amadan
plan: self-serve moves 2, rev 16 (Astra review 15: one expiry decision path, compared against the cut state the worker saw, with a recovery branch for a won expiry)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+4
−4
docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md+4 −4
CI failed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok amadan.net/carlos/platform.git/launchctx 0.016s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (19 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (176 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 4.446s
ok github.com/carlosframework/platform/cmd/moveprobe 11.654s
ok github.com/carlosframework/platform/cmd/zddprobe 0.731s
ok github.com/carlosframework/platform/internal/activator 60.828s
ok github.com/carlosframework/platform/internal/agentsock 0.021s
ok github.com/carlosframework/platform/internal/alerting 0.005s
ok github.com/carlosframework/platform/internal/analytics 0.039s
ok github.com/carlosframework/platform/internal/appconfig 3.170s
ok github.com/carlosframework/platform/internal/apperr 0.130s
ok github.com/carlosframework/platform/internal/applog 0.197s
ok github.com/carlosframework/platform/internal/awsinv 0.004s
ok github.com/carlosframework/platform/internal/boxchoice 0.016s
ok github.com/carlosframework/platform/internal/boxid 0.820s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.012s
ok github.com/carlosframework/platform/internal/caps 0.027s
ok github.com/carlosframework/platform/internal/certwarm 0.005s
ok github.com/carlosframework/platform/internal/cgroup 0.798s
ok github.com/carlosframework/platform/internal/changelog 0.493s
ok github.com/carlosframework/platform/internal/claimactivation 1.134s
ok github.com/carlosframework/platform/internal/clamd 0.060s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.856s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.019s
ok github.com/carlosframework/platform/internal/dbverify 0.006s
ok github.com/carlosframework/platform/internal/dnsrec 0.005s
ok github.com/carlosframework/platform/internal/docsite 0.011s
ok github.com/carlosframework/platform/internal/domains 3.264s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.007s
ok github.com/carlosframework/platform/internal/edge 45.816s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.131s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.014s
ok github.com/carlosframework/platform/internal/geo 0.015s
ok github.com/carlosframework/platform/internal/geoip 0.029s
ok github.com/carlosframework/platform/internal/historyreadback 0.151s
ok github.com/carlosframework/platform/internal/host 145.479s
ok github.com/carlosframework/platform/internal/hostactors 8.417s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.015s
ok github.com/carlosframework/platform/internal/hostbox 4.844s
ok github.com/carlosframework/platform/internal/hostclaim 1.232s
ok github.com/carlosframework/platform/internal/hostenv 0.010s
ok github.com/carlosframework/platform/internal/hostevidence 0.013s
ok github.com/carlosframework/platform/internal/hostexec 8.185s
ok github.com/carlosframework/platform/internal/hostfence 0.102s
ok github.com/carlosframework/platform/internal/hostfiles 11.233s
ok github.com/carlosframework/platform/internal/hostfloor 0.026s
ok github.com/carlosframework/platform/internal/hostguard 1.104s
ok github.com/carlosframework/platform/internal/hostops 3.027s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.005s
ok github.com/carlosframework/platform/internal/hostquarantine 0.007s
ok github.com/carlosframework/platform/internal/hostrelocate 1.180s
ok github.com/carlosframework/platform/internal/hostresolve 0.340s
ok github.com/carlosframework/platform/internal/hostwrite 0.006s
ok github.com/carlosframework/platform/internal/infraview 0.003s
ok github.com/carlosframework/platform/internal/instancectl 5.302s
ok github.com/carlosframework/platform/internal/instanceexec 3.032s
ok github.com/carlosframework/platform/internal/instancefs 0.076s
ok github.com/carlosframework/platform/internal/instancekey 0.003s
ok github.com/carlosframework/platform/internal/instanceupdates 0.024s
ok github.com/carlosframework/platform/internal/layout 2.832s
ok github.com/carlosframework/platform/internal/lbhealth 0.005s
ok github.com/carlosframework/platform/internal/lease 10.108s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.838s
ok github.com/carlosframework/platform/internal/ledger 0.033s
ok github.com/carlosframework/platform/internal/mail 0.383s
ok github.com/carlosframework/platform/internal/maintenance 0.116s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.833s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.188s
ok github.com/carlosframework/platform/internal/metrics 0.010s
ok github.com/carlosframework/platform/internal/moves 24.286s
ok github.com/carlosframework/platform/internal/moves/archive 1.445s
ok github.com/carlosframework/platform/internal/objstore 0.277s
ok github.com/carlosframework/platform/internal/ops 0.205s
ok github.com/carlosframework/platform/internal/park 0.597s
ok github.com/carlosframework/platform/internal/plans 0.021s
ok github.com/carlosframework/platform/internal/privatefile 0.015s
2026/10/22 11:13:35 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/22 11:13:35 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/22 11:13:35 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/22 11:13:35 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/22 11:13:35 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/22 11:13:35 provision: an app's records could not be listed: they are skipped
2026/10/22 11:13:35 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:35 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/22 11:13:35 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/22 11:13:35 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/22 11:13:35 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/22 11:13:35 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/22 11:13:35 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/22 11:13:35 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/22 11:13:35 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/22 11:13:35 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/22 11:13:35 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:35 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/22 11:13:35 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/22 11:13:36 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/22 11:13:36 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/22 11:13:36 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/22 11:13:36 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/22 11:13:36 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/22 11:13:36 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/22 11:13:36 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/22 11:13:36 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:36 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:36 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:36 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:36 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:36 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:36 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:36 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/22 11:13:37 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/22 11:13:37 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/22 11:13:37 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/22 11:13:37 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:37 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:37 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io channel stable -> edge
2026/10/22 11:13:39 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/22 11:13:39 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/22 11:13:39 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/22 11:13:39 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io hibernate false -> true
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged acme.go.tito.io status-named false -> true
2026/10/22 11:13:39 provision: converged acme.go.tito.io status-named true -> false
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/22 11:13:39 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/22 11:13:39 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/22 11:13:39 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/22 11:13:39 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/22 11:13:39 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/22 11:13:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:39 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/22 11:13:39 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/22 11:13:40 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/22 11:13:40 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/22 11:13:40 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:40 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/22 11:13:40 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/22 11:13:40 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/22 11:13:40 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/22 11:13:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:40 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/22 11:13:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/22 11:13:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/22 11:13:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/22 11:13:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/22 11:13:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/22 11:13:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/22 11:13:40 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/22 11:13:40 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/22 11:13:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/22 11:13:40 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/22 11:13:40 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/22 11:13:40 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/22 11:13:40 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/22 11:13:40 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/22 11:13:40 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/22 11:13:40 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/22 11:13:40 provision: dry-run: would converge owned.go.tito.io seed
2026/10/22 11:13:40 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/22 11:13:40 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/22 11:13:40 provision: converged owned.go.tito.io channel stable -> edge
2026/10/22 11:13:40 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/22 11:13:40 provision: converged owned.go.tito.io hibernate false -> true
2026/10/22 11:13:40 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/22 11:13:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: removed retired static route site.go.tito.io (record gone)
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/22 11:13:40 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/22 11:13:40 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:40 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:40 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/22 11:13:40 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/22 11:13:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/22 11:13:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/22 11:13:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/22 11:13:41 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/22 11:13:41 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/22 11:13:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/22 11:13:41 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/22 11:13:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/22 11:13:41 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/22 11:13:41 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/22 11:13:41 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/22 11:13:41 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/22 11:13:41 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/22 11:13:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/22 11:13:41 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/22 11:13:41 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/22 11:13:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:41 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/22 11:13:42 provision: a.shop.example.com: swapped for import sd_cb7etqxpmgxyy4xohjy2h6su6u (the original route is journaled)
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_cb7etqxpmgxyy4xohjy2h6su6u committed: its gate is cleared and its journal row dropped
2026/10/22 11:13:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_4jganch2v5bxlaa7b552molplm rolled back to its original route
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_4jganch2v5bxlaa7b552molplm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_4jganch2v5bxlaa7b552molplm is cleaned up and its journal row retired
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_tslgfjaytc72zoj7zxhayjiaki rolled back to its original route
