amadan
units: pin the rootfs cmd template to the instance's reach; no escape hatch or block override (rootfs apps plan 2, task 4 fix 1)
Review round 1. The cmd template's Slice=, BindPaths=, ReadWritePaths= and cmd pair were unpinned, so deleting its Slice= passed every test and took a command out of the host slice and out of carlos-instances.slice, whose IPAddressDeny= is the only box-address fence (#367). Pinned, and the cmd template is now the instance template outside its named lines (TestRootfsCmdTemplateEqualsRootfsOutsideTheNamedLines, as the binary seed/cmd pair). Gen, worker and cmd pin the coupling, stop budget and resource lines too. New tests: no IPAddressAllow=, Delegate= or Exec prefix (+, !, !!, or any other: every Exec value is a bare absolute path) in a rootfs unit; no directive outside the shared block reuses a key the block sets, since systemd takes the last assignment (a non-empty BindReadOnlyPaths= excepted); the bind-source allowlist also covers RootDirectory=, MountImages=, ExtensionImages= and ExtensionDirectories=; exactly one WorkingDirectory= per tenant template and none in the probe. The ProtectSystem=strict comment now says what systemd 257 does: /dev, /proc and /sys are exempt, /run is read-only too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
6 files changed,
+200
−29
internal/host/units/carlos-instance-rootfs-cmd@.service+5 −3internal/host/units/carlos-instance-rootfs-gen@.service+5 −3internal/host/units/carlos-instance-rootfs-probe.service+5 −3internal/host/units/carlos-instance-rootfs-worker@.service+5 −3internal/host/units/carlos-instance-rootfs@.service+5 −3internal/host/units_rootfs_test.go+175 −14
CI failed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (17 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (70 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.900s
ok github.com/carlosframework/platform/cmd/moveprobe 11.640s
ok github.com/carlosframework/platform/cmd/zddprobe 0.714s
ok github.com/carlosframework/platform/internal/activator 59.059s
ok github.com/carlosframework/platform/internal/agentsock 0.018s
ok github.com/carlosframework/platform/internal/alerting 0.006s
ok github.com/carlosframework/platform/internal/analytics 0.026s
ok github.com/carlosframework/platform/internal/appconfig 3.329s
ok github.com/carlosframework/platform/internal/apperr 0.095s
ok github.com/carlosframework/platform/internal/applog 0.165s
ok github.com/carlosframework/platform/internal/assetcache 0.078s
ok github.com/carlosframework/platform/internal/awsinv 0.006s
ok github.com/carlosframework/platform/internal/boxchoice 0.006s
ok github.com/carlosframework/platform/internal/boxid 0.919s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.004s
ok github.com/carlosframework/platform/internal/cgroup 0.739s
ok github.com/carlosframework/platform/internal/changelog 0.375s
ok github.com/carlosframework/platform/internal/claimactivation 0.929s
ok github.com/carlosframework/platform/internal/clamd 0.057s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 7.823s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.009s
ok github.com/carlosframework/platform/internal/dbquery 0.007s
ok github.com/carlosframework/platform/internal/dbreads 2.113s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.005s
ok github.com/carlosframework/platform/internal/dnsrec 0.004s
ok github.com/carlosframework/platform/internal/docsite 0.021s
ok github.com/carlosframework/platform/internal/domains 3.365s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.007s
ok github.com/carlosframework/platform/internal/edge 45.998s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.009s
ok github.com/carlosframework/platform/internal/fleetapi 0.190s
ok github.com/carlosframework/platform/internal/gate 1.761s
ok github.com/carlosframework/platform/internal/genselect 0.032s
ok github.com/carlosframework/platform/internal/geo 0.011s
ok github.com/carlosframework/platform/internal/geoip 0.079s
ok github.com/carlosframework/platform/internal/historyreadback 0.278s
ok github.com/carlosframework/platform/internal/hostactors 7.191s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.007s
ok github.com/carlosframework/platform/internal/hostbox 3.596s
ok github.com/carlosframework/platform/internal/hostclaim 0.795s
ok github.com/carlosframework/platform/internal/hostenv 0.005s
ok github.com/carlosframework/platform/internal/hostevidence 0.008s
ok github.com/carlosframework/platform/internal/hostexec 5.770s
ok github.com/carlosframework/platform/internal/hostfence 0.038s
ok github.com/carlosframework/platform/internal/hostfiles 10.213s
ok github.com/carlosframework/platform/internal/hostfloor 0.020s
ok github.com/carlosframework/platform/internal/hostguard 1.074s
ok github.com/carlosframework/platform/internal/hostops 2.416s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.003s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.703s
ok github.com/carlosframework/platform/internal/hostresolve 0.182s
ok github.com/carlosframework/platform/internal/hostwrite 0.005s
ok github.com/carlosframework/platform/internal/infraview 0.004s
ok github.com/carlosframework/platform/internal/instancectl 5.254s
ok github.com/carlosframework/platform/internal/instanceexec 2.831s
ok github.com/carlosframework/platform/internal/instancefs 0.005s
ok github.com/carlosframework/platform/internal/instancekey 0.002s
ok github.com/carlosframework/platform/internal/instanceupdates 0.012s
ok github.com/carlosframework/platform/internal/layout 2.185s
ok github.com/carlosframework/platform/internal/lbhealth 0.004s
ok github.com/carlosframework/platform/internal/lease 10.229s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.580s
