E2	linux:internal/release/adopt.go:backfillManifestDigest	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootHistoryInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readEffectiveMovesFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	syncSibling	E2	linux:internal/release/adopt.go:stageFrom	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofBindingSource.findRecord	B3	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Cache index success or failure once per pass; selected records and ETags remain freshly read.
    plan14_input_inventory_test.go:382: J4	internal/hostops/move_fence_release.go	MoveRecoveryGrant.ReleaseFencedTarget	C+D	linux:internal/console/movesrecovery.go:Server.movesRecovery	Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	randomMigrationID	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=cryptographic nonce identifies newly collected stop evidence, never authorizes a stop
    plan14_input_inventory_test.go:382: J4	internal/host/retention.go	retentionPass	E2	linux:internal/host/agent.go:retentionLoop	root-route
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/report.go	Disk.Running	F	linux:internal/console/hostreports.go:Server.localHostReport	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	JournalService.MigrateLegacy	C	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	type RootRestarts	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/instancectl/legacy_claim_cleanup.go	Server.clearLegacyClaimLaunch	C+G	linux:internal/instancectl/server.go:Server.handleStart	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	FailureBook.recordLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.reconcileLocked	fix1-merge-review;basis=Marks restriction state dirty and advances its generation before publication.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.beginExecutionRecoveryFence	D	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	OpenForUpdate	D	linux:internal/host/rootmovesfloor_source.go:rootMovesFloorIdentity	Unactivated absent census does not block update or recovery; retained census remains authoritative.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	Disk.Load	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	Guard.With	C	linux:internal/hostbox/work.go:selectedWork.With	Recheck remote root denial immediately before the protected effect.
    plan14_input_inventory_test.go:382: J4	internal/release/signedhead.go	StageSignedHead	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	type rootGenerationSource	E2	linux:internal/host/claimlaunch_root.go:type ClaimLaunchRoot	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationRetained	F+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	recoverLegacyClaimEdgeMask	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	readGenerationsSeq	E2	linux:internal/release/pins.go:ReadGenerations	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootview.go	FenceView.admit	G	linux:internal/hostguard/guard.go:Guard.With	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=read-only root view applies same predecessor-completion requirement as locked admission
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootserving.go	RootBroker.servingView	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootProtocolBound	F	linux:internal/host/rootmigration_startup.go:verifyRootMigrationFloors	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	UpdateIdle	F	linux:internal/host/claimreport.go:claimReport	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	treeStats	E2	linux:internal/release/sweep.go:SweepStaged	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration.go	migrateClaimJournals	G		rev3=PROPOSED-p3;identity=test-only wrapper; production offline uid 0 CLI calls migrateClaimJournalsWith with full=true;basis=retains legacy import/mask behavior for tests; no production caller
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	type rootSeedsPublication	F	linux:internal/host/rootseedsfloor_publication.go:verifyRootSeedsPublication	rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose
    plan14_input_inventory_test.go:382: J4	internal/host/claimowners.go	claimServingOwners.serving	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	bounceExecRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	proofObserver.recordSettled	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-5;basis=Ordinary unstamped and derived routes do not resolve deployment records for post-restart health observation.
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence.go	publishConsumed	E3	linux:internal/release/adopt.go:settingsTarget	root-route;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	armMovesPass	B+C	linux:internal/host/agent.go:runAgent	Agent moves construction passes registration client and existing guarded publication and park providers.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/production.go	Open	D	linux:internal/rootparticipation/production.go:ActivationReady	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.reconstruct	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires private root-issued box/generation/nonce token and refuses weakening; no production caller installed
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Sync	A+F+G	linux:internal/rootstate/state.go:Sync	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability
    plan14_input_inventory_test.go:382: J4	internal/hostbox/wakepolicy.go	relocationProbe	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	ServeHeldStageRequests	E2		E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.floorArmed	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.acquire	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Retry conditional writes and authority reads within original monotonic cutoff; reconcile uncertain writes by exact bytes.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_delivery.go	HistoryRecoveryRetirementKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/safefile/file_linux.go	writeAtSteps	A+F+G	linux:internal/safefile/file_linux.go:writeAt	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement
    plan14_input_inventory_test.go:382: J4	internal/host/claimcensus.go	claimUnitCensus	C+G	linux:internal/host/claimcensus.go:claimGlobalSharedPaths	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.Blocks	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	type HistoryMigrationStatus	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/worker.go	Worker.self	C+D	linux:internal/hostrelocate/worker.go:Worker.ConvertLanding	Worker identity requires current active directory enrollment, home-region match and termination-fence check.
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.bind	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	rootExecutionRead	D	linux:internal/host/rootexecution_read.go:productionClaimLocal.checkRootParticipation	Production root observer selects the descriptor-checked participation reader.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	type Receipt	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration_inventory.go	RootAuthority.MigrationInstallations	C+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0; also root claim startup uid 0;basis=read-only root installation enumeration includes incomplete records and never repairs before preflight
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	validHistoryRetirement	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	LaunchJournal.Read	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRootTask	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.afterRecovery	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	productionRootRestartChecks	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	var openRootMigrationParticipation	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=fixed production participation opener remains rootparticipation.OpenForUpdate; package tests substitute explicit no-census fixtures without accessing the machine store
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.installRecoveryInventory	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.MintHeld	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.MintHeldUnder	Local held-row mint requires matching nested installation ownership and operation; production remote path uses separate registration.
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	install	C	linux:internal/hostclaim/relocation.go:ToInstalling	Install transition allocates authoritative stamp and pinned release, records target before effects and removes prior local receipt.