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_tslgfjaytc72zoj7zxhayjiaki: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_tslgfjaytc72zoj7zxhayjiaki is cleaned up and its journal row retired
2026/10/22 11:13:42 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_yvrmkbeu4lm6d6mae7znxuy4nm
2026/10/22 11:13:42 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/22 11:13:42 provision: dry-run: would converge a.shop.example.com seed source
2026/10/22 11:13:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/22 11:13:42 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/22 11:13:42 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_jkxkxcxrtjawkumliibpbcbl7m cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_5v3udevzgaepyns4yc2pvgxoaq cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_6q2w6ptfflco5hg63kx4oty2eu is journaled, but this box cannot act on imports; its row is left alone
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_hz3krlqqxmsgwknm732vopqbry is journaled, but this box cannot act on imports; its row is left alone
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_viezfwbd6smezfetqbkhc2ahte is journaled, but this box cannot act on imports; its row is left alone
2026/10/22 11:13:42 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/22 11:13:42 provision: c.shop.example.com: import sd_fjb7mar4kk4rrr6dmyrhpoayau left alone this pass: the import journal could not be read
2026/10/22 11:13:42 provision: b.shop.example.com: import sd_7ohusdd72r32ago5thrwpi3xm4 left alone this pass: the import journal could not be read
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_nltb6uldofgawsaxg6smswctza committed: its gate is cleared and its journal row dropped
2026/10/22 11:13:42 provision: a.shop.example.com: not converging import sd_k46poj3r5ttk54ndfcjk6aah4m: it is swapped but not committed, and the row on this box has no import gate
2026/10/22 11:13:42 provision: a.shop.example.com: not converging import sd_fwivwq2k5p6z5ogwdczvdmhkem: it is swapped but not committed, and the row on this box has no import gate
2026/10/22 11:13:42 provision: a.shop.example.com: not converging import sd_q5vywfnnwiqx6tvqdou7wxgaje: it is placed but not committed, and the row on this box has no import gate
2026/10/22 11:13:42 provision: a.shop.example.com: not converging import sd_3djjmpqvlcpd2upq73qjkpy73a: it is placed but not committed, and the row on this box has no import gate
2026/10/22 11:13:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/22 11:13:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: a.shop.example.com: import sd_ezddsvii5luql6nh3f5bkeclxm committed: its gate is cleared and its journal row dropped
2026/10/22 11:13:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:42 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:42 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/22 11:13:42 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_jwsy3e4p6qrye66keyd5kjns5i: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_jwsy3e4p6qrye66keyd5kjns5i rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/22 11:13:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:43 provision: removed instance route acme.go.tito.io (its seed sd_khhvj4ygzpaoydi5fkvsjaxxc4 was aborted); the next pass rolls it back
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_khhvj4ygzpaoydi5fkvsjaxxc4: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_khhvj4ygzpaoydi5fkvsjaxxc4 rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_mm3d4iieehgpro3quxernnhkym has a row this pass may not remove; leaving the seed aborted
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_s4kis3pyf5d7lvpeodo53rwxmi rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:43 provision: removed instance route acme.go.tito.io (its seed sd_vfpn75scdftlap6n7z5jwbgzuu was aborted); the next pass rolls it back
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_vfpn75scdftlap6n7z5jwbgzuu has no route on this box: its local data is removed
2026/10/22 11:13:43 provision: acme.go.tito.io: aborted seed sd_vfpn75scdftlap6n7z5jwbgzuu rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_zuawhxo4jcfan6vwxvaipmb2fy (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_zuawhxo4jcfan6vwxvaipmb2fy rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_zuawhxo4jcfan6vwxvaipmb2fy is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ki3lp3wwccqijrupex25472tqm (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ki3lp3wwccqijrupex25472tqm rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ki3lp3wwccqijrupex25472tqm is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_prxhoyugtqkfvbcalngiy746rm (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_prxhoyugtqkfvbcalngiy746rm rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_prxhoyugtqkfvbcalngiy746rm: the host's replica is left alone: its record no longer names this seed
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_prxhoyugtqkfvbcalngiy746rm is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_gu33kquezfwl477atund6vzsym (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_gu33kquezfwl477atund6vzsym rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_gu33kquezfwl477atund6vzsym rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_gu33kquezfwl477atund6vzsym is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_jwrdxdrcrtdh3oypwpmf2iqvci (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_jwrdxdrcrtdh3oypwpmf2iqvci rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_h5kg2gu3z46uql45f677mcreq4 (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_h5kg2gu3z46uql45f677mcreq4 is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_lewdelygp5ewqz5g3kqlonwwi4 (the original route is journaled)
2026/10/22 11:13:43 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_lewdelygp5ewqz5g3kqlonwwi4 left alone this pass: its record could not be read
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_dtrmcslj2yt5ua6f4pjwionzme (the original route is journaled)
2026/10/22 11:13:43 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_dtrmcslj2yt5ua6f4pjwionzme left alone this pass: its record could not be read
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_5qnn7oyhhvkqjsj2fgqs57k47e (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_5qnn7oyhhvkqjsj2fgqs57k47e: close the import gate: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_5qnn7oyhhvkqjsj2fgqs57k47e rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_5qnn7oyhhvkqjsj2fgqs57k47e is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_co372xvl72k7d2cgbeifkn7bfu (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_co372xvl72k7d2cgbeifkn7bfu: close the import gate: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_co372xvl72k7d2cgbeifkn7bfu rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_co372xvl72k7d2cgbeifkn7bfu is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_xmcsfq3psqof2bp3zo4ng6up4a (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_xmcsfq3psqof2bp3zo4ng6up4a rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_xmcsfq3psqof2bp3zo4ng6up4a rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_xmcsfq3psqof2bp3zo4ng6up4a is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_3buayaenjkhqhcsdfpuq5hvwha (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_3buayaenjkhqhcsdfpuq5hvwha rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_3buayaenjkhqhcsdfpuq5hvwha is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_oo5qs7rbxkwaoynsqnedmrqaly (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_oo5qs7rbxkwaoynsqnedmrqaly: retire its instance key: injected failure at retire-key
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_oo5qs7rbxkwaoynsqnedmrqaly rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_oo5qs7rbxkwaoynsqnedmrqaly is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_wzjznvx4sjnfywbej27hbyfxqm (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_wzjznvx4sjnfywbej27hbyfxqm rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_wzjznvx4sjnfywbej27hbyfxqm is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_jrurtedz7w6el5khtriihllxgi (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_jrurtedz7w6el5khtriihllxgi: remove its local data: injected failure at remove-local
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_jrurtedz7w6el5khtriihllxgi rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_jrurtedz7w6el5khtriihllxgi is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_eaa72da5vpcbmp6bfddxie6x4i (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_eaa72da5vpcbmp6bfddxie6x4i rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_eaa72da5vpcbmp6bfddxie6x4i is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ofilrplc7gkuenbbe4o74x4iuy (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ofilrplc7gkuenbbe4o74x4iuy: remove its local data: injected failure at remove-local-done
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ofilrplc7gkuenbbe4o74x4iuy rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ofilrplc7gkuenbbe4o74x4iuy is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_24dnzzrfq2dkv5xrls2k4xd3ra (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_24dnzzrfq2dkv5xrls2k4xd3ra rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_24dnzzrfq2dkv5xrls2k4xd3ra is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_aqeexmgfa2hy3w6ovy6px37ery (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_aqeexmgfa2hy3w6ovy6px37ery: restore the original route: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_aqeexmgfa2hy3w6ovy6px37ery rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_aqeexmgfa2hy3w6ovy6px37ery is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_isfasv262i7alrl7wbwihxqfzi (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_isfasv262i7alrl7wbwihxqfzi: restore the original route: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_isfasv262i7alrl7wbwihxqfzi rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_isfasv262i7alrl7wbwihxqfzi is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ovvlpafhnrmwhzoclcovk2csxa (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ovvlpafhnrmwhzoclcovk2csxa is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_pmwgfwlzf6hxkur3spzhvxncuu (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_pmwgfwlzf6hxkur3spzhvxncuu rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_pmwgfwlzf6hxkur3spzhvxncuu: delete its snapshot: injected failure at delete-snapshot
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_pmwgfwlzf6hxkur3spzhvxncuu is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_7g5cd4ybapuhqhcoer3rmlbf6e (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_7g5cd4ybapuhqhcoer3rmlbf6e rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_7g5cd4ybapuhqhcoer3rmlbf6e is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_4b6rtx4izhqucybry3gdxx6kbe (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_4b6rtx4izhqucybry3gdxx6kbe rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_4b6rtx4izhqucybry3gdxx6kbe: delete the host's replica: injected failure at delete-replica
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_4b6rtx4izhqucybry3gdxx6kbe is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_oolqjeponn2qgsegg2c7beumei (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_oolqjeponn2qgsegg2c7beumei rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_oolqjeponn2qgsegg2c7beumei is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_hz5gzbr25zkvcvlz6rh5mfhkim (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_hz5gzbr25zkvcvlz6rh5mfhkim rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_hz5gzbr25zkvcvlz6rh5mfhkim: retire its journal row: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_hz5gzbr25zkvcvlz6rh5mfhkim is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ra7ifsbuustlzmsyurm7pxxqiq (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ra7ifsbuustlzmsyurm7pxxqiq rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ra7ifsbuustlzmsyurm7pxxqiq: retire its journal row: constraint failed: injected (1811)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ra7ifsbuustlzmsyurm7pxxqiq is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_tdylqygeymuucqj6fxq5wyfkbe (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_tdylqygeymuucqj6fxq5wyfkbe rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_tdylqygeymuucqj6fxq5wyfkbe is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: mark import sd_tdylqygeymuucqj6fxq5wyfkbe rolled back: injected failure at cas
2026/10/22 11:13:43 provision: a.shop.example.com: aborted seed sd_tdylqygeymuucqj6fxq5wyfkbe rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_6wjk4mt3k3i2wsmjkmeuktjsgu (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_6wjk4mt3k3i2wsmjkmeuktjsgu rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_6wjk4mt3k3i2wsmjkmeuktjsgu is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: aborted seed sd_6wjk4mt3k3i2wsmjkmeuktjsgu rolled back (no box had swapped it)
