carlos / platform Public

Sidecar isolation Task 5 fix 1: the shared socket refuses a nested worker by its incarnation, not its listener

Closing a pinned listener gave the host back to the shared socket, but a
closed listener proves neither a move back to flat nor a revoked token: a
crashed nested worker's entry keeps its token through the restart backoff
and a failed respawn. The shared socket now asks the Workers for its own
token (SharedWorkerToken), which the Service answers "" for a nested
worker: the launch the token was minted for ran nested, or the entry's row
is a nested worker row (by shape, so a fenced row stays refused). Only a
flat row woken flat is answered. The pinned listener's refcount is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 9 hours ago 039914d683ef8c32c29add40e1b386e67a94f50c parent 81dc25c

6 files changed, +260 −86

internal/activator/activator.go +29 −0
internal/activator/backend_unit.go +9 −0
internal/activator/prepare.go +8 −0
internal/activator/prepare_test.go +116 −11
internal/agentsock/agentsock.go +29 −47
internal/agentsock/agentsock_test.go +69 −28

CI failed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (11 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (162 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.648s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.731s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.739s
ok  	github.com/carlosframework/platform/internal/activator	59.121s
ok  	github.com/carlosframework/platform/internal/agentsock	0.065s
ok  	github.com/carlosframework/platform/internal/alerting	0.011s
ok  	github.com/carlosframework/platform/internal/analytics	0.045s
ok  	github.com/carlosframework/platform/internal/appconfig	2.868s
ok  	github.com/carlosframework/platform/internal/apperr	0.128s
ok  	github.com/carlosframework/platform/internal/applog	0.242s
ok  	github.com/carlosframework/platform/internal/awsinv	0.017s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.009s
ok  	github.com/carlosframework/platform/internal/boxid	0.764s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.016s
ok  	github.com/carlosframework/platform/internal/caps	0.033s
ok  	github.com/carlosframework/platform/internal/certwarm	0.006s
ok  	github.com/carlosframework/platform/internal/cgroup	0.773s
ok  	github.com/carlosframework/platform/internal/changelog	0.411s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.024s
ok  	github.com/carlosframework/platform/internal/clamd	0.060s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.410s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.022s
ok  	github.com/carlosframework/platform/internal/dbquery	0.016s
ok  	github.com/carlosframework/platform/internal/dbreads	2.122s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.014s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.010s
ok  	github.com/carlosframework/platform/internal/docsite	0.014s
ok  	github.com/carlosframework/platform/internal/domains	2.697s
ok  	github.com/carlosframework/platform/internal/doorkey	0.013s
ok  	github.com/carlosframework/platform/internal/economics	0.010s
ok  	github.com/carlosframework/platform/internal/edge	45.185s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.009s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.162s
ok  	github.com/carlosframework/platform/internal/gate	1.730s
ok  	github.com/carlosframework/platform/internal/genselect	0.027s
ok  	github.com/carlosframework/platform/internal/geo	0.015s
ok  	github.com/carlosframework/platform/internal/geoip	0.035s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.214s
ok  	github.com/carlosframework/platform/internal/host	140.346s
ok  	github.com/carlosframework/platform/internal/hostactors	6.297s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.010s
ok  	github.com/carlosframework/platform/internal/hostbox	2.840s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.771s
ok  	github.com/carlosframework/platform/internal/hostenv	0.005s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.009s
ok  	github.com/carlosframework/platform/internal/hostexec	5.294s
ok  	github.com/carlosframework/platform/internal/hostfence	0.069s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.395s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.025s
ok  	github.com/carlosframework/platform/internal/hostguard	1.069s
ok  	github.com/carlosframework/platform/internal/hostops	2.023s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.632s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.198s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.005s
ok  	github.com/carlosframework/platform/internal/instancectl	6.893s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.795s
ok  	github.com/carlosframework/platform/internal/instancefs	0.008s
ok  	github.com/carlosframework/platform/internal/instancekey	0.004s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	1.739s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.004s
ok  	github.com/carlosframework/platform/internal/lease	10.100s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.473s
ok  	github.com/carlosframework/platform/internal/ledger	0.025s
ok  	github.com/carlosframework/platform/internal/mail	0.283s
ok  	github.com/carlosframework/platform/internal/maintenance	0.116s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.587s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.092s
ok  	github.com/carlosframework/platform/internal/metrics	0.007s
ok  	github.com/carlosframework/platform/internal/moves	21.987s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.015s
ok  	github.com/carlosframework/platform/internal/objstore	0.354s
ok  	github.com/carlosframework/platform/internal/ops	0.249s
ok  	github.com/carlosframework/platform/internal/park	0.291s
ok  	github.com/carlosframework/platform/internal/plans	0.006s
ok  	github.com/carlosframework/platform/internal/privatefile	0.006s
2026/10/24 22:15:14 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:14 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:14 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:14 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:14 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:14 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:14 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:14 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/24 22:15:14 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:14 provision: an app's records could not be listed: they are skipped
2026/10/24 22:15:14 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:15 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 22:15:15 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 22:15:15 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:15:15 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:15:15 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:15:15 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:15:15 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 22:15:15 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:15:15 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:15:15 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:15:15 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:15:15 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:15:15 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 22:15:15 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:15 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:15 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:15 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 22:15:15 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 22:15:15 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/24 22:15:15 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/24 22:15:15 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:16 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:16 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (0.73s)
    plan9_b8_census_test.go:372: record-write census rejected 2 site(s); update the explicit inventory only after reviewing the source:
          changed site internal/instanceexec/exit.go:RunExit: source differs from the reviewed digest
          changed site internal/ops/litestream.go:FleetDBsWithSkipped: source differs from the reviewed digest
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:15:17 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/24 22:15:17 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/24 22:15:17 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/24 22:15:17 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io hibernate false -> true
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged acme.go.tito.io status-named false -> true
2026/10/24 22:15:17 provision: converged acme.go.tito.io status-named true -> false
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:15:17 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:15:17 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:15:17 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:15:17 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/24 22:15:17 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/24 22:15:17 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 22:15:17 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 22:15:17 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 22:15:17 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:17 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:15:17 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/24 22:15:17 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/24 22:15:17 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:17 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 22:15:17 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:17 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:17 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/24 22:15:17 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 22:15:17 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:17 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 22:15:17 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:17 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 22:15:17 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:17 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:15:17 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:17 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/24 22:15:17 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:15:17 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 22:15:18 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 22:15:18 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/24 22:15:18 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:18 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:15:18 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/24 22:15:18 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/24 22:15:18 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/24 22:15:18 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/24 22:15:18 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/24 22:15:18 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/24 22:15:18 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/24 22:15:18 provision: dry-run: would converge owned.go.tito.io seed
2026/10/24 22:15:18 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/24 22:15:18 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:18 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/24 22:15:18 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/24 22:15:18 provision: converged owned.go.tito.io channel stable -> edge
2026/10/24 22:15:18 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/24 22:15:18 provision: converged owned.go.tito.io hibernate false -> true
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/24 22:15:18 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/24 22:15:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: removed retired static route site.go.tito.io (record gone)
