amadan
Sidecar isolation Task 10: downgrade guards hold the workers floor (D11 rev 4)
Install refuses, beside R9's guard and before the journal, a candidate below release.WorkerLayoutFloor (or, unparseable, one whose staged units lack carlos-instance-worker@.service) while /etc/carlos/host.env sets CARLOS_NESTED_WORKERS=on (an unreadable host.env counts as on) or the layout row test names a worker host (nested, fenced/conflict, or a journal). layoutReversalIncomplete returns hosts and failed reads apart; a registry that cannot be read cannot vouch. The console's layoutDowngradeBlocked gains the same floor over observed worker hosts and over boxes whose agent started opted in; stale and silent boxes block as for the layout floor, silence below the workers floor reading as worker-clear. Refusal texts are Task 12 placeholders. Census claims added for the three systemapply.go units.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
7 files changed,
+568
−29
implementation/census-claims-sidecar-isolation.txt+3 −0internal/console/layoutguard.go+54 −12internal/console/layoutguard_copy.go+15 −0internal/console/layoutguard_test.go+90 −1internal/host/systemapply.go+132 −11internal/host/systemapply_test.go+249 −5internal/host/workerguard_copy.go+25 −0
CI failed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok amadan.net/carlos/platform.git/launchctx 0.013s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (18 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (173 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.788s
ok github.com/carlosframework/platform/cmd/moveprobe 11.789s
ok github.com/carlosframework/platform/cmd/zddprobe 0.702s
ok github.com/carlosframework/platform/internal/activator 59.563s
ok github.com/carlosframework/platform/internal/agentsock 0.068s
ok github.com/carlosframework/platform/internal/alerting 0.009s
ok github.com/carlosframework/platform/internal/analytics 0.034s
ok github.com/carlosframework/platform/internal/appconfig 2.831s
ok github.com/carlosframework/platform/internal/apperr 0.203s
ok github.com/carlosframework/platform/internal/applog 0.231s
ok github.com/carlosframework/platform/internal/awsinv 0.017s
ok github.com/carlosframework/platform/internal/boxchoice 0.006s
ok github.com/carlosframework/platform/internal/boxid 1.221s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.016s
ok github.com/carlosframework/platform/internal/caps 0.037s
ok github.com/carlosframework/platform/internal/certwarm 0.005s
ok github.com/carlosframework/platform/internal/cgroup 0.838s
ok github.com/carlosframework/platform/internal/changelog 0.488s
ok github.com/carlosframework/platform/internal/claimactivation 1.139s
ok github.com/carlosframework/platform/internal/clamd 0.065s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 8.524s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.022s
ok github.com/carlosframework/platform/internal/dbquery 0.015s
ok github.com/carlosframework/platform/internal/dbreads 2.206s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.014s
ok github.com/carlosframework/platform/internal/dnsrec 0.011s
ok github.com/carlosframework/platform/internal/docsite 0.030s
ok github.com/carlosframework/platform/internal/domains 2.872s
ok github.com/carlosframework/platform/internal/doorkey 0.033s
ok github.com/carlosframework/platform/internal/economics 0.015s
ok github.com/carlosframework/platform/internal/edge 45.901s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.014s
ok github.com/carlosframework/platform/internal/fleetapi 0.142s
ok github.com/carlosframework/platform/internal/gate 1.658s
ok github.com/carlosframework/platform/internal/genselect 0.024s
ok github.com/carlosframework/platform/internal/geo 0.017s
ok github.com/carlosframework/platform/internal/geoip 0.030s
ok github.com/carlosframework/platform/internal/historyreadback 0.159s
ok github.com/carlosframework/platform/internal/host 143.560s
ok github.com/carlosframework/platform/internal/hostactors 6.223s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.016s
ok github.com/carlosframework/platform/internal/hostbox 3.087s
ok github.com/carlosframework/platform/internal/hostclaim 0.694s
ok github.com/carlosframework/platform/internal/hostenv 0.016s
ok github.com/carlosframework/platform/internal/hostevidence 0.016s
ok github.com/carlosframework/platform/internal/hostexec 5.437s
ok github.com/carlosframework/platform/internal/hostfence 0.038s
ok github.com/carlosframework/platform/internal/hostfiles 10.388s
ok github.com/carlosframework/platform/internal/hostfloor 0.021s
ok github.com/carlosframework/platform/internal/hostguard 1.053s
ok github.com/carlosframework/platform/internal/hostops 2.043s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.021s
ok github.com/carlosframework/platform/internal/hostquarantine 0.021s
ok github.com/carlosframework/platform/internal/hostrelocate 0.620s
ok github.com/carlosframework/platform/internal/hostresolve 0.224s
ok github.com/carlosframework/platform/internal/hostwrite 0.016s
ok github.com/carlosframework/platform/internal/infraview 0.016s
ok github.com/carlosframework/platform/internal/instancectl 6.912s
ok github.com/carlosframework/platform/internal/instanceexec 2.828s
ok github.com/carlosframework/platform/internal/instancefs 0.018s
ok github.com/carlosframework/platform/internal/instancekey 0.018s
ok github.com/carlosframework/platform/internal/instanceupdates 0.020s
ok github.com/carlosframework/platform/internal/layout 2.541s
ok github.com/carlosframework/platform/internal/lbhealth 0.015s
ok github.com/carlosframework/platform/internal/lease 10.140s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.563s
ok github.com/carlosframework/platform/internal/ledger 0.036s
ok github.com/carlosframework/platform/internal/mail 0.207s
ok github.com/carlosframework/platform/internal/maintenance 0.078s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.544s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.124s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 22.465s
ok github.com/carlosframework/platform/internal/moves/archive 1.041s
ok github.com/carlosframework/platform/internal/objstore 0.299s
ok github.com/carlosframework/platform/internal/ops 0.282s
ok github.com/carlosframework/platform/internal/park 0.321s
ok github.com/carlosframework/platform/internal/plans 0.006s
ok github.com/carlosframework/platform/internal/privatefile 0.007s
2026/10/25 00:19:04 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:04 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:04 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:04 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/25 00:19:04 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:04 provision: an app's records could not be listed: they are skipped
2026/10/25 00:19:04 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:04 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:19:04 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:19:04 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:19:04 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:19:04 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:19:04 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:19:04 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:19:04 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:19:04 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:19:04 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:19:04 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:19:04 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:19:04 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:19:04 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:19:04 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:19:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:04 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:19:05 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:19:05 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:19:05 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:19:05 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:19:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:05 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:19:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:05 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:05 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:19:05 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:19:05 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/25 00:19:05 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/25 00:19:05 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:05 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:05 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (0.77s)
plan9_b8_census_test.go:372: record-write census rejected 4 site(s); update the explicit inventory only after reviewing the source:
changed site internal/instanceexec/exit.go:RunExit: source differs from the reviewed digest
changed site internal/layout/plan.go:PlanFor: source differs from the reviewed digest
changed site internal/ops/litestream.go:FleetDBsWithSkipped: source differs from the reviewed digest
changed site internal/provision/sidecar_reconcile.go:ReconcileSidecars: source differs from the reviewed digest
2026/10/25 00:19:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:06 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/25 00:19:07 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/25 00:19:07 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/25 00:19:07 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io hibernate false -> true
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged acme.go.tito.io status-named false -> true
2026/10/25 00:19:07 provision: converged acme.go.tito.io status-named true -> false
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:19:07 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:19:07 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:19:07 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:19:07 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/25 00:19:07 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:19:07 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:19:07 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:19:07 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:19:07 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:07 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:19:07 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/25 00:19:07 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/25 00:19:07 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:07 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:19:07 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:07 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/25 00:19:07 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:19:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:07 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:19:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:07 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:19:07 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:07 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:07 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/25 00:19:07 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:19:07 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/25 00:19:07 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:07 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:19:07 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/25 00:19:07 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/25 00:19:07 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:19:07 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/25 00:19:07 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/25 00:19:07 provision: dry-run: would converge owned.go.tito.io seed
2026/10/25 00:19:07 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/25 00:19:07 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:07 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:19:07 provision: converged owned.go.tito.io channel stable -> edge
2026/10/25 00:19:07 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/25 00:19:07 provision: converged owned.go.tito.io hibernate false -> true
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/25 00:19:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/25 00:19:07 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/25 00:19:07 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:07 provision: removed retired static route site.go.tito.io (record gone)