ok github.com/carlosframework/platform/internal/ledger 0.014s
ok github.com/carlosframework/platform/internal/mail 0.177s
ok github.com/carlosframework/platform/internal/maintenance 0.096s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.562s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.095s
ok github.com/carlosframework/platform/internal/metrics 0.006s
ok github.com/carlosframework/platform/internal/moves 22.216s
ok github.com/carlosframework/platform/internal/moves/archive 1.368s
ok github.com/carlosframework/platform/internal/objstore 0.252s
ok github.com/carlosframework/platform/internal/ops 0.239s
ok github.com/carlosframework/platform/internal/park 0.249s
ok github.com/carlosframework/platform/internal/plans 0.006s
ok github.com/carlosframework/platform/internal/privatefile 0.003s
2026/10/25 12:03:21 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:21 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:21 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/25 12:03:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:21 provision: an app's records could not be listed: they are skipped
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:21 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 12:03:21 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 12:03:21 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 12:03:21 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 12:03:21 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 12:03:21 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 12:03:21 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 12:03:21 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 12:03:21 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 12:03:21 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 12:03:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 12:03:21 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 12:03:21 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 12:03:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:21 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:21 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:21 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:21 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:21 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:21 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:22 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 12:03:22 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 12:03:22 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/25 12:03:22 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/25 12:03:22 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:22 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:22 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/25 12:03:24 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/25 12:03:24 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/25 12:03:24 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io hibernate false -> true
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged acme.go.tito.io status-named false -> true
2026/10/25 12:03:24 provision: converged acme.go.tito.io status-named true -> false
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 12:03:24 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 12:03:24 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 12:03:24 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 12:03:24 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/25 12:03:24 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/25 12:03:24 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 12:03:24 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 12:03:24 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 12:03:24 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:24 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 12:03:24 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/25 12:03:24 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/25 12:03:24 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:24 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 12:03:24 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:24 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/25 12:03:24 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 12:03:24 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:24 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 12:03:24 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:24 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 12:03:24 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:24 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:24 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/25 12:03:24 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 12:03:24 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/25 12:03:24 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:24 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 12:03:24 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/25 12:03:24 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/25 12:03:24 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/25 12:03:24 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/25 12:03:24 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/25 12:03:24 provision: dry-run: would converge owned.go.tito.io seed
2026/10/25 12:03:24 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:24 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/25 12:03:24 provision: converged owned.go.tito.io channel stable -> edge
2026/10/25 12:03:24 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/25 12:03:24 provision: converged owned.go.tito.io hibernate false -> true