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/24 22:15:18 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/24 22:15:18 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:18 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 22:15:18 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 22:15:18 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:15:18 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:15:18 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/24 22:15:18 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:15:18 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:15:18 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:15:18 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 22:15:18 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/24 22:15:18 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/24 22:15:18 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:15:18 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/24 22:15:18 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/24 22:15:18 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 22:15:18 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/24 22:15:18 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:15:18 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:18 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:19 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:19 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:15:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:19 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:15:19 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/24 22:15:19 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/24 22:15:19 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 22:15:19 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:19 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 22:15:19 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:19 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 22:15:19 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:19 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:19 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 22:15:19 provision: a.shop.example.com: swapped for import sd_76nstvrsyplmlnyyrbuhiwrnye (the original route is journaled)
2026/10/24 22:15:19 provision: a.shop.example.com: import sd_76nstvrsyplmlnyyrbuhiwrnye committed: its gate is cleared and its journal row dropped
2026/10/24 22:15:19 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_k2qu5jjokgpippw3zja2vvrs4m rolled back to its original route
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_k2qu5jjokgpippw3zja2vvrs4m: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_k2qu5jjokgpippw3zja2vvrs4m is cleaned up and its journal row retired
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_ytrbh6r3v4afjd5dxm5mhm7t54 rolled back to its original route
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_ytrbh6r3v4afjd5dxm5mhm7t54: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_ytrbh6r3v4afjd5dxm5mhm7t54 is cleaned up and its journal row retired
2026/10/24 22:15:20 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_vfkn4wic3afwzeycmnyiagm4mi
2026/10/24 22:15:20 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/24 22:15:20 provision: dry-run: would converge a.shop.example.com seed source
2026/10/24 22:15:20 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/24 22:15:20 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/24 22:15:20 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_cv6x5vp36ywjexsaccri4zri6m cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_bok4owzcrpzngrqhhdhx5hgh3m cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_icjymwk42u3cxbc33oxf6q2gqu is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_cy33b3kuzp6kzrcdyjaigdxhqu is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_lgfcpdbxb2mfdfn5ac7egmohfa is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:15:20 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/24 22:15:20 provision: c.shop.example.com: import sd_wsctr3nrlcerjfetqs4txwbjei left alone this pass: the import journal could not be read
2026/10/24 22:15:20 provision: b.shop.example.com: import sd_vn3hvhjl7p53px4gpxw3gpizhy left alone this pass: the import journal could not be read
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_zzuwngt5sfwc2zmhtjxgeepse4 committed: its gate is cleared and its journal row dropped
2026/10/24 22:15:20 provision: a.shop.example.com: not converging import sd_gnsrhu3bu3loodgpfwzhcn3acu: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 22:15:20 provision: a.shop.example.com: not converging import sd_vwppmy6c5ptmnzpwyvxfss2zv4: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 22:15:20 provision: a.shop.example.com: not converging import sd_emz7i6rrjaaab7qw7e33yvmo5q: it is placed but not committed, and the row on this box has no import gate
2026/10/24 22:15:20 provision: a.shop.example.com: not converging import sd_hmukgtek4ls2oyefp73iaeoxnq: it is placed but not committed, and the row on this box has no import gate
2026/10/24 22:15:20 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/24 22:15:20 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: a.shop.example.com: import sd_uzigx4xej3fmxtsc6twkg7iq2q committed: its gate is cleared and its journal row dropped
2026/10/24 22:15:20 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:20 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:20 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/24 22:15:20 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_gikpme6zu4ix4nsvaovebr6lm4: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_gikpme6zu4ix4nsvaovebr6lm4 rolled back (no box had swapped it)
2026/10/24 22:15:20 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/24 22:15:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:20 provision: removed instance route acme.go.tito.io (its seed sd_rqqjyoejp554myudj5pzlej3f4 was aborted); the next pass rolls it back
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_rqqjyoejp554myudj5pzlej3f4: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_rqqjyoejp554myudj5pzlej3f4 rolled back (no box had swapped it)
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_neznbqykch42powpxqbuokiqju has a row this pass may not remove; leaving the seed aborted
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_yqawac4vs4stpgbzgwowv645ly rolled back (no box had swapped it)
2026/10/24 22:15:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:20 provision: removed instance route acme.go.tito.io (its seed sd_ffgwkyssxfxatcuywytzxumgly was aborted); the next pass rolls it back
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_ffgwkyssxfxatcuywytzxumgly has no route on this box: its local data is removed
2026/10/24 22:15:20 provision: acme.go.tito.io: aborted seed sd_ffgwkyssxfxatcuywytzxumgly rolled back (no box had swapped it)
2026/10/24 22:15:20 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_yiate53y2put4asvyeoa6ebxhy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_yiate53y2put4asvyeoa6ebxhy rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_yiate53y2put4asvyeoa6ebxhy is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_v2ob4otwsda7hrsat3xicidxwy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_v2ob4otwsda7hrsat3xicidxwy rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_v2ob4otwsda7hrsat3xicidxwy is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_7dvfh3i3e7qrk47krzzlzyqkgy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7dvfh3i3e7qrk47krzzlzyqkgy rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7dvfh3i3e7qrk47krzzlzyqkgy: the host's replica is left alone: its record no longer names this seed
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7dvfh3i3e7qrk47krzzlzyqkgy is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_7zyjpzgailk6okirlcgxfvdem4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7zyjpzgailk6okirlcgxfvdem4 rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7zyjpzgailk6okirlcgxfvdem4 rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_7zyjpzgailk6okirlcgxfvdem4 is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_bvn6lll3w2ksvkv6bigfzqdhje (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_bvn6lll3w2ksvkv6bigfzqdhje rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_6ktiu42bgu7cvw6v3lkcjye57a (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_6ktiu42bgu7cvw6v3lkcjye57a is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ghtnfedz4yexdzui2j65zux2q4 (the original route is journaled)
2026/10/24 22:15:21 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ghtnfedz4yexdzui2j65zux2q4 left alone this pass: its record could not be read
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_lqhnldxa5mi4m36tnc4fkabquy (the original route is journaled)
2026/10/24 22:15:21 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_lqhnldxa5mi4m36tnc4fkabquy left alone this pass: its record could not be read
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_xw7heftqudspcgxarsw2zos7ea (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_xw7heftqudspcgxarsw2zos7ea: close the import gate: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_xw7heftqudspcgxarsw2zos7ea rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_xw7heftqudspcgxarsw2zos7ea is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_wenxqtxyhfawkorecuaznlb7gi (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wenxqtxyhfawkorecuaznlb7gi: close the import gate: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wenxqtxyhfawkorecuaznlb7gi rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wenxqtxyhfawkorecuaznlb7gi is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_b67ejz4hwilebjo2tgky4pk74y (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_b67ejz4hwilebjo2tgky4pk74y rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_b67ejz4hwilebjo2tgky4pk74y rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_b67ejz4hwilebjo2tgky4pk74y is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ytewta4pvkwseqtjb6w5pjt2si (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ytewta4pvkwseqtjb6w5pjt2si rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ytewta4pvkwseqtjb6w5pjt2si is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_lxwr7hlto2lklpog5jt7aff4yq (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_lxwr7hlto2lklpog5jt7aff4yq: retire its instance key: injected failure at retire-key
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_lxwr7hlto2lklpog5jt7aff4yq rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_lxwr7hlto2lklpog5jt7aff4yq is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ooksxaeajdgq7ws3wkq5mna4jy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ooksxaeajdgq7ws3wkq5mna4jy rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ooksxaeajdgq7ws3wkq5mna4jy is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_wz6v3ttrdficrd7vfpo7e5t65m (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wz6v3ttrdficrd7vfpo7e5t65m: remove its local data: injected failure at remove-local
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wz6v3ttrdficrd7vfpo7e5t65m rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_wz6v3ttrdficrd7vfpo7e5t65m is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_noc73rpj2pacdaggwvck5ojdeq (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_noc73rpj2pacdaggwvck5ojdeq rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_noc73rpj2pacdaggwvck5ojdeq is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_jzuovhklygoksndbibfwowctw4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_jzuovhklygoksndbibfwowctw4: remove its local data: injected failure at remove-local-done
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_jzuovhklygoksndbibfwowctw4 rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_jzuovhklygoksndbibfwowctw4 is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_c77jht56mpm4qldc5zb6a3n7z4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_c77jht56mpm4qldc5zb6a3n7z4 rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_c77jht56mpm4qldc5zb6a3n7z4 is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_sypecjvp7dhlcm7i4zsj6czbby (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sypecjvp7dhlcm7i4zsj6czbby: restore the original route: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sypecjvp7dhlcm7i4zsj6czbby rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sypecjvp7dhlcm7i4zsj6czbby is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ivzm6zoarbh4h4n4oc7v47rosa (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ivzm6zoarbh4h4n4oc7v47rosa: restore the original route: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ivzm6zoarbh4h4n4oc7v47rosa rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ivzm6zoarbh4h4n4oc7v47rosa is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_gprgy2pnctme5rbujaqiefhdpm (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_gprgy2pnctme5rbujaqiefhdpm is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_nfbcpwsyixtcudpjonrkkb4woe (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_nfbcpwsyixtcudpjonrkkb4woe rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_nfbcpwsyixtcudpjonrkkb4woe: delete its snapshot: injected failure at delete-snapshot
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_nfbcpwsyixtcudpjonrkkb4woe is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_43re3k4hr2toj4ylapvsaf7wfu (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_43re3k4hr2toj4ylapvsaf7wfu rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_43re3k4hr2toj4ylapvsaf7wfu is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_u5qbltkffs4f3a3sqclo7h2fle (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_u5qbltkffs4f3a3sqclo7h2fle rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_u5qbltkffs4f3a3sqclo7h2fle: delete the host's replica: injected failure at delete-replica