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ctgjyzschmvuvhkil6fina6tfq (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ctgjyzschmvuvhkil6fina6tfq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ctgjyzschmvuvhkil6fina6tfq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ctgjyzschmvuvhkil6fina6tfq rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ctgjyzschmvuvhkil6fina6tfq is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_yaoktooabgh2yv5pp4ertj3viy (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_yaoktooabgh2yv5pp4ertj3viy rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_yaoktooabgh2yv5pp4ertj3viy is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_npdflzivlyd7axr3w46zpvpxda (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_npdflzivlyd7axr3w46zpvpxda rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_npdflzivlyd7axr3w46zpvpxda is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_smmydzz52c4ayuimubb5juzzji (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_smmydzz52c4ayuimubb5juzzji rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_smmydzz52c4ayuimubb5juzzji is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_wf2mhei2xn7lqse244viggm5xm (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_wf2mhei2xn7lqse244viggm5xm rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_wf2mhei2xn7lqse244viggm5xm is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_rploh424gsodfayo3q2x5awaty (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_rploh424gsodfayo3q2x5awaty rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_rploh424gsodfayo3q2x5awaty is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/22 11:13:43 provision: a.shop.example.com: swapped for import sd_ovb37cxxxbp2k3ak7bcf7jdr4u (the original route is journaled)
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ovb37cxxxbp2k3ak7bcf7jdr4u rolled back to its original route
2026/10/22 11:13:43 provision: a.shop.example.com: import sd_ovb37cxxxbp2k3ak7bcf7jdr4u is cleaned up and its journal row retired
2026/10/22 11:13:43 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_ek3qxacb66ipjc3msgnukqegci (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_ek3qxacb66ipjc3msgnukqegci rolled back to its original route
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_ek3qxacb66ipjc3msgnukqegci is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_tfizvxgs5cjv6eyho3mjudguma (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_tfizvxgs5cjv6eyho3mjudguma has no route on this box: its local data is removed and no route is put back
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_tfizvxgs5cjv6eyho3mjudguma is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_aeb67aol4iw4yzevr464xy53wy (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_knezcnu27idlxcbhvka7p5ckfi (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_ject4idelh3k7e76fuivhjiwmy (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_ject4idelh3k7e76fuivhjiwmy cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_frezlgw5h3uj2d2oeo7hu2pidy (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_frezlgw5h3uj2d2oeo7hu2pidy is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/22 11:13:44 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/22 11:13:44 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_ktx666p7o7dbmrdsxw55zcbei4 (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_6scwqzg5y7bpsxkn4tqpfqz5xa (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_n6xhqlgqr7tarzrpxqoyllvjsm (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_xl43mshwhvftoo3h5yaxqbz6be (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_nikearmaolzbae7bzpfi2cp32y (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_nikearmaolzbae7bzpfi2cp32y rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_mnw243zlglnkyrtayeel5ctz5i (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_mnw243zlglnkyrtayeel5ctz5i has no route on this box: its local data is removed and no route is put back
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_mnw243zlglnkyrtayeel5ctz5i is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_o5ipkutakrspx4gt6y37u3sxz4 (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_o5ipkutakrspx4gt6y37u3sxz4: remove its local data: injected failure at remove-local
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_o5ipkutakrspx4gt6y37u3sxz4 is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_6tathgx6jr3zf5kacgmrvzjrfa (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_6tathgx6jr3zf5kacgmrvzjrfa: a route appeared at the host, so its local database is left and the rollback waits
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_ylwnsw4vxh7hgvt5tfwubgy5dm (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_ylwnsw4vxh7hgvt5tfwubgy5dm rollback deferred: no fence generation: registry busy
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_dxezilgofportxtekgoaneklqa (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_dxezilgofportxtekgoaneklqa rollback deferred: no fence generation: the generation source answered 0
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_qyf5gsdijcw72277kn7qczuwki (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_6yffpmpcd6iynguc6mhw6vdkrq (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_4a3l6hpibj7pb2lveqlu5zzogi (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/22 11:13:44 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_bkrsigrmh4ebolbisjjymngnp4 (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_bkrsigrmh4ebolbisjjymngnp4 rolled back to its original route
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_bkrsigrmh4ebolbisjjymngnp4 is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_vd6dbjepj3jw27eoshilyhqrxm (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_vd6dbjepj3jw27eoshilyhqrxm rolled back to its original route
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_vd6dbjepj3jw27eoshilyhqrxm is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_wq5ftklyn4jgyxcw262vuzlnqm (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_wq5ftklyn4jgyxcw262vuzlnqm rolled back to its original route
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_wq5ftklyn4jgyxcw262vuzlnqm is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_oppvjyy65wxdlqo7jsy7hm57ey (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_oppvjyy65wxdlqo7jsy7hm57ey: retire its instance key: the env file is a symlink
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_oppvjyy65wxdlqo7jsy7hm57ey rolled back to its original route
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_oppvjyy65wxdlqo7jsy7hm57ey is cleaned up and its journal row retired
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_b4ocw4aeyd7n3k47z42amh3auy (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_khypfkk2uzxlwcd3kxzpewq4gu (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_kbmrs2kcscy3nyshdiw3arw4ce refused: there is no route at a.shop.example.com to replace
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_xjxshf5ym5fgjqcg2akxekscfy refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_dfnqardbdmohzrcsh2xbj7d44a refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_rspauqfdwz5uqd52kbwtnwb5zi refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_m4cc4ixdez66mhofrsiicjhnqm refused: the route belongs to app other
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_xqcdsvjumfgwxsmwx5rnlhq2cq refused: the route is filed under another account
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_7bdjyl6ivqnlfmvh6olcgks2uy refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_ublvd6xrapzaloomwvsq5g4x5y refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_w3zv2pajak22ye62562lgblt5m refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_5ka6syicb4oata7yuzae7idtai refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_v2pz6ap6lwzqh6hxdcbgvhzngq refused: the route is not an address route this import can take over (socket)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_fos25lxyqrzllgfs57gm4pzo6e refused: the route is not an address route this import can take over (no address)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_kpzeb44x6i6u3rvevfm6jxqczq refused: the route is not an address route this import can take over (provisioned)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_kgexi3gevcluwnwx6lobll36sm refused: the route is not an address route this import can take over (kind static)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_vc3cag2yxcsusyddb7hxb456yy refused: the route is not an address route this import can take over (backing)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_vhjnhf4nn5sgmgdy5klt4oh5fa refused: the route is not an address route this import can take over (tunnel)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_z7dcl42wqdknqeorfmo3lw4234 refused: the route is not an address route this import can take over (caps)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_4nqixhzim35ebtc2c6xhfan2ua refused: the route is not an address route this import can take over (platform)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_wdjuh4gj3ebwubupkxtr2aqfsm refused: the route is not an address route this import can take over (canary)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_yoeqccblob45imzgkjzenj7sgq refused: the route is not an address route this import can take over (kind sidecar)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_oeovczvc47htgwmsstogur2z7u refused: the route is not an address route this import can take over (region)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_2nbldicq65innckwfambjfl3yu refused: the route is not an address route this import can take over (fleet_box)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_pnrm6acl42xuf45vl7jf66p2ja refused: the route is not an address route this import can take over (hibernate)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_2zzwrbbkpwk6wsycyym6ue5iuy refused: the route is not an address route this import can take over (claim_owner)
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_lhr3q4ghfgrpg75fccr5jsmpgu refused: this box does not run instances nested
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_5dlqij4p64rmdzcitk55wr36xi refused: this box does not run instances nested
2026/10/22 11:13:44 provision: a.shop.example.com: import sd_qjqao4ktpidsnwgqxufvgxbyvq refused: claim control is on for this box
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_i5feab7ivy55rmuueuxzsag5qe (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: swapped for import sd_qep4zsirqoeyzoekxwvfl7q55u (the original route is journaled)
2026/10/22 11:13:44 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/22 11:13:44 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/22 11:13:44 provision: a.shop.example.com: not swapping for import sd_dukrkpvegpqhwpcef2xjjt5gai: its verify hash is not a sha256
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_463akouufchjxqazeukm47rznu: its verify hash is not a sha256
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_sjs7rda5ovuxq5cls73gmlwhja: its verify hash is not a sha256
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/22 11:13:45 provision: A.shop.example.com/..: not swapping for import sd_4jsj5e3cmii3jsvl6fkfq6gidu: its host or seed id is malformed (seeds: not a host)
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_le32ba6jzc3ahkryyrtaybkut4: its record does not describe a nested, hibernating instance
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_53w5sqdbw2fmykmhblakkyzi5e: its record does not describe a nested, hibernating instance
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_24qi6n7omdsgb4jqcqecbvl3wu: its record does not describe a nested, hibernating instance
2026/10/22 11:13:45 provision: a.shop.example.com: not swapping for import sd_ugy6bbsmfs7j3bsmwly6njlgqa: its record does not describe a nested, hibernating instance
2026/10/22 11:13:45 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/22 11:13:45 provision: a.shop.example.com: swapped for import sd_nep2ffuhut5nnyr4ght3uvm6sq (the original route is journaled)
2026/10/22 11:13:45 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/22 11:13:45 provision: a.shop.example.com: swapped for import sd_k4n4uuh4qbx6uz2p322sj65j64 (the original route is journaled)
2026/10/22 11:13:45 provision: a.shop.example.com: swapped for import sd_oyhqx5552qaqyhordsen2jhati (the original route is journaled)
2026/10/22 11:13:45 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/22 11:13:45 provision: dry-run: would consider swapping a.shop.example.com for import sd_qzt3zsk2txxxh25wsknl5zt7wu
2026/10/22 11:13:45 provision: a.shop.example.com: import sd_x4xzmgqakyb7ys573yb7rly2tq rolled back to its original route
2026/10/22 11:13:45 provision: a.shop.example.com: import sd_x4xzmgqakyb7ys573yb7rly2tq: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/22 11:13:45 provision: a.shop.example.com: import sd_x4xzmgqakyb7ys573yb7rly2tq is cleaned up and its journal row retired
2026/10/22 11:13:45 provision: a.shop.example.com: import sd_245orpt7rp2pgvmgivyflzsiyq left alone: the import journal holds seed sd_nsg3u4x5pywcsktlystehghqz4 at swapped
2026/10/22 11:13:45 provision: a.shop.example.com: not minting import sd_56j4casfr2oblcdd35cjfiw6ou: it is swapped but not committed, and only its swap makes its row