2026/10/25 12:03:24 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/25 12:03:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/25 12:03:24 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/25 12:03:24 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:24 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: removed retired static route site.go.tito.io (record gone)
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/25 12:03:25 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/25 12:03:25 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:25 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 12:03:25 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 12:03:25 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 12:03:25 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 12:03:25 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/25 12:03:25 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 12:03:25 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 12:03:25 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 12:03:25 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 12:03:25 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/25 12:03:25 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/25 12:03:25 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 12:03:25 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/25 12:03:25 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/25 12:03:25 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 12:03:25 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/25 12:03:25 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 12:03:25 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:25 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:26 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:26 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 12:03:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 12:03:26 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/25 12:03:26 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/25 12:03:26 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 12:03:26 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:26 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:26 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 12:03:26 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 12:03:26 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:26 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:26 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 12:03:26 provision: a.shop.example.com: swapped for import sd_jri4i75jyxqyxeurxdmiu7z6jy (the original route is journaled)
2026/10/25 12:03:26 provision: a.shop.example.com: import sd_jri4i75jyxqyxeurxdmiu7z6jy committed: its gate is cleared and its journal row dropped
2026/10/25 12:03:26 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_db6solju55yfjdneye5te7meyq rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_db6solju55yfjdneye5te7meyq: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_db6solju55yfjdneye5te7meyq is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_a5qhnbik7qnxbukxb5trp2hqjy rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_a5qhnbik7qnxbukxb5trp2hqjy: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_a5qhnbik7qnxbukxb5trp2hqjy is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_eru4v2e7vsdanb67yee6t5qnk4
2026/10/25 12:03:27 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/25 12:03:27 provision: dry-run: would converge a.shop.example.com seed source
2026/10/25 12:03:27 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/25 12:03:27 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/25 12:03:27 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_xxk3qda6kqoe7xj5esanhzufhm cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_pygqebz4rhre4wxscbokpb3ueu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_hcecw37ii6dhbbdutxgjpecrxa is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_fxesh77jsgajxrmqkv7b7qtrk4 is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_6bjxrwwbvyjkhim5zp7xfeqkfe is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 12:03:27 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/25 12:03:27 provision: b.shop.example.com: import sd_eezj3ymep6v6j67ynyxvhplxyq left alone this pass: the import journal could not be read
2026/10/25 12:03:27 provision: c.shop.example.com: import sd_icofvne7m4ztgwkdmehy2z3exu left alone this pass: the import journal could not be read
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_u2nfy5pobptw5afumpncumbtuq committed: its gate is cleared and its journal row dropped
2026/10/25 12:03:27 provision: a.shop.example.com: not converging import sd_em7rsyfubjfpnzwkxybfusvptm: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 12:03:27 provision: a.shop.example.com: not converging import sd_zosctf3iopz6tsystgglmbsb3i: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 12:03:27 provision: a.shop.example.com: not converging import sd_423td2fqio4hylzq7gf5qkwjmu: it is placed but not committed, and the row on this box has no import gate
2026/10/25 12:03:27 provision: a.shop.example.com: not converging import sd_hzsrid2zuutpu2xovyl3copgoq: it is placed but not committed, and the row on this box has no import gate
2026/10/25 12:03:27 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/25 12:03:27 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_vp6do4oldxu57s3uttpnxpujny committed: its gate is cleared and its journal row dropped