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	IndexRecords	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Discover hosts once, reject duplicate keys, and classify partial discovery as retry rather than permission refusal.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	RequestKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	rootHistoryCreation	E1	linux:internal/host/roothistory.go:openRootHistory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Reserve	E2	linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	claimConstructionProcessStart	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	nextGenerationsSeq	E2	linux:internal/release/pins.go:WriteGenerations	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootroute.go	proofBindingSource.claimIdentity	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor.go	rootMovesFloors.projection	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum
    plan14_input_inventory_test.go:382: J4	internal/activator/workerswap.go	Service.ReplaceWorker	E2	linux:internal/rollout/worker.go:scheduler.executeWorker	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	restartValue	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.refresh	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	route-and-input
    plan14_input_inventory_test.go:382: J4	internal/release/buildstate.go	Consumed.ForeignTo	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	ForeignTo binds consumed decisions to account/app before root release history can be reused.
    plan14_input_inventory_test.go:382: J4	internal/release/rollback.go	rollbackGroup	B3+E1+E3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyRootRestart	B3+G	linux:internal/host/roothistory_creation.go:productionCreationHistory	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationPathRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartEligible	E1+E3	linux:internal/host/rollout.go:feedRestarts	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	readClaimUnitSettings	C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	LaunchJournal.HasInstallationEffects	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_production.go	WithProductionClaimLaunch	E1+E2	linux:internal/host/claimstop_run.go:RunInstanceControl	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/proofpolicy.go	LoadProofPolicy	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.rebindRecoveryInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Retain fresh claim and inventory checks and refuse a box listed Lost.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_runtime.go	var openClaimExecutionAuthority	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Instance-control owns broker, checked store, monitor and bounded cleanup lifetime.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	RootHistory.RecoveryRetired	E1	linux:internal/host/recoveryrefusals.go:checkUnresolvedRecoveries	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/roleintention_linux.go	resolveRoleIntention	C	linux:internal/hostbox/roleintention_linux.go:LaunchJournal.ResolveRoleIntentions	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.recoverSettlement	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	Recovery serializes settlement with in-flight requests and requires cleanup, exact conditional release and CC9. TestPlan14ExecutionRecoverySettlesWithoutControllerToken and TestPlan14ExecutionRecoveryJoinsRemoteWrite.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_relocation.go	productionClaimLocal.Acknowledged	D	linux:internal/host/relocatepass.go:NewRelocationRuntime	Relocation acknowledgement waits for bound controller readiness; participates in execution admission.
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_writers_linux.go	rootInstallationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:verifyNoProcessAt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	heldStageable	C+E1	linux:internal/release/materializeheld.go:materializeHeldChecked	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	historyRecoveryKey	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retireAll	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rootStartRoute	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Use main systemctl start for legacy non-NotUp recovery while retaining checked rollback when authority binds.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerationpins.go	generationFileIdentity	E2	linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	publishMigrationReceipt	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reconstructs immutable key/digest from original signed receipt bytes without changing evidence time
    plan14_input_inventory_test.go:382: J4	internal/host/claimwakewriters.go	claimWakeAttempt.StopWriters	C+G	linux:internal/host/claimstop_writers.go:ClaimAssembly.writersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	validHistoryRecovery	E1	linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_startup.go	verifyRootMigrationFloors	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks installed and guard signed binaries against both locally retained protocol bounds without remote access
    plan14_input_inventory_test.go:382: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Retire	C+E2	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/release/consumedfence_linux.go	lockConsumedCarry	E3	linux:internal/release/consumedfence.go:FenceCarry	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	PinAfterRelease	C	linux:internal/hostrelocate/worker.go:Worker.Step	Pin transition verifies source release authority and exact journal phase before removing execution authority.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	historyRestartAttempt	B3+E1	linux:internal/host/rootrestart.go:checkedUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/completion.go	ReadRetirement	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	claimUnitStopKernel.settleUnits	C+G	linux:internal/host/claimlaunch_root.go:claimUnitStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_linux.go	verifiedClaimExecutable	C+G	linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Launch	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	type rootHistoryAccess	E1	linux:internal/host/claimretire_transport.go:type ClaimRootHTTP	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/materializeheld.go	materializeHeldChecked	E2	linux:internal/release/materializeheld.go:serveHeldStageRequest	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	type generationReconciler	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/movespass.go	movesWorker.liftFences	C	linux:internal/host/movespass.go:movesPass	root-route;kept=C;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	routeReady	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart.go	rollbackUnitRestart	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-system-update.path	external	F	linux:internal/host/bootstrap.go:var unitsFS	root-input
    plan14_input_inventory_test.go:382: J4	internal/safefile/file_linux.go	writeAt	A+F+G	linux:internal/safefile/file_linux.go:Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	readProductionRosterRow	C+G	linux:internal/host/movessources.go:productionRosterRegion	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	type HistoryHostStatus	E1	linux:internal/release/roothistory_status.go:type HistoryMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	strictRoleLaunch	C	linux:internal/hostbox/rolelaunch.go:DecodeRoleLaunchRequest	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_recovery.go	linkRootHistory	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/work.go	Serving	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_runtime.go	newClaimExecutionRuntime	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.settleExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_inventory.go	type generationInventory	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.inventoryVersion	C	linux:internal/hostbox/inventory_expected.go:StopInventoryDB.Snapshot	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/rootbroker.go	RootBroker.Execute	D	linux:internal/host/rootexecution_transport.go:ClaimRootHTTP.serveExecution	Retry transient authority reads within existing admission slack; bounded replay and permanent mismatches remain enforced.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBinding.authorizedRecovery	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_transport.go	type ClaimRootHTTP	E1	linux:internal/host/claimstop_run.go:RunInstanceControl	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimjournal_migration_linux.go	var claimSystemctl	C+G	linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryRefusals	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.spawnInCgroupGated	E2	linux:internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/proofobserve.go	proofObserver.observe	B3	linux:internal/host/proofobserve.go:proofObserver.recordSettled	fix1;basis=Observes only the canonically bound unit, executable and readiness, including the installed console guard wrapper.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/file_other.go	CheckPublicConfig	A+B3	darwin:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Non-Linux descriptor checks fail closed.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationRead	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.boot	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:382: J4	internal/host/claimready_linux.go	claimProbePeer	B3	linux:internal/host/claimready_linux.go:claimProbeSocketReady	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootinventory.go	ClaimRootHTTP.commitRootInventoryPending	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.withRootInventoryHistory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/claimconstruction.go	OpenProductionClaimAssembly	G	linux:internal/host/claimconstruction.go:ensureProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	LivePins	B3+E2	linux:internal/host/versionsweep.go:sweepStagedVersions	Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping.