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_u5qbltkffs4f3a3sqclo7h2fle is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_zhe2mikgi5hpkizxn6zde52i24 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_zhe2mikgi5hpkizxn6zde52i24 rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_zhe2mikgi5hpkizxn6zde52i24 is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_koxapt7dctlpn3btbmkbvvxsri (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_koxapt7dctlpn3btbmkbvvxsri rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_koxapt7dctlpn3btbmkbvvxsri: retire its journal row: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_koxapt7dctlpn3btbmkbvvxsri is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_sprkxowl6bmdbwjoogdi64yn5i (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sprkxowl6bmdbwjoogdi64yn5i rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sprkxowl6bmdbwjoogdi64yn5i: retire its journal row: constraint failed: injected (1811)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_sprkxowl6bmdbwjoogdi64yn5i is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_54y6cgmijlhozepfozl6kh3hxq (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_54y6cgmijlhozepfozl6kh3hxq rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_54y6cgmijlhozepfozl6kh3hxq is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: mark import sd_54y6cgmijlhozepfozl6kh3hxq rolled back: injected failure at cas
2026/10/24 22:15:21 provision: a.shop.example.com: aborted seed sd_54y6cgmijlhozepfozl6kh3hxq rolled back (no box had swapped it)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ga6ghcj2pnttwnosnjqpu423ym (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ga6ghcj2pnttwnosnjqpu423ym rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ga6ghcj2pnttwnosnjqpu423ym is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: aborted seed sd_ga6ghcj2pnttwnosnjqpu423ym rolled back (no box had swapped it)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_hqsugeycmb74t4bzhiy6kcupme (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_hqsugeycmb74t4bzhiy6kcupme rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_hqsugeycmb74t4bzhiy6kcupme rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_hqsugeycmb74t4bzhiy6kcupme rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_hqsugeycmb74t4bzhiy6kcupme is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_upn2mprlsd37ew6gu7jd7euwbu (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_upn2mprlsd37ew6gu7jd7euwbu rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_upn2mprlsd37ew6gu7jd7euwbu is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_6rtx4w2kvbdwg5wjfa53xxokbm (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_6rtx4w2kvbdwg5wjfa53xxokbm rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_6rtx4w2kvbdwg5wjfa53xxokbm is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_eym6nhj2twkqqlm57vsrzgoymy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_eym6nhj2twkqqlm57vsrzgoymy rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_eym6nhj2twkqqlm57vsrzgoymy is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_p62i3evjx2rtgti5vwlwj2butm (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_p62i3evjx2rtgti5vwlwj2butm rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_p62i3evjx2rtgti5vwlwj2butm is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_5npd2vl4pcv6ge2jantdeh5vh4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_5npd2vl4pcv6ge2jantdeh5vh4 rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_5npd2vl4pcv6ge2jantdeh5vh4 is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_mmc52uyj7llfmcehl4xlgf5xse (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_mmc52uyj7llfmcehl4xlgf5xse rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_mmc52uyj7llfmcehl4xlgf5xse is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_i3bfbpa6lu6ijcokau7ghv4mjq (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_i3bfbpa6lu6ijcokau7ghv4mjq rolled back to its original route
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_i3bfbpa6lu6ijcokau7ghv4mjq is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_fwpy2q75qrc5i6zi5l3g5ksz6m (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_fwpy2q75qrc5i6zi5l3g5ksz6m has no route on this box: its local data is removed and no route is put back
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_fwpy2q75qrc5i6zi5l3g5ksz6m is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_6vdjtv37khixmr7nkdirhn3uga (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_whuvkzsenuxkv27vobnjxjiksy (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ehfeq54tuu2nw2ikirhcicxawa (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ehfeq54tuu2nw2ikirhcicxawa cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ikxbxbdwr4xclczmcavshszef4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ikxbxbdwr4xclczmcavshszef4 is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/24 22:15:21 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/24 22:15:21 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ibwxoedukg6v6sbfnly2t2uv2a (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_cklv4as5ccwgdshqewaimsjsi4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_pwh4b2bij5gzomiajzpquxdzp4 (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_r2ymryfib3kqgmgk2wo4uoxcye (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_tsfdd6iezot3x4zgvlab5cgyoq (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_tsfdd6iezot3x4zgvlab5cgyoq rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_tjoleyq6k6rt4x7n4y7h3esl5u (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_tjoleyq6k6rt4x7n4y7h3esl5u has no route on this box: its local data is removed and no route is put back
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_tjoleyq6k6rt4x7n4y7h3esl5u is cleaned up and its journal row retired
2026/10/24 22:15:21 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_ypruz6etyurlbmk6mdh6z7q66a (the original route is journaled)
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ypruz6etyurlbmk6mdh6z7q66a: remove its local data: injected failure at remove-local
2026/10/24 22:15:21 provision: a.shop.example.com: import sd_ypruz6etyurlbmk6mdh6z7q66a is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/24 22:15:21 provision: a.shop.example.com: swapped for import sd_klikv7ej5xpccgzjnt345dmtay (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_klikv7ej5xpccgzjnt345dmtay: a route appeared at the host, so its local database is left and the rollback waits
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_27nuq6u442yzk3vgo5lizckr6i (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_27nuq6u442yzk3vgo5lizckr6i rollback deferred: no fence generation: registry busy
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_bf23qyaaz2hn6qr4y5h7xjws3m (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_bf23qyaaz2hn6qr4y5h7xjws3m rollback deferred: no fence generation: the generation source answered 0
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_z73v3rbf7y7crdxb43uusephvq (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_dvlc2zgivymjq32ruemcdwqsh4 (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_imwzvcsaaoe6x4brznpx2eyv4e (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_q52o24eiq5vsakminwaoqhmbhy (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_q52o24eiq5vsakminwaoqhmbhy rolled back to its original route
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_q52o24eiq5vsakminwaoqhmbhy is cleaned up and its journal row retired
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_olju2sccogb3znvbtt4alatelm (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_olju2sccogb3znvbtt4alatelm rolled back to its original route
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_olju2sccogb3znvbtt4alatelm is cleaned up and its journal row retired
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_es4mkh235ra35aiotwgvklpufy (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_es4mkh235ra35aiotwgvklpufy rolled back to its original route
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_es4mkh235ra35aiotwgvklpufy is cleaned up and its journal row retired
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_vofqnwf6m53rc2n3wjzhu2srgq (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_vofqnwf6m53rc2n3wjzhu2srgq: retire its instance key: the env file is a symlink
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_vofqnwf6m53rc2n3wjzhu2srgq rolled back to its original route
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_vofqnwf6m53rc2n3wjzhu2srgq is cleaned up and its journal row retired
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_zehde6lelup5wgf4suwyi27q3e (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_vbx7pw5drdzf5hv4tnbf6ewsoe (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_ctgl2avvdwj6rv254a4zjvx3jm refused: there is no route at a.shop.example.com to replace
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_xrmxkcivkgbwej7mkumd6lox74 refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_oen2bgxecbtnlrp6psukzdwtoe refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_2popdkxnajwhkr2d536zrih4ju refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_xv7isifii577nxjsyv6w6ldrz4 refused: the route belongs to app other
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_2kv7x2diax64tgrbqqwdkoqo2y refused: the route is filed under another account
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_dzwx5ph76ozpd4h3ad3adpqmau refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_l5co63snin45owo5ywhtw3q5ue refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_fzh6q3mt722g5bjafsxzmtm2bu refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_4p6vvurpmnrmm43ec4zajr2bku refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_65ppe554xhjoy46andv2unxjky refused: the route is not an address route this import can take over (socket)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_kdroddrkccxkowul4d7kexcvyi refused: the route is not an address route this import can take over (no address)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_6zyighlsn4phgp76q25zfecwlq refused: the route is not an address route this import can take over (provisioned)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_b3t5mk2j2ptrn7g6sl4mnt2cyi refused: the route is not an address route this import can take over (kind static)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_us2wd2vv5arnacu65xcmbx5jim refused: the route is not an address route this import can take over (backing)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_dww73o3dnfqthv77hjprpaswli refused: the route is not an address route this import can take over (tunnel)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_zswanuvlg63ydtqz5ds3ndmt5e refused: the route is not an address route this import can take over (caps)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_3dcnz3edx45gxugvnsuldqfhui refused: the route is not an address route this import can take over (platform)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_poyssvgeitlb5tqlwnldhl64se refused: the route is not an address route this import can take over (canary)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_yhwm6akqkljg3geo55hzxouwry refused: the route is not an address route this import can take over (kind sidecar)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_5ro6i2b2svsnih7w7dsxvci23u refused: the route is not an address route this import can take over (region)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_o5vu6th5w4yj4fzslmexcanbyy refused: the route is not an address route this import can take over (fleet_box)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_xfncjnw4ovvo7xhgg4lvhsjhl4 refused: the route is not an address route this import can take over (hibernate)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_7m525xgmmy5xe7rifroe2um27e refused: the route is not an address route this import can take over (claim_owner)
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_gsp2pkpqrscr3fcl3e5glrlbom refused: this box does not run instances nested
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_bxbjrhipialnd7wvy6cpy3shua refused: this box does not run instances nested
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_wq232bvmz2w6uefof7tzpqq23y refused: claim control is on for this box
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_7iigzebf5ut4u2r7xbfzoojduq (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_qgs6zvfe2ttq72iwrblb6iczy4 (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_xki3m4h3q5sv6ikuv75ruwkvhm: its verify hash is not a sha256
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_uqo5t56kmz3w4xqizwjgw5w35m: its verify hash is not a sha256