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/25 00:19:08 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/25 00:19:08 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:08 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:19:08 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:19:08 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:19:08 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:19:08 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/25 00:19:08 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:19:08 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:19:08 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:19:08 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:19:08 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/25 00:19:08 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/25 00:19:08 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:19:08 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/25 00:19:08 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/25 00:19:08 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:19:08 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/25 00:19:08 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:19:08 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:08 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:09 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:09 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:09 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:19:09 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:09 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:19:09 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/25 00:19:09 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/25 00:19:09 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:19:09 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:19:09 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:09 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:09 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:19:09 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:09 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:09 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:19:09 provision: a.shop.example.com: swapped for import sd_6vbkazjt6kikhclmwdinkh5ldi (the original route is journaled)
2026/10/25 00:19:09 provision: a.shop.example.com: import sd_6vbkazjt6kikhclmwdinkh5ldi committed: its gate is cleared and its journal row dropped
2026/10/25 00:19:09 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_p54g2dynqecns4rzrfzbmxkgba rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_p54g2dynqecns4rzrfzbmxkgba: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_p54g2dynqecns4rzrfzbmxkgba is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_pkll5omlgs35xzej5hnb6zsjly rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_pkll5omlgs35xzej5hnb6zsjly: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_pkll5omlgs35xzej5hnb6zsjly is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_bgq3n25djhzeorijywixodt6o4
2026/10/25 00:19:10 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/25 00:19:10 provision: dry-run: would converge a.shop.example.com seed source
2026/10/25 00:19:10 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/25 00:19:10 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/25 00:19:10 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_rdkziksqvl4efz3u4njuyhn75q cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_jdaf7f3kiktk4abrahdvjkume4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_jmlq7crwcsxsjusi7yfuwoby2q is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_ps3elyga2jr3acrlwt3rkxrjoq is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_7zd3kl24jz6yoogocxxfiwfwq4 is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:19:10 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/25 00:19:10 provision: b.shop.example.com: import sd_fjmpa6g2f5u6vdjtgraqppccxq left alone this pass: the import journal could not be read
2026/10/25 00:19:10 provision: c.shop.example.com: import sd_2zvrqnhuh3nihwhem4zi3ytcju left alone this pass: the import journal could not be read
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_pm7udfxgwdzwdstfabtrxdf2ea committed: its gate is cleared and its journal row dropped
2026/10/25 00:19:10 provision: a.shop.example.com: not converging import sd_kittpf67sljb7thbf72b2kzaey: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:19:10 provision: a.shop.example.com: not converging import sd_tkfd6ddlk34w5mrjm2ukkpu4cq: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:19:10 provision: a.shop.example.com: not converging import sd_6syb23dzl7mrgrph7elwamppay: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:19:10 provision: a.shop.example.com: not converging import sd_y5giog4hwg7b6x3xyolk5iwypm: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:19:10 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/25 00:19:10 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_7v5unk7x2nhd5kkvmdrgexj5w4 committed: its gate is cleared and its journal row dropped
2026/10/25 00:19:10 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:10 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:10 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/25 00:19:10 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_wx6t7wgh44xzwinqnfayjcck5u: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_wx6t7wgh44xzwinqnfayjcck5u rolled back (no box had swapped it)
2026/10/25 00:19:10 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/25 00:19:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:10 provision: removed instance route acme.go.tito.io (its seed sd_3b2x4gpd2ttrgwbd4ikdkuycxy was aborted); the next pass rolls it back
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_3b2x4gpd2ttrgwbd4ikdkuycxy: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_3b2x4gpd2ttrgwbd4ikdkuycxy rolled back (no box had swapped it)
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_zokwnyjrruk5gouax6dqzh4r5i has a row this pass may not remove; leaving the seed aborted
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_vi4cv7aa7vaplffntloop2i44a rolled back (no box had swapped it)
2026/10/25 00:19:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:10 provision: removed instance route acme.go.tito.io (its seed sd_rqrdmhivhgudvhtxk6yip44aoe was aborted); the next pass rolls it back
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_rqrdmhivhgudvhtxk6yip44aoe has no route on this box: its local data is removed
2026/10/25 00:19:10 provision: acme.go.tito.io: aborted seed sd_rqrdmhivhgudvhtxk6yip44aoe rolled back (no box had swapped it)
2026/10/25 00:19:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_33gvwcd2c7fcq7wohvicil72ze (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_33gvwcd2c7fcq7wohvicil72ze rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_33gvwcd2c7fcq7wohvicil72ze is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_urniirjckgz4vax6aonmxg3w3i (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_urniirjckgz4vax6aonmxg3w3i rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_urniirjckgz4vax6aonmxg3w3i is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_427tpnvssaadcoxwe5mimoonki (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_427tpnvssaadcoxwe5mimoonki rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_427tpnvssaadcoxwe5mimoonki: the host's replica is left alone: its record no longer names this seed
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_427tpnvssaadcoxwe5mimoonki is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_prwbep2d52zc5t5gycrrqa5wsi (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_prwbep2d52zc5t5gycrrqa5wsi rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_prwbep2d52zc5t5gycrrqa5wsi rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_prwbep2d52zc5t5gycrrqa5wsi is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_5erq54jo2wfm6xqrh7yxh76d7i (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_5erq54jo2wfm6xqrh7yxh76d7i rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_22zt5a6lpu25p2tybdx5hugv2q (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_22zt5a6lpu25p2tybdx5hugv2q is cleaned up and its journal row retired
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_v43wvsgfgzd5cingkbz2b2fi7u (the original route is journaled)
2026/10/25 00:19:10 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_v43wvsgfgzd5cingkbz2b2fi7u left alone this pass: its record could not be read
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_3725mzcz7yhwcdmtrnjsn6hzku (the original route is journaled)
2026/10/25 00:19:10 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_3725mzcz7yhwcdmtrnjsn6hzku left alone this pass: its record could not be read
2026/10/25 00:19:10 provision: a.shop.example.com: swapped for import sd_j4pop25ihslk6qkdb7jwmmwwiu (the original route is journaled)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_j4pop25ihslk6qkdb7jwmmwwiu: close the import gate: constraint failed: injected (1811)
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_j4pop25ihslk6qkdb7jwmmwwiu rolled back to its original route
2026/10/25 00:19:10 provision: a.shop.example.com: import sd_j4pop25ihslk6qkdb7jwmmwwiu is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_yxdakcs54ukdbpluucoijegr2u (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_yxdakcs54ukdbpluucoijegr2u: close the import gate: constraint failed: injected (1811)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_yxdakcs54ukdbpluucoijegr2u rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_yxdakcs54ukdbpluucoijegr2u is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_555itmuyt6gbfbuiunekkujav4 (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_555itmuyt6gbfbuiunekkujav4 rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_555itmuyt6gbfbuiunekkujav4 rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_555itmuyt6gbfbuiunekkujav4 is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_6laplgnisllrqtlogedadap3ei (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_6laplgnisllrqtlogedadap3ei rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_6laplgnisllrqtlogedadap3ei is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_aco5irrnefgaclrpfgyfzownc4 (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_aco5irrnefgaclrpfgyfzownc4: retire its instance key: injected failure at retire-key
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_aco5irrnefgaclrpfgyfzownc4 rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_aco5irrnefgaclrpfgyfzownc4 is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_4rtsmgdzxijpviihihbimiey5i (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_4rtsmgdzxijpviihihbimiey5i rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_4rtsmgdzxijpviihihbimiey5i is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_nfb35t4nut2s2ra7gxzvcg5aiu (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_nfb35t4nut2s2ra7gxzvcg5aiu: remove its local data: injected failure at remove-local
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_nfb35t4nut2s2ra7gxzvcg5aiu rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_nfb35t4nut2s2ra7gxzvcg5aiu is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_xtsybezt2xqiggruff4uoxmare (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xtsybezt2xqiggruff4uoxmare rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xtsybezt2xqiggruff4uoxmare is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_6n3uuy4x4elw757t5zbagp5zfy (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_6n3uuy4x4elw757t5zbagp5zfy: remove its local data: injected failure at remove-local-done
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_6n3uuy4x4elw757t5zbagp5zfy rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_6n3uuy4x4elw757t5zbagp5zfy is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_ewiwaeravbjvq7iua4bvtg2pyq (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_ewiwaeravbjvq7iua4bvtg2pyq rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_ewiwaeravbjvq7iua4bvtg2pyq is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_qtsmupcirafm4lwl2k2xoo72pm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qtsmupcirafm4lwl2k2xoo72pm: restore the original route: constraint failed: injected (1811)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qtsmupcirafm4lwl2k2xoo72pm rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qtsmupcirafm4lwl2k2xoo72pm is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_v2ubwsvzkogixef447szkg3yhe (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_v2ubwsvzkogixef447szkg3yhe: restore the original route: constraint failed: injected (1811)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_v2ubwsvzkogixef447szkg3yhe rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_v2ubwsvzkogixef447szkg3yhe is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_juqwq7xpr2tt5tcvclwzdv6h6e (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_juqwq7xpr2tt5tcvclwzdv6h6e is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_lvdi6qjngjmwhemgf6xlrkcmba (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_lvdi6qjngjmwhemgf6xlrkcmba rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_lvdi6qjngjmwhemgf6xlrkcmba: delete its snapshot: injected failure at delete-snapshot
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_lvdi6qjngjmwhemgf6xlrkcmba is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_eu66gttnw5yhf3jowypuui3gdi (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_eu66gttnw5yhf3jowypuui3gdi rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_eu66gttnw5yhf3jowypuui3gdi is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_qm6uo5yvjdec4hjv5p3ffbvodi (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qm6uo5yvjdec4hjv5p3ffbvodi rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qm6uo5yvjdec4hjv5p3ffbvodi: delete the host's replica: injected failure at delete-replica