    plan14_input_inventory_test.go:382: J4	internal/console/apirestartscope.go	resolveRestartScope	E1+E3	linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/restart.go	restartApps	E1+E3	linux:internal/host/restart.go:restartPass	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/restartscope.go	scopedHosts	E1+E3	linux:internal/host/restartscope.go:bounceScopedRoutes	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/proofnamed.go	proofExecPath	B3	linux:internal/host/proofobserve.go:proofObserver.observe	fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/shared_linux.go	ensurePublicChild	A+B4	linux:internal/rootstate/shared_linux.go:EnsurePublicDir	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	readRootFloorProjection	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=selects moves public root projection for checked advertisement reader
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.notePrev	F	linux:internal/host/systemapply.go:systemApplier.decidePrev	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.restoreVersion	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census
    plan14_input_inventory_test.go:382: J4	internal/provision/rootrecord.go	RecordIndex.Find	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Use cached key identity but read and validate current record body and ETag.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.task	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	RootAuthority.RetainMigrationDeny	C+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority
    plan14_input_inventory_test.go:382: J4	internal/host/rootfloor_available.go	rootFloorAvailable	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_creation.go	RootHistory.ConsumeCreation	E1	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	ProductionClaimOwnerProvider.OpenClaimOwners	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Production owner factory wires bounded C8 and relocation providers and closes partial construction on error.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/launchjournal.go	OpenLaunchJournal	C	linux:internal/host/claimjournal_migration.go:var openClaimRootJournal	root-input
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	RequestStatus	E1		E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_identity.go	rememberRootFloorSystemIdentity	F	linux:internal/host/systemapply.go:systemApplier.verifyPointer	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=re-fetches and verifies signed pointer equality before retaining its executable identity
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_source.go	withEffectiveMovesFloorLock	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover final activation, uid 0;basis=locks moves then seeds private root stores across final activation; no census uses unchanged legacy lock
    plan14_input_inventory_test.go:382: J4	internal/release/ratchet.go	DigestRatchet.note	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/coldhandover.go	ColdHandover.Recover	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	A provably superseded cold admission can abandon its barrier without discarding its receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_kernel_linux.go	generationTaskFDs	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/migration.go	Ledger.MigrationCensus	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	buildStates.refreshAll	E3	linux:internal/host/agent.go:fastConvergeLoop	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_census_linux.go	generationKernel.census	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_stopped_linux.go	verifyMigrationStopped	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery
    plan14_input_inventory_test.go:382: J4	internal/host/proofask.go	mintAsker.tick	B3	linux:internal/host/agent.go:fastConvergeLoop	route-and-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	ReplaceTarget	C	linux:internal/hostrelocate/worker.go:Worker.replace	Replacement verifies target termination fence and allocates a new install stamp, preserving unopened prepared build reuse.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.refresh	F	linux:internal/host/rootmovesfloor_refresh.go:rootRefreshAndJudgeMovesPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.Finish	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/activator/containment.go	ExecBackend.startRole	E2	linux:internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Launch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor_publication.go	readRootSeedsBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh, system apply/recover and guard floor readers, uid 0;basis=unpublished seeds supplies no bound; verified retained publication and root-capped denies determine the bound
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	claimLaunchProcessIdentity	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/rolelaunch.go	LaunchJournal.UnitIntentions	C	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/proofgate.go	ProofGate.bindRecording	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/rollout/failures.go	newBookID	E1+E3	linux:internal/rollout/failures.go:OpenFailureBook	fix1-merge-review;basis=Uses the named entropy source and propagates failure; retains authority classification despite no scanner-recognized direct read.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/participation.go	checkLegacyParticipation	D	linux:internal/hostfloor/disk.go:Disk.Begin	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state.go	type Store	A+B3	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	rootJudgeMovesPrev	F		rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt-only wrapper delegates to root-aware moves judge; no direct input reads
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory.go	RootHistory.Refusals	E1	linux:internal/release/roothistory_app.go:RootHistory.MintRefusals	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_requirements.go	type generationRecord	E2	linux:internal/host/rootgeneration_inventory.go:type generationInventory	E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_boot.go	rootFloorPrevVerdict	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorBootCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches actual signed previous binary to identity and accepted generation before allowing its gate
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	keepsBuildState	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/systemapply.go	systemApplier.restoreFiles	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalmigration_linux.go	legacyJournalFiles	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:382: J4	internal/activator/rolelaunch_root_linux.go	RoleLaunch.startIsolated	C	linux:internal/activator/rolelaunch_linux.go:RoleLaunch.Start	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/buildstate.go	newBuildStates	E3	linux:internal/host/agent.go:runAgent	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	wireClaimAdmission	C+D	linux:internal/host/claimhandover_crossbox.go:wireProductionAdmission	Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind.
    plan14_input_inventory_test.go:382: J4	internal/hostguard/coldhandover.go	Guard.AbandonColdHandover	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt.
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-adopt.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.CaptureInventory	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.RegisterLanding	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_outcomes.go	RootHistory.RetainRecovery	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmovefence.go	claimBoxFenceVerifier	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.recoverAfterReboot	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	validGeneration	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration_production_linux.go	rootMigrationLegacySuspects	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_execpermit.go	ClaimLaunchRoot.execPermit	D	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks.