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_nznfdjbkw2bvadoc6dmwyg62kq: its verify hash is not a sha256
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/24 22:15:22 provision: A.shop.example.com/..: not swapping for import sd_jijekvhvn6r6oisq6a5tzdxqwe: its host or seed id is malformed (seeds: not a host)
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_skgejs3q4oz322wg4s4e4tu3na: its record does not describe a nested, hibernating instance
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_4ghetdekht5tn2feuc3gjbf62a: its record does not describe a nested, hibernating instance
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_r4s554t3xfzmf6t7hu2b6ehziy: its record does not describe a nested, hibernating instance
2026/10/24 22:15:22 provision: a.shop.example.com: not swapping for import sd_v4amg3wioofvfngunqql5kyavu: its record does not describe a nested, hibernating instance
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_adxbon7ep6ugwuso64taxsfklu (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_ctoheefoj5ji5iwv3wc5cdeuse (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_6yiwi5zrdiiqza7m3ynk45liym (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/24 22:15:22 provision: dry-run: would consider swapping a.shop.example.com for import sd_2dskdnrn6kmrsbjnnhyhjmovae
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_tjxqbol75la5i77za4pbklevvm rolled back to its original route
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_tjxqbol75la5i77za4pbklevvm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_tjxqbol75la5i77za4pbklevvm is cleaned up and its journal row retired
2026/10/24 22:15:22 provision: a.shop.example.com: import sd_u6rndvy75f755jilwdqb5ibrlu left alone: the import journal holds seed sd_nb5so4zhn2gddt3q6zfomekepm at swapped
2026/10/24 22:15:22 provision: a.shop.example.com: not minting import sd_qucp3tck7cvmomsqgtwbzpahcq: it is swapped but not committed, and only its swap makes its row
2026/10/24 22:15:22 provision: a.shop.example.com: not minting import sd_ygevxn74dfq22lk4jzjgvakiby: it is placed but not committed, and only its swap makes its row
2026/10/24 22:15:22 provision: a.shop.example.com: swapped for import sd_ipleedle25yteowspafcelpo7u (the original route is journaled)
2026/10/24 22:15:22 provision: a.shop.example.com: not minting import sd_ipleedle25yteowspafcelpo7u: it is swapped but not committed, and only its swap makes its row
2026/10/24 22:15:22 provision: a.shop.example.com: not minting import sd_ipleedle25yteowspafcelpo7u: it is placed but not committed, and only its swap makes its row
2026/10/24 22:15:22 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:15:23 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/24 22:15:23 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/24 22:15:23 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/24 22:15:23 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/24 22:15:23 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/24 22:15:23 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 22:15:23 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/24 22:15:23 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/24 22:15:23 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 22:15:23 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:15:23 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/24 22:15:23 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/24 22:15:23 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/24 22:15:23 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:15:23 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/24 22:15:23 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:15:23 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:15:23 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/24 22:15:23 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:15:23 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:15:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:23 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/24 22:15:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:23 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:15:23 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:15:23 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 22:15:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:15:23 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:15:23 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 22:15:23 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:15:23 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:23 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:23 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:23 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:23 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:15:23 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 22:15:23 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:23 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:15:23 provision: an app's records could not be listed: they are skipped
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: record view: change index unusable (get refused): walking
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 22:15:23 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/24 22:15:23 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:15:23 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:15:23 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/24 22:15:23 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:15:23 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 22:15:23 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 22:15:23 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 22:15:23 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 22:15:23 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:15:23 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:15:23 provision: removed retired instance route one.example.com (record gone)
2026/10/24 22:15:23 provision: removed retired instance route one.example.com (record gone)
2026/10/24 22:15:23 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:15:23 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/24 22:15:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (12.02s)
    plan14_root_reads_test.go:600: root read census: 69 discrepancies
        changed root read internal/activator/activator.go:Service.doWake; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.respawnWorkerLocked; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.stop; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom; review class, task, sites and digest
        changed root read internal/activator/backend_unit.go:SplitBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/containment.go:Service.legacyRunGone; review class, task, sites and digest
        changed root read internal/activator/layout.go:Classify; review class, task, sites and digest
        changed root read internal/activator/maintenance.go:Service.cleanupFailedWake; review class, task, sites and digest
        changed root read internal/activator/opset.go:Service.reapUnprovenWake; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareAt; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareKeyedAt; review class, task, sites and digest
        changed root read internal/activator/unitproc.go:ExecBackend.observe; review class, task, sites and digest
        changed root read internal/activator/workerswap.go:Service.ReplaceWorker; review class, task, sites and digest
        changed root read internal/host/agent.go:runAgent; review class, task, sites and digest
        changed root read internal/instancectl/server.go:parseRequest; review class, task, sites and digest
        changed root read internal/instancectl/server.go:type Server; review class, task, sites and digest
        changed root read internal/ops/hibernate_verify.go:HibernatingHosts; review class, task, sites and digest
        changed root read internal/ops/litestream.go:FleetDBsWithSkipped; review class, task, sites and digest
        changed root read internal/ops/ops.go:runLitestream; review class, task, sites and digest
        changed root source envelope internal/activator
        changed root source envelope internal/agentsock
        changed root source envelope internal/host
        changed root source envelope internal/host/units
        changed root source envelope internal/instancectl
        changed root source envelope internal/instanceexec
        changed root source envelope internal/ops
        stale root read internal/activator/control.go:systemctlUnitState
        unclassified root read internal/activator/activator.go:Service.SharedWorkerToken whole:Route@329
        unclassified root read internal/activator/activator.go:Service.agentSocketFor whole:Route@148
        unclassified root read internal/activator/backend_exec.go:ExecBackend.RoleGone registry:Host@192,registry:Host@228,registry:Host@271,registry:Host@562
        unclassified root read internal/activator/backend_exec.go:ExecBackend.startWorkerUnit registry:Host@1137,registry:Host@1299,registry:Host@1647,registry:Host@1775,registry:Host@2094,registry:Host@2193,registry:Host@626,registry:Host@698,whole:Route@1341,whole:Route@2291,whole:Route@328,whole:Route@419
        unclassified root read internal/activator/backend_unit.go:SplitBackend.RoleGone file:Exec@263,registry:Backing@107,registry:Host@217,registry:Host@323,whole:Route@377
        unclassified root read internal/activator/backend_unit.go:SplitBackend.nestedWorkerRow file:Exec@134,registry:Backing@69,whole:Route@193
        unclassified root read internal/activator/backend_unit.go:SplitBackend.perHostAgentSocket file:Exec@154,registry:Backing@82,whole:Route@217
        unclassified root read internal/activator/containment.go:Service.roleGone whole:Route@581
        unclassified root read internal/activator/control.go:systemctlUnitFacts file:CommandContext@105
        unclassified root read internal/activator/layout.go:WorkerManaged registry:Backing@71,registry:Tunnel@91
        unclassified root read internal/activator/opset.go:Service.stopUnitProven registry:Host@309,whole:Route@101,whole:Route@177
        unclassified root read internal/activator/prepare.go:ExecBackend.agentSocketFor whole:Route@102
        unclassified root read internal/activator/prepare.go:ExecBackend.nestedWorkerRow registry:DBPath@112,registry:Host@159,registry:Socket@93,whole:Route@86
        unclassified root read internal/activator/prepare.go:ExecBackend.perHostAgentSocket whole:Route@141,whole:Route@96
        unclassified root read internal/activator/prepare.go:ExecBackend.prepareWorker whole:Route@210
        unclassified root read internal/activator/unitproc.go:ExecBackend.newWorkerUnitProc registry:Host@244,registry:Host@286,whole:Route@167,whole:Route@171
        unclassified root read internal/host/units/carlos-instance-worker@.service:external file:external@0
        unclassified root read internal/ops/litestream.go:ActivatorReplicated registry:Backing@59,registry:DBPath@97,registry:Hibernate@117
        unclassified root read internal/ops/litestream.go:ActivatorReplicatedPaths registry:DBPath@257,whole:Route@178,whole:Route@212
        changed legacy declaration internal/activator/activator.go:Service.doWake
        changed legacy declaration internal/activator/activator.go:Service.stop
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.LegacyRunGone
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom
        changed legacy declaration internal/activator/backend_unit.go:SplitBackend.LegacyRunGone
        changed legacy declaration internal/activator/containment.go:Service.legacyRunGone
        changed legacy declaration internal/activator/layout.go:Classify
        changed legacy declaration internal/activator/maintenance.go:Service.cleanupFailedWake
        changed legacy declaration internal/activator/opset.go:Service.reapUnprovenWake
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareAt
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareKeyedAt
        changed legacy declaration internal/activator/unitproc.go:ExecBackend.observe
        changed legacy declaration internal/instancectl/server.go:parseRequest
        changed legacy declaration internal/instancectl/server.go:type Server
        changed legacy declaration internal/ops/hibernate_verify.go:HibernatingHosts
        changed legacy declaration internal/ops/litestream.go:FleetDBsWithSkipped
        changed legacy declaration internal/ops/ops.go:runLitestream
        changed reclassified declaration internal/activator/activator.go:Service.respawnWorkerLocked
        changed reclassified declaration internal/activator/workerswap.go:Service.ReplaceWorker
        legacy declaration needs explicit reclassification or removal internal/activator/control.go:systemctlUnitState
        