2026/10/25 12:03:27 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:27 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:27 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/25 12:03:27 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_2tdocm5tpo3y6rpwcz7m2lxlma: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_2tdocm5tpo3y6rpwcz7m2lxlma rolled back (no box had swapped it)
2026/10/25 12:03:27 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/25 12:03:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:27 provision: removed instance route acme.go.tito.io (its seed sd_s2ihi7fwgn5lnfzgpbmdagqmee was aborted); the next pass rolls it back
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_s2ihi7fwgn5lnfzgpbmdagqmee: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_s2ihi7fwgn5lnfzgpbmdagqmee rolled back (no box had swapped it)
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_5eliojmte2irrzhuy6sqnkxwv4 has a row this pass may not remove; leaving the seed aborted
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_6m5ouxc42oetmkypgmsw6evvlu rolled back (no box had swapped it)
2026/10/25 12:03:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:27 provision: removed instance route acme.go.tito.io (its seed sd_pzmk6jzdvaispthlaatkjnzgim was aborted); the next pass rolls it back
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_pzmk6jzdvaispthlaatkjnzgim has no route on this box: its local data is removed
2026/10/25 12:03:27 provision: acme.go.tito.io: aborted seed sd_pzmk6jzdvaispthlaatkjnzgim rolled back (no box had swapped it)
2026/10/25 12:03:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_mqxflxfpyiybnhxgu3ffbniipq (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_mqxflxfpyiybnhxgu3ffbniipq rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_mqxflxfpyiybnhxgu3ffbniipq is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_yp55x2srjrgurgnakmhhpr56di (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_yp55x2srjrgurgnakmhhpr56di rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_yp55x2srjrgurgnakmhhpr56di is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_nefi5xuyr4q53kecdglbfudune (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_nefi5xuyr4q53kecdglbfudune rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_nefi5xuyr4q53kecdglbfudune: the host's replica is left alone: its record no longer names this seed
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_nefi5xuyr4q53kecdglbfudune is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_zutl6yzvbkifvjj2nshqcocpgu (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_zutl6yzvbkifvjj2nshqcocpgu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_zutl6yzvbkifvjj2nshqcocpgu rolled back to its original route
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_zutl6yzvbkifvjj2nshqcocpgu is cleaned up and its journal row retired
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_gml35gcak76fkpl6o5xmtwblzq (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_gml35gcak76fkpl6o5xmtwblzq rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/25 12:03:27 provision: a.shop.example.com: swapped for import sd_wwwvptrsg2rjpwx2kvcn5lkazy (the original route is journaled)
2026/10/25 12:03:27 provision: a.shop.example.com: import sd_wwwvptrsg2rjpwx2kvcn5lkazy is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_sg4z35ctsmdm7uv4n7lsmi5kse (the original route is journaled)
2026/10/25 12:03:28 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_sg4z35ctsmdm7uv4n7lsmi5kse left alone this pass: its record could not be read
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_wv2bvdgspscnhmmpsynodl7juu (the original route is journaled)
2026/10/25 12:03:28 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_wv2bvdgspscnhmmpsynodl7juu left alone this pass: its record could not be read
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_vjx5k2m6nqk237b4efek6hoidm (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_vjx5k2m6nqk237b4efek6hoidm: close the import gate: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_vjx5k2m6nqk237b4efek6hoidm rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_vjx5k2m6nqk237b4efek6hoidm is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_ygtgnfkprj2fhwyt2qlpx3o3z4 (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ygtgnfkprj2fhwyt2qlpx3o3z4: close the import gate: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ygtgnfkprj2fhwyt2qlpx3o3z4 rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ygtgnfkprj2fhwyt2qlpx3o3z4 is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_c55xzpwow4hpfm2lju5q4t3qom (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_c55xzpwow4hpfm2lju5q4t3qom rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_c55xzpwow4hpfm2lju5q4t3qom rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_c55xzpwow4hpfm2lju5q4t3qom is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_qyb6wxmdj32cg3xq7c747sorfm (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_qyb6wxmdj32cg3xq7c747sorfm rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_qyb6wxmdj32cg3xq7c747sorfm is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_ps7knzmcejoxxgcsieqe2cmrra (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ps7knzmcejoxxgcsieqe2cmrra: retire its instance key: injected failure at retire-key
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ps7knzmcejoxxgcsieqe2cmrra rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ps7knzmcejoxxgcsieqe2cmrra is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_jdopjbxidrhpmzq45xyjrm3z24 (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_jdopjbxidrhpmzq45xyjrm3z24 rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_jdopjbxidrhpmzq45xyjrm3z24 is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_pwwm5olxc7bjrn4hjfwslsyvny (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_pwwm5olxc7bjrn4hjfwslsyvny: remove its local data: injected failure at remove-local