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	systemApplier.rootProtocolAllowsBinary	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory.go	openRootHistory	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/host/rootrestart_requests.go	restartRequestPass	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmigration.go	rootMigrationSnapshot.preflight	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationState	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refuses active moves, unfinished seeds, incomplete inventories or mismatched migration identity before effects
    plan14_input_inventory_test.go:382: J4	internal/host/unitsettle.go	systemdUnits.Show	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostexec/participation.go	PreinstallationParticipant	D	linux:internal/host/rootexecution_authority.go:ClaimRootHTTP.executionAuthority	D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_read.go	productionClaimLocal.checkRootParticipation	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.Check	Root observer binds participation to enrolled actor; TestPlan14ExecutionRootLocalIgnoresAgentAbsence.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	trusted	A	linux:internal/rootstate/file_linux.go:OpenTrustedFile	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/rootgeneration_rows.go	generationRegistryInventory	E2	linux:internal/host/rootgeneration_rows.go:productionGenerationRegistryInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorDowngradeIdle	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=under participation exclusion checks local root generation/installation/launch/retirement inventory and kernel census; no recovery store read
    plan14_input_inventory_test.go:382: J4	internal/hostops/backfill_seeds.go	CollectCensusSeeds	G	linux:internal/host/rootmigration_census.go:rootMigrationCollector.collect	rev3=census-ruling-seeded-instances;basis=no caller in the tree yet; G wires the census collector that will call it: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:382: J4	internal/host/claimmoveparks.go	openProductionClaimMoveWake	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_pass.go	RootHistoryPass.begin	E1	linux:internal/release/adopt.go:adoptHost	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_status.go	const RootHistoryStatusDir	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/historyreadback/readback.go	validScope	E1	linux:internal/historyreadback/readback.go:enrolled	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/work.go	WorkSource.Select	C	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/image_other.go	Disk.Exec	F	darwin:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/instancectl/server.go	runWithClaim	C+D+G	linux:internal/instancectl/claim.go:RunWithClaim	Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary.
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyRollbackRestart	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	rev3=merge-ruling-6;basis=Restore main reset-failed, restart and D1 settle even after an operator reset; retain main error wrapping and diagnostics.
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	WithRunningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=fix3-Astra-P2;basis=Root-only hook supplies verified current or previous running authority before replacing pointers.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction_linux.go	productionStopControllers.VerifiedController	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	localDir.write	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/heldstage.go	heldStagePass	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	const RootRestartsDir	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/release/sweep.go	SweepStaged	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_creation.go	productionCreationHistory	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type RootGenerations	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/movesheldrelease_root.go	type movesHeldReleaseRoot	E2	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_migration.go	ClaimRootHTTP.executionAuthorityWithMigration	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration.
    plan14_input_inventory_test.go:382: J4	internal/host/rootexecution_recovery.go	recoverRootExecution	D	linux:internal/host/guardtransaction.go:var recoverPendingControllers	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:382: J4	internal/host/claimparticipation_stale.go	productionClaimLocal.clearUntracked	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	Untracked participation cleanup now carries exact controller binding into retirement before stale-state clearing.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/park.go	Regional.observe	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.runHost	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostrelocate/participant.go	Participant.sameInstallation	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session.
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	pointerBoundUnit	B3	linux:internal/host/rootrestart.go:restartBoundUnit	rev3=merge-ruling-4;basis=Only PID-zero stopped or restarting states may bind without process identity; inactive units are never woken.
    plan14_input_inventory_test.go:382: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.sourceEvidence	C+G	linux:internal/host/claimhandover_crossbox.go:claimCrossBoxHandover.After	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/units/carlos-config-sync.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journaltrust_linux.go	checkTrustedJournalDir	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/begun.go	ReadBegun	F	linux:internal/host/guardtransaction.go:systemApplier.guardFinished	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/relocationowners.go	relocationBeforeAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/authorityfile_other.go	OpenAuthorityFile	E2	darwin:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/floor.go	Read	F	linux:internal/host/hostfencepass.go:hostFenceOnce	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	type GenerationProcess	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	const RootRestartAbsent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/host/claimproduction.go	declinedClaimGate	C+G	linux:internal/host/claimmoveaccess.go:claimMoveLaunchSource	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/rootseedsfloor.go	rootRefreshAndJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path
    plan14_input_inventory_test.go:382: J4	internal/hostguard/fence.go	StopAuthorityMatches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectCapturedStop	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/guard.go	record.admits	G	linux:internal/hostguard/guard.go:Guard.With	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt
    plan14_input_inventory_test.go:382: J4	internal/host/rootrollback.go	settleRollbackAttempt	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/disk.go	RemoveDurable	F	linux:internal/hostfloor/disk.go:Disk.Begin	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/stopinventory_db.go	OpenStopInventoryDB	C		root-input
    plan14_input_inventory_test.go:382: J4	internal/host/legacyrestart.go	legacyCheckedUnitRestart	B3	linux:internal/host/rootrestart.go:rootRestartRouteWith	rev3=merge-ruling-6;basis=Restore main stamped-unit restart and D1 settle, including diagnostics; only clock, readiness and health-hook adapters differ.
    plan14_input_inventory_test.go:382: J4	internal/host/roothistory_launch.go	ClaimLaunchRoot.rootInstalledProgram	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:382: J4	internal/activator/backend_exec.go	ExecBackend.startSidecarUnitFrom	E2	linux:internal/activator/genbackend.go:ExecBackend.StartSidecarGen	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:382: J4	internal/host/movesfloor.go	readLineFrom	F	linux:internal/host/movesfloor.go:readLine	root-input
    plan14_input_inventory_test.go:382: J4	internal/release/adopt.go	PassFilter	B3+E1+E2+E3	linux:internal/release/adopt.go:Pass	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:382: J4	internal/release/pins.go	BuildStateKept	E2	linux:internal/release/pins.go:SettingsRefs	root-route
    plan14_input_inventory_test.go:382: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.judge	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=PROPOSED-p3;identity=carlos adopt normal refresh and carlos system apply notePrev, uid 0;basis=observes participation before floor lock; writes identity-bound current/prev verdict even under unknown history without blocking repair executor
    plan14_input_inventory_test.go:382: J4	internal/caps/render.go	RenderService	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/journalservice.go	JournalService.Execute	C	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:382: J4	internal/host/proofbinding.go	proofBindingSource.binding	B3	linux:internal/host/proofbinding.go:proofBindingSource.forHost	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:382: J4	internal/host/guardexec.go	recoverLockHeld	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.member	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.PrepareState	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimexec.go	ClaimUnits.prepareExecGate	C+G	linux:internal/instancectl/claimunit.go:ClaimUnits.start	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimexec_socket_linux.go	claimListenExecSocket	C+G	linux:internal/instancectl/claimexec.go:ClaimUnits.prepareExecGate	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostfloor/controllers_linux.go	EnsureControllerDir	F	linux:internal/host/guardarm.go:guardArmControllers	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostclaim/relocation.go	requireReceiptOfInstallation	C	linux:internal/hostclaim/relocation.go:RecordLocalInstall	Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation.
