amadan
carlos run: the cmd role is outside #292's start/stop fence in instance control open
On branch carlos-run
Found during carlos-run's pre-land merge with main 132cf996.
What #292 changed. fix-shutdown-lease-292 fences run-role starts against stops in instance control. A start whose response is lost cannot launch the unit after the agent has stopped it.
The gap. The cmd role, which carlos run adds through carlos-instance-cmd@ and instancectl's /cmd endpoints, doesn't share that fence. If a command's start response is lost while the agent stops it, the cmd unit can start after the stop.
Why this isn't a blocker.
- The run's settle then fails.
- The sweep's retirement retries prove and settle the command within one sweep. That is review finding 6 on carlos-run, fixed in 1c23afa9.
- While unproven, the instance keeps its replication and lease.
- The command's pin and handle stay held until it settles.
Follow-up. Put cmd starts under #292's fence, so that a stopped instance can never have a command start after the stop, rather than relying on the settle retry.
Claims. Not on the claims activation list (#250). carlos run is refused on claim-armed boxes, so the cmd role cannot start while claims are on.
Census: the instancectl cmd rows are ruled under census-ruling-carlos-run, J4 seed pattern. A change here keeps cmd on refuseStagedExe and the template-equality test.