2026/10/22 11:13:45 provision: a.shop.example.com: not minting import sd_a5io272t2d7oqt4ys254t56oge: it is placed but not committed, and only its swap makes its row
2026/10/22 11:13:45 provision: a.shop.example.com: swapped for import sd_lud5acwy5jommqd3ckfgwstjnm (the original route is journaled)
2026/10/22 11:13:45 provision: a.shop.example.com: not minting import sd_lud5acwy5jommqd3ckfgwstjnm: it is swapped but not committed, and only its swap makes its row
2026/10/22 11:13:45 provision: a.shop.example.com: not minting import sd_lud5acwy5jommqd3ckfgwstjnm: it is placed but not committed, and only its swap makes its row
2026/10/22 11:13:45 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/22 11:13:45 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/22 11:13:45 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/22 11:13:45 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/22 11:13:45 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/22 11:13:45 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/22 11:13:45 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/22 11:13:45 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/22 11:13:45 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/22 11:13:45 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/22 11:13:45 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/22 11:13:45 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/22 11:13:45 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/22 11:13:45 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/22 11:13:45 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/22 11:13:45 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/22 11:13:45 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/22 11:13:45 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/22 11:13:45 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/22 11:13:45 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/22 11:13:45 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/22 11:13:45 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:45 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/22 11:13:45 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:45 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:45 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/22 11:13:45 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/22 11:13:45 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/22 11:13:45 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/22 11:13:45 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/22 11:13:45 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/22 11:13:45 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
--- FAIL: TestPlan14RootReadCensus (13.98s)
plan14_root_reads_test.go:1261: root read census: 1 discrepancies
changed root source envelope internal/provision
FAIL
FAIL github.com/carlosframework/platform/internal/provision 24.175s
ok github.com/carlosframework/platform/internal/publicrelease 0.016s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 7.372s
ok github.com/carlosframework/platform/internal/relay 7.281s
ok github.com/carlosframework/platform/internal/release 28.577s
ok github.com/carlosframework/platform/internal/rollout 4.768s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.009s
ok github.com/carlosframework/platform/internal/rootparticipation 0.061s
ok github.com/carlosframework/platform/internal/rootstate 0.029s
ok github.com/carlosframework/platform/internal/runs 0.607s
ok github.com/carlosframework/platform/internal/s3compat 0.006s
ok github.com/carlosframework/platform/internal/safefile 0.006s
ok github.com/carlosframework/platform/internal/schedule 3.527s
ok github.com/carlosframework/platform/internal/seeds 0.023s
ok github.com/carlosframework/platform/internal/sim/hostlife 17.998s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.920s
ok github.com/carlosframework/platform/internal/status 0.183s
ok github.com/carlosframework/platform/internal/steering 0.013s
ok github.com/carlosframework/platform/internal/stopevidence 0.536s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.025s
ok github.com/carlosframework/platform/internal/termfence 0.006s
ok github.com/carlosframework/platform/internal/tunnelclient 0.007s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.008s
ok github.com/carlosframework/platform/internal/usage 0.007s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 2.002s
FAIL
=== internal_console@0 (84 s)
ok github.com/carlosframework/platform/internal/console 81.621s
=== internal_console@1 (40 s)
ok github.com/carlosframework/platform/internal/console 37.621s
=== internal_console@2 (45 s)
ok github.com/carlosframework/platform/internal/console 43.063s
=== internal_console@3 (40 s)
ok github.com/carlosframework/platform/internal/console 38.325s
=== internal_console@4 (40 s)
ok github.com/carlosframework/platform/internal/console 37.982s
=== internal_console@5 (37 s)
ok github.com/carlosframework/platform/internal/console 35.369s
=== internal_console@6 (39 s)
ok github.com/carlosframework/platform/internal/console 37.337s
=== internal_console@7 (46 s)
ok github.com/carlosframework/platform/internal/console 43.495s
=== root@0 (38 s)
ok github.com/carlosframework/platform 36.374s
=== root@1 (47 s)
ok github.com/carlosframework/platform 45.785s
=== root@2 (45 s)
ok github.com/carlosframework/platform 43.999s
FAILED: rest
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md| index 9f471428a..6bbcb3316 100644 |
| --- a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md |
| +++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md |
| @@ -2,7 +2,7 @@ |
| > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. |
| -Rev 15, 2026-10-22. Rev 14's review (`selfserve-plan2-review14.md`: N10b closed; N12 narrowed) is answered: the request-expiry decision is **durable and conditional** (`ExpireSelfServeRequest(id, nonce, sawDeadline)`: one UPDATE predicated on the nonce, the deadline the worker saw, no consumption and no accepted cut), mutually exclusive with `MarkSelfServeCut` (which also requires `request_expired = 0`), and only the winning expiry fences, voids and aborts; `persistedRequest` carries `Deadline`; the abbreviated call sites name their full arguments. Rev 13's review (`selfserve-plan2-review13.md`: N11, N10a closed; N10b narrowed; N12 new) is answered: the maintenance-to-idle consume requires `cut_requested_at = 0` in its predicate, so a cut that won makes a stale consume fail and the worker re-reads into the handoff (N10b); `MarkSelfServeCut` also transfers an outstanding unconfirmed `maintain` request's `request_deadline` to the cut's copy allowance in the same UPDATE, so one deadline policy governs adoption (N12). Rev 12's review (`selfserve-plan2-review12.md`: N9 closed; N10 narrowed; N11 new) is answered: **a request deadline exists only for writes whose expiry action is abort** (the pre-open writes: queue, stage, maintain, precheck, start, seal, flip, open); the post-open and clearing writes (gate 1, gate 2, finish, the abort path's abort and finish, estimate) carry `request_deadline = 0`, which `selfServeApply` never checks, so a page-and-retain phase whose evidence arrives late still clears the move (N11); abandonment rolls the next wait's deadline in its own UPDATE (`AbandonSelfServeRequest(id, nonce, nextDeadline)`) (N10a); a maintenance round's allowance starts at its issue and `ready` has **no step deadline while idle** (`next_maintenance_at` schedules the next round; `step_deadline = 0` between rounds) (N10b). Rev 11's review (`selfserve-plan2-review11.md`: N8 closed; N9 narrowed; N10 new) is answered: `selfServeApply` checks the request's deadline **before every forward-write attempt, replays included**, and an expired request leaves the loop as `errRequestExpired` for the fence-and-classify path, so no retry can open after the deadline inside one invocation (N9); a same-phase consume **rolls the next wait's deadline** in the same UPDATE (`ConsumeSelfServeRequest(id, nonce, nextStep, nextDeadline)`), issuance copies that fresh deadline into `request_deadline`, and the phase-wide limits stay on `staging_started_at` and `window_deadline` (N10). Rev 10's review (`selfserve-plan2-review10.md`: N6 closed; N8 narrowed; N9 new) is answered: **every** writer, the operator doors included, proposes its stamp as `max(now, the observed record's previous stamp + 1 ns)` and the mutation stores it verbatim, so stamps are monotonic under a backward clock and supersession by stamp is sound (N8); every request persists **its own deadline** (`request_deadline`, the issuing phase's step deadline), and an unconfirmed request whose deadline has passed while the record is at or before `offline-landed` is never replayed from **any** row phase, `open-uncertain` included: fence, classify, confirm if the write won, else void and abort (N9). Rev 9's review (`selfserve-plan2-review9.md`: 8, 10, 13, 20, N7 closed) is answered: **a committed confirmation expiry wins over a later cut** (`MarkSelfServeCut` also requires `expiry_pending = 0`; the cut door answers 409 "the move expired. prepare again"), and the persisted expiry carries its kind and deadline so execution revalidates its identity (N6); **an operator's newer staging stamp supersedes the job's outstanding wait**: when the record's stamp for the awaited field has moved past `request_proposed` without the receipt changing, the job abandons its request and issues a fresh bound round, with the crash between the two stated (N8). Rev 8's review (`selfserve-plan2-review8.md`: 21, N4 closed) is answered: reconciliation maps the record to a **phase and substep** (the first substep whose transition the record has not made), so an operator's progress never makes the job repeat a refused transition (item 10); abandonment is only for **leaving** a wait (abort, cancel, operator supersession), never for a page-and-retain expiry, with the phase table stated (item 13); the confirmation-deadline expiry commits only against `cut_requested_at = 0` and the deadline it saw, and the cut's copy expiry is a different decision (N6); the cut handoff persists which continuation it chose as a `restage` substep (`adopted` or `issue`) in the advancing transaction (N7); acceptance and discovery share one participant predicate (item 8); the superseded tag arrangement is deleted (item 20). Rev 7's review (`selfserve-plan2-review7.md`: N1, N2, N3, N5 closed) is answered: a phase with several writes has a durable **substep** (`phase_step`), advanced atomically with the consumption that ends the previous substep, and the phase function dispatches on it (item 10); confirmation is the **receipt alone** (no state predicate), phase progress is reconciliation's business (item 10); issuance refused with no outstanding request is its own result (`errRequestRefused`) (item 10); a confirmed request whose wait will never be satisfied is **abandoned** (consumed without its wait) by abort, expiry and operator supersession, and the finaliser consumes a confirmed clearing request in the transaction that records the outcome (item 13); `maintain` updates the stage identity like `stage` (N4); the cut's `MarkSelfServeCut` retires the ready deadline in the same UPDATE and ready expiry is conditional on no accepted cut (N6); return reports are **immutable per request key** (item 21); an id-less forward keeps `BoxID` membership and drops only the instance comparison (item 8); one untagged bridge file with the complete helper closure (item 20). Rev 6's review (`selfserve-plan2-review6.md`: items 1, 6, 17 closed) is answered: the request lifecycle is a complete state machine (`issued → confirmed → consumed`, or `voided`) with a **resume** path for a confirmed-unconsumed request, a standalone consume for same-phase sequences (start then seal, finish gate 1 then finish, round after round, estimate), issuance that returns the existing request so a caller of another kind or phase stops instead of interpreting it, and no-op-free receipts (a request-bearing mutation always writes its receipt) (item 10); the bound write checks **incarnation and sequence** (`provision.Expect{Incarnation, Seq}`) for the job and the operator doors (N5, item 13); every finalisation requires no outstanding request after a fence (item 13); the expiry branch classifies the fenced observation (N3); the cut is a **handoff**: the door marks `cut_requested_at` and the job turns the outstanding maintenance round into the first cut round (N4); event delivery marks `emitted` inside the transaction before delivering and the terminal event is inserted with the outcome (N1); per-box FIFO is stated (N2); the open intent is prepared before the request is issued so adoption and the persisted proposal agree, return requests carry a full identity ordered deterministically, reports name the request key, and acceptance binds the report to the reverse move's selected target (item 21); `Expect`'s real fields, `Load`'s absence distinction and one id-less rule (item 8); the fixtures move to an untagged `linux` file so today's tests keep compiling, `CopyEvent` carries its completion fields, the saved book is validated before seeding, `DiskFreeBytes` is numeric (item 20). Rev 5's review (`selfserve-plan2-review5.md`: items 2, 3, 4, 5, 7, 9, 11, 12, 14, 15, 16, 18, 19 closed) is answered: every job and operator record write is **predecessor-bound** (`provision.SetRecordMoveAt(ctx, s, acct, app, host, expectSeq, mut)`: one CAS write against the record whose `record_seq` equals the persisted expectation, no fresh-read retry), so a voided request can never land and an operator door never rebuilds a write after a reclaim fence (items 10, 13); every self-serve mutation stamps a **nonce receipt** on the record (`SelfServe.LastRequest`, or `LastMove.Request` for a clearing write), so confirmation is exact for every transition and distinct from an operator's reconciliation (item 10); confirm and advance require an unconsumed, unvoided request, so a stale worker cannot confirm a voided one (item 10); "pending" means **no confirmed request for the phase's write**, so the interval before issuance is compatible with the predecessor state (item 10); an expired uncommitted open is fenced and aborted, never replayed (N1); the stage book is reconciled against each complete successful round so deleted keys leave it (item 6); identity records are loaded by `boxid.Key(BoxID)` and `Verified` is narrowed to what `Enroll` proves (item 8); the gate's exception for an authorised malformed hostname and plan 1's outer 503 are declared (item 1); the view joins row id, move id, self-serve id and incarnation (item 17); the open record adopts an existing complete intent, return discovery and acceptance compare `InstanceID`, incarnation is re-checked at the door and in the guarded write, and `Layout` comes from the source's `stopped` report so every operator move has it (item 21); a maintenance restage in `ready` has its own kind and keeps the confirmation deadline (N2); the gate types, `StagedRequest`, failed diagnostics, the request argument to `confirmed`, and the bridge's compile rule are stated (item 20). Reviews: rev 1 (`after236/selfserve-plan2-review.md`, 20 findings), rev 2 (`selfserve-plan2-review2.md`, 21), rev 3 (`selfserve-plan2-review3.md`, 21 items), rev 4 (`selfserve-plan2-review4.md`, 21 items, 9 closed). Rev 5 is **self-contained** (nothing is "as rev N"; every schema, phase, predicate, sentence and test list is in this document) and answers rev 4's open items: the gate orders authentication, host shape and the capability check before the limiter and the no-bucket rail (item 1); operator moves keep today's admission (nil or stale metrics, no identity record) and only the self-serve path requires fresh identity; `BootID` is dropped (items 4, 8); the evidence reader takes the move and a freshness table is stated (item 5); the staged inventory is a **move-bound book** built from every copy event the mirror reports, including same-ETag and deferred copies, through a new observer hook that leaves ordinary mirroring unchanged (item 6); a participant is identified by `BoxID` **and** `InstanceID` in the resolver, in report validation and at every gate, and abort never requires the target (item 8); every request persists its **nonce, expected sequence and proposed stamp before the write**, confirmation is conditional on the record carrying that exact stamp, replay is idempotent, and consumption and the phase advance are one UPDATE predicated on the nonce (item 10); compatible sets include the predecessor state while a phase's write is pending (item 10); expiry is bound to its phase and cleared on reconciliation into another phase, with the health rule taking precedence (item 12); abandonment is conditional on the fenced observation and persisted before release, and every reclaim fences first, operator reservations included (item 13); own retries are accepted only for a complete expected selection after the whole table validates (item 14); the status view joins rows regardless of the mode (item 17); events carry a per-row sequence and are delivered inside the caller's transaction, the harness is an exported bridge **inside package host** behind the `e2e` tag with the CI step named, the Go declarations are complete, and queue ordering is stated (item 20); the open record is written **before** the open transition with the proposed open time, return requests have unique durable identities, the report path is named, acceptance is bound to the lifetime and the forward's participants, and leftovers are judged by the forward's layout (item 21). |
| +Rev 16, 2026-10-22. Rev 15's review (`selfserve-plan2-review15.md`: declarations closed; N12 three gaps) is answered: request expiry has **one** path (`selfServeApply`'s step (2) is the only place that decides it; the step's branch calls into it and acts only on a won decision, `open-uncertain` included); the decision compares **the cut state the worker saw** (`cut_requested_at = ?`) rather than requiring no cut, so expiry against the current deadline stays possible after a cut; an already-expired request (`pr.Expired`) resumes fence-and-classify directly and never re-decides; issuance resets `request_expired = 0`; the reload after a lost decision dispatches on what it finds (same nonce → retry; consumed or voided → stop; another nonce → `errRequestForeign`). Rev 14's review (`selfserve-plan2-review14.md`: N10b closed; N12 narrowed) is answered: the request-expiry decision is **durable and conditional** (`ExpireSelfServeRequest(id, nonce, sawDeadline)`: one UPDATE predicated on the nonce, the deadline the worker saw, no consumption and no accepted cut), mutually exclusive with `MarkSelfServeCut` (which also requires `request_expired = 0`), and only the winning expiry fences, voids and aborts; `persistedRequest` carries `Deadline`; the abbreviated call sites name their full arguments. Rev 13's review (`selfserve-plan2-review13.md`: N11, N10a closed; N10b narrowed; N12 new) is answered: the maintenance-to-idle consume requires `cut_requested_at = 0` in its predicate, so a cut that won makes a stale consume fail and the worker re-reads into the handoff (N10b); `MarkSelfServeCut` also transfers an outstanding unconfirmed `maintain` request's `request_deadline` to the cut's copy allowance in the same UPDATE, so one deadline policy governs adoption (N12). Rev 12's review (`selfserve-plan2-review12.md`: N9 closed; N10 narrowed; N11 new) is answered: **a request deadline exists only for writes whose expiry action is abort** (the pre-open writes: queue, stage, maintain, precheck, start, seal, flip, open); the post-open and clearing writes (gate 1, gate 2, finish, the abort path's abort and finish, estimate) carry `request_deadline = 0`, which `selfServeApply` never checks, so a page-and-retain phase whose evidence arrives late still clears the move (N11); abandonment rolls the next wait's deadline in its own UPDATE (`AbandonSelfServeRequest(id, nonce, nextDeadline)`) (N10a); a maintenance round's allowance starts at its issue and `ready` has **no step deadline while idle** (`next_maintenance_at` schedules the next round; `step_deadline = 0` between rounds) (N10b). Rev 11's review (`selfserve-plan2-review11.md`: N8 closed; N9 narrowed; N10 new) is answered: `selfServeApply` checks the request's deadline **before every forward-write attempt, replays included**, and an expired request leaves the loop as `errRequestExpired` for the fence-and-classify path, so no retry can open after the deadline inside one invocation (N9); a same-phase consume **rolls the next wait's deadline** in the same UPDATE (`ConsumeSelfServeRequest(id, nonce, nextStep, nextDeadline)`), issuance copies that fresh deadline into `request_deadline`, and the phase-wide limits stay on `staging_started_at` and `window_deadline` (N10). Rev 10's review (`selfserve-plan2-review10.md`: N6 closed; N8 narrowed; N9 new) is answered: **every** writer, the operator doors included, proposes its stamp as `max(now, the observed record's previous stamp + 1 ns)` and the mutation stores it verbatim, so stamps are monotonic under a backward clock and supersession by stamp is sound (N8); every request persists **its own deadline** (`request_deadline`, the issuing phase's step deadline), and an unconfirmed request whose deadline has passed while the record is at or before `offline-landed` is never replayed from **any** row phase, `open-uncertain` included: fence, classify, confirm if the write won, else void and abort (N9). Rev 9's review (`selfserve-plan2-review9.md`: 8, 10, 13, 20, N7 closed) is answered: **a committed confirmation expiry wins over a later cut** (`MarkSelfServeCut` also requires `expiry_pending = 0`; the cut door answers 409 "the move expired. prepare again"), and the persisted expiry carries its kind and deadline so execution revalidates its identity (N6); **an operator's newer staging stamp supersedes the job's outstanding wait**: when the record's stamp for the awaited field has moved past `request_proposed` without the receipt changing, the job abandons its request and issues a fresh bound round, with the crash between the two stated (N8). Rev 8's review (`selfserve-plan2-review8.md`: 21, N4 closed) is answered: reconciliation maps the record to a **phase and substep** (the first substep whose transition the record has not made), so an operator's progress never makes the job repeat a refused transition (item 10); abandonment is only for **leaving** a wait (abort, cancel, operator supersession), never for a page-and-retain expiry, with the phase table stated (item 13); the confirmation-deadline expiry commits only against `cut_requested_at = 0` and the deadline it saw, and the cut's copy expiry is a different decision (N6); the cut handoff persists which continuation it chose as a `restage` substep (`adopted` or `issue`) in the advancing transaction (N7); acceptance and discovery share one participant predicate (item 8); the superseded tag arrangement is deleted (item 20). Rev 7's review (`selfserve-plan2-review7.md`: N1, N2, N3, N5 closed) is answered: a phase with several writes has a durable **substep** (`phase_step`), advanced atomically with the consumption that ends the previous substep, and the phase function dispatches on it (item 10); confirmation is the **receipt alone** (no state predicate), phase progress is reconciliation's business (item 10); issuance refused with no outstanding request is its own result (`errRequestRefused`) (item 10); a confirmed request whose wait will never be satisfied is **abandoned** (consumed without its wait) by abort, expiry and operator supersession, and the finaliser consumes a confirmed clearing request in the transaction that records the outcome (item 13); `maintain` updates the stage identity like `stage` (N4); the cut's `MarkSelfServeCut` retires the ready deadline in the same UPDATE and ready expiry is conditional on no accepted cut (N6); return reports are **immutable per request key** (item 21); an id-less forward keeps `BoxID` membership and drops only the instance comparison (item 8); one untagged bridge file with the complete helper closure (item 20). Rev 6's review (`selfserve-plan2-review6.md`: items 1, 6, 17 closed) is answered: the request lifecycle is a complete state machine (`issued → confirmed → consumed`, or `voided`) with a **resume** path for a confirmed-unconsumed request, a standalone consume for same-phase sequences (start then seal, finish gate 1 then finish, round after round, estimate), issuance that returns the existing request so a caller of another kind or phase stops instead of interpreting it, and no-op-free receipts (a request-bearing mutation always writes its receipt) (item 10); the bound write checks **incarnation and sequence** (`provision.Expect{Incarnation, Seq}`) for the job and the operator doors (N5, item 13); every finalisation requires no outstanding request after a fence (item 13); the expiry branch classifies the fenced observation (N3); the cut is a **handoff**: the door marks `cut_requested_at` and the job turns the outstanding maintenance round into the first cut round (N4); event delivery marks `emitted` inside the transaction before delivering and the terminal event is inserted with the outcome (N1); per-box FIFO is stated (N2); the open intent is prepared before the request is issued so adoption and the persisted proposal agree, return requests carry a full identity ordered deterministically, reports name the request key, and acceptance binds the report to the reverse move's selected target (item 21); `Expect`'s real fields, `Load`'s absence distinction and one id-less rule (item 8); the fixtures move to an untagged `linux` file so today's tests keep compiling, `CopyEvent` carries its completion fields, the saved book is validated before seeding, `DiskFreeBytes` is numeric (item 20). Rev 5's review (`selfserve-plan2-review5.md`: items 2, 3, 4, 5, 7, 9, 11, 12, 14, 15, 16, 18, 19 closed) is answered: every job and operator record write is **predecessor-bound** (`provision.SetRecordMoveAt(ctx, s, acct, app, host, expectSeq, mut)`: one CAS write against the record whose `record_seq` equals the persisted expectation, no fresh-read retry), so a voided request can never land and an operator door never rebuilds a write after a reclaim fence (items 10, 13); every self-serve mutation stamps a **nonce receipt** on the record (`SelfServe.LastRequest`, or `LastMove.Request` for a clearing