    plan14_input_inventory_test.go:382: J4	internal/host/claim_evidence_producer.go	ConfigureStopEvidence	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/instancectl/claimlaunch_snapshot_linux.go	claimRootDir	C+G	linux:internal/instancectl/claimlaunch_snapshot.go:ClaimUnits.freezeLaunch	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchLocked	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/host/rolloutdeclined.go	failureHolds.applyPointers	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pass	root-route
    plan14_input_inventory_test.go:382: J4	internal/release/rootrestart_history.go	RootRestarts.write	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:382: J4	internal/rootstate/state_linux.go	directory.Read	A	linux:internal/rootparticipation/ledger.go:Ledger.Acquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckHeld	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Hold-only source checks its own row-owned installation inventory rather than the target holder stamp.
    plan14_input_inventory_test.go:382: J4	internal/rootparticipation/ledger.go	Ledger.Acquire	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion.
    plan14_input_inventory_test.go:382: J4	internal/release/rootgenerations.go	RootGenerations.Check	E2	linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.check	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/migration_census_linux.go	CheckMigrationRoots	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=offline scan requires every managed payload to match independent retained inode/type inventory or explicit shared path rules
    plan14_input_inventory_test.go:382: J4	internal/host/claimretire_transport.go	retirementAcknowledgement	C+G	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/host/claimrecoveryreceipt.go	claimCrossBoxHandover.recoveryStopReceipt	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.recoveryEvidence	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/hostexec/local_unix.go	tryAcquireNamed	D	linux:internal/hostexec/local_unix.go:tryAcquire	root-input
    plan14_input_inventory_test.go:382: J4	internal/hostguard/rootmigration.go	RootAuthority.CompleteMigrationInventory	C+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root completed fence receipt and retained session deny required before installing recovered inventory revision
    plan14_input_inventory_test.go:382: J4	internal/hostguard/root.go	RootAuthority.read	C+G	linux:internal/hostguard/root.go:Guard.Capture	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	historyRecoveryDigest	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/claimunit.go	var readClaimUnitFile	C+G	linux:internal/host/claimunit.go:readClaimUnitSettings	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:382: J4	internal/release/roothistory_retirement.go	historyRetirementKey	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:382: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.check	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/writer.go	Writer.Published	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:382: J4	internal/rootstate/live_linux.go	directory.HoldLive	A+D	linux:internal/rootstate/live.go:HoldLive	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:382: J4	internal/hostbox/retirement_timers.go	retirementWithTimers	C+E2	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:389: family E3 missing erasure fixture 
    plan14_input_inventory_test.go:389: family E3 missing hostile fixture 
    plan14_input_inventory_test.go:389: family E3 missing positive fixture 
    plan14_input_inventory_test.go:389: family E3 missing rename fixture 
    plan14_input_inventory_test.go:389: family E3 missing retry fixture 
    plan14_input_inventory_test.go:389: family E4 missing erasure fixture 
    plan14_input_inventory_test.go:389: family E4 missing hostile fixture 
    plan14_input_inventory_test.go:389: family E4 missing positive fixture 
    plan14_input_inventory_test.go:389: family E4 missing rename fixture 
    plan14_input_inventory_test.go:389: family E4 missing retry fixture 
    plan14_input_inventory_test.go:389: internal/activator/rolelaunch_linux.go:RoleLaunch.prepareRoleReservation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/historyreadback/readback.go:RequestStatus: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/claimjournal_migration.go:migrateClaimJournals: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/claimstate_linux.go:prepareClaimDatabaseOwner: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/movesfloor.go:rootJudgeMovesPrev: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofnamed.go:proofBindingSource.capturedVersion: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofnamed.go:proofBindingSource.installedConsoleVersion: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/proofobserve.go:recordSettled: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootgeneration_kernel_linux.go:generationMajor: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootgeneration_kernel_linux.go:generationMinor: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor.go:rootMovesFloors.reconstruct: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizeReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizedReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootmovesfloor_source.go:readRootLegacyFloorJSON: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/host/rootrestart.go:rootRestartRoute: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/hold.go:ChangeHold: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/migration_census_other.go:CheckMigrationRoots: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostbox/stopinventory_db.go:OpenStopInventoryDB: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostclaim/relocation.go:StartRelocation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostfloor/participation.go:CheckParticipation: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostguard/root.go:Guard.CommitRootInventory: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostrelocate/participant.go:Participant.Sweep: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/hostrelocate/worker.go:Worker.Start: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:PublishHeld: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:ServeHeldStageRequests: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/materializeheld.go:StageHeld: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/roothistory_delivery.go:PublishHistoryReconstruction: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/release/roothistory_delivery.go:PublishHistoryRecoveryRetirement: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:389: internal/rootparticipation/ledger.go:Ledger.EndUpdate: no production caller reachable from root entrypoint
    plan14_input_inventory_test.go:393: authority coverage: 16403 reachable declarations; 569 failures
2026/10/15 17:20:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/15 17:20:20 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged acme.go.tito.io status-named false -> true
2026/10/15 17:20:20 provision: converged acme.go.tito.io status-named true -> false
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 17:20:20 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/15 17:20:20 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 17:20:20 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 17:20:20 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 17:20:20 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:20 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 17:20:20 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/15 17:20:20 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/15 17:20:20 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 17:20:20 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 17:20:20 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/15 17:20:20 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 17:20:20 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/15 17:20:20 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:20 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/15 17:20:20 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/15 17:20:20 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: dry-run: would converge owned.go.tito.io seed
2026/10/15 17:20:20 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged owned.go.tito.io channel stable -> edge
2026/10/15 17:20:20 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/15 17:20:20 provision: converged owned.go.tito.io hibernate false -> true
2026/10/15 17:20:20 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/15 17:20:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/15 17:20:20 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:20 provision: removed retired static route site.go.tito.io (record gone)