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_qm6uo5yvjdec4hjv5p3ffbvodi is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_ys75tl7qnok4cslcti7w7sbyfy (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_ys75tl7qnok4cslcti7w7sbyfy rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_ys75tl7qnok4cslcti7w7sbyfy is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_gkc2bw7s4v5vzkkdkmlzoubvqe (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gkc2bw7s4v5vzkkdkmlzoubvqe rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gkc2bw7s4v5vzkkdkmlzoubvqe: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gkc2bw7s4v5vzkkdkmlzoubvqe is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_gt77y3je5j4u4roacw3kazyc2q (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gt77y3je5j4u4roacw3kazyc2q rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gt77y3je5j4u4roacw3kazyc2q: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gt77y3je5j4u4roacw3kazyc2q is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_gjiy5qjqbuemvzbk7sv5mt5fbu (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gjiy5qjqbuemvzbk7sv5mt5fbu rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_gjiy5qjqbuemvzbk7sv5mt5fbu is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: mark import sd_gjiy5qjqbuemvzbk7sv5mt5fbu rolled back: injected failure at cas
2026/10/25 00:19:11 provision: a.shop.example.com: aborted seed sd_gjiy5qjqbuemvzbk7sv5mt5fbu rolled back (no box had swapped it)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_h5yrhdtblyovlnxhmjafvg6cwu (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_h5yrhdtblyovlnxhmjafvg6cwu rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_h5yrhdtblyovlnxhmjafvg6cwu is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: aborted seed sd_h5yrhdtblyovlnxhmjafvg6cwu rolled back (no box had swapped it)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_xym2hevppxqoi2ac4wyynmwcpa (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xym2hevppxqoi2ac4wyynmwcpa rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xym2hevppxqoi2ac4wyynmwcpa rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xym2hevppxqoi2ac4wyynmwcpa rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xym2hevppxqoi2ac4wyynmwcpa is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_sww4uwuzy6xgtncoufmcxdap2e (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_sww4uwuzy6xgtncoufmcxdap2e rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_sww4uwuzy6xgtncoufmcxdap2e is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_odxui7njwirxnnhdqxbqi5wknm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_odxui7njwirxnnhdqxbqi5wknm rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_odxui7njwirxnnhdqxbqi5wknm is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_7jdhpxmd4d7bchdxgmz3ovjjbm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_7jdhpxmd4d7bchdxgmz3ovjjbm rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_7jdhpxmd4d7bchdxgmz3ovjjbm is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_aqcootyf7tspr5udntwuv77f6m (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_aqcootyf7tspr5udntwuv77f6m rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_aqcootyf7tspr5udntwuv77f6m is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_mrajglnywwmevdt2bsflju5rmu (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_mrajglnywwmevdt2bsflju5rmu rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_mrajglnywwmevdt2bsflju5rmu is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_txdteajx7rtx3fs46llpoqkjz4 (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_txdteajx7rtx3fs46llpoqkjz4 rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_txdteajx7rtx3fs46llpoqkjz4 is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_iyjb3g6h7bmvgcqtxdertbzcmq (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_iyjb3g6h7bmvgcqtxdertbzcmq rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_iyjb3g6h7bmvgcqtxdertbzcmq is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_awduahqd4b6pmntbortrmfufea (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_awduahqd4b6pmntbortrmfufea has no route on this box: its local data is removed and no route is put back
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_awduahqd4b6pmntbortrmfufea is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_62gwzszqgrzjys6e47wd66pr6i (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_jv3zekappjkhlou6xl47lmlt7m (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_hmm577zkbfltqqtlqgwma54xiy (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_hmm577zkbfltqqtlqgwma54xiy cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_eqhdekqpcqjce4hgwiobocjs5m (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_eqhdekqpcqjce4hgwiobocjs5m is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/25 00:19:11 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/25 00:19:11 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_7us7b5633gfrtsu2dcs52xvr4e (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_n3fl4xg376exwputx5daoet6rm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_uqy4zv52fpjl4rd63xom45d64m (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_hrvfp6w2rkzsjzgve6kxpn7ryq (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_x2mvb6soa7vv25nmxezjdlzq2u (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_x2mvb6soa7vv25nmxezjdlzq2u rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_euvyalrrn3rw3fv2wxhfoddixe (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_euvyalrrn3rw3fv2wxhfoddixe has no route on this box: its local data is removed and no route is put back
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_euvyalrrn3rw3fv2wxhfoddixe is cleaned up and its journal row retired
2026/10/25 00:19:11 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_a2swfvscvixmjtum42bdrj7sg4 (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_a2swfvscvixmjtum42bdrj7sg4: remove its local data: injected failure at remove-local
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_a2swfvscvixmjtum42bdrj7sg4 is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_vhlvquc7cinlmewpl26plir2rm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_vhlvquc7cinlmewpl26plir2rm: a route appeared at the host, so its local database is left and the rollback waits
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_xjm3e2dmt2r5xspw5yag77uf64 (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_xjm3e2dmt2r5xspw5yag77uf64 rollback deferred: no fence generation: registry busy
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_zt7qduju3movtzrfwyjcv5cpvu (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_zt7qduju3movtzrfwyjcv5cpvu rollback deferred: no fence generation: the generation source answered 0
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_vkvzdp26q7mnbeostnwvr2faui (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_oc4ibgidxx7yrlxbh7rrblnk5q (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_yyplgw6c5khj7c7z57cpk2pzlm (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/25 00:19:11 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/25 00:19:11 provision: a.shop.example.com: swapped for import sd_5d244md5lrxkbyt6j4xf6fny4m (the original route is journaled)
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_5d244md5lrxkbyt6j4xf6fny4m rolled back to its original route
2026/10/25 00:19:11 provision: a.shop.example.com: import sd_5d244md5lrxkbyt6j4xf6fny4m is cleaned up and its journal row retired
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_lbkae2izglvuybbmwndooyzel4 (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_lbkae2izglvuybbmwndooyzel4 rolled back to its original route
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_lbkae2izglvuybbmwndooyzel4 is cleaned up and its journal row retired
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_4lzj7zazkjkcoiryk2o3myr72e (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_4lzj7zazkjkcoiryk2o3myr72e rolled back to its original route
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_4lzj7zazkjkcoiryk2o3myr72e is cleaned up and its journal row retired
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_fbpmw2fagvio3eke22rkxzktem (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_fbpmw2fagvio3eke22rkxzktem: retire its instance key: the env file is a symlink
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_fbpmw2fagvio3eke22rkxzktem rolled back to its original route
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_fbpmw2fagvio3eke22rkxzktem is cleaned up and its journal row retired
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_2azebi6qriselgav7kywddxxme (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_nml2ca5jln4j2w22pvkmn5ju4y (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_qieh5atsarmetczw7zfxkqlvh4 refused: there is no route at a.shop.example.com to replace
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_agin3kpkgg7lk26ngrylr3buoe refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_5uchzg2cuuytbvo64trofjjtmi refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_i5noxwfjckhzl37fv7wjm5geyu refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_mydgwl4l7ll3gpspp5txhwuc3y refused: the route belongs to app other
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_ys4ty67bv5x6vtezd4zzhlioz4 refused: the route is filed under another account
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_67nd4rnuzq76fjmce56qef3ore refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_dcr4ibod7pcfubeakpgndrvtx4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_sjrinikytav3i7haeync7qyt5e refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_mpjujfbxn23wcdr5diiqwofxtu refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_hnr43izqv43myatvtle3rtco3m refused: the route is not an address route this import can take over (socket)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_zrpwf3pg3vrmdglrltp5k5buqm refused: the route is not an address route this import can take over (no address)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_qdqszfumnb5r4lv2tds3xgp22i refused: the route is not an address route this import can take over (provisioned)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_urol5xmyuqaemyjju3jhsht3le refused: the route is not an address route this import can take over (kind static)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_gnu5dqozjp62asasfqdr56yope refused: the route is not an address route this import can take over (backing)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_ev6tjleoymyoljixiaknilopjm refused: the route is not an address route this import can take over (tunnel)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_x3jey2gyustxrzr7pzynlayurm refused: the route is not an address route this import can take over (caps)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_ksi4xetp56inz64hv2rukk5cdq refused: the route is not an address route this import can take over (platform)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_jn2il74rlcsiilrppgejj2etly refused: the route is not an address route this import can take over (canary)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_zokb3utlkw5lrexrpxxmpf5gyu refused: the route is not an address route this import can take over (kind sidecar)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_cpsd4xms6efgda4fvwedkrju3m refused: the route is not an address route this import can take over (region)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_ep675x5aoroi7whkv4d3di2udq refused: the route is not an address route this import can take over (fleet_box)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_fy575j6zq2okymlq2hpesbfnxy refused: the route is not an address route this import can take over (hibernate)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_onh3jecdnfrnnimwcimzzv6osy refused: the route is not an address route this import can take over (claim_owner)
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_6mmhm5oot4oemqwvf3nliyldhe refused: this box does not run instances nested
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_ezujqpspu3kaq4wvo3ytwlccw4 refused: this box does not run instances nested
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_j6c3urqf2mjdy2d6v6sjtqdopa refused: claim control is on for this box
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_3fdexyqgcpowhzlqodcuzh4bhm (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_arnjqkbnrytc7gmkuzk7uavlg4 (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/25 00:19:12 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_5j3ake6tmnkfydcfhxtshxkxsq: its verify hash is not a sha256
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_lufrb2ogzok5iz2h5omds2ebou: its verify hash is not a sha256
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_nn3hekdfolxapn6ehh2y3m6usy: its verify hash is not a sha256
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/25 00:19:12 provision: A.shop.example.com/..: not swapping for import sd_3timgar2yyono3j7ehocuwgv2y: its host or seed id is malformed (seeds: not a host)