write), so confirmation is exact for every transition and distinct from an operator's reconciliation (item 10); confirm and advance require an unconsumed, unvoided request, so a stale worker cannot confirm a voided one (item 10); "pending" means **no confirmed request for the phase's write**, so the interval before issuance is compatible with the predecessor state (item 10); an expired uncommitted open is fenced and aborted, never replayed (N1); the stage book is reconciled against each complete successful round so deleted keys leave it (item 6); identity records are loaded by `boxid.Key(BoxID)` and `Verified` is narrowed to what `Enroll` proves (item 8); the gate's exception for an authorised malformed hostname and plan 1's outer 503 are declared (item 1); the view joins row id, move id, self-serve id and incarnation (item 17); the open record adopts an existing complete intent, return discovery and acceptance compare `InstanceID`, incarnation is re-checked at the door and in the guarded write, and `Layout` comes from the source's `stopped` report so every operator move has it (item 21); a maintenance restage in `ready` has its own kind and keeps the confirmation deadline (N2); the gate types, `StagedRequest`, failed diagnostics, the request argument to `confirmed`, and the bridge's compile rule are stated (item 20). Reviews: rev 1 (`after236/selfserve-plan2-review.md`, 20 findings), rev 2 (`selfserve-plan2-review2.md`, 21), rev 3 (`selfserve-plan2-review3.md`, 21 items), rev 4 (`selfserve-plan2-review4.md`, 21 items, 9 closed). Rev 5 is **self-contained** (nothing is "as rev N"; every schema, phase, predicate, sentence and test list is in this document) and answers rev 4's open items: the gate orders authentication, host shape and the capability check before the limiter and the no-bucket rail (item 1); operator moves keep today's admission (nil or stale metrics, no identity record) and only the self-serve path requires fresh identity; `BootID` is dropped (items 4, 8); the evidence reader takes the move and a freshness table is stated (item 5); the staged inventory is a **move-bound book** built from every copy event the mirror reports, including same-ETag and deferred copies, through a new observer hook that leaves ordinary mirroring unchanged (item 6); a participant is identified by `BoxID` **and** `InstanceID` in the resolver, in report validation and at every gate, and abort never requires the target (item 8); every request persists its **nonce, expected sequence and proposed stamp before the write**, confirmation is conditional on the record carrying that exact stamp, replay is idempotent, and consumption and the phase advance are one UPDATE predicated on the nonce (item 10); compatible sets include the predecessor state while a phase's write is pending (item 10); expiry is bound to its phase and cleared on reconciliation into another phase, with the health rule taking precedence (item 12); abandonment is conditional on the fenced observation and persisted before release, and every reclaim fences first, operator reservations included (item 13); own retries are accepted only for a complete expected selection after the whole table validates (item 14); the status view joins rows regardless of the mode (item 17); events carry a per-row sequence and are delivered inside the caller's transaction, the harness is an exported bridge **inside package host** behind the `e2e` tag with the CI step named, the Go declarations are complete, and queue ordering is stated (item 20); the open record is written **before** the open transition with the proposed open time, return requests have unique durable identities, the report path is named, acceptance is bound to the lifetime and the forward's participants, and leftovers are judged by the forward's layout (item 21). |
| Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13): records carry a lifetime, `record_seq` and `move_seq`, rows carry the pair, readers and writers are judged, `fenceRecord(ctx, acct, app, host, op fenceOwner) (fenceResult, Observation, error)` exists, the console runs behind the lifetimes cutover. This plan adds everything a Tito customer's request needs up to a finished move except the holding page, the edge probe mode and cleanup (plans 3 and 4). |
| @@ -103,7 +103,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| **Interfaces:** |
| - Table `self_serve_moves (id TEXT PRIMARY KEY, account TEXT, app TEXT, host TEXT, incarnation INTEGER, from_region TEXT, to_region TEXT, participants TEXT, display_name TEXT, requested_by TEXT, phase TEXT, phase_started_at INTEGER, step_deadline INTEGER, window_deadline INTEGER, expiry_pending INTEGER, expiry_phase TEXT, expiry_kind TEXT, expiry_deadline INTEGER, staging_started_at INTEGER, request_issued INTEGER, request_kind TEXT, request_phase TEXT, request_nonce TEXT, request_expect_seq INTEGER, request_proposed INTEGER, request_confirmed INTEGER, request_consumed INTEGER, request_voided INTEGER, request_abandoned INTEGER, request_expect_inc INTEGER, request_deadline INTEGER, request_expired INTEGER, next_maintenance_at INTEGER, cut_requested_at INTEGER, phase_step TEXT, stage_request INTEGER, precheck_request INTEGER, rounds INTEGER, estimate_seconds INTEGER, estimate_terms TEXT, reason TEXT, health_attempts INTEGER, health_consecutive_ok INTEGER, health_first_ok_at INTEGER, health_last_probe_at INTEGER, health_last_error TEXT, finish_gate TEXT, notified_seq INTEGER, event_seq INTEGER, outcome TEXT, outcome_reason TEXT, warning TEXT, abort_requested_at INTEGER, source_reopened_at INTEGER, abort_finished_at INTEGER, effects_done INTEGER, release_pending INTEGER, open_record_pending INTEGER, created_at INTEGER, updated_at INTEGER)`; `CREATE UNIQUE INDEX IF NOT EXISTS self_serve_moves_open ON self_serve_moves(account, app, host) WHERE outcome = ''`. |
| -- **The request lifecycle** (one request at a time per row): `IssueSelfServeRequest(id, kind, phase string, pr persistedRequest, now time.Time) (issued bool, existing *persistedRequest, err error)` (`WHERE phase = ? AND outcome = '' AND (request_consumed <> 0 OR request_issued = 0)`: sets `request_issued = now, request_kind, request_phase, request_nonce, request_expect_inc, request_expect_seq, request_proposed, request_deadline = the issuing phase's step deadline **for a request whose expiry action is abort** (queue, stage, maintain, precheck, start, seal, flip, open) and **0 for every other kind** (gate 1, gate 2, finish, abort, the abort path's finish, estimate: their phases page and retain, and their writes must always be allowed to complete), request_confirmed = 0, request_consumed = 0, request_voided = 0`; not issued → `existing` is the outstanding request, whatever its kind and phase); `ConsumeSelfServeRequest(id, nonce, nextStep string, nextDeadline time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, phase_step = nextStep, step_deadline = nextDeadline` in one statement, so **each wait's deadline starts when the previous request is consumed**: a staging round's `max(10 min, 3 × est.Copy)` runs from its own issue, each finishing gate gets its own 10 min, each maintenance round its own allowance; the phase-wide limits (`now - staging_started_at > 30 min`, `WindowDeadline`) are separate columns and unaffected; `AdvanceSelfServe` sets `step_deadline` for the new phase's first wait likewise; a crash between a consume and the next issue finds the fresh deadline already persisted; the standalone consume for a same-phase sequence: the substep advances exactly when the previous request is consumed, so a crash between them cannot lose the position); `AbandonSelfServeRequest(id, nonce string, nextDeadline time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, request_abandoned = 1, step_deadline = nextDeadline` in one statement, so the replacement wait gets a fresh allowance and a crash between the abandon and the next issue finds it persisted; only abort, an expiry action and operator supersession call it: the request's write committed but its wait will never be satisfied, so the phase gives it up and proceeds); `ConfirmSelfServeRequest(id, nonce string, now time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_voided = 0 AND request_confirmed = 0`: `request_confirmed = now`; false → the caller re-reads the row: confirmed already → **resume** (success), voided or consumed → stop; for kinds `stage` **and `maintain`** also `stage_request = request_proposed`, for `precheck` also `precheck_request = request_proposed`); `VoidSelfServeRequest(id, nonce string) error` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_confirmed = 0`: `request_consumed = 1, request_voided = 1`; a confirmed request is never voided; the phase function decides again); `AdvanceSelfServe(id, from, to, reason string, step, window time.Time, nonce string, now time.Time) (bool, error)`: one UPDATE with the predicate `phase = ? AND (abort_requested_at = 0 OR ? IN ('reverting','done','opened','health','finishing')) AND (? = '' OR request_nonce = ?)` that sets the phase, `phase_started_at`, the deadlines, `expiry_pending = 0, expiry_phase = ''` when `to <> expiry_phase`, and, when a nonce is given, additionally requires `request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0` and sets `request_consumed = 1` (**consumption and the advance are one statement**), and inserts the phase event in the same transaction (`event_seq = event_seq + 1`); a stale worker holding another nonce, or the same nonce after a void, cannot confirm or consume. |
| +- **The request lifecycle** (one request at a time per row): `IssueSelfServeRequest(id, kind, phase string, pr persistedRequest, now time.Time) (issued bool, existing *persistedRequest, err error)` (`WHERE phase = ? AND outcome = '' AND (request_consumed <> 0 OR request_issued = 0)`: sets `request_issued = now, request_kind, request_phase, request_nonce, request_expect_inc, request_expect_seq, request_proposed, request_deadline = the issuing phase's step deadline **for a request whose expiry action is abort** (queue, stage, maintain, precheck, start, seal, flip, open) and **0 for every other kind** (gate 1, gate 2, finish, abort, the abort path's finish, estimate: their phases page and retain, and their writes must always be allowed to complete), request_confirmed = 0, request_consumed = 0, request_voided = 0, request_expired = 0`; not issued → `existing` is the outstanding request, whatever its kind and phase); `ConsumeSelfServeRequest(id, nonce, nextStep string, nextDeadline time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, phase_step = nextStep, step_deadline = nextDeadline` in one statement, so **each wait's deadline starts when the previous request is consumed**: a staging round's `max(10 min, 3 × est.Copy)` runs from its own issue, each finishing gate gets its own 10 min, each maintenance round its own allowance; the phase-wide limits (`now - staging_started_at > 30 min`, `WindowDeadline`) are separate columns and unaffected; `AdvanceSelfServe` sets `step_deadline` for the new phase's first wait likewise; a crash between a consume and the next issue finds the fresh deadline already persisted; the standalone consume for a same-phase sequence: the substep advances exactly when the previous request is consumed, so a crash between them cannot lose the position); `AbandonSelfServeRequest(id, nonce string, nextDeadline time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, request_abandoned = 1, step_deadline = nextDeadline` in one statement, so the replacement wait gets a fresh allowance and a crash between the abandon and the next issue finds it persisted; only abort, an expiry action and operator supersession call it: the request's write committed but its wait will never be satisfied, so the phase gives it up and proceeds); `ConfirmSelfServeRequest(id, nonce string, now time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_voided = 0 AND request_confirmed = 0`: `request_confirmed = now`; false → the caller re-reads the row: confirmed already → **resume** (success), voided or consumed → stop; for kinds `stage` **and `maintain`** also `stage_request = request_proposed`, for `precheck` also `precheck_request = request_proposed`); `VoidSelfServeRequest(id, nonce string) error` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_confirmed = 0`: `request_consumed = 1, request_voided = 1`; a confirmed request is never voided; the phase function decides again); `AdvanceSelfServe(id, from, to, reason string, step, window time.Time, nonce string, now time.Time) (bool, error)`: one UPDATE with the predicate `phase = ? AND (abort_requested_at = 0 OR ? IN ('reverting','done','opened','health','finishing')) AND (? = '' OR request_nonce = ?)` that sets the phase, `phase_started_at`, the deadlines, `expiry_pending = 0, expiry_phase = ''` when `to <> expiry_phase`, and, when a nonce is given, additionally requires `request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0` and sets `request_consumed = 1` (**consumption and the advance are one statement**), and inserts the phase event in the same transaction (`event_seq = event_seq + 1`); a stale worker holding another nonce, or the same nonce after a void, cannot confirm or consume. |