        make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	20.538s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.010s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.547s
ok  	github.com/carlosframework/platform/internal/relay	7.235s
ok  	github.com/carlosframework/platform/internal/release	25.376s
ok  	github.com/carlosframework/platform/internal/rollout	3.826s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.010s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/runs	0.622s
ok  	github.com/carlosframework/platform/internal/s3compat	0.007s
ok  	github.com/carlosframework/platform/internal/safefile	0.006s
ok  	github.com/carlosframework/platform/internal/schedule	2.671s
ok  	github.com/carlosframework/platform/internal/seeds	0.015s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.548s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	10.052s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.502s
ok  	github.com/carlosframework/platform/internal/status	0.081s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.306s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.006s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.005s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.005s
ok  	github.com/carlosframework/platform/internal/usage	0.009s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.713s
FAIL
=== internal_console@0 (85 s)
ok  	github.com/carlosframework/platform/internal/console	83.536s
=== internal_console@1 (44 s)
ok  	github.com/carlosframework/platform/internal/console	42.185s
=== internal_console@2 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.545s
=== internal_console@3 (42 s)
ok  	github.com/carlosframework/platform/internal/console	39.994s
=== internal_console@4 (43 s)
ok  	github.com/carlosframework/platform/internal/console	41.412s
=== internal_console@5 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.008s
=== internal_console@6 (37 s)
ok  	github.com/carlosframework/platform/internal/console	34.939s
=== internal_console@7 (46 s)
ok  	github.com/carlosframework/platform/internal/console	44.176s
=== root@0 (109 s)
ok  	github.com/carlosframework/platform	107.026s
=== root@1 (84 s)
ok  	github.com/carlosframework/platform	82.198s
=== root@2 (92 s)
using http://127.0.0.1:40741 as a@keymail.dev
using http://127.0.0.1:41881 as vicky@keymail.dev
titogo (staging):
KEY   VALUE
PORT  8080
--- FAIL: TestRunBuiltCopyIsApplied (0.14s)
    approved_run_copy_test.go:139: RUN-C13: internal/instanceexec/exec.go does not contain the approved text "instance-exec: role <role> is not run, seed, sidecar or cmd"
    approved_run_copy_test.go:139: RUN-C14: internal/instanceexec/exit.go does not contain the approved text "instance-exit: role <role> is not run, seed, sidecar or cmd"
2026/10/24 22:15:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:27 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44597": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:27 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:27 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44597": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:27 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:27 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A35399": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:27 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:29 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A45021": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:29 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:29 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A40117": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:29 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:31 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44799": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:31 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:33 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A38553": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:33 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
using http://127.0.0.1:35083 as paul@keymail.dev
account: ops (bab)
2026/10/24 22:15:36 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A35083": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:36 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
set 1 env var(s) for titogo (default)
using http://127.0.0.1:35083 as paul@keymail.dev
account: ops (bab)
set 1 secret(s) for titogo (default)
account: ops (bab)
account: ops (bab)
using http://127.0.0.1:35083 as paul@keymail.dev
account: ops (bab)
config sync requested for titogo the files land within seconds; programs carlos owns restart themselves, and anything else keeps its old values until you restart it
2026/10/24 22:15:36 console: delivery to mallory@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=mallory%40keymail.dev&from=console%40127.0.0.1%3A35083": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:36 console: could not notify mallory@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:38 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:15:38 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:15:38 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:15:39 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:15:39 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:15:39 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:15:39 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:39 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A42377": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:39 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:15:39 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:15:39 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:15:39 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:15:40 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:15:40 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:15:40 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:15:41 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:15:41 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A38411": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:15:41 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:22 console: db read dbr_b6i34ucrmflsbaoqtllf3jcbde: relayed 1 chunks (101 bytes) in 41.035s, ended done
2026/10/24 22:16:22 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:16:22 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:16:22 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:16:23 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:16:23 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:16:23 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:16:23 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:16:23 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A41969": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:23 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:24 console: db read dbr_ozufqvubysixqiqllaewvzffxi: relayed 1 chunks (1070 bytes) in 1.001s, ended done
2026/10/24 22:16:25 console: db read dbr_2xekywmjhuivsodpxkolfltyie: relayed 1 chunks (805 bytes) in 1.001s, ended done
2026/10/24 22:16:25 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:16:25 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:16:25 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:16:26 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:16:26 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:16:26 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:16:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:16:26 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A33273": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:26 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:27 console: db read dbr_rx3xrl4zc2dtl3kvlrg7665avu: relayed 2 chunks (8386 bytes) in 1.044s, ended client gone
using http://127.0.0.1:35939 as paul@keymail.dev
account: ops (bab)
attached tickets.example.com -> default.go.tito.io
DNS: pointing
using http://127.0.0.1:35939 as paul@keymail.dev
account: ops (bab)
attached carloku.example.com -> default.go.tito.io
2026/10/24 22:16:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:16:28 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A46063": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:28 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:28 console: delivery to rival@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=rival%40keymail.dev&from=console%40127.0.0.1%3A46063": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:28 console: could not notify rival@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:36 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A37297": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:36 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:37 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:16:37 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A34145": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:16:37 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:16:38 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/24 22:16:38 domains: minted platform domain blog.mdbbndjqx.oncarlos.test (upstream blog.kass.test)
2026/10/24 22:16:38 domains: minted platform domain blog.gdpkwhwrw.oncarlos.test (upstream blog.woodstar.test)
2026/10/24 22:16:38 domains: minted platform domain oldsite.bab.oncarlos.test (upstream old.test)
2026/10/24 22:16:38 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/24 22:16:38 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 22:16:38 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
FAIL
FAIL	github.com/carlosframework/platform	90.005s
FAIL