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_tqezvbhgzdojaphvlfm4avrdfe: its record does not describe a nested, hibernating instance
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_i5rte42t3xdtl5oxjim6z7inqy: its record does not describe a nested, hibernating instance
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_tj3lbmyrlw2ek7qciloo5jdnsa: its record does not describe a nested, hibernating instance
2026/10/25 00:19:12 provision: a.shop.example.com: not swapping for import sd_tgmnhx5jifhjwcpwfhrtmere3a: its record does not describe a nested, hibernating instance
2026/10/25 00:19:12 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_yo4traq7woqnekg56bpgs6bwgi (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_q77h63zartn35ouek5ym4pwjq4 (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_gxxrbi5sz2nefqu5w2yokzogwu (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/25 00:19:12 provision: dry-run: would consider swapping a.shop.example.com for import sd_cyvvtdyyvpyksqyuwbsj6ckyem
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_4o3tmkigeb7vahmdtuumzgv7w4 rolled back to its original route
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_4o3tmkigeb7vahmdtuumzgv7w4: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_4o3tmkigeb7vahmdtuumzgv7w4 is cleaned up and its journal row retired
2026/10/25 00:19:12 provision: a.shop.example.com: import sd_c45jkaosx7p7kqs6eyfkc3u6ry left alone: the import journal holds seed sd_hkxlgi36rqsff26tpq76nuonwa at swapped
2026/10/25 00:19:12 provision: a.shop.example.com: not minting import sd_ayap7gzjiduojxxffpztohq3zq: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:19:12 provision: a.shop.example.com: not minting import sd_jrfg7jqf6z5mc3ohp2cesq2fzm: it is placed but not committed, and only its swap makes its row
2026/10/25 00:19:12 provision: a.shop.example.com: swapped for import sd_5dvvjr6dw3dqdunpctkew5s7qu (the original route is journaled)
2026/10/25 00:19:12 provision: a.shop.example.com: not minting import sd_5dvvjr6dw3dqdunpctkew5s7qu: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:19:12 provision: a.shop.example.com: not minting import sd_5dvvjr6dw3dqdunpctkew5s7qu: it is placed but not committed, and only its swap makes its row
2026/10/25 00:19:12 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:19:12 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:19:12 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:12 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:12 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/25 00:19:12 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:12 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/25 00:19:12 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:12 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/25 00:19:12 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/25 00:19:12 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/25 00:19:12 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/25 00:19:12 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/25 00:19:12 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:19:13 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/25 00:19:13 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/25 00:19:13 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:19:13 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:19:13 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/25 00:19:13 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:19:13 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/25 00:19:13 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/25 00:19:13 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:19:13 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: sidecar bot.eleven.bac.sidecar.internal: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:19:13 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:19:13 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:19:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:13 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/25 00:19:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:13 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:19:13 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:19:13 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:19:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:19:13 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:19:13 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:19:13 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:19:13 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:13 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:13 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:13 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:13 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: record view: change index unusable (get refused): walking
2026/10/25 00:19:13 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:19:13 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:19:13 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:13 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:19:13 provision: an app's records could not be listed: they are skipped
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:19:13 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:19:13 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:19:13 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/25 00:19:13 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:19:13 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:19:13 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:19:13 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:19:13 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:19:13 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:19:13 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:19:13 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:19:13 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:19:13 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:19:13 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/25 00:19:13 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (15.46s)
plan14_root_reads_test.go:600: root read census: 124 discrepancies
changed root read internal/activator/activator.go:Service.doWake; review class, task, sites and digest
changed root read internal/activator/activator.go:Service.respawnWorkerLocked; review class, task, sites and digest
changed root read internal/activator/activator.go:Service.stop; review class, task, sites and digest
changed root read internal/activator/activator.go:Service.sweepOnce; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.LegacyRunGone; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.spawnInCgroupGated; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom; review class, task, sites and digest
changed root read internal/activator/backend_unit.go:SplitBackend.LegacyRunGone; review class, task, sites and digest
changed root read internal/activator/containment.go:ExecBackend.spawnInCgroupAtTier; review class, task, sites and digest
changed root read internal/activator/containment.go:Service.legacyRunGone; review class, task, sites and digest
changed root read internal/activator/layout.go:Classify; review class, task, sites and digest
changed root read internal/activator/maintenance.go:Service.cleanupFailedWake; review class, task, sites and digest
changed root read internal/activator/opset.go:Service.reapUnprovenWake; review class, task, sites and digest
changed root read internal/activator/prepare.go:ExecBackend.prepareAt; review class, task, sites and digest
changed root read internal/activator/prepare.go:ExecBackend.prepareKeyedAt; review class, task, sites and digest
changed root read internal/activator/unitproc.go:ExecBackend.observe; review class, task, sites and digest
changed root read internal/activator/workerswap.go:Service.ReplaceWorker; review class, task, sites and digest
changed root read internal/appconfig/syncexec.go:nestedRoute; review class, task, sites and digest
changed root read internal/host/agent.go:fastConvergeLoop; review class, task, sites and digest
changed root read internal/host/agent.go:runAgent; review class, task, sites and digest
changed root read internal/host/agent.go:statusLoop; review class, task, sites and digest
changed root read internal/host/layoutleg.go:layoutStatusReport; review class, task, sites and digest
changed root read internal/host/layoutleg.go:unmanagedLayoutReport; review class, task, sites and digest
changed root read internal/host/systemapply.go:layoutReversalIncomplete; review class, task, sites and digest
changed root read internal/instancectl/server.go:parseRequest; review class, task, sites and digest
changed root read internal/instancectl/server.go:type Server; review class, task, sites and digest
changed root read internal/layout/journal.go:Validate; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.Converge; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.convergeHost; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.migrateHost; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.recoverHost; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.restoreHold; review class, task, sites and digest
changed root read internal/layout/pass.go:Pass.shift; review class, task, sites and digest
changed root read internal/ops/hibernate_verify.go:HibernatingHosts; review class, task, sites and digest
changed root read internal/ops/litestream.go:FleetDBsWithSkipped; review class, task, sites and digest
changed root read internal/ops/ops.go:runLitestream; review class, task, sites and digest
changed root read internal/provision/sidecar_reconcile.go:ReconcileSidecars; review class, task, sites and digest
changed root read internal/provision/sidecar_reconcile.go:convergeSidecar; review class, task, sites and digest
changed root read internal/status/snapshot.go:CollectBox; review class, task, sites and digest
changed root source envelope internal/activator
changed root source envelope internal/agentsock
changed root source envelope internal/appconfig
changed root source envelope internal/console
changed root source envelope internal/host
changed root source envelope internal/host/units
changed root source envelope internal/hostenv
changed root source envelope internal/instancectl
changed root source envelope internal/instanceexec
changed root source envelope internal/layout
changed root source envelope internal/ops
changed root source envelope internal/provision
changed root source envelope internal/release
changed root source envelope internal/status
stale root read internal/activator/control.go:systemctlUnitState
stale root read internal/host/systemapply.go:systemApplier.install
stale root read internal/host/systemapply.go:systemApplier.layoutReversalReasons
unclassified root read internal/activator/activator.go:Service.SharedWorkerToken whole:Route@329
unclassified root read internal/activator/activator.go:Service.agentSocketFor whole:Route@148
unclassified root read internal/activator/backend_exec.go:ExecBackend.RoleGone registry:Host@192,registry:Host@228,registry:Host@271,registry:Host@562
unclassified root read internal/activator/backend_exec.go:ExecBackend.startWorkerUnit registry:Host@1137,registry:Host@1299,registry:Host@1647,registry:Host@1775,registry:Host@2094,registry:Host@2193,registry:Host@626,registry:Host@698,whole:Route@1341,whole:Route@2291,whole:Route@328,whole:Route@419
unclassified root read internal/activator/backend_unit.go:SplitBackend.RoleGone file:Exec@263,registry:Backing@107,registry:Host@217,registry:Host@323,whole:Route@377
unclassified root read internal/activator/backend_unit.go:SplitBackend.nestedWorkerRow file:Exec@134,registry:Backing@69,whole:Route@193
unclassified root read internal/activator/backend_unit.go:SplitBackend.perHostAgentSocket file:Exec@154,registry:Backing@82,whole:Route@217
unclassified root read internal/activator/containment.go:Service.roleGone whole:Route@581
unclassified root read internal/activator/control.go:systemctlUnitFacts file:CommandContext@105
unclassified root read internal/activator/flatexec.go:ExecBackend.admitFlatExec whole:Route@126,whole:Route@155
unclassified root read internal/activator/flatexec.go:FlatExecPolicy.Admit registry:Host@201,registry:Host@278,registry:Host@320,registry:Host@378,registry:Host@97
unclassified root read internal/activator/layout.go:WorkerManaged registry:Backing@71,registry:Tunnel@91
unclassified root read internal/activator/opset.go:Service.stopUnitProven registry:Host@309,whole:Route@101,whole:Route@177
unclassified root read internal/activator/prepare.go:ExecBackend.agentSocketFor whole:Route@102
unclassified root read internal/activator/prepare.go:ExecBackend.nestedWorkerRow registry:DBPath@112,registry:Host@159,registry:Socket@93,whole:Route@86
unclassified root read internal/activator/prepare.go:ExecBackend.perHostAgentSocket whole:Route@141,whole:Route@96
unclassified root read internal/activator/prepare.go:ExecBackend.prepareWorker whole:Route@210
unclassified root read internal/activator/unitproc.go:ExecBackend.newWorkerUnitProc registry:Host@244,registry:Host@286,whole:Route@167,whole:Route@171