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_pwwm5olxc7bjrn4hjfwslsyvny rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_pwwm5olxc7bjrn4hjfwslsyvny is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_sq23i4wsczpinwmpqlmjxdviaq (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_sq23i4wsczpinwmpqlmjxdviaq rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_sq23i4wsczpinwmpqlmjxdviaq is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_u2kxfrzmehik4g7wfo46dbo7aa (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_u2kxfrzmehik4g7wfo46dbo7aa: remove its local data: injected failure at remove-local-done
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_u2kxfrzmehik4g7wfo46dbo7aa rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_u2kxfrzmehik4g7wfo46dbo7aa is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_2yrvwenrvlyjtoitlg7hbpgbx4 (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_2yrvwenrvlyjtoitlg7hbpgbx4 rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_2yrvwenrvlyjtoitlg7hbpgbx4 is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_syybjltno7knnbe7x2vhfm4t6a (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_syybjltno7knnbe7x2vhfm4t6a: restore the original route: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_syybjltno7knnbe7x2vhfm4t6a rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_syybjltno7knnbe7x2vhfm4t6a is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_7lghe2rhjlbff6btq7nixmocmi (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_7lghe2rhjlbff6btq7nixmocmi: restore the original route: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_7lghe2rhjlbff6btq7nixmocmi rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_7lghe2rhjlbff6btq7nixmocmi is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_mhto4tzfvtrhlhspbx7nmkkaea (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_mhto4tzfvtrhlhspbx7nmkkaea is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_l7hdszox2qif6iiw2gfz4zhxty (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_l7hdszox2qif6iiw2gfz4zhxty rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_l7hdszox2qif6iiw2gfz4zhxty: delete its snapshot: injected failure at delete-snapshot
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_l7hdszox2qif6iiw2gfz4zhxty is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_347n2ztipzc6etfuxspkxiaxeq (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_347n2ztipzc6etfuxspkxiaxeq rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_347n2ztipzc6etfuxspkxiaxeq is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_voyt3cwllfz5accol7k2jccxwi (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_voyt3cwllfz5accol7k2jccxwi rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_voyt3cwllfz5accol7k2jccxwi: delete the host's replica: injected failure at delete-replica
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_voyt3cwllfz5accol7k2jccxwi is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_nvqdcvfc2sxgxem3qea4qd2pgm (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_nvqdcvfc2sxgxem3qea4qd2pgm rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_nvqdcvfc2sxgxem3qea4qd2pgm is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_wpxmagfmvsqhkvlz2xjdsr45lq (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_wpxmagfmvsqhkvlz2xjdsr45lq rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_wpxmagfmvsqhkvlz2xjdsr45lq: retire its journal row: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_wpxmagfmvsqhkvlz2xjdsr45lq is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_csxipix2yngyfs7b7dyee53jiu (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_csxipix2yngyfs7b7dyee53jiu rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_csxipix2yngyfs7b7dyee53jiu: retire its journal row: constraint failed: injected (1811)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_csxipix2yngyfs7b7dyee53jiu is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_gw2yp2qoomu2p3pw4mmj3yibgy (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_gw2yp2qoomu2p3pw4mmj3yibgy rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_gw2yp2qoomu2p3pw4mmj3yibgy is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: mark import sd_gw2yp2qoomu2p3pw4mmj3yibgy rolled back: injected failure at cas
2026/10/25 12:03:28 provision: a.shop.example.com: aborted seed sd_gw2yp2qoomu2p3pw4mmj3yibgy rolled back (no box had swapped it)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_5gygekld42zauu2jxdwe5jc4aq (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_5gygekld42zauu2jxdwe5jc4aq rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_5gygekld42zauu2jxdwe5jc4aq is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: aborted seed sd_5gygekld42zauu2jxdwe5jc4aq rolled back (no box had swapped it)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_n4hwxsma7gbikapbzpf5u5pile (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_n4hwxsma7gbikapbzpf5u5pile rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_n4hwxsma7gbikapbzpf5u5pile rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_n4hwxsma7gbikapbzpf5u5pile rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_n4hwxsma7gbikapbzpf5u5pile is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_bgmkbuyzhp7a2qxbx7rqkyxewu (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_bgmkbuyzhp7a2qxbx7rqkyxewu rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_bgmkbuyzhp7a2qxbx7rqkyxewu is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_2jcbcolaacbvgbsbwrrf3j7dee (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_2jcbcolaacbvgbsbwrrf3j7dee rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_2jcbcolaacbvgbsbwrrf3j7dee is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_a4qynliu5deu3wwmx27fx7hgpi (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_a4qynliu5deu3wwmx27fx7hgpi rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_a4qynliu5deu3wwmx27fx7hgpi is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_sbytoy27a2xve6auy3g5gcksxe (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_sbytoy27a2xve6auy3g5gcksxe rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_sbytoy27a2xve6auy3g5gcksxe is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_l6knduequ33su26nlymqqijk2m (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_l6knduequ33su26nlymqqijk2m rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_l6knduequ33su26nlymqqijk2m is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_ihj3knerwjhw7cw4ilpdoqkeiy (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ihj3knerwjhw7cw4ilpdoqkeiy rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ihj3knerwjhw7cw4ilpdoqkeiy is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_fi4h2cjnkingcypxed3m527l34 (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_fi4h2cjnkingcypxed3m527l34 rolled back to its original route
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_fi4h2cjnkingcypxed3m527l34 is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_yc5sraibsj6ndamoxrdeoqhwva (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_yc5sraibsj6ndamoxrdeoqhwva has no route on this box: its local data is removed and no route is put back
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_yc5sraibsj6ndamoxrdeoqhwva is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_3yxdrxzq5tlo55hcjq3utffhmq (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_6h2m5tt7d256mtsmtou5nl4uei (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_tx5p4nlk5fe6cqit547sw3az2e (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_tx5p4nlk5fe6cqit547sw3az2e cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_jcl4sihp6odc7xf5bcuqsnkdhy (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_jcl4sihp6odc7xf5bcuqsnkdhy is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/25 12:03:28 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/25 12:03:28 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_xhs4sfhczdctoza443hiaxftfi (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_exyr3ulpph4rtnvfec3gzncfou (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_ne5bnv2cxioznkgnviwctcdplm (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_2plil4uf4da3hnwimmquuhklry (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_vqbo5s5xsyycy3l4ananfiiq2u (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_vqbo5s5xsyycy3l4ananfiiq2u rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_p4lcrlepji5fmup27hnmcdsjsm (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_p4lcrlepji5fmup27hnmcdsjsm has no route on this box: its local data is removed and no route is put back
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_p4lcrlepji5fmup27hnmcdsjsm is cleaned up and its journal row retired
2026/10/25 12:03:28 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_ymkej5fkpigck45gxgut3uptca (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ymkej5fkpigck45gxgut3uptca: remove its local data: injected failure at remove-local
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_ymkej5fkpigck45gxgut3uptca is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_7hswtqsijx6b7ghotfe5cmibye (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_7hswtqsijx6b7ghotfe5cmibye: a route appeared at the host, so its local database is left and the rollback waits
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_fzpn7ad3bjkostr34kzvodnlhy (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_fzpn7ad3bjkostr34kzvodnlhy rollback deferred: no fence generation: registry busy
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_tjpppqya2ippsy5undo5h7kgl4 (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: import sd_tjpppqya2ippsy5undo5h7kgl4 rollback deferred: no fence generation: the generation source answered 0
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_dhypbzpwmaufibix4aqclx5mpi (the original route is journaled)
2026/10/25 12:03:28 provision: a.shop.example.com: swapped for import sd_c2dlsugh5brx5ietscyprgamn4 (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_e2wqcndxmokjpktiv3ulpbgvui (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_hzgvcalresy26vznj2zvt4iluy (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_hzgvcalresy26vznj2zvt4iluy rolled back to its original route
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_hzgvcalresy26vznj2zvt4iluy is cleaned up and its journal row retired
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_rdq6moppis3vmjz36eztnmhipm (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_rdq6moppis3vmjz36eztnmhipm rolled back to its original route
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_rdq6moppis3vmjz36eztnmhipm is cleaned up and its journal row retired
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_gqhtovhe4lvsd3nncpi4aa3tda (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_gqhtovhe4lvsd3nncpi4aa3tda rolled back to its original route
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_gqhtovhe4lvsd3nncpi4aa3tda is cleaned up and its journal row retired
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_lqwplzr52eswftkem7twfxxmpa (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_lqwplzr52eswftkem7twfxxmpa: retire its instance key: the env file is a symlink