| - Other store methods: `AdmitSelfServeMove(m SelfServeMove) (admitted bool, open *SelfServeMove, err error)`; `SelfServeMove(id string) (*SelfServeMove, error)`; `SelfServeMoveForHost(acct, app, host string) (open, terminal *SelfServeMove, err error)` (the open row, and the newest terminal row); `OpenSelfServeMoves() ([]SelfServeMove, error)` (`outcome = '' OR release_pending = 1 OR effects_done = 0 OR open_record_pending = 1`, **ordered by `created_at, id`**: the pass steps rows in that order; **per-box FIFO**: a row in `reserving` may reserve only when no older open row (by `created_at, id`) that shares any participant `BoxID` is still in `requested` or `reserving`; otherwise it waits with `reason` "waiting for an earlier move on this box"; rows with disjoint participants never wait on each other); `MarkSelfServeCut(id string, now time.Time, copyDeadline time.Time) (bool, error)` (`WHERE phase = 'ready' AND abort_requested_at = 0 AND cut_requested_at = 0 AND expiry_pending = 0 AND request_expired = 0`: a confirmation expiry already committed wins, and the cut door re-reads and answers 409 "the move expired. prepare again"; sets `cut_requested_at = now`, **`window_deadline = 0`** (the confirmation deadline is retired by the cut that won), `step_deadline = copyDeadline` (the cut's copy wait) **and, when an unconsumed `maintain` request is outstanding, `request_deadline = copyDeadline`** (the adopted round gets the cut's allowance whether or not its write has committed yet) in the same UPDATE; the cut door's only write); the `ready` expiry rule applies only while `cut_requested_at = 0`; `SetSelfServeEstimate`, `RecordSelfServeHealth(id string, probeAt time.Time, ok bool, errText string) error` (`health_attempts + 1`; `consecutive_ok = CASE ok THEN consecutive_ok + 1 ELSE 0`; `first_ok_at` kept once set), `SetSelfServeFinishGate`, `SetSelfServeWarning`, `SetSelfServeNotifiedSeq(id string, seq uint64) error`, `SetSelfServeExpiry(id, phase string, kind string, sawDeadline time.Time, pending bool) (bool, error)` (`kind` is `window` or `step`; the UPDATE also records `expiry_kind = kind, expiry_deadline = sawDeadline`, and the expiry **action** later re-reads the row and runs only when `expiry_pending`, `expiry_phase`, `expiry_kind` and `expiry_deadline` still match what it is acting on (an expiry whose identity changed is dropped); the UPDATE's predicate is `phase = ? AND (window_deadline = ? for window, step_deadline = ? for step) AND (kind <> 'window' OR cut_requested_at = 0)`, so a worker whose snapshot predates a successful cut cannot record the obsolete confirmation expiry (`TestStaleExpiryLosesToTheCut`: a worker paused across the cut at T-1 resumes at T+1 and its `window` expiry is refused; the copy's `step` expiry after the cut is accepted; **expiry first**: the window expiry commits at T+ε, then the cut door → 409 expired, and the abort runs; a restart between the committed expiry and the cut → the same); `SetSelfServeExpiry` returning false → the worker re-reads the row and decides again`, `RequestSelfServeAbort(id string, phases []string, now time.Time) (bool, error)` (`WHERE phase IN (...) AND abort_requested_at = 0`), `SetSelfServeReopened`, `SetSelfServeAbortFinished`, `FinishSelfServeMove(id, outcome, reason, warning string, now time.Time) error` (`release_pending = 1`, `effects_done = 0`), `SetSelfServeEffectsDone(id string) error`, `ClearSelfServeRelease(id string) error`, `SetSelfServeOpenRecordPending(id string, pending bool) error`. |
| - Table `self_serve_events (id TEXT, seq INTEGER, phase TEXT, account TEXT, app TEXT, host TEXT, at INTEGER, reason TEXT, detail TEXT, emitted INTEGER, PRIMARY KEY (id, seq))`: `InsertSelfServeEventTx(tx *sql.Tx, e SelfServeEvent) error` (allocates `seq` from the row's `event_seq` in the same transaction; used by `AdvanceSelfServe` and by every refusal, fact decision, lane probe, health probe and timing); `UnemittedSelfServeEvents(limit int) ([]SelfServeEvent, error)`; `DeliverSelfServeEvent(ctx context.Context, e SelfServeEvent, deliver func(tx *sql.Tx) error) error` (one transaction: first `UPDATE self_serve_events SET emitted = 1 WHERE id = ? AND seq = ? AND emitted = 0`; zero rows → commit nothing and return (another worker delivered it); else `deliver(tx)` inserts the audit row through `auditActivityTx(tx, ...)`; a failure rolls both back). The terminal event is inserted by `FinishSelfServeMove` in the transaction that sets the outcome, so a crash between finalisation steps never allocates a second terminal event. Table `self_serve_timings (id TEXT, mark TEXT, account TEXT, app TEXT, host TEXT, at INTEGER, bytes INTEGER, PRIMARY KEY (id, mark))`. |
| - Phases: `requested`, `reserving`, `queued`, `reports`, `staging`, `prechecks`, `ready`, `restage`, `barrier`, `stopping`, `sealing`, `landing`, `landed`, `open-uncertain`, `opened`, `health`, `finishing`, `reverting`, `done`. |
| @@ -161,9 +161,9 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| - Test: `internal/e2e/selfserve/job_test.go` |
| **Interfaces:** |
| -- `type persistedRequest struct { Kind, Phase, Nonce string; ExpectInc, ExpectSeq uint64; Proposed, Deadline time.Time; Confirmed, Consumed, Voided, Expired bool }`; `func (s *Server) selfServeApply(ctx context.Context, t *leaseToken, row *SelfServeMove, req request, proposed *time.Time, mut func(at time.Time, rc provision.Receipt) func(*provision.Record) error) (*provision.Record, error)` with `type request struct { Kind, Phase string }`: (1) the judged record → `pr.ExpectInc = rec.Incarnation`, `pr.ExpectSeq = rec.RecordSeq`; `pr.Proposed = *proposed` when given (the open intent) else `max(now, latest stamp on the record + 1 ns)`; `pr.Nonce = random`; `IssueSelfServeRequest(id, kind, phase, pr, now)`: not issued and `existing == nil` → `errRequestRefused` (the row left the phase or ended; the step ends); `existing.Kind != req.Kind || existing.Phase != req.Phase` → return `errRequestForeign` (this caller never interprets another request; the step ends and reconciliation decides next tick); `existing.Confirmed && !existing.Consumed` → **resume**: return the record (the caller continues its wait and the notification catch-up); otherwise `pr = *existing` and go to (3); (2) **first, when `pr.Deadline != 0` and `now >= pr.Deadline`**, the expiry is **decided durably**: `ExpireSelfServeRequest(id, pr.Nonce, pr.Deadline)` (`UPDATE ... SET request_expired = 1 WHERE request_nonce = ? AND request_deadline = ? AND request_consumed = 0 AND request_expired = 0 AND cut_requested_at = 0`); true → return `errRequestExpired` without writing (the step's fence-and-classify path takes over, and only this winner may fence, void and abort); false → the row changed under this worker (a cut extended the deadline, or the request was consumed): **reload the request** and go back to (2) with the fresh `pr` (`TestStaleRequestDeadlineLosesToTheCut`: a worker paused in its confirmation read across a cut that extends the deadline → its expiry UPDATE matches nothing, it reloads and continues under the new allowance; expiry first → the cut door is refused; crashes after the decision and around the fence in both orders); otherwise a request with `Deadline == 0` is never expired by this check (`TestLateEvidenceStillClearsTheMove`: a source's `gone` report arriving after `finishing`'s deadline → the finish is written and the reservations release; the same for `reverting`'s facts and for an already-issued uncommitted finish recovering after the deadline); then `provision.SetRecordMoveAt(ctx', s, acct, app, host, provision.Expect{Incarnation: pr.ExpectInc, Seq: pr.ExpectSeq}, mut(pr.Proposed, Receipt{pr.Nonce}))` with the lease-bounded context and the write guard: **one CAS attempt against the record at that incarnation and sequence; no fresh-read retry inside**; (3) **confirmation** from a fresh judged read, whatever (2) returned: `rec` carries the receipt (`SelfServe.LastRequest == pr.Nonce`, or `LastMove.Request == pr.Nonce` for a clearing write) → `ConfirmSelfServeRequest(id, nonce, now)` (**the receipt alone confirms**; a box that has already advanced the record past the written state (seal → sealed, flip → landed) does not change that; the `confirmed` callback is dropped and phase progress is reconciliation's business) (false → re-read: already confirmed → resume; voided → stop); else `rec.Incarnation == pr.ExpectInc && rec.RecordSeq == pr.ExpectSeq` (unchanged) → the write did not land: repeat (2), **which re-checks the deadline first** (idempotent replay of the same bound write; bounded by the lease and the deadline; `TestReplayStopsAtTheDeadlineInsideOneInvocation`: an open request whose PUT fails at T-1 s and whose confirmation read returns at T+1 s is not replayed; the step fences and classifies; the same with the PUT having committed → confirmed); else (the record advanced without the receipt: another writer, an operator) → `VoidSelfServeRequest(id, nonce)` and return `errRequestVoided`; the bound write makes this safe: a PUT transmitted against `ExpectSeq` cannot commit on a record that has moved past it; after a confirmed write: `bumpSerialErr` and, on success, `SetSelfServeNotifiedSeq(id, rec.RecordSeq)`; a failed bump leaves `notified_seq` behind and every later tick bumps again while `rec.RecordSeq != notified_seq`. A crash anywhere resumes at (3) on the next tick from the persisted request. |
| +- `type persistedRequest struct { Kind, Phase, Nonce string; ExpectInc, ExpectSeq uint64; Proposed, Deadline time.Time; Confirmed, Consumed, Voided, Expired bool }`; `func (s *Server) selfServeApply(ctx context.Context, t *leaseToken, row *SelfServeMove, req request, proposed *time.Time, mut func(at time.Time, rc provision.Receipt) func(*provision.Record) error) (*provision.Record, error)` with `type request struct { Kind, Phase string }`: (1) the judged record → `pr.ExpectInc = rec.Incarnation`, `pr.ExpectSeq = rec.RecordSeq`; `pr.Proposed = *proposed` when given (the open intent) else `max(now, latest stamp on the record + 1 ns)`; `pr.Nonce = random`; `IssueSelfServeRequest(id, kind, phase, pr, now)`: not issued and `existing == nil` → `errRequestRefused` (the row left the phase or ended; the step ends); `existing.Kind != req.Kind || existing.Phase != req.Phase` → return `errRequestForeign` (this caller never interprets another request; the step ends and reconciliation decides next tick); `existing.Confirmed && !existing.Consumed` → **resume**: return the record (the caller continues its wait and the notification catch-up); otherwise `pr = *existing` and go to (3); (2) **first, when `pr.Deadline != 0` and `now >= pr.Deadline`**, the expiry is **decided durably**: `ExpireSelfServeRequest(id, pr.Nonce, pr.Deadline)` (`UPDATE ... SET request_expired = 1 WHERE request_nonce = ? AND request_deadline = ? AND cut_requested_at = ? AND request_consumed = 0 AND request_expired = 0`, the third `?` being the `cut_requested_at` the worker read with `pr`, so a cut that landed since makes the decision lose, while after a cut the decision is made against the current deadline as usual); true → return `errRequestExpired` without writing (the step's fence-and-classify path takes over, and only this winner may fence, void and abort); false → **reload the request** and dispatch on what is found: the same nonce, still unconsumed and unexpired → back to (2) with the fresh `pr` (a cut extended the deadline); the same nonce **already expired** (`pr.Expired`, a previous worker won and crashed before fencing) → return `errRequestExpired` **without re-deciding** (the fence-and-classify path resumes; a crash around the fence re-enters here and resumes again); consumed or voided → stop (`errRequestRefused`); another nonce → `errRequestForeign` (`TestStaleRequestDeadlineLosesToTheCut`: a worker paused in its confirmation read across a cut that extends the deadline → its expiry UPDATE matches nothing, it reloads and continues under the new allowance; expiry first → the cut door is refused; **after a cut**, an open request whose extended deadline passes expires normally against the current `cut_requested_at`; **a won expiry followed by a crash before the fence** → the restart finds `pr.Expired` and fences, classifies and aborts without a second decision; crashes around the fence in both orders); otherwise a request with `Deadline == 0` is never expired by this check (`TestLateEvidenceStillClearsTheMove`: a source's `gone` report arriving after `finishing`'s deadline → the finish is written and the reservations release; the same for `reverting`'s facts and for an already-issued uncommitted finish recovering after the deadline); then `provision.SetRecordMoveAt(ctx', s, acct, app, host, provision.Expect{Incarnation: pr.ExpectInc, Seq: pr.ExpectSeq}, mut(pr.Proposed, Receipt{pr.Nonce}))` with the lease-bounded context and the write guard: **one CAS attempt against the record at that incarnation and sequence; no fresh-read retry inside**; (3) **confirmation** from a fresh judged read, whatever (2) returned: `rec` carries the receipt (`SelfServe.LastRequest == pr.Nonce`, or `LastMove.Request == pr.Nonce` for a clearing write) → `ConfirmSelfServeRequest(id, nonce, now)` (**the receipt alone confirms**; a box that has already advanced the record past the written state (seal → sealed, flip → landed) does not change that; the `confirmed` callback is dropped and phase progress is reconciliation's business) (false → re-read: already confirmed → resume; voided → stop); else `rec.Incarnation == pr.ExpectInc && rec.RecordSeq == pr.ExpectSeq` (unchanged) → the write did not land: repeat (2), **which re-checks the deadline first** (idempotent replay of the same bound write; bounded by the lease and the deadline; `TestReplayStopsAtTheDeadlineInsideOneInvocation`: an open request whose PUT fails at T-1 s and whose confirmation read returns at T+1 s is not replayed; the step fences and classifies; the same with the PUT having committed → confirmed); else (the record advanced without the receipt: another writer, an operator) → `VoidSelfServeRequest(id, nonce)` and return `errRequestVoided`; the bound write makes this safe: a PUT transmitted against `ExpectSeq` cannot commit on a record that has moved past it; after a confirmed write: `bumpSerialErr` and, on success, `SetSelfServeNotifiedSeq(id, rec.RecordSeq)`; a failed bump leaves `notified_seq` behind and every later tick bumps again while `rec.RecordSeq != notified_seq`. A crash anywhere resumes at (3) on the next tick from the persisted request. |