FAILED: rest root@2
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/internal/activator/activator.go b/internal/activator/activator.go

index a1589d086..4e37ea0af 100644

--- a/internal/activator/activator.go

+++ b/internal/activator/activator.go

@@ -3333,8 +3333,12 @@ func (a *Service) agentSocket() string {

// agentSocketRouter is a backend that knows a row's own agent socket: a

// nested worker's listener in its run directory (sidecar isolation D3).

+// nestedWorkerRow is the row's shape alone (a worker row whose database is

+// the nested path), whatever a journal or a peer says: the shared socket's

+// refusal must not lift because a nested row is fenced mid-move.

type agentSocketRouter interface {

perHostAgentSocket(rt registry.Route) (string, bool)

+ nestedWorkerRow(rt registry.Route) bool

}

// agentSocketFor is the agent socket the worker for rt dials, workerEnv's

@@ -3966,6 +3970,31 @@ func (a *Service) WorkerToken(host string) string {

return ""

}

+// SharedWorkerToken is WorkerToken for the shared agent socket (sidecar

+// isolation D3, Review Focus 4): "" for a nested worker, whose only channel

+// is its own pinned listener. The entry's worker is nested if the launch its

+// token was minted for ran nested (launchLayout, set at install), or if its

+// row is a nested worker row (a waking entry, whose launch is not yet

+// installed, and every respawn of it). Neither depends on a pinned listener

+// being open, so a nested worker's token stays refused on the shared socket

+// through a crash, a failed respawn and its backoff. Only a flat transition

+// gives the host back: a flat row, woken flat, with a token of its own.

+func (a *Service) SharedWorkerToken(host string) string {

+ a.mu.Lock()

+ defer a.mu.Unlock()

+ e := a.entries[host]

+ if e == nil || !e.worker || !(e.state == actAwake || e.state == actWaking) {

+ return ""

+ }

+ if e.launchLayout == LayoutNested {

+ return ""

+ }

+ if r, ok := a.backend.(agentSocketRouter); ok && r.nestedWorkerRow(e.route) {

+ return ""

+ }

+ return e.workerToken

// setWorkerToken publishes a wake's freshly minted credential onto the entry.

// Its own critical section because doWake runs off a.mu — every other write to

// an entry's fields is likewise made under the lock.

diff --git a/internal/activator/backend_unit.go b/internal/activator/backend_unit.go

index 2dc80cac4..d740bc5a3 100644

--- a/internal/activator/backend_unit.go

+++ b/internal/activator/backend_unit.go

@@ -419,6 +419,15 @@ func (b *SplitBackend) perHostAgentSocket(rt registry.Route) (string, bool) {

return "", false

}

+// nestedWorkerRow forwards to the exec side, as perHostAgentSocket does.

+func (b *SplitBackend) nestedWorkerRow(rt registry.Route) bool {

+ if rt.Backing == registry.BackingUnit {

+ return false

+ }

+ s, ok := b.Exec.(agentSocketRouter)

+ return ok && s.nestedWorkerRow(rt)

func (b *SplitBackend) StartSidecar(ctx context.Context, rt registry.Route) (Proc, error) {

return b.pick(rt).StartSidecar(ctx, rt)

}

diff --git a/internal/activator/prepare.go b/internal/activator/prepare.go

index 3eef175ea..d17471572 100644

--- a/internal/activator/prepare.go

+++ b/internal/activator/prepare.go

@@ -85,6 +85,14 @@ func (b *ExecBackend) agentSocketFor(rt registry.Route) string {

return DefaultAgentSocket

}

+// nestedWorkerRow reports whether rt is a worker row in the nested shape

+// (D2: no socket, the nested database path), by the row alone: a fenced or

+// conflicting nested row still answers true. The shared agent socket

+// refuses such a host's token (SharedWorkerToken).

+func (b *ExecBackend) nestedWorkerRow(rt registry.Route) bool {

+ return WorkerManaged(rt) && rt.Socket == "" && rt.DBPath == provision.NestedDBPath(b.DataDir, rt.Host)

// perHostAgentSocket is agentSocketFor's per-host half: the pinned

// listener's path and true for a nested worker row, false for every other

// row, which dials the shared socket. The run directory honours

diff --git a/internal/activator/prepare_test.go b/internal/activator/prepare_test.go

index 3b21cb8c0..3f7ad451f 100644

--- a/internal/activator/prepare_test.go

+++ b/internal/activator/prepare_test.go

@@ -34,6 +34,7 @@ func (w *pinWorkers) WorkerToken(host string) string {

defer w.mu.Unlock()

return w.tokens[host]

}

+func (w *pinWorkers) SharedWorkerToken(host string) string { return w.WorkerToken(host) }

func (w *pinWorkers) NoteWorkerContact(host string) {

w.mu.Lock()

defer w.mu.Unlock()

@@ -205,8 +206,7 @@ func TestPrepareWorkerHasNoAdminToken(t *testing.T) {

// TestPrepareWorkerAgentListenerClosesAfterDone: the worker's unitProc

// owns the agent listener. An unproven stop leaves it answering (a worker

// that may still run keeps its channel), and once the unit is proven gone

-// closeListeners closes it with no second Stop: the socket file is gone and

-// the host is the shared socket's again.

+// closeListeners closes it with no second Stop: the socket file is gone.

func TestPrepareWorkerAgentListenerClosesAfterDone(t *testing.T) {

ctl := &fakeControl{inv: "inv1"}

unit := &fakeUnit{}

@@ -215,9 +215,6 @@ func TestPrepareWorkerAgentListenerClosesAfterDone(t *testing.T) {

if err != nil {

t.Fatalf("prepareWorker: %v", err)

}

- if code := sharedHeartbeat(b.AgentSock, rt.Host, "tok"); code != http.StatusUnauthorized {

- t.Fatalf("the moved worker's token on the shared socket: %d, want 401", code)

- }

unit.set("active", "inv1", true, true)

up := b.newWorkerUnitProc(rt, p, "inv1", logs, agent)

if up.role != instancectl.RoleWorker || up.unit != instancectl.UnitName(instancectl.RoleWorker, rt.Host) {

@@ -242,9 +239,6 @@ func TestPrepareWorkerAgentListenerClosesAfterDone(t *testing.T) {

if code := heartbeatOver(agent.Path(), rt.Host, "tok"); code != 0 {

t.Fatalf("agent listener still answers after done: %d", code)

}

- if code := sharedHeartbeat(b.AgentSock, rt.Host, "tok"); code != http.StatusNoContent {

- t.Fatalf("the host on the shared socket once its listener closed: %d, want 204", code)

- }

}

// TestPrepareWorkerFailedGateClosesTheAgentListener: a refusal after the

@@ -261,9 +255,6 @@ func TestPrepareWorkerFailedGateClosesTheAgentListener(t *testing.T) {

if _, err := os.Lstat(filepath.Join(b.pathsFor(rt).runDir, "agent.sock")); !os.IsNotExist(err) {

t.Fatalf("the refused prepare left the agent socket: %v", err)

}

- if code := sharedHeartbeat(b.AgentSock, rt.Host, "tok"); code != http.StatusNoContent {

- t.Fatalf("the host stayed pinned after a refused prepare: %d", code)

- }

}

// TestPrepareWorkerRefusesWhatItCannotServe: a flat worker row, a backend

@@ -334,3 +325,117 @@ func TestAgentSocketForNestedWorkerIsPerHost(t *testing.T) {

t.Errorf("plain backend: %s, want the shared socket", got)

}

+// TestWorkerTokenRefusedOnSharedSocketAfterCrashAndFailedRespawn is Review

+// Focus 4 through the real Service, as the agent wires it (the Service

+// answers both the shared socket and the pinned listener). A nested

+// worker's live token is refused on the shared socket while it serves, and

+// stays refused once it has crashed, its listener has closed and a respawn

+// has failed, leaving the old token live on the entry.

+func TestWorkerTokenRefusedOnSharedSocketAfterCrashAndFailedRespawn(t *testing.T) {

+ old := sidecarSettle

+ sidecarSettle = 0

+ t.Cleanup(func() { sidecarSettle = old })

+ h := newWorkerHarness(t, nil)

+ h.stage("v1", stubScript(t, "v1"))

+ a, _, _, _ := lifecycleService(t, h, time.Hour)

+ host, unit := h.host, h.workerUnit()

+ h.writeTenantEnv("STUB_MODE=serve\n")

+ if err := a.WakeWorker(h.rt); err != nil {

+ t.Fatalf("WakeWorker: %v\nsystemd:\n%s", err, h.sd.joined())

+ }

+ waitFor(t, "the worker to be ready", func() bool { return a.workerReady(host) })

+ tok := a.WorkerToken(host)

+ if tok == "" {

+ t.Fatal("no live token for the awake worker")

+ }

+ pinned := h.b.agentSocketFor(h.rt)

+ if code := heartbeatOver(pinned, host, tok); code != http.StatusNoContent {

+ t.Fatalf("the worker's token on its own listener: %d, want 204", code)

+ }

+ if code := sharedHeartbeat(h.b.AgentSock, host, tok); code != http.StatusUnauthorized {

+ t.Fatalf("the nested worker's token on the shared socket while it serves: %d, want 401", code)

+ }

+ // The crash, then a respawn that fails: a symlink at the env file is

+ // refused by the read through instancefs, so nothing starts.