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/15 17:20:21 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/15 17:20:21 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:21 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 17:20:21 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 17:20:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 17:20:21 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 17:20:21 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/15 17:20:21 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 17:20:21 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 17:20:21 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 17:20:21 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 17:20:21 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/15 17:20:21 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/15 17:20:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 17:20:21 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/15 17:20:21 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/15 17:20:21 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 17:20:21 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/15 17:20:21 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 17:20:21 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:21 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/15 17:20:21 provision: a.shop.example.com: swapped for import sd_d2wzkehe47enqzudxyzyucxo5y (the original route is journaled)
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d2wzkehe47enqzudxyzyucxo5y committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:21 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu rolled back to its original route
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_njrknwn3h6u7oa2owz4xrpizcu is cleaned up and its journal row retired
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy rolled back to its original route
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_d5j5azdkawxvceeonnw3j2fhhy is cleaned up and its journal row retired
2026/10/15 17:20:21 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_2gxktx6c5wi2vbcmtpa2trdt3y
2026/10/15 17:20:21 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/15 17:20:21 provision: dry-run: would converge a.shop.example.com seed source
2026/10/15 17:20:21 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/15 17:20:21 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_a3v5jojikmbzifnbiepgbz3odi cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_2phcbumgyvcabmazn3xxirgi2q cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_r76hef4zddpxf5ypsrksotfpdm is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_npmjstmtsvuq7tayg5iyi5cqca is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: a.shop.example.com: import sd_5nbvox734efznvpgrjj5kxhdse is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 17:20:21 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/15 17:20:21 provision: b.shop.example.com: import sd_4yxba4attk23dr7xqpcphhqrsy left alone this pass: the import journal could not be read
2026/10/15 17:20:21 provision: c.shop.example.com: import sd_urxrgjl5g5zjbciyj7jswgpcku left alone this pass: the import journal could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wdqfrjqvucozepsqq6fjzqxxfy committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_vcpendyj3ekep56jtxec5vh4oq: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_rg72nydybcygurlgpoypdhbu44: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_u7xpyp5pkzdyjq6o6vp4b6dj4e: it is placed but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: not converging import sd_ouy2w7jbtgmihg5timb4q3m3uy: it is placed but not committed, and the row on this box has no import gate
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_sa752qpqq5owo45g674adi6sna committed: its gate is cleared and its journal row dropped
2026/10/15 17:20:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_vkvigu6e7mq3rykhk2zlurhvcy: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_vkvigu6e7mq3rykhk2zlurhvcy rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: removed instance route acme.go.tito.io (its seed sd_bjqcxdaqqhhbnv4otbiblwh4pi was aborted); the next pass rolls it back
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_bjqcxdaqqhhbnv4otbiblwh4pi: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_bjqcxdaqqhhbnv4otbiblwh4pi rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_qjwlviwh525pcdkydg55quxqt4 has a row this pass may not remove; leaving the seed aborted
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_4xsvjf3yuyh3tg4kpq2jmqdljy rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: removed instance route acme.go.tito.io (its seed sd_3dbnnzwe7lae756gulxw6ac5l4 was aborted); the next pass rolls it back
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_3dbnnzwe7lae756gulxw6ac5l4 has no route on this box: its local data is removed
2026/10/15 17:20:22 provision: acme.go.tito.io: aborted seed sd_3dbnnzwe7lae756gulxw6ac5l4 rolled back (no box had swapped it)
2026/10/15 17:20:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_wfh7xhlee53abvazskpdeaemam (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wfh7xhlee53abvazskpdeaemam rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_wfh7xhlee53abvazskpdeaemam is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_n7mmjgo243vkjj3jj2awcs4mfq (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_n7mmjgo243vkjj3jj2awcs4mfq rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_n7mmjgo243vkjj3jj2awcs4mfq is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_hd4n6ydnqxunukkfakbffw6pk4 (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4 rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4: the host's replica is left alone: its record no longer names this seed
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hd4n6ydnqxunukkfakbffw6pk4 is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_je3awsfss5ytj7mkxv7b63ri4a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_je3awsfss5ytj7mkxv7b63ri4a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_ol3zvsl5q65jukufosdwnftrhm (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_ol3zvsl5q65jukufosdwnftrhm rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_pqaaxjler7x67psvvztvhi3q7m (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_pqaaxjler7x67psvvztvhi3q7m is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_54bkeyqslifsfhyng3etbgwfkq (the original route is journaled)
2026/10/15 17:20:22 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_54bkeyqslifsfhyng3etbgwfkq left alone this pass: its record could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_axqidivqga6h67lik2ykuroxyq (the original route is journaled)
2026/10/15 17:20:22 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_axqidivqga6h67lik2ykuroxyq left alone this pass: its record could not be read
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_mlxti7anaix3fanzko6ckjkgsu (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu: close the import gate: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mlxti7anaix3fanzko6ckjkgsu is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_blu3umnpfhzmjuq3oesbqyoe7u (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u: close the import gate: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_blu3umnpfhzmjuq3oesbqyoe7u is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_px36e3jjyclpc6hbuyee54bnhi (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_px36e3jjyclpc6hbuyee54bnhi is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_zabycs3s52lsvbb472jqimik5a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zabycs3s52lsvbb472jqimik5a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zabycs3s52lsvbb472jqimik5a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_spz67n2dsfngzt73boypxbln4i (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i: retire its instance key: injected failure at retire-key
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_spz67n2dsfngzt73boypxbln4i is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_mif225md4hwlka4xb2cwechh7y (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mif225md4hwlka4xb2cwechh7y rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_mif225md4hwlka4xb2cwechh7y is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_zlggih4vs2micrnebd3ba4vdfy (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy: remove its local data: injected failure at remove-local
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_zlggih4vs2micrnebd3ba4vdfy is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_uqbmmpjd5vpu7lqmo75zyam3ba (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_uqbmmpjd5vpu7lqmo75zyam3ba rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_uqbmmpjd5vpu7lqmo75zyam3ba is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_xwd4grm4abmhrqslbe3iaovl4e (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e: remove its local data: injected failure at remove-local-done