| - `type provision.Expect struct { Incarnation, Seq uint64 }`; `provision.SetRecordMoveAt(ctx, s, acct, app, host string, expect Expect, mut) (*provision.Record, error)`: reads the judged record; `rec.Incarnation != expect.Incarnation || rec.RecordSeq != expect.Seq` → `ErrCASConflict` without writing; otherwise one `WriteRecord` against the observed ETag; a CAS conflict → `ErrCASConflict` (no retry). `SetRecordMove` (today's, with its retry) is no longer used by any self-serve or operator move writer. |
| -- `selfServeStep`: (1) the row's deadlines: an expired `StepDeadline`, or an expired `WindowDeadline` while `cut_requested_at = 0`, → `SetSelfServeExpiry(id, phase, kind, sawDeadline, true)` (`kind` `window` or `step` by which deadline passed, `sawDeadline` the value the worker read) (no action yet); (2) the judged record; (3) **reconcile forward** by the compatible sets (Task 4): an unconfirmed request → step (3) of `selfServeApply` first, **except** when the request's own `request_deadline` has passed (whatever the row's current phase: `landed`, `open-uncertain` or any other) and the record is at or before `offline-landed`: then the record is observed once; the receipt present → confirmed (the write won before the expiry, the expiry is post-write); absent → `fenceRecord` (plan 1; so the outstanding bound PUT can never land) and **the fenced observation is classified**: the receipt present in it → the write won during the fence: confirm and proceed forward (an open that committed is reconciled as opened, never aborted); absent → `VoidSelfServeRequest` and the expiry action runs (abort), **never a replay** (`TestExpiredOpenIsNeverReplayed`); then the row's phase not in the record's set → `AdvanceSelfServe` to the set's first phase (without the abort predicate for `opened`), which clears a foreign expiry; (4) the expiry action for an `expiry_pending` whose `expiry_phase == phase`: the record at or before `offline-landed` → abort; committed open → the blocked action (page); unreadable → `open-uncertain`; `health` → warning, page, `finishing`; (5) the abort step when requested and the record at or before `offline-landed`; (6) the phase function. Every wait for a report is for `Request`/`StagedRequest == request_proposed` of the **confirmed** request; **supersession by stamp**: each tick the waiting phase also reads the record's stamp for the awaited field (`StagedAt` for `stage`/`maintain`, `PrecheckAt` for `precheck`); when it is **later** than `request_proposed` while the receipt is unchanged, an operator round has superseded the job's (`OfflineRestage`/`OfflinePrecheck` from the operator doors move the stamp without a receipt), so the job `AbandonSelfServeRequest`s its request and, on the next step, issues a fresh bound round (the abandon is one UPDATE; a crash after it finds no outstanding request and issues; a crash before it repeats the comparison); the job never adopts an operator round as its own (`TestOperatorRoundSupersedesTheJobsWait`: a confirmed restage at S1, an operator stage to S2, the stager reports S2 only → the job abandons S1 and issues S3, the cut proceeds; the same in `staging/round` and `ready/round`; a crash between the abandon and the issue); the report is consumed by the `AdvanceSelfServe` that leaves the waiting phase, with the nonce, **or**, inside a phase that writes more than once (`stopping`: start then seal; `finishing`: gate 1 then gate 2; `staging`: round after round; `prechecks`: the precheck then the estimate; `ready`: each maintenance round), by `ConsumeSelfServeRequest(id, nonce)` once its wait is satisfied, immediately before the next request is issued, and **the phase function dispatches on `phase_step`**: `stopping` = `start` → `seal`; `finishing` = `gate1` → `gate2`; `prechecks` = `precheck` → `estimate`; `reverting` = `abort` → `finish`; `staging` and `ready` = `round` (repeated); a phase entered by `AdvanceSelfServe` from the **job's own** progression starts at its first substep (`phase_step` set by the advance); a phase entered by **reconciliation** starts at the substep the record dictates (below); a restart resumes the substep recorded, never the phase's first write (`TestSubstepsResumeAfterEveryCrash`: a crash after consuming start and before issuing seal re-enters at `seal`; a crash with the estimate request outstanding re-enters at `estimate` and resumes it; the same for gate 1 → gate 2 and abort → finish). **Abandonment** is for **leaving a wait**, never for retaining it: when abort is requested, when an expiry whose action is **abort** fires, or when an operator transition supersedes the phase, a confirmed request whose wait is unsatisfied is `AbandonSelfServeRequest`ed before the abort or the reconciliation step issues its own request; an expiry whose action is page-and-retain (`opened`, `finishing`, `reverting`, `open-uncertain`) or warn-and-finish (`health`) abandons nothing and the wait continues (`TestPageOnlyExpiriesKeepTheWait`: the open request confirmed, `opened` missing at the deadline, the page sent, then the target reports opened and the nonce-bearing advance succeeds). By phase: `requested`/`reserving` resolve or fence an issued queue request before finalising or releasing; `queued`/`reports` abandon a superseded wait, a queued abort clears and finalises atomically; `staging`/`prechecks`/`ready` may abandon on cancel or aborting expiry; `restage`/`barrier`/`stopping`/`sealing`/`landing`/pre-open `landed` may abandon on aborting expiry after resolving the uncertain write; `open-uncertain` abandons nothing; a confirmed clearing write is consumed with the terminal outcome (`TestAbandonedRequestsNeverStrandAbort`: a confirmed stage request whose copy never reports, then cancel → the abort request issues; a confirmed precheck whose box died, then the deadline → abort issues). **Clearing requests**: `OfflineFinish`, `OfflineAbortAt` and the abort path's finish are confirmed from `LastMove.Request`; the finaliser's `FinishSelfServeMove` consumes that confirmed request in the same transaction as the outcome, so a crash between confirmation and finalisation resumes at the finaliser, not at a re-issue. |
| +- `selfServeStep`: (1) the row's deadlines: an expired `StepDeadline`, or an expired `WindowDeadline` while `cut_requested_at = 0`, → `SetSelfServeExpiry(id, phase, kind, sawDeadline, true)` (`kind` `window` or `step` by which deadline passed, `sawDeadline` the value the worker read) (no action yet); (2) the judged record; (3) **reconcile forward** by the compatible sets (Task 4): an unconfirmed request → step (3) of `selfServeApply` first, **except** when `selfServeApply`'s step (2) returned `errRequestExpired` for the outstanding request (**the only place expiry is decided**, whatever the row's current phase: `landed`, `open-uncertain` or any other; the step never compares deadlines itself) and the record is at or before `offline-landed`: then the record is observed once; the receipt present → confirmed (the write won before the expiry, the expiry is post-write); absent → `fenceRecord` (plan 1; so the outstanding bound PUT can never land) and **the fenced observation is classified**: the receipt present in it → the write won during the fence: confirm and proceed forward (an open that committed is reconciled as opened, never aborted); absent → `VoidSelfServeRequest` and the expiry action runs (abort), **never a replay** (`TestExpiredOpenIsNeverReplayed`); then the row's phase not in the record's set → `AdvanceSelfServe` to the set's first phase (without the abort predicate for `opened`), which clears a foreign expiry; (4) the expiry action for an `expiry_pending` whose `expiry_phase == phase`: the record at or before `offline-landed` → abort; committed open → the blocked action (page); unreadable → `open-uncertain`; `health` → warning, page, `finishing`; (5) the abort step when requested and the record at or before `offline-landed`; (6) the phase function. Every wait for a report is for `Request`/`StagedRequest == request_proposed` of the **confirmed** request; **supersession by stamp**: each tick the waiting phase also reads the record's stamp for the awaited field (`StagedAt` for `stage`/`maintain`, `PrecheckAt` for `precheck`); when it is **later** than `request_proposed` while the receipt is unchanged, an operator round has superseded the job's (`OfflineRestage`/`OfflinePrecheck` from the operator doors move the stamp without a receipt), so the job `AbandonSelfServeRequest`s its request and, on the next step, issues a fresh bound round (the abandon is one UPDATE; a crash after it finds no outstanding request and issues; a crash before it repeats the comparison); the job never adopts an operator round as its own (`TestOperatorRoundSupersedesTheJobsWait`: a confirmed restage at S1, an operator stage to S2, the stager reports S2 only → the job abandons S1 and issues S3, the cut proceeds; the same in `staging/round` and `ready/round`; a crash between the abandon and the issue); the report is consumed by the `AdvanceSelfServe` that leaves the waiting phase, with the nonce, **or**, inside a phase that writes more than once (`stopping`: start then seal; `finishing`: gate 1 then gate 2; `staging`: round after round; `prechecks`: the precheck then the estimate; `ready`: each maintenance round), by `ConsumeSelfServeRequest(id, nonce)` once its wait is satisfied, immediately before the next request is issued, and **the phase function dispatches on `phase_step`**: `stopping` = `start` → `seal`; `finishing` = `gate1` → `gate2`; `prechecks` = `precheck` → `estimate`; `reverting` = `abort` → `finish`; `staging` and `ready` = `round` (repeated); a phase entered by `AdvanceSelfServe` from the **job's own** progression starts at its first substep (`phase_step` set by the advance); a phase entered by **reconciliation** starts at the substep the record dictates (below); a restart resumes the substep recorded, never the phase's first write (`TestSubstepsResumeAfterEveryCrash`: a crash after consuming start and before issuing seal re-enters at `seal`; a crash with the estimate request outstanding re-enters at `estimate` and resumes it; the same for gate 1 → gate 2 and abort → finish). **Abandonment** is for **leaving a wait**, never for retaining it: when abort is requested, when an expiry whose action is **abort** fires, or when an operator transition supersedes the phase, a confirmed request whose wait is unsatisfied is `AbandonSelfServeRequest`ed before the abort or the reconciliation step issues its own request; an expiry whose action is page-and-retain (`opened`, `finishing`, `reverting`, `open-uncertain`) or warn-and-finish (`health`) abandons nothing and the wait continues (`TestPageOnlyExpiriesKeepTheWait`: the open request confirmed, `opened` missing at the deadline, the page sent, then the target reports opened and the nonce-bearing advance succeeds). By phase: `requested`/`reserving` resolve or fence an issued queue request before finalising or releasing; `queued`/`reports` abandon a superseded wait, a queued abort clears and finalises atomically; `staging`/`prechecks`/`ready` may abandon on cancel or aborting expiry; `restage`/`barrier`/`stopping`/`sealing`/`landing`/pre-open `landed` may abandon on aborting expiry after resolving the uncertain write; `open-uncertain` abandons nothing; a confirmed clearing write is consumed with the terminal outcome (`TestAbandonedRequestsNeverStrandAbort`: a confirmed stage request whose copy never reports, then cancel → the abort request issues; a confirmed precheck whose box died, then the deadline → abort issues). **Clearing requests**: `OfflineFinish`, `OfflineAbortAt` and the abort path's finish are confirmed from `LastMove.Request`; the finaliser's `FinishSelfServeMove` consumes that confirmed request in the same transaction as the outcome, so a crash between confirmation and finalisation resumes at the finaliser, not at a re-issue. |
| - **Reconciliation and recovery table** (the record is the truth): |
| | row phase | record | action | |