unclassified root read internal/host/flatexec.go:flatExecInventory registry:Host@288,registry:Host@457,whole:Route@181,whole:Route@223,whole:Route@255,whole:Route@331
unclassified root read internal/host/flatexec.go:flatExecStatusReport whole:Route@544,whole:Route@548,whole:Route@603,whole:Route@758,whole:Route@796,whole:Route@812
unclassified root read internal/host/layoutleg.go:layoutRowsReport registry:Hibernate@956,registry:Host@1106,registry:Host@658,registry:Host@812,registry:Host@894,registry:Kind@911,registry:Socket@936,whole:Route@151,whole:Route@313,whole:Route@367,whole:Route@396,whole:Route@434,whole:Route@438
unclassified root read internal/host/units/carlos-instance-worker@.service:external file:external@0
unclassified root read internal/layout/pass.go:Pass.managed whole:Route@136,whole:Route@84
unclassified root read internal/layout/plan.go:WorkerRowAgrees registry:Kind@236,registry:Kind@366
unclassified root read internal/layout/replicator.go:configFile.unchanged file:Stat@63
unclassified root read internal/layout/replicator.go:readConfig file:Open@62,file:ReadAll@635,file:Stat@1043,file:Stat@262,file:Stat@783
unclassified root read internal/layout/replicator.go:systemctlShow file:CommandContext@161
unclassified root read internal/layout/replicator.go:unitCgroupEmpty file:ReadFile@339
unclassified root read internal/ops/litestream.go:ActivatorReplicated registry:Backing@59,registry:DBPath@97,registry:Hibernate@117
unclassified root read internal/ops/litestream.go:ActivatorReplicatedPaths registry:DBPath@257,whole:Route@178,whole:Route@212
changed legacy declaration internal/activator/activator.go:Service.doWake
changed legacy declaration internal/activator/activator.go:Service.stop
changed legacy declaration internal/activator/activator.go:Service.sweepOnce
changed legacy declaration internal/activator/backend_exec.go:ExecBackend.LegacyRunGone
changed legacy declaration internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged
changed legacy declaration internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom
changed legacy declaration internal/activator/backend_unit.go:SplitBackend.LegacyRunGone
changed legacy declaration internal/activator/containment.go:Service.legacyRunGone
changed legacy declaration internal/activator/layout.go:Classify
changed legacy declaration internal/activator/maintenance.go:Service.cleanupFailedWake
changed legacy declaration internal/activator/opset.go:Service.reapUnprovenWake
changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareAt
changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareKeyedAt
changed legacy declaration internal/activator/unitproc.go:ExecBackend.observe
changed legacy declaration internal/appconfig/syncexec.go:nestedRoute
changed legacy declaration internal/host/agent.go:statusLoop
changed legacy declaration internal/instancectl/server.go:parseRequest
changed legacy declaration internal/instancectl/server.go:type Server
changed legacy declaration internal/layout/journal.go:Validate
changed legacy declaration internal/layout/pass.go:Pass.Converge
changed legacy declaration internal/layout/pass.go:Pass.convergeHost
changed legacy declaration internal/layout/pass.go:Pass.migrateHost
changed legacy declaration internal/layout/pass.go:Pass.recoverHost
changed legacy declaration internal/layout/pass.go:Pass.restoreHold
changed legacy declaration internal/layout/pass.go:Pass.shift
changed legacy declaration internal/ops/hibernate_verify.go:HibernatingHosts
changed legacy declaration internal/ops/litestream.go:FleetDBsWithSkipped
changed legacy declaration internal/ops/ops.go:runLitestream
changed legacy declaration internal/provision/sidecar_reconcile.go:ReconcileSidecars
changed legacy declaration internal/provision/sidecar_reconcile.go:convergeSidecar
changed legacy declaration internal/status/snapshot.go:CollectBox
changed reclassified declaration internal/activator/activator.go:Service.respawnWorkerLocked
changed reclassified declaration internal/activator/backend_exec.go:ExecBackend.spawnInCgroupGated
changed reclassified declaration internal/activator/containment.go:ExecBackend.spawnInCgroupAtTier
changed reclassified declaration internal/activator/workerswap.go:Service.ReplaceWorker
changed reclassified declaration internal/host/agent.go:fastConvergeLoop
legacy declaration needs explicit reclassification or removal internal/activator/control.go:systemctlUnitState
make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL github.com/carlosframework/platform/internal/provision 24.433s
ok github.com/carlosframework/platform/internal/publicrelease 0.012s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.636s
ok github.com/carlosframework/platform/internal/relay 7.234s
ok github.com/carlosframework/platform/internal/release 25.858s
ok github.com/carlosframework/platform/internal/rollout 3.899s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.013s
ok github.com/carlosframework/platform/internal/rootparticipation 0.061s
ok github.com/carlosframework/platform/internal/rootstate 0.027s
ok github.com/carlosframework/platform/internal/runs 0.506s
ok github.com/carlosframework/platform/internal/s3compat 0.006s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.720s
ok github.com/carlosframework/platform/internal/seeds 0.012s
ok github.com/carlosframework/platform/internal/sim/engines 2.854s
ok github.com/carlosframework/platform/internal/sim/hostlife 11.031s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.218s
ok github.com/carlosframework/platform/internal/status 0.075s
ok github.com/carlosframework/platform/internal/steering 0.008s
ok github.com/carlosframework/platform/internal/stopevidence 0.298s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.005s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.013s
ok github.com/carlosframework/platform/internal/usage 0.007s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.672s
FAIL
=== internal_console@0 (82 s)
ok github.com/carlosframework/platform/internal/console 80.543s
=== internal_console@1 (41 s)
ok github.com/carlosframework/platform/internal/console 39.954s
=== internal_console@2 (40 s)
ok github.com/carlosframework/platform/internal/console 38.427s
=== internal_console@3 (44 s)
ok github.com/carlosframework/platform/internal/console 42.948s
=== internal_console@4 (42 s)
ok github.com/carlosframework/platform/internal/console 40.363s
=== internal_console@5 (41 s)
ok github.com/carlosframework/platform/internal/console 39.130s
=== internal_console@6 (40 s)
ok github.com/carlosframework/platform/internal/console 38.434s
=== internal_console@7 (47 s)
ok github.com/carlosframework/platform/internal/console 45.172s
=== root@0 (110 s)
ok github.com/carlosframework/platform 108.498s
=== root@1 (84 s)
ok github.com/carlosframework/platform 82.791s
=== root@2 (92 s)
using http://127.0.0.1:44999 as a@keymail.dev
using http://127.0.0.1:45451 as vicky@keymail.dev
titogo (staging):
KEY VALUE
PORT 8080
--- FAIL: TestRunBuiltCopyIsApplied (0.13s)
approved_run_copy_test.go:139: RUN-C13: internal/instanceexec/exec.go does not contain the approved text "instance-exec: role <role> is not run, seed, sidecar or cmd"
approved_run_copy_test.go:139: RUN-C14: internal/instanceexec/exit.go does not contain the approved text "instance-exit: role <role> is not run, seed, sidecar or cmd"
2026/10/25 00:19:16 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:16 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44873": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:16 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:16 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44873": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:16 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:16 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:16 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A40853": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:16 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:18 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:18 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A35535": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:18 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:18 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:18 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A40181": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:18 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:20 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:20 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44691": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:20 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:22 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:22 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44755": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:22 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
using http://127.0.0.1:33961 as paul@keymail.dev
account: ops (bab)
2026/10/25 00:19:25 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A33961": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:25 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
set 1 env var(s) for titogo (default)
using http://127.0.0.1:33961 as paul@keymail.dev
account: ops (bab)
set 1 secret(s) for titogo (default)
account: ops (bab)
account: ops (bab)
using http://127.0.0.1:33961 as paul@keymail.dev
account: ops (bab)
config sync requested for titogo the files land within seconds; programs carlos owns restart themselves, and anything else keeps its old values until you restart it
2026/10/25 00:19:25 console: delivery to mallory@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=mallory%40keymail.dev&from=console%40127.0.0.1%3A33961": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:25 console: could not notify mallory@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:27 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:19:27 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:19:27 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:19:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:19:28 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:19:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:19:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:28 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A46033": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:28 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:19:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:19:28 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:19:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:19:29 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:19:29 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:19:29 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:19:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:19:30 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A34883": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:19:30 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:11 console: db read dbr_uzxrpehobsopl75tqksbnis4ni: relayed 1 chunks (101 bytes) in 41.031s, ended done
2026/10/25 00:20:11 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:20:11 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:20:11 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:20:12 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:20:12 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:20:12 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:20:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:20:12 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A39315": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:12 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:13 console: db read dbr_ftlxyecmzprxxh75d2cps3oqpy: relayed 1 chunks (1070 bytes) in 1.001s, ended done
2026/10/25 00:20:14 console: db read dbr_nlt35kbaeeukc5o4ta5hce5cga: relayed 1 chunks (805 bytes) in 1.002s, ended done
2026/10/25 00:20:14 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:20:14 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:20:14 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:20:15 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:20:15 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:20:15 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:20:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:20:15 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A35343": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:15 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:16 console: db read dbr_3y5zbv5x3kxpgrpdhqytupemne: relayed 2 chunks (8386 bytes) in 1.043s, ended client gone
using http://127.0.0.1:35065 as paul@keymail.dev
account: ops (bab)
attached tickets.example.com -> default.go.tito.io
DNS: pointing
using http://127.0.0.1:35065 as paul@keymail.dev
account: ops (bab)
attached carloku.example.com -> default.go.tito.io