+ if err := h.sd.unitOf(unit).cmd.Process.Kill(); err != nil {

+ t.Fatal(err)

+ }

+ waitFor(t, "the crash to be observed", func() bool { return a.workerProcExited(host) })

+ own := filepath.Join(h.instanceDir(), host+".env")

+ outside := filepath.Join(h.root, "elsewhere.env")

+ if err := os.WriteFile(outside, []byte("STUB_MODE=serve\n"), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.Remove(own); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.Symlink(outside, own); err != nil {

+ t.Fatal(err)

+ }

+ a.sweepOnce()

+ waitFor(t, "the failed respawn", func() bool {

+ return hasLine(h.sink.eventLines(), "sidecar could not be restarted")

+ })

+ if h.sd.startCount() != 1 {

+ t.Fatalf("starts = %d: the respawn was meant to fail before its start", h.sd.startCount())

+ }

+ if got := a.WorkerToken(host); got != tok {

+ t.Fatalf("the failed respawn replaced the token (%q -> %q); this test needs the old one live", tok, got)

+ }

+ if _, err := os.Lstat(pinned); !os.IsNotExist(err) {

+ t.Fatalf("the dead unit's pinned listener is still bound: %v", err)

+ }

+ if code := sharedHeartbeat(h.b.AgentSock, host, tok); code != http.StatusUnauthorized {

+ t.Fatalf("the old token on the shared socket after the listener closed and a respawn failed: %d, want 401", code)

+ }

+ a.Bounce(host)

+ waitFor(t, "the final stop", func() bool { return !a.Owns(host) })

+// TestSharedWorkerTokenNeedsAFlatTransition: SharedWorkerToken answers from

+// the entry that holds the token, through the composed backend: refused for

+// a nested row (waking, before its launch is installed) and for a token

+// minted for a nested launch even once the row reads flat; answered for a

+// flat row woken flat, the explicit flat transition; never for an entry

+// WorkerToken would refuse.

+func TestSharedWorkerTokenNeedsAFlatTransition(t *testing.T) {

+ b, rt, _ := nestedWorkerBackend(t, &fakeControl{}, &fakeUnit{})

+ flat := rt

+ flat.DBPath = provision.DefaultDBPath(b.DataDir, rt.Host)

+ a := New(Config{}, &SplitBackend{Exec: b, Unit: &UnitBackend{}}, nil)

+ set := func(e *actEntry) {

+ e.host, e.workerToken = rt.Host, "tok"

+ a.mu.Lock()

+ a.entries[rt.Host] = e

+ a.mu.Unlock()

+ }

+ for _, tc := range []struct {

+ name string

+ e *actEntry

+ shared string

+ }{

+ {"nested row, waking", &actEntry{worker: true, state: actWaking, route: rt}, ""},

+ {"nested row, launched nested", &actEntry{worker: true, state: actAwake, route: rt, launchLayout: LayoutNested}, ""},

+ {"row reads flat, token minted for a nested launch", &actEntry{worker: true, state: actAwake, route: flat, launchLayout: LayoutNested}, ""},

+ {"flat row woken flat", &actEntry{worker: true, state: actAwake, route: flat, launchLayout: LayoutFlat}, "tok"},

+ {"flat row, waking", &actEntry{worker: true, state: actWaking, route: flat}, "tok"},

+ {"flat row, stopping", &actEntry{worker: true, state: actStopping, route: flat, launchLayout: LayoutFlat}, ""},

+ {"not a worker", &actEntry{state: actAwake, route: flat, launchLayout: LayoutFlat}, ""},

+ } {

+ set(tc.e)

+ if got := a.SharedWorkerToken(rt.Host); got != tc.shared {

+ t.Errorf("%s: SharedWorkerToken = %q, want %q", tc.name, got, tc.shared)

+ }

+ if tc.shared != "" && a.WorkerToken(rt.Host) != tc.shared {

+ t.Errorf("%s: WorkerToken disagrees with the shared answer for a flat worker", tc.name)

+ }

+ a.mu.Lock()

+ delete(a.entries, rt.Host)

+ a.mu.Unlock()

+ if got := a.SharedWorkerToken(rt.Host); got != "" {

+ t.Errorf("no entry: %q", got)

+ }

diff --git a/internal/agentsock/agentsock.go b/internal/agentsock/agentsock.go

index d2d0d3c5c..f01c09c8c 100644

--- a/internal/agentsock/agentsock.go

+++ b/internal/agentsock/agentsock.go

@@ -49,8 +49,19 @@ import (

// WorkerToken returns "" for a host that is unknown, asleep, or stopped. That

// is a REFUSAL, never "no token required" — see authorize.

+//

+// SharedWorkerToken is the token the SHARED socket accepts for host:

+// WorkerToken's, except "" for a host whose worker is nested (sidecar

+// isolation D3, Review Focus 4). A nested worker's only channel is its own

+// pinned listener, so its token, leaked or not, is refused on the shared

+// socket. That is the activator's answer from its own state (the row and

+// the launch the token was minted for), not this package's, and it does not

+// depend on whether a pinned listener happens to be open: only a flat

+// transition gives a host back to the shared socket. One call, so the token

+// and the nested answer are read together.

type Workers interface {

WorkerToken(host string) string

+ SharedWorkerToken(host string) string

NoteWorkerContact(host string)

SetWorkerNextDue(host string, at int64) error

SleepWorker(host string)

@@ -94,14 +105,10 @@ const (

)

// Server serves the agent socket. Zero per-request state: one instance

-// answers every child on the box concurrently. Its one piece of state is

-// which hosts are currently served by a pinned listener of their own

-// (ListenPinned), which the shared socket then refuses.

+// answers every child on the box concurrently, on the shared socket and on

+// every pinned listener.

type Server struct {

w Workers

- mu sync.Mutex

- pinned map[string]int // host -> live pinned listeners for it

}

// New builds the socket server over w.

@@ -157,30 +164,6 @@ func pinnedTo(r *http.Request, host string) bool {

return len(v) == 1 && v[0] == host

}

-// isPinned reports whether host is currently served by a pinned listener.

-func (s *Server) isPinned(host string) bool {

- s.mu.Lock()

- defer s.mu.Unlock()

- return s.pinned[host] > 0

-func (s *Server) pin(host string) {

- s.mu.Lock()

- defer s.mu.Unlock()

- if s.pinned == nil {

- s.pinned = map[string]int{}

- }

- s.pinned[host]++

-func (s *Server) unpin(host string) {

- s.mu.Lock()

- defer s.mu.Unlock()

- if s.pinned[host]--; s.pinned[host] <= 0 {

- delete(s.pinned, host)

- }

// authorize resolves the caller to the one host it may speak about.

// The dangerous shape here is WorkerToken returning "" — unknown host, asleep,

@@ -202,17 +185,21 @@ func (s *Server) unpin(host string) {

// signal beyond the length leak inherent to any comparison.

// onPinned says the request arrived on a host's pinned listener (guard has

-// already checked the pin). On the shared socket a host that is served by a

-// pinned listener has no token here (sidecar isolation D3, Review Focus 4):

-// a nested worker's token, leaked or not, is useless on the shared socket,

-// and the refusal runs the same compare against an unmatchable value.

+// already checked the pin), where the host's live token is WorkerToken's.

+// On the shared socket it is SharedWorkerToken's, "" for a nested worker

+// (sidecar isolation D3, Review Focus 4), so a nested worker's token is

+// refused there by the same compare against an unmatchable value.

func (s *Server) authorize(r *http.Request, onPinned bool) (string, bool) {

host := r.Header.Get(hostHeader)

presented := bearer(r.Header.Get("Authorization"))

want := ""

- if host != "" && (onPinned || !s.isPinned(host)) {

- want = s.w.WorkerToken(host)

+ if host != "" {

+ if onPinned {

+ want = s.w.WorkerToken(host)

+ } else {

+ want = s.w.SharedWorkerToken(host)

+ }

}

if want == "" {

want = unmatchable()

@@ -423,10 +410,10 @@ func newHTTPServer(h http.Handler) *http.Server {

// Pinned is a listener bound for one host (sidecar isolation D3): a nested

// worker's own agent socket, in its run directory. It is served by the same

// Server as the shared socket, with the same verbs and the same token check,

-// and admits only requests that name its host (guard). While it is open the

-// shared socket refuses that host.