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_xwd4grm4abmhrqslbe3iaovl4e is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_hn622yzfvykfasfauvvlbjh26a (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hn622yzfvykfasfauvvlbjh26a rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_hn622yzfvykfasfauvvlbjh26a is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_abolhlwcckmviqvgpesxwpgoza (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza: restore the original route: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_abolhlwcckmviqvgpesxwpgoza is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_qp4cm5pfbhdypz2oiailhq6gee (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee: restore the original route: constraint failed: injected (1811)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_qp4cm5pfbhdypz2oiailhq6gee is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_nwbr3uobwguwauedw2z7canjkm (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_nwbr3uobwguwauedw2z7canjkm is cleaned up and its journal row retired
2026/10/15 17:20:22 provision: a.shop.example.com: swapped for import sd_l6nv5kamjoyetm7cybbthitnme (the original route is journaled)
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme rolled back to its original route
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme: delete its snapshot: injected failure at delete-snapshot
2026/10/15 17:20:22 provision: a.shop.example.com: import sd_l6nv5kamjoyetm7cybbthitnme is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_qis57l6zkwsec6ljd4rudg4e6u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qis57l6zkwsec6ljd4rudg4e6u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qis57l6zkwsec6ljd4rudg4e6u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_mm75yvl3evpliyx2h4icvi4azq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq: delete the host's replica: injected failure at delete-replica
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mm75yvl3evpliyx2h4icvi4azq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_q6y466hywb5mofqcrzexf5cygm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_q6y466hywb5mofqcrzexf5cygm rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_q6y466hywb5mofqcrzexf5cygm is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_4nq767p3mfei2r3co2d7dztfqq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq: retire its journal row: constraint failed: injected (1811)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_4nq767p3mfei2r3co2d7dztfqq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_hi67xntrhx22a36qonirz5e7ny (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny: retire its journal row: constraint failed: injected (1811)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hi67xntrhx22a36qonirz5e7ny is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_hq4icf4a5t47wkiaks67hci7oy (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hq4icf4a5t47wkiaks67hci7oy rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_hq4icf4a5t47wkiaks67hci7oy is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: mark import sd_hq4icf4a5t47wkiaks67hci7oy rolled back: injected failure at cas
2026/10/15 17:20:23 provision: a.shop.example.com: aborted seed sd_hq4icf4a5t47wkiaks67hci7oy rolled back (no box had swapped it)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_d5r7awuhoetfrzjivy7u6gcngq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_d5r7awuhoetfrzjivy7u6gcngq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_d5r7awuhoetfrzjivy7u6gcngq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: aborted seed sd_d5r7awuhoetfrzjivy7u6gcngq rolled back (no box had swapped it)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ue3w5lbawwqkditgy62eo4xmwq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ue3w5lbawwqkditgy62eo4xmwq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_a7nibfiezkee55aukmespb5jya (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_a7nibfiezkee55aukmespb5jya rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_a7nibfiezkee55aukmespb5jya is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_po4jqkdombb5fbaos6y73edqsu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_po4jqkdombb5fbaos6y73edqsu rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_po4jqkdombb5fbaos6y73edqsu is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_xhtcookwntbrdc5ikswwae4wca (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xhtcookwntbrdc5ikswwae4wca rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xhtcookwntbrdc5ikswwae4wca is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_62rtxgbrjzb3cvmny47l3jjhia (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_62rtxgbrjzb3cvmny47l3jjhia rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_62rtxgbrjzb3cvmny47l3jjhia is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_2othqgjkpltv74tvvn4zvqbzxe (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2othqgjkpltv74tvvn4zvqbzxe rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2othqgjkpltv74tvvn4zvqbzxe is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_eeacva6dx3o5rjduh4dq5eogzq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_eeacva6dx3o5rjduh4dq5eogzq rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_eeacva6dx3o5rjduh4dq5eogzq is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_tyjigtzdws4j5sktwmailgxqzm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_tyjigtzdws4j5sktwmailgxqzm rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_tyjigtzdws4j5sktwmailgxqzm is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_wsggm2f2e2dlwys535ie7ssb7y (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_wsggm2f2e2dlwys535ie7ssb7y has no route on this box: its local data is removed and no route is put back
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_wsggm2f2e2dlwys535ie7ssb7y is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_uhtulanwpkzgqyqa22aficciqa (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_bgnun5ym4p6mcikvass6yql6rm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_zywyzgflrv7njvkwpmtppxld5m (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_zywyzgflrv7njvkwpmtppxld5m cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ycs6kpfdx6szl7pywbbp4soevu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ycs6kpfdx6szl7pywbbp4soevu is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/15 17:20:23 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/15 17:20:23 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_45e3z2d664sinr5yugtt3eaga4 (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_fjqxap4omkgwgy4qak2ka2z5ka (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_3shooktns2d3pkjxz3gipscm24 (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_gvc3gbuhpcuvwvdipih64uq3ou (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_axk4q3l2jcrjzemnfmwbkkxwmm (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_axk4q3l2jcrjzemnfmwbkkxwmm rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_3k5d56v45ek2i4rkswulgez6ia (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3k5d56v45ek2i4rkswulgez6ia has no route on this box: its local data is removed and no route is put back
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3k5d56v45ek2i4rkswulgez6ia is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_w5g23uu63lktzavlbo5xwlct6a (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w5g23uu63lktzavlbo5xwlct6a: remove its local data: injected failure at remove-local
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w5g23uu63lktzavlbo5xwlct6a is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_zgehnrm2smexleyofjnyaiw5ka (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_zgehnrm2smexleyofjnyaiw5ka: a route appeared at the host, so its local database is left and the rollback waits
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_dzka4ny2nzwratkv56lricpbly (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_dzka4ny2nzwratkv56lricpbly rollback deferred: no fence generation: registry busy
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_75ji44by2mjqtchetrrat4ucpu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_75ji44by2mjqtchetrrat4ucpu rollback deferred: no fence generation: the generation source answered 0
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_4nxy2ztuplb5cvnzmuzawfzrvq (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_pnwibyfdysfyztaxwrt43gfqli (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ewipbp3bsalsnyqjglagyh5ebu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/15 17:20:23 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_saqxdfv3ythlc36blevtk3442u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_saqxdfv3ythlc36blevtk3442u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_saqxdfv3ythlc36blevtk3442u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_xdt4egyjllb3ngbksmscwkt34i (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xdt4egyjllb3ngbksmscwkt34i rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xdt4egyjllb3ngbksmscwkt34i is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ug6qw3rzerlgzhhuwjqdsjl4xu (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ug6qw3rzerlgzhhuwjqdsjl4xu rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ug6qw3rzerlgzhhuwjqdsjl4xu is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_ituvurf4snggz4hqycabdouv7u (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u: retire its instance key: the env file is a symlink