2026/10/25 00:20:17 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:20:17 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43295": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:17 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:17 console: delivery to rival@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=rival%40keymail.dev&from=console%40127.0.0.1%3A43295": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:17 console: could not notify rival@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:26 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A45875": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:26 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:20:26 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A42821": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:20:26 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:20:27 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/25 00:20:27 domains: minted platform domain blog.mdbbndjqx.oncarlos.test (upstream blog.kass.test)
2026/10/25 00:20:27 domains: minted platform domain blog.gdpkwhwrw.oncarlos.test (upstream blog.woodstar.test)
2026/10/25 00:20:27 domains: minted platform domain oldsite.bab.oncarlos.test (upstream old.test)
2026/10/25 00:20:27 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:20:28 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 00:20:28 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
FAIL
FAIL github.com/carlosframework/platform 90.412s
FAIL
FAILED: rest root@2
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/implementation/census-claims-sidecar-isolation.txt b/implementation/census-claims-sidecar-isolation.txt| index da7bedcdf..a493f4bae 100644 |
| --- a/implementation/census-claims-sidecar-isolation.txt |
| +++ b/implementation/census-claims-sidecar-isolation.txt |
| @@ -29,3 +29,6 @@ internal/host/flatexec.go:flatExecStatusReport NEW: the policy, spawn record, in |
| internal/host/layoutleg.go:layoutStatusReport now sets the workers readiness word and reason on the report (D14) and delegates the rows to layoutRowsReport; its own reads moved there |
| internal/host/layoutleg.go:layoutRowsReport NEW: layoutStatusReport's former body, unchanged: the rows of the layout report through the pass Classify; the same reads layoutStatusReport had |
| internal/status/snapshot.go:CollectBox carries Probes.FlatExec into BoxMetrics.FlatExec, counted as a known metric (D14); no new read |
| +internal/host/systemapply.go:systemApplier.install beside R9 and before the journal, refuses a pre-worker candidate (version below release.WorkerLayoutFloor, or unparseable and no carlos-instance-worker@.service in its staged units) while host.env sets CARLOS_NESTED_WORKERS=on (unreadable counts as on) or the row test names a worker host (D11 rev 4, R3-1); no new read |
| +internal/host/systemapply.go:layoutReversalIncomplete returns the named hosts and the failed reads apart (hosts, problems) so the workers floor can tell a worker host from an error; the same reads, the same hosts named |
| +internal/host/systemapply.go:systemApplier.layoutReversalReasons opens the registry through guardRegistry (the seam it had inline) and joins layoutReversalIncomplete's hosts and problems into the same list as before; no new read |
diff --git a/internal/console/layoutguard.go b/internal/console/layoutguard.go| index a2f3ea488..8f314c65c 100644 |
| --- a/internal/console/layoutguard.go |
| +++ b/internal/console/layoutguard.go |
| @@ -2,10 +2,12 @@ package console |
| import ( |
| "context" |
| + "fmt" |
| "sort" |
| "strings" |
| "time" |
| + "github.com/carlosframework/platform/internal/provision" |
| "github.com/carlosframework/platform/internal/release" |
| "github.com/carlosframework/platform/internal/status" |
| ) |
| @@ -16,13 +18,23 @@ import ( |
| // refuses the install too, but only on the box that runs it; this one |
| // stops the pointer moving at all, so no box has to refuse. |
| // |
| +// It also holds the workers floor (sidecar isolation spec rev 4, D11): a |
| +// pointer must not move below release.WorkerLayoutFloor (or to a release |
| +// that cannot be placed against it) while any box reports a worker row |
| +// (provision.SidecarSuffix) nested, fenced or in conflict, or reports that |
| +// its agent started opted into nested workers: a release before the |
| +// nested worker runs such a row flat and unisolated, and the box's own |
| +// install refuses it on the same terms. |
| +// |
| // It judges OBSERVED state, never the intent: a revert refused on a box |
| // leaves a nested row under a flat intent. A box that has not reported in |
| // time, or whose snapshot carries no layout at all, is unknown and blocks, |
| // because the cost of guessing is a database hidden under a mount. The |
| // empty string means the move is allowed. |
| func (s *Server) layoutDowngradeBlocked(ctx context.Context, target string) string { |
| - if !release.PreLayout(target) { |
| + preLayout := release.PreLayout(target) |
| + preWorker := !release.AtOrAboveFloor(target, release.WorkerLayoutFloor) |
| + if !preLayout && !preWorker { |
| return "" |
| } |
| // Every fleet's boxes, the union carlos system status reads. Strict: |
| @@ -30,14 +42,23 @@ func (s *Server) layoutDowngradeBlocked(ctx context.Context, target string) stri |
| // unknown, and unknown blocks. |
| boxes, _, err := s.systemBoxes(ctx, true) |
| if err != nil { |
| + if !preLayout { |
| + return fmt.Sprintf(workerDowngradeUnknownCopy, target, err.Error()) |
| + } |
| return target + " predates the instance layout and the fleet's layout is unknown: could not read the boxes' snapshots: " + err.Error() |
| } |
| now := time.Now() |
| - var reasons []string |
| + // layoutReasons hold for the layout floor, workerReasons for the |
| + // workers floor; an unknown box is both. |
| + var layoutReasons, workerReasons []string |
| + unknown := func(r string) { |
| + layoutReasons = append(layoutReasons, r) |
| + workerReasons = append(workerReasons, r) |
| + } |
| for _, b := range boxes { |
| switch { |
| case status.BoxStale(b, now, status.SnapshotPeriod): |
| - reasons = append(reasons, b.Label+" is stale") |
| + unknown(b.Label + " is stale") |
| case b.Metrics == nil || b.Metrics.Layout == nil: |
| // A box whose running release parses and is below the floor |
| // cannot have run the layout pass (the pass and its report |
| @@ -48,25 +69,46 @@ func (s *Server) layoutDowngradeBlocked(ctx context.Context, target string) stri |
| // pass), is unknown and blocks. A box at or above the floor |
| // with no activator publishes a report of its own (Mode |
| // "unmanaged", host/layoutleg.go), so it is not silent here. |
| - if b.Metrics != nil && release.BelowFloor(b.Metrics.Release, release.LayoutFloor) { |
| - continue |
| + // |
| + // The workers floor reads silence the same way: a box whose |
| + // release parses below release.WorkerLayoutFloor never ran a |
| + // nested worker, so its silence says nothing nested is a worker. |
| + r := b.Label + " reports no layout field" |
| + if b.Metrics == nil || !release.BelowFloor(b.Metrics.Release, release.LayoutFloor) { |
| + layoutReasons = append(layoutReasons, r) |
| + } |
| + if b.Metrics == nil || !release.BelowFloor(b.Metrics.Release, release.WorkerLayoutFloor) { |
| + workerReasons = append(workerReasons, r) |
| } |
| - reasons = append(reasons, b.Label+" reports no layout field") |
| default: |
| + // Omitted by a box that predates it, and "off" when its agent |
| + // started without the opt-in; any other word is an agent that |
| + // started with CARLOS_NESTED_WORKERS=on. |
| + if w := b.Metrics.Layout.Workers; w != "" && w != "off" { |
| + workerReasons = append(workerReasons, fmt.Sprintf(workerDowngradeOptedInCopy, b.Label, w)) |
| + } |
| for host, row := range b.Metrics.Layout.Rows { |
| switch row.Layout { |
| case "nested", "fenced", "conflict": |
| - reasons = append(reasons, b.Label+": "+host+" is "+row.Layout) |
| + r := b.Label + ": " + host + " is " + row.Layout |
| + layoutReasons = append(layoutReasons, r) |
| + if strings.HasSuffix(host, provision.SidecarSuffix) { |
| + workerReasons = append(workerReasons, r) |
| + } |
| } |
| } |
| } |
| } |
| - if len(reasons) == 0 { |
| - return "" |
| + if preLayout && len(layoutReasons) > 0 { |
| + sort.Strings(layoutReasons) |
| + return target + " predates the instance layout and the fleet is not flat: " + strings.Join(layoutReasons, "; ") + |
| + ". Run `carlos system layout revert`, wait for `carlos status --layout` to show every row flat, then retry" |
| } |
| - sort.Strings(reasons) |
| - return target + " predates the instance layout and the fleet is not flat: " + strings.Join(reasons, "; ") + |
| - ". Run `carlos system layout revert`, wait for `carlos status --layout` to show every row flat, then retry" |
| + if preWorker && len(workerReasons) > 0 { |
| + sort.Strings(workerReasons) |
| + return fmt.Sprintf(workerDowngradeBlockedCopy, target, strings.Join(workerReasons, "; ")) |
| + } |
| + return "" |
| } |
| // layoutMigrateBlocked refuses `layout migrate` while any box in scope |
diff --git a/internal/console/layoutguard_copy.go b/internal/console/layoutguard_copy.go| new file mode 100644 |
| index 000000000..f7b1b033e |
| --- /dev/null |
| +++ b/internal/console/layoutguard_copy.go |
| @@ -0,0 +1,15 @@ |
| +package console |
| + |
| +// Copy for the console's workers-floor refusal (sidecar isolation spec rev |
| +// 4, D11), collected and reviewed in Task 12. A placeholder until then. |
| + |
| +// workerDowngradeBlockedCopy takes the target release and the boxes and |
| +// worker rows in its way (joined by "; "), and gives the way back. |
| +const workerDowngradeBlockedCopy = "%s predates nested sidecar workers and the fleet is not clear of them: %s. Run `carlos system layout revert`, set CARLOS_NESTED_WORKERS=off in each box's /etc/carlos/host.env and restart its agent, wait for `carlos status --layout` to show workers off and every worker row flat, then retry" // copy: placeholder, Task 12 |
| + |
| +// workerDowngradeUnknownCopy takes the target and the snapshot read error. |
| +const workerDowngradeUnknownCopy = "%s predates nested sidecar workers and the fleet's workers are unknown: could not read the boxes' snapshots: %s" // copy: placeholder, Task 12 |
| + |
| +// workerDowngradeOptedInCopy takes a box label and its workers word: the |
| +// box's agent started opted in, so its own install would refuse. |
| +const workerDowngradeOptedInCopy = "%s has CARLOS_NESTED_WORKERS=on (workers %s)" // copy: placeholder, Task 12 |
diff --git a/internal/console/layoutguard_test.go b/internal/console/layoutguard_test.go| index b05056134..6af48ec8a 100644 |
| --- a/internal/console/layoutguard_test.go |
| +++ b/internal/console/layoutguard_test.go |
| @@ -8,6 +8,7 @@ import ( |
| "testing" |
| "time" |
| + "github.com/carlosframework/platform/internal/provision" |
| "github.com/carlosframework/platform/internal/release" |
| "github.com/carlosframework/platform/internal/status" |
| ) |
| @@ -38,7 +39,8 @@ func TestLayoutDowngradeBlockedJudgesEveryBoxsReport(t *testing.T) { |
| if strings.Contains(got, "c.example.com") || strings.Contains(got, "ie") { |
| t.Errorf("reason %q names a flat row or a flat box", got) |
| } |
| - // At or above the floor nothing is judged. |
| + // At or above the floor nothing here is judged: no row is a worker and |
| + // no box opts into nested workers (the workers floor, below). |
| for _, v := range []string{"v0.25.0", "v0.26.1"} { |
| if got := fx.srv.layoutDowngradeBlocked(ctx, v); got != "" { |
| t.Errorf("%s: %q, want allowed", v, got) |
| @@ -237,3 +239,90 @@ func TestLayoutGuardsTreatNestedByDefaultLikeAnIntent(t *testing.T) { |
| t.Fatalf("a box the default has not reached blocked: %q", got) |
| } |
| } |
| + |
| +// The workers floor (sidecar isolation spec rev 4, D11): a target below |
| +// release.WorkerLayoutFloor, or one that cannot be placed, is blocked while |
| +// any box reports a worker row nested, fenced or in conflict, or reports |
| +// that it opted into nested workers (its agent started with |
| +// CARLOS_NESTED_WORKERS=on, so its own install would refuse). Nested |
| +// instance rows are the layout floor's business, not this one's. Stale and |
| +// silent boxes are unknown and block as they do for the layout floor. |
| +func TestDowngradeBlockedBelowWorkerFloor(t *testing.T) { |
| + fx := newConsoleFixture(t) |
| + ctx := context.Background() |
| + now := time.Now() |
| + worker := provision.SidecarHost("worker", "shop", "bab") |
| + const target = "v0.28.12" |
| + |
| + seedLayoutBox(t, fx.rel, "ie", now, &status.LayoutReport{Mode: "nested", Workers: "off", Rows: map[string]status.RowLayout{ |
| + "a.example.com": {Layout: "nested"}, worker: {Layout: "flat"}, |
| + }}) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); got != "" { |
| + t.Fatalf("nested instance rows, a flat worker, workers off: %q, want allowed", got) |
| + } |
| + |
| + for _, layout := range []string{"nested", "fenced", "conflict"} { |
| + seedLayoutBox(t, fx.rel, "uk", now, &status.LayoutReport{Mode: "nested", Workers: "off", Rows: map[string]status.RowLayout{worker: {Layout: layout}}}) |
| + got := fx.srv.layoutDowngradeBlocked(ctx, target) |
| + for _, want := range []string{target + " predates nested sidecar workers", "uk: " + worker + " is " + layout, "CARLOS_NESTED_WORKERS=off", "restart"} { |
| + if !strings.Contains(got, want) { |
| + t.Errorf("worker %s: reason %q lacks %q", layout, got, want) |
| + } |
| + } |
| + if strings.Contains(got, "a.example.com") { |