+// and admits only requests that name its host (guard). The shared socket's

+// refusal of a nested host is the Workers' (SharedWorkerToken), not this

+// listener's: closing it gives the shared socket nothing back.

type Pinned struct {

- s *Server

path string

host string

srv *http.Server

@@ -448,10 +435,7 @@ func (s *Server) ListenPinned(path, host string) (*Pinned, error) {

if err != nil {

return nil, err

}

- // Pinned before the first request can arrive: from here on the shared

- // socket refuses host.

- s.pin(host)

- p := &Pinned{s: s, path: path, host: host, srv: newHTTPServer(s.handler(host)), errc: make(chan error, 1)}

+ p := &Pinned{path: path, host: host, srv: newHTTPServer(s.handler(host)), errc: make(chan error, 1)}

go func() { p.errc <- p.srv.Serve(ln) }()

return p, nil

}

@@ -462,9 +446,8 @@ func (p *Pinned) Path() string { return p.path }

// Host is the host the listener answers for.

func (p *Pinned) Host() string { return p.host }

-// Close stops serving, closes the listener (which unlinks the socket file

-// it created, and only that one) and returns host to the shared socket.

-// Safe to call more than once and concurrently; every call returns the

+// Close stops serving and closes the listener, which unlinks the socket file

+// it created, and only that one. Safe to call more than once and concurrently; every call returns the

// first call's result.

func (p *Pinned) Close() error {

p.once.Do(func() {

@@ -474,7 +457,6 @@ func (p *Pinned) Close() error {

if err := <-p.errc; !errors.Is(err, http.ErrServerClosed) && p.closeErr == nil {

p.closeErr = err

}

- p.s.unpin(p.host)

})

return p.closeErr

}

diff --git a/internal/agentsock/agentsock_test.go b/internal/agentsock/agentsock_test.go

index 111a7887d..6663efa21 100644

--- a/internal/agentsock/agentsock_test.go

+++ b/internal/agentsock/agentsock_test.go

@@ -21,6 +21,7 @@ import (

type fakeWorkers struct {

mu sync.Mutex

tokens map[string]string

+ nested map[string]bool // hosts whose worker is nested: SharedWorkerToken answers ""

contacts []string

due map[string]int64

dueErr error

@@ -34,6 +35,24 @@ func (f *fakeWorkers) WorkerToken(host string) string {

return f.tokens[host]

}

+func (f *fakeWorkers) SharedWorkerToken(host string) string {

+ f.mu.Lock()

+ defer f.mu.Unlock()

+ if f.nested[host] {

+ return ""

+ }

+ return f.tokens[host]

+func (f *fakeWorkers) setNested(host string, nested bool) {

+ f.mu.Lock()

+ defer f.mu.Unlock()

+ if f.nested == nil {

+ f.nested = map[string]bool{}

+ }

+ f.nested[host] = nested

func (f *fakeWorkers) NoteWorkerContact(host string) {

f.mu.Lock()

defer f.mu.Unlock()

@@ -822,11 +841,12 @@ func TestPinnedSocketRefusesALiveSocket(t *testing.T) {

}

// TestWorkerTokenRefusedOnSharedSocketAfterMove is Review Focus 4's second

-// half. Once a host is served by its own pinned listener (it moved to

-// nested), its token is refused on the shared socket with the uniform 401:

-// the shared socket is not a second door for a nested worker's leaked

-// token. When the pinned listener closes the host is the shared socket's

-// again, as a host that moved back to flat must be.

+// half. While a host's worker is nested its token is refused on the shared

+// socket with the uniform 401 and no effect, whether or not its pinned

+// listener is open: before it is bound (a waking entry), while it serves,

+// after it closed with the row still nested (a crash), and after a failed

+// respawn left the old token live. Only a flat transition gives the host

+// back to the shared socket. A flat neighbour is untouched throughout.

func TestWorkerTokenRefusedOnSharedSocketAfterMove(t *testing.T) {

const a, b = "a.x.internal", "b.x.internal"

f := &fakeWorkers{tokens: map[string]string{a: "tok-a", b: "tok-b"}}

@@ -837,41 +857,62 @@ func TestWorkerTokenRefusedOnSharedSocketAfterMove(t *testing.T) {

if rec := post(shared, "/v1/heartbeat", a, "tok-a", ""); rec.Code != http.StatusNoContent {

t.Fatalf("flat A on the shared socket: %d, want 204", rec.Code)

}

+ contactsFlat, _, _, _ := f.effects()

- pl, err := s.ListenPinned(filepath.Join(shortSockDir(t), "agent.sock"), a)

- if err != nil {

- t.Fatal(err)

- }

- before, _, _, _ := f.effects()

- for _, verb := range allVerbs {

- body := ""

- switch verb {

- case "/v1/ready":

- body = `{"version":"v1"}`

- case "/v1/next-due":

- body = `{"at":1756}`

+ refused := func(stage string) {

+ t.Helper()

+ before, _, _, _ := f.effects()

+ for _, verb := range allVerbs {

+ body := ""

+ switch verb {

+ case "/v1/ready":

+ body = `{"version":"v1"}`

+ case "/v1/next-due":

+ body = `{"at":1756}`

+ }

+ rec := post(shared, verb, a, "tok-a", body)

+ if rec.Code != http.StatusUnauthorized || rec.Body.String() != want {

+ t.Fatalf("%s: nested A's token on the shared socket %s: %d %q, want the uniform 401", stage, verb, rec.Code, rec.Body.String())

+ }

}

- rec := post(shared, verb, a, "tok-a", body)

- if rec.Code != http.StatusUnauthorized || rec.Body.String() != want {

- t.Fatalf("moved A's token on the shared socket %s: %d %q, want the uniform 401", verb, rec.Code, rec.Body.String())

+ if after, slept, due, ready := f.effects(); after != before || slept != 0 || len(due) != 0 || len(ready) != 0 {

+ t.Fatalf("%s: a refused shared-socket call had an effect: contacts %d->%d slept=%d due=%v ready=%v", stage, before, after, slept, due, ready)

+ }

+ if rec := post(shared, "/v1/heartbeat", b, "tok-b", ""); rec.Code != http.StatusNoContent {

+ t.Fatalf("%s: flat B on the shared socket: %d, want 204", stage, rec.Code)

}

- if after, slept, due, ready := f.effects(); after != before || slept != 0 || len(due) != 0 || len(ready) != 0 {

- t.Fatalf("a refused shared-socket call had an effect: contacts %d->%d slept=%d due=%v ready=%v", before, after, slept, due, ready)

- }

- // A flat neighbour is untouched by A's move.

- if rec := post(shared, "/v1/heartbeat", b, "tok-b", ""); rec.Code != http.StatusNoContent {

- t.Fatalf("flat B on the shared socket while A is pinned: %d, want 204", rec.Code)

+ // The move: A's row is nested. No pinned listener yet (a waking entry).

+ f.setNested(a, true)

+ refused("nested, no listener yet")

+ pl, err := s.ListenPinned(filepath.Join(shortSockDir(t), "agent.sock"), a)

+ if err != nil {

+ t.Fatal(err)

}

- // And A is still answered where it lives now.

+ refused("nested, listener open")

if code, _ := pinnedCall(t, pl.Path(), "/v1/heartbeat", []string{a}, "tok-a", ""); code != http.StatusNoContent {

t.Fatalf("A on its pinned listener: %d, want 204", code)

}

+ // The worker crashed: its listener closed, the row is still nested, the

+ // entry still holds the token.

if err := pl.Close(); err != nil {

t.Fatal(err)

}

+ refused("listener closed, row still nested")

+ // A failed respawn: the old token stays live, no listener is bound.

+ refused("after a failed respawn")

+ // The flat transition: the row is flat again and woken flat.

+ f.setNested(a, false)

if rec := post(shared, "/v1/heartbeat", a, "tok-a", ""); rec.Code != http.StatusNoContent {

- t.Fatalf("A on the shared socket after its pinned listener closed: %d, want 204", rec.Code)

+ t.Fatalf("A on the shared socket once its row is flat: %d, want 204", rec.Code)

+ }

+ // B at each of the four refused stages, A on its listener, A flat again.

+ if contacts, _, _, _ := f.effects(); contacts != contactsFlat+6 {

+ t.Fatalf("contacts = %d, want %d", contacts, contactsFlat+6)

}