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u rolled back to its original route
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ituvurf4snggz4hqycabdouv7u is cleaned up and its journal row retired
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_pad7sartgyfsp2g7evdft2vfei (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 17:20:23 provision: a.shop.example.com: swapped for import sd_cnr2smscciopxvebizini7xnfy (the original route is journaled)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_vxuyrx4s2wati55jmxmqast2zi refused: there is no route at a.shop.example.com to replace
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_3fc4sxgivjx7e5gysyvsyj5fhe refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_mzmzjmer45nt7qd45i5nsqllqy refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2eowv2744rtam7m5himgpzbgwe refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_aezbjo7dz2o2iicimu6mz2pwim refused: the route belongs to app other
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_oqtmrenk36xkn54dazu5ciadpu refused: the route is filed under another account
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_2erslwxozyejkmtforecnzrgja refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_ad2i4swjk3pgndrk4tosxmvmne refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_w3nr7guwlogp4yho6yhb2yhjhi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_vb7fzrzx322l2vxtk62xdohpqe refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_dyt3egs5ezmffdh7kii2pikiua refused: the route is not an address route this import can take over (socket)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_z7u53loy77ucfwxyzibmraytcu refused: the route is not an address route this import can take over (no address)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_fuy555rx22qriomlwgurtuvs5m refused: the route is not an address route this import can take over (provisioned)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_xy4s5llzeutes7sv4aqmojyysi refused: the route is not an address route this import can take over (kind static)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_oabqrub3ydeghmlsbxiivo2im4 refused: the route is not an address route this import can take over (backing)
2026/10/15 17:20:23 provision: a.shop.example.com: import sd_qrzp3jpscmah74twmcor47gixm refused: the route is not an address route this import can take over (tunnel)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_bkejstskl6toxz2rpvqt7csqqi refused: the route is not an address route this import can take over (caps)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_vowdmmnd5pm2s25fmlrzfti2km refused: the route is not an address route this import can take over (platform)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_ftij6w5wkoqvcip7hfiteqdjpu refused: the route is not an address route this import can take over (canary)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_n5u2wshreydxzn2ognz2oiewwm refused: the route is not an address route this import can take over (kind sidecar)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_cbqnzso3ejgvkjfargdjo2ru7u refused: the route is not an address route this import can take over (region)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_fixgrrx5jol4juudhcujbuuarq refused: the route is not an address route this import can take over (fleet_box)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_zlq4wdjvyigyqxxw6taml2b7oy refused: the route is not an address route this import can take over (hibernate)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_inmyyklz4ogct2imdy7b47pbc4 refused: the route is not an address route this import can take over (claim_owner)
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_nzifpmywvvy5ibqhmbjw3t7mme refused: this box does not run instances nested
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_a2b3w5sfojvfftojw6jlo4i2pa refused: this box does not run instances nested
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_n6ahhi2ofy6uif4tdn4pzmih7u refused: claim control is on for this box
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_xsonccdr7gp43jyfvzeqzr5nya (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_nsyfvfidzsy7gkg3u43fdmm64q (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_3gsgza5nbppfo57yg5nrojpo3u: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_3bmxmkgm7kl7brnt2xnihbthl4: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_fmczlqsgrcffhab5zwtmzgg54m: its verify hash is not a sha256
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/15 17:20:24 provision: A.shop.example.com/..: not swapping for import sd_e4lcasvxchk57jnh7r6vuna3vm: its host or seed id is malformed (seeds: not a host)
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_yioae2ltbsylg5gql4x2gudtle: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_tsuxur6ukyp2damfnjhqmwz3oa: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_rsjnbwsigfmkwzijhse7mdylom: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: not swapping for import sd_4mytsxlol37igxyyxh2z7wixum: its record does not describe a nested, hibernating instance
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_5x6szaz3o6fcoc2rmzug4y62tu (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_dya56b6xovoybavacc3mn5bmkq (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_e2g3sxotvf7wrmtxuxfbm7jwku (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/15 17:20:24 provision: dry-run: would consider swapping a.shop.example.com for import sd_22lue6qofeofetyni3npccbopm
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e rolled back to its original route
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_c2hvhe6npsu6zmxakpwxgv7n6e is cleaned up and its journal row retired
2026/10/15 17:20:24 provision: a.shop.example.com: import sd_hizshfznj6mi6b7kdpqew67uwa left alone: the import journal holds seed sd_ylwdybfriuqcvuhnoq2bsdhmju at swapped
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_q4236ly2psukiwxedqj746xjlu: it is swapped but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_bigf2fd575uebqkl5eo54pwsmy: it is placed but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: swapped for import sd_o53pchuwoxu3g3d5t2dr5irgha (the original route is journaled)
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_o53pchuwoxu3g3d5t2dr5irgha: it is swapped but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: a.shop.example.com: not minting import sd_o53pchuwoxu3g3d5t2dr5irgha: it is placed but not committed, and only its swap makes its row
2026/10/15 17:20:24 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 17:20:24 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/15 17:20:24 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/15 17:20:24 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/15 17:20:24 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 17:20:24 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/15 17:20:24 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 17:20:24 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/15 17:20:24 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 17:20:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 17:20:24 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/15 17:20:24 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 17:20:24 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 17:20:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 17:20:24 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 17:20:24 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	29.511s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.349s
ok  	github.com/carlosframework/platform/internal/relay	7.237s
ok  	github.com/carlosframework/platform/internal/release	21.455s
ok  	github.com/carlosframework/platform/internal/rollout	3.689s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.005s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.578s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.462s
ok  	github.com/carlosframework/platform/internal/seeds	0.010s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.259s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.519s
ok  	github.com/carlosframework/platform/internal/status	0.039s
ok  	github.com/carlosframework/platform/internal/steering	0.009s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.265s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.554s
FAIL
make: *** [Makefile:18: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log