| + t.Errorf("worker %s: reason %q names an instance row", layout, got) |
| + } |
| + // Unplaceable targets are judged; the floor release and later are not. |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, "abc1234"); !strings.Contains(got, "uk: "+worker+" is "+layout) { |
| + t.Errorf("worker %s, unplaceable target: %q", layout, got) |
| + } |
| + for _, v := range []string{"v0.29.0", "v0.30.1"} { |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, v); got != "" { |
| + t.Errorf("worker %s, %s: %q, want allowed", layout, v, got) |
| + } |
| + } |
| + } |
| + |
| + // Opted in with no worker rows at all: every word but off blocks. |
| + for _, word := range []string{"nested", "waiting_for_prev", "blocked"} { |
| + seedLayoutBox(t, fx.rel, "uk", now, &status.LayoutReport{Mode: "nested", Workers: word, Rows: map[string]status.RowLayout{}}) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); !strings.Contains(got, "uk has CARLOS_NESTED_WORKERS=on (workers "+word+")") { |
| + t.Errorf("workers %s: %q", word, got) |
| + } |
| + } |
| + // A box that predates the word (omitted) never opted in. |
| + seedLayoutBox(t, fx.rel, "uk", now, &status.LayoutReport{Mode: "nested", Rows: map[string]status.RowLayout{}}) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); got != "" { |
| + t.Fatalf("no workers word: %q, want allowed", got) |
| + } |
| + |
| + // A pre-layout target over a flat fleet that opted in is blocked by |
| + // this floor too. |
| + seedLayoutBox(t, fx.rel, "uk", now, &status.LayoutReport{Mode: "flat", Workers: "waiting_for_prev", Rows: map[string]status.RowLayout{}}) |
| + seedLayoutBox(t, fx.rel, "ie", now, &status.LayoutReport{Mode: "flat", Workers: "off", Rows: map[string]status.RowLayout{}}) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, "v0.19.0"); !strings.Contains(got, "v0.19.0 predates nested sidecar workers") { |
| + t.Errorf("pre-layout target over an opted-in flat fleet: %q", got) |
| + } |
| + seedLayoutBox(t, fx.rel, "uk", now, &status.LayoutReport{Mode: "flat", Workers: "off", Rows: map[string]status.RowLayout{}}) |
| + |
| + // Unknown blocks: a stale box, and a silent one at or above the workers |
| + // floor or on a release that cannot be placed. A silent box below the |
| + // workers floor never ran a nested worker (the layout floor's own rule, |
| + // read for this floor), so today's fleet keeps its rollbacks. |
| + seedLayoutBox(t, fx.rel, "au", now.Add(-20*time.Minute), &status.LayoutReport{Mode: "flat", Workers: "off", Rows: map[string]status.RowLayout{}}) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); !strings.Contains(got, "au is stale") || !strings.Contains(got, "predates nested sidecar workers") { |
| + t.Errorf("stale: %q", got) |
| + } |
| + for _, v := range []string{"v0.29.0", "dev"} { |
| + seedBox(t, fx, "au", "linux-arm64", "stable", v) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); !strings.Contains(got, "au reports no layout field") || !strings.Contains(got, "predates nested sidecar workers") { |
| + t.Errorf("silent at %s: %q", v, got) |
| + } |
| + } |
| + for _, v := range []string{"v0.24.2", "v0.28.0"} { |
| + seedBox(t, fx, "au", "linux-arm64", "stable", v) |
| + if got := fx.srv.layoutDowngradeBlocked(ctx, target); got != "" { |
| + t.Errorf("silent at %s, below the workers floor: %q, want allowed", v, got) |
| + } |
| + } |
| +} |
diff --git a/internal/host/systemapply.go b/internal/host/systemapply.go| index da966c116..3b7426632 100644 |
| --- a/internal/host/systemapply.go |
| +++ b/internal/host/systemapply.go |
| @@ -1,6 +1,7 @@ |
| package host |
| import ( |
| + "bufio" |
| "bytes" |
| "context" |
| "crypto/ed25519" |
| @@ -25,6 +26,7 @@ import ( |
| "github.com/carlosframework/platform/internal/cliflag" |
| "github.com/carlosframework/platform/internal/hostfloor" |
| "github.com/carlosframework/platform/internal/hostwrite" |
| + "github.com/carlosframework/platform/internal/instancectl" |
| "github.com/carlosframework/platform/internal/layout" |
| "github.com/carlosframework/platform/internal/moves" |
| "github.com/carlosframework/platform/internal/provision" |
| @@ -527,6 +529,20 @@ func (a *systemApplier) install(ctx context.Context, req systemRequest, p *relea |
| return a.record(req, fmt.Errorf("%w: "+systemApplyLayoutRefusal, errSystemRefused, target, strings.Join(reasons, ", "))) |
| } |
| } |
| + // The workers floor (sidecar isolation spec rev 4, D11; R1-2, R3-1): a |
| + // release before the nested worker runs a nested worker row flat and |
| + // unisolated, beside a second replica of its database. A candidate |
| + // whose version parses below release.WorkerLayoutFloor, or whose |
| + // version does not parse and whose unit set lacks the worker template, |
| + // is refused while host.env opts the box in (root-owned, so it does not |
| + // depend on what the running agent has done since it started) or while |
| + // R9's row test names a worker host. Here, before the journal, so a |
| + // refusal leaves the box exactly as it was. |
| + if preWorkerCandidate(target, newUnits) { |
| + if why := a.workerDowngradeReasons(); len(why) > 0 { |
| + return a.record(req, fmt.Errorf("%w: "+systemApplyWorkerRefusal, errSystemRefused, target, strings.Join(why, "; "))) |
| + } |
| + } |
| // Only the unit set is taken from the return: a rollback picks this |
| // staging up as it stands, plan.json and all, rather than exec'ing the |
| // previous binary again on a box that is already unhealthy. |
| @@ -1232,6 +1248,102 @@ func (a *systemApplier) stagePlan(ctx context.Context, binary, dir string) (boot |
| // marks a release that understands the nested layout. |
| const layoutMountUnit = "data-instances.mount" |
| +// workerTemplateUnit is the unit whose presence in a candidate's staged set |
| +// marks a release that runs a nested sidecar worker (D11). |
| +const workerTemplateUnit = instancectl.UnitPrefixWorker + ".service" |
| + |
| +// preWorkerCandidate reports whether a candidate predates the nested worker: |
| +// its version parses below release.WorkerLayoutFloor, or it does not parse |
| +// and the candidate's own staged unit set lacks the worker template. A |
| +// version that parses at or above the floor is judged by the version alone. |
| +func preWorkerCandidate(target string, units []string) bool { |
| + if _, ok := release.ParseReleaseVersion(target); ok { |
| + return release.BelowFloor(target, release.WorkerLayoutFloor) |
| + } |
| + return !slices.Contains(units, workerTemplateUnit) |
| +} |
| + |
| +// workerDowngradeReasons is what makes a pre-worker candidate unsafe on |
| +// this box, as copy fragments; none means it may install. The first arm is |
| +// host.env's opt-in, read from the file as it stands (what the agent read |
| +// at its start, or will at its next), not from this process's environment, |
| +// and a host.env that cannot be read counts as opted in. The second is every worker host R9's row |
| +// test names (nested paths, fenced or conflict, or a journal), whatever |
| +// host.env says now; a registry or journal directory that cannot be read |
| +// cannot vouch that there is none, so that is a reason too. |
| +func (a *systemApplier) workerDowngradeReasons() []string { |
| + var why []string |
| + if on, err := nestedWorkersOptedIn(filepath.Join(a.etcDir, "carlos", "host.env")); err != nil { |
| + why = append(why, fmt.Sprintf(systemApplyWorkerHostEnvUnread, err)) |
| + } else if on { |
| + why = append(why, systemApplyWorkerOptedIn) |
| + } |
| + reg, err := a.guardRegistry() |
| + if err != nil { |
| + return append(why, fmt.Sprintf(systemApplyWorkerUnknown, err.Error())) |
| + } |
| + defer reg.Close() |
| + hosts, problems := layoutReversalIncomplete(reg, a.dataDir) |
| + var workers []string |
| + for _, h := range hosts { |
| + if strings.HasSuffix(h, provision.SidecarSuffix) { |
| + workers = append(workers, h) |
| + } |
| + } |
| + if len(workers) > 0 { |
| + why = append(why, fmt.Sprintf(systemApplyWorkerHosts, strings.Join(workers, ", "))) |
| + } |
| + if len(problems) > 0 { |
| + why = append(why, fmt.Sprintf(systemApplyWorkerUnknown, strings.Join(problems, ", "))) |
| + } |
| + return why |
| +} |
| + |
| +// nestedWorkersOptedIn reports whether the host.env at path sets |
| +// CARLOS_NESTED_WORKERS to exactly "on", read the way the agent's |
| +// EnvironmentFile=- reads it: comments and blank lines skipped, one pair of |
| +// matching quotes stripped, the last assignment winning. A missing file is |
| +// off (the agent then runs with the setting unset). A file that cannot be |
| +// read, or that uses syntax this reader cannot place (a continuation line, |
| +// an unterminated quote, an escape in the value), is an error: the caller |
| +// must not take it for off. |
| +func nestedWorkersOptedIn(path string) (bool, error) { |
| + raw, err := readClaimUnitFile(path) |
| + if errors.Is(err, os.ErrNotExist) { |
| + return false, nil |
| + } |
| + if err != nil { |
| + return false, err |
| + } |
| + value := "" |
| + scan := bufio.NewScanner(bytes.NewReader(raw)) |
| + for scan.Scan() { |
| + line := strings.TrimSpace(scan.Text()) |
| + if line == "" || strings.HasPrefix(line, "#") || strings.HasPrefix(line, ";") { |
| + continue |
| + } |
| + key, v, ok := strings.Cut(line, "=") |
| + key, v = strings.TrimSpace(key), strings.TrimSpace(v) |
| + if strings.HasSuffix(line, `\`) || (len(v) > 0 && (v[0] == '"' || v[0] == '\'') && (len(v) < 2 || v[len(v)-1] != v[0])) { |
| + return false, errors.New("unsupported multiline or unterminated host.env value") |
| + } |
| + if !ok || key != nestedWorkersEnv { |
| + continue |
| + } |
| + if len(v) >= 2 && ((v[0] == '"' && v[len(v)-1] == '"') || (v[0] == '\'' && v[len(v)-1] == '\'')) { |
| + v = v[1 : len(v)-1] |
| + } |
| + if strings.ContainsAny(v, "\\\"'\x00\r\n") { |
| + return false, errors.New("unsupported value for " + nestedWorkersEnv) |
| + } |
| + value = v |
| + } |
| + if err := scan.Err(); err != nil { |
| + return false, err |
| + } |
| + return value == "on", nil |
| +} |
| + |
| // systemApplyLayoutRefusal takes the release and the rows in its way. |
| const systemApplyLayoutRefusal = "%s predates the instance layout, and this box still has: %s. revert the layout and wait for every row to report flat before installing it" |
| @@ -1256,16 +1368,22 @@ func (a *systemApplier) layoutReversalReasons() []string { |
| } |
| } |
| - open := a.openRegistry |
| - if open == nil { |
| - open = func() (*registry.Registry, error) { return openSystemRegistry(a.dataDir) } |
| - } |
| - reg, err := open() |
| + reg, err := a.guardRegistry() |
| if err != nil { |
| return []string{err.Error()} |
| } |
| defer reg.Close() |
| - return layoutReversalIncomplete(reg, a.dataDir) |
| + hosts, problems := layoutReversalIncomplete(reg, a.dataDir) |
| + return append(hosts, problems...) |
| +} |
| + |
| +// guardRegistry opens the registry for the install's row tests (R9 and |
| +// the workers floor), through the test seam when one is set. |
| +func (a *systemApplier) guardRegistry() (*registry.Registry, error) { |
| + if a.openRegistry != nil { |
| + return a.openRegistry() |
| + } |
| + return openSystemRegistry(a.dataDir) |
| } |
| // layoutReversalIncomplete names, once each and sorted, every host a |
| @@ -1276,7 +1394,10 @@ func (a *systemApplier) layoutReversalReasons() []string { |
| // or not its row still exists. A registry that cannot be listed, or a |
| // journal directory that cannot be read, is named as such rather than |
| // taken for an empty box. |
| -func layoutReversalIncomplete(reg *registry.Registry, dataDir string) []string { |
| +// |
| +// The named hosts and the failed reads come back apart, so the workers |
| +// floor can tell a worker host from an error; R9's refusal lists both. |
| +func layoutReversalIncomplete(reg *registry.Registry, dataDir string) (hosts, problems []string) { |
| named := map[string]bool{} |
| var extra []string |
| routes, err := reg.List() |
| @@ -1302,12 +1423,12 @@ func layoutReversalIncomplete(reg *registry.Registry, dataDir string) []string { |
| named[host] = true |
| } |
| } |
| - reasons := make([]string, 0, len(named)+len(extra)) |
| + hosts = make([]string, 0, len(named)) |
| for h := range named { |
| - reasons = append(reasons, h) |
| + hosts = append(hosts, h) |
| } |
| - slices.Sort(reasons) |
| - return append(reasons, extra...) |
| + slices.Sort(hosts) |
| + return hosts, extra |
| } |
| func (a *systemApplier) journal(j systemJournal) error { |
diff --git a/internal/host/systemapply_test.go b/internal/host/systemapply_test.go| index ee79416d8..34fce9069 100644 |
| --- a/internal/host/systemapply_test.go |
| +++ b/internal/host/systemapply_test.go |
| @@ -1568,6 +1568,9 @@ func TestApplyInstallsAPreLayoutCandidateOverFlatRows(t *testing.T) { |
| func TestApplyInstallsAPostLayoutCandidateOverNestedRows(t *testing.T) { |
| f, req := applyHappy(t) |
| f.postLayout() |
| + // And the worker template, so the workers floor (D11) has no reason |
| + // to open it either. |
| + f.postWorker() |
| f.seedRoutes(nestedRow(f.a.dataDir, "acme.example.com")) |
| opened := false |
| f.a.openRegistry = func() (*registry.Registry, error) { |
| @@ -1681,10 +1684,10 @@ func TestLayoutReversalIncompleteNamesEveryRowInTheWay(t *testing.T) { |
| // A journal's temp file is not a journal. |
| os.WriteFile(filepath.Join(dd, "layout", ".other.example.com.tmp-1"), []byte("{}"), 0o600) |
| - got := layoutReversalIncomplete(reg, dd) |
| + got, problems := layoutReversalIncomplete(reg, dd) |
| want := []string{"gone.example.com", "moving.example.com", "nested.example.com", "unflagged.example.com"} |
| - if !slices.Equal(got, want) { |
| - t.Fatalf("reasons = %q, want %q", got, want) |
| + if !slices.Equal(got, want) || len(problems) != 0 { |
| + t.Fatalf("hosts = %q, problems = %q, want %q and none", got, problems, want) |
| } |
| flatOnly := t.TempDir() |
| @@ -1696,11 +1699,252 @@ func TestLayoutReversalIncompleteNamesEveryRowInTheWay(t *testing.T) { |
| if err := reg2.Upsert(flatRow(flatOnly, "flat.example.com")); err != nil { |
| t.Fatal(err) |
| } |
| - if got := layoutReversalIncomplete(reg2, flatOnly); len(got) != 0 { |
| - t.Fatalf("a flat box reported %q", got) |
| + if got, problems := layoutReversalIncomplete(reg2, flatOnly); len(got) != 0 || len(problems) != 0 { |
| + t.Fatalf("a flat box reported %q, %q", got, problems) |
| } |
| } |
| +// ---- the workers floor (sidecar isolation spec rev 4, D11) ---- |
| + |
| +// preWorker is a candidate that ships the layout (so R9's guard stays out |
| +// of the way) at a release that parses below release.WorkerLayoutFloor. |
| +const preWorker = "v0.28.12" |
| + |
| +// postWorker gives the fixture's candidate the worker template unit, which |
| +// is what makes an unplaceable build one that runs a nested worker. |
| +func (f *applyFixture) postWorker() { |
| + staged := filepath.Join(f.a.stagingDir(), "carlos") |
| + f.answer["units:"+staged] += " " + workerTemplateUnit |
| +} |
| + |
| +// hostEnv installs /etc/carlos/host.env in the fixture's etc root. |
| +func (f *applyFixture) hostEnv(content string) { |
| + f.t.Helper() |
| + path := filepath.Join(f.a.etcDir, "carlos", "host.env") |
| + if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { |
| + f.t.Fatal(err) |
| + } |
| + if err := os.WriteFile(path, []byte(content), 0o600); err != nil { |
| + f.t.Fatal(err) |
| + } |
| +} |
| + |
| +// workerHost is a real sidecar host shape (provision.SidecarSuffix). |
| +var workerHost = provision.SidecarHost("worker", "shop", "bab") |
| + |
| +// workerRow is a sidecar row for workerHost, at the nested paths when |
| +// nested, else at the flat ones. |
| +func workerRow(dataDir string, nested bool) registry.Route { |
| + rt := registry.Route{Host: workerHost, Kind: "sidecar", Slug: "worker", App: "shop", Account: "bab", Channel: "stable", Status: "ready", |
| + DBPath: provision.DefaultDBPath(dataDir, workerHost)} |
| + if nested { |
| + rt.DBPath = provision.NestedDBPath(dataDir, workerHost) |
| + } |
| + return rt |
| +} |
| + |
| +// workerRefused checks a workers-floor refusal: refused, the reason names |
| +// the release, the setting and the way back plus every want, and the box |
| +// is exactly as it was (no journal, the old binary, systemd untouched). |
| +func workerRefused(t *testing.T, f *applyFixture, req systemRequest, target string, wants ...string) { |
| + t.Helper() |
| + r := f.result() |
| + if r == nil || r.Outcome != systemOutcomeRefused || !r.matches("stable", target, req.PromotedAt) { |
| + t.Fatalf("result = %+v, want refused", r) |
| + } |
| + for _, want := range append([]string{target + " predates nested sidecar workers", "CARLOS_NESTED_WORKERS=off", "restart the agent"}, wants...) { |
| + if !strings.Contains(r.Reason, want) { |
| + t.Errorf("reason %q lacks %q", r.Reason, want) |
| + } |
| + } |
| + if j, _ := readSystemJournal(f.a.optDir); j != nil { |
| + t.Fatalf("a refused apply wrote a journal: %+v", j) |
| + } |
| + if bin, _ := os.ReadFile(systemBinaryPath(f.a.optDir)); !strings.Contains(string(bin), "carlos v1") { |
| + t.Fatal("a refused apply swapped the binary") |
| + } |
| + if f.called("systemctl stop") || f.called("systemctl restart") { |
| + t.Fatalf("a refused apply touched systemd: %v", f.calls) |
| + } |
| +} |
| + |
| +func workerApplied(t *testing.T, f *applyFixture, req systemRequest, target string) { |
| + t.Helper() |
| + if r := f.result(); r == nil || r.Outcome != systemOutcomeApplied || !r.matches("stable", target, req.PromotedAt) { |
| + t.Fatalf("result = %+v, want applied", r) |
| + } |
| +} |
| + |
| +// The first arm (R3-1): host.env opting in refuses a pre-worker candidate |
| +// on a box with no worker rows at all, because an agent started on that |
| +// say-so may create nested worker state at any moment. The setting is read |
| +// the way systemd reads it (quotes stripped, the last line wins), and a |
| +// host.env that cannot be read is taken as opted in. |
| +func TestInstallRefusesPreWorkerCandidateWhenHostEnvOptsIn(t *testing.T) { |
| + t.Parallel() |
| + for _, tc := range []struct{ name, env string }{ |
| + {"on", "CARLOS_REGION=eu-west-1\nCARLOS_NESTED_WORKERS=on\n"}, |
| + {"quoted", "CARLOS_NESTED_WORKERS=\"on\"\n"}, |
| + {"last wins", "CARLOS_NESTED_WORKERS=off\nCARLOS_NESTED_WORKERS = on\n"}, |
| + } { |
| + t.Run(tc.name, func(t *testing.T) { |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.seedRoutes(flatRow(f.a.dataDir, "flat.example.com"), nestedRow(f.a.dataDir, "acme.example.com")) |
| + f.hostEnv(tc.env) |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "/etc/carlos/host.env sets CARLOS_NESTED_WORKERS=on") |
| + if r := f.result(); strings.Contains(r.Reason, "acme.example.com") { |
| + t.Errorf("reason %q names a row that is not a worker", r.Reason) |
| + } |
| + }) |
| + } |
| + // The exact text, once, so the placeholder's assembly is pinned. |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.hostEnv("CARLOS_NESTED_WORKERS=on\n") |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + want := "refused: " + fmt.Sprintf(systemApplyWorkerRefusal, preWorker, systemApplyWorkerOptedIn) |
| + if r := f.result(); r == nil || r.Reason != want { |
| + t.Fatalf("reason = %+v\nwant %q", r, want) |
| + } |
| + |
| + // Unreadable: a directory where the file should be. Not silently off. |
| + f, req = applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + if err := os.MkdirAll(filepath.Join(f.a.etcDir, "carlos", "host.env"), 0o755); err != nil { |
| + t.Fatal(err) |
| + } |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "could not be read", "taken to set CARLOS_NESTED_WORKERS=on") |
| + |
| + // Syntax this reader cannot place (a continuation line) is the same. |
| + f, req = applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.hostEnv("CARLOS_REGION=eu-west-1 \\\nCARLOS_NESTED_WORKERS=off\n") |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "could not be read") |
| +} |
| + |
| +// The second arm: R9's row test naming a worker host refuses, whatever |
| +// host.env says now (the residual: set off without a restart, or state |
| +// left from before the operator turned it off). A registry that will not |
| +// open cannot vouch that there is none. |
| +func TestInstallRefusesPreWorkerCandidateWithNestedWorker(t *testing.T) { |
| + t.Parallel() |
| + for _, env := range []string{"", "CARLOS_NESTED_WORKERS=off\n"} { |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.seedRoutes(flatRow(f.a.dataDir, "flat.example.com"), workerRow(f.a.dataDir, true)) |
| + if env != "" { |
| + f.hostEnv(env) |
| + } |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "worker state for "+workerHost) |
| + if r := f.result(); strings.Contains(r.Reason, "sets CARLOS_NESTED_WORKERS=on") || strings.Contains(r.Reason, "flat.example.com") { |
| + t.Errorf("host.env %q: reason %q claims the setting or names a flat row", env, r.Reason) |
| + } |
| + } |
| + |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.a.openRegistry = func() (*registry.Registry, error) { return nil, errors.New("registry.db: disk I/O error") } |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "could not be checked", "registry.db: disk I/O error") |
| +} |
| + |
| +// A migration journal for a worker host is worker state even with the row |
| +// flat or gone: a move in flight that a pre-worker binary would mishandle. |
| +func TestInstallRefusesPreWorkerCandidateWithWorkerJournalOnly(t *testing.T) { |
| + t.Parallel() |
| + for _, withRow := range []bool{true, false} { |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + if withRow { |
| + f.seedRoutes(workerRow(f.a.dataDir, false)) |
| + } |
| + os.MkdirAll(filepath.Join(f.a.dataDir, "layout"), 0o700) |
| + if err := os.WriteFile(provision.LayoutJournalPath(f.a.dataDir, workerHost), []byte("{}"), 0o600); err != nil { |
| + t.Fatal(err) |
| + } |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, preWorker, "worker state for "+workerHost) |
| + } |
| +} |
| + |
| +// With host.env off (or absent: the agent's EnvironmentFile=- reads no |
| +// file, so it never opted in) and no worker host named, a pre-worker |
| +// candidate installs: nested and journaled instance rows are R9's business, |
| +// and this candidate ships the layout. At or above the floor nothing is |
| +// judged, opted in and worker rows nested or not. |
| +func TestInstallRefusesPreWorkerCandidateAcceptsWhenNoWorkerHost(t *testing.T) { |
| + t.Parallel() |
| + for _, env := range []string{"", "CARLOS_NESTED_WORKERS=off\n", "CARLOS_NESTED_WORKERS=yes\n", "# CARLOS_NESTED_WORKERS=on\n"} { |
| + f, req := applyHappyVersion(t, preWorker) |
| + f.postLayout() |
| + f.seedRoutes(flatRow(f.a.dataDir, "flat.example.com"), nestedRow(f.a.dataDir, "acme.example.com"), workerRow(f.a.dataDir, false)) |
| + os.MkdirAll(filepath.Join(f.a.dataDir, "layout"), 0o700) |
| + os.WriteFile(provision.LayoutJournalPath(f.a.dataDir, "moving.example.com"), []byte("{}"), 0o600) |
| + if env != "" { |
| + f.hostEnv(env) |
| + } |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerApplied(t, f, req, preWorker) |
| + } |
| + |
| + f, req := applyHappyVersion(t, "v0.29.0") |
| + f.postLayout() |
| + f.seedRoutes(workerRow(f.a.dataDir, true)) |
| + f.hostEnv("CARLOS_NESTED_WORKERS=on\n") |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerApplied(t, f, req, "v0.29.0") |
| +} |
| + |
| +// A version that does not parse (a local build named by a sha) is judged |
| +// by its unit set: without carlos-instance-worker@.service it is a |
| +// pre-worker build and is refused on an opted-in box; with it, it installs. |
| +func TestInstallRefusesPreWorkerCandidateUnparseableVersionJudgedByUnitSet(t *testing.T) { |
| + t.Parallel() |
| + if _, err := unitsFS.ReadFile("units/" + workerTemplateUnit); err != nil { |
| + t.Fatalf("the worker template this guard looks for is not an embedded unit: %v", err) |
| + } |
| + f, req := applyHappy(t) |
| + f.postLayout() |
| + f.hostEnv("CARLOS_NESTED_WORKERS=on\n") |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerRefused(t, f, req, "v2", "sets CARLOS_NESTED_WORKERS=on") |
| + |
| + f, req = applyHappy(t) |
| + f.postLayout() |
| + f.postWorker() |
| + f.hostEnv("CARLOS_NESTED_WORKERS=on\n") |
| + f.seedRoutes(workerRow(f.a.dataDir, true)) |
| + if err := f.a.Run(context.Background(), false); err != nil { |
| + t.Fatal(err) |
| + } |
| + workerApplied(t, f, req, "v2") |
| +} |
| + |
| // ---- the moves protocol floor (moves spec §11, Task 13) ---- |
| // floorFixture is applyHappy with release numbers the floor can compare: a |
diff --git a/internal/host/workerguard_copy.go b/internal/host/workerguard_copy.go| new file mode 100644 |
| index 000000000..f4f0cfd76 |
| --- /dev/null |
| +++ b/internal/host/workerguard_copy.go |
| @@ -0,0 +1,25 @@ |
| +package host |
| + |
| +// Copy for install's workers-floor refusal (sidecar isolation spec rev 4, |
| +// D11), collected and reviewed in Task 12. A placeholder until then. |
| +// |
| +// The refusal is systemApplyWorkerRefusal with the release and one or more |
| +// of the fragments below, joined by "; ". It is recorded after "refused: ". |
| + |
| +// systemApplyWorkerRefusal takes the release and what this box has that a |
| +// pre-worker binary would mishandle, and gives the way back. |
| +const systemApplyWorkerRefusal = "%s predates nested sidecar workers, and %s. revert the layout, set CARLOS_NESTED_WORKERS=off in /etc/carlos/host.env, restart the agent, then install it" // copy: placeholder, Task 12 |
| + |
| +// systemApplyWorkerOptedIn is the first arm: the box's root-owned opt-in. |
| +const systemApplyWorkerOptedIn = "/etc/carlos/host.env sets CARLOS_NESTED_WORKERS=on" // copy: placeholder, Task 12 |
| + |
| +// systemApplyWorkerHostEnvUnread takes the read or parse error: a host.env |
| +// that cannot be read is taken as opted in, never as off. |
| +const systemApplyWorkerHostEnvUnread = "/etc/carlos/host.env could not be read (%v), so this box is taken to set CARLOS_NESTED_WORKERS=on" // copy: placeholder, Task 12 |
| + |
| +// systemApplyWorkerHosts takes the worker hosts R9's row test names. |
| +const systemApplyWorkerHosts = "this box still has worker state for %s" // copy: placeholder, Task 12 |
| + |
| +// systemApplyWorkerUnknown takes why the rows could not be checked: a |
| +// registry or journal directory that cannot be read cannot vouch. |
| +const systemApplyWorkerUnknown = "this box's worker rows could not be checked (%s)" // copy: placeholder, Task 12 |