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_lqwplzr52eswftkem7twfxxmpa rolled back to its original route
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_lqwplzr52eswftkem7twfxxmpa is cleaned up and its journal row retired
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_g7gztrowrvlgddn6slnfk63k3q (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_fydvjsocs6g22kfistg4kiu3xa (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_kegoqr3ck2chbfe34pufw3snka refused: there is no route at a.shop.example.com to replace
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_ujpol6r722bjkurqaibobjthni refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_rw5tbcyry7qz276oxrizfcsihe refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_wuaiqlwax44hjvtmep2t7rfif4 refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_jx2hvwbf5hatool4p3ogvoanjq refused: the route belongs to app other
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_wgif4kx2xjmdfmhvw6ekphuipu refused: the route is filed under another account
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_iqwwiflto7r7q6pdjwgu7dut4e refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_smyo2jpsd7ymyofoockjozbzzy refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_djp6d76pdzes77yi3sfgwi7dlq refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_esh5qqwukohmsj3ipsef62pnmm refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_dnp2atn5pbzvvsiksk3mobkmee refused: the route is not an address route this import can take over (socket)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_arhbnzdklrw7cwfqotkmzlv25e refused: the route is not an address route this import can take over (no address)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_yr7jizegzd2v2j47o3inzfvfqq refused: the route is not an address route this import can take over (provisioned)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_r4xhnubdwsdcvgdrs3uj7i3uty refused: the route is not an address route this import can take over (kind static)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_zeqyxp2lgaaaquah4pmuibi5t4 refused: the route is not an address route this import can take over (backing)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_uizcp5knolxhzjngzxq4352ksa refused: the route is not an address route this import can take over (tunnel)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_vca6fiucz73laqvg7qy5ng5hqa refused: the route is not an address route this import can take over (caps)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_3bmu3bp4s2p42gtq34lbt7tc2m refused: the route is not an address route this import can take over (platform)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_qswrqo62ioh23ddssfwypogdcu refused: the route is not an address route this import can take over (canary)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_mkmk5enr3bsq33au3qbiwohxsi refused: the route is not an address route this import can take over (kind sidecar)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_elgcqkivfwpmcia5jm6qoeydnm refused: the route is not an address route this import can take over (region)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_ydevx7i4zihjeuxiz3qm3w2zla refused: the route is not an address route this import can take over (fleet_box)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_a5t3mia4n7jjillkbm6ahzo4g4 refused: the route is not an address route this import can take over (hibernate)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_au3yntyjy3x2ezsvkwrzjibqhi refused: the route is not an address route this import can take over (claim_owner)
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_o3mga574daxlnhiwsf3yui4k5i refused: this box does not run instances nested
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_qfofhtgr754bx5tn4yargwxgui refused: this box does not run instances nested
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_royzbkyuewxk3srs6lhey7vvqq refused: claim control is on for this box
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_ygaoxe2a2tealztv5ymkkc4xbi (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_w7rdppmgoesrne3djxrs57mahy (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_tizov2346plm3qhdiwppp6tciy: its verify hash is not a sha256
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_apgnbr4ycbibwokppzntjjuezi: its verify hash is not a sha256
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_bfsd56wnkxmegcrdg2fr6zltcq: its verify hash is not a sha256
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/25 12:03:29 provision: A.shop.example.com/..: not swapping for import sd_2ovf2kpedsdnje6okeut55n4xa: its host or seed id is malformed (seeds: not a host)
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_mz4hrddacgiaqybixffryzlorm: its record does not describe a nested, hibernating instance
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_34dq4klr76ic2ijptpcebb5gue: its record does not describe a nested, hibernating instance
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_sgqgstt3qwfg5m6zenoqw2zgw4: its record does not describe a nested, hibernating instance
2026/10/25 12:03:29 provision: a.shop.example.com: not swapping for import sd_amoho4e2ofwpdzrtddalf6w7y4: its record does not describe a nested, hibernating instance
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_o53utgwsfa2k2o3sidi3lc4fyi (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_bc4ictq5bwwkhp5oydhvcxylii (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_wk65o6yjxh5xd4rf76bu5jk3qu (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/25 12:03:29 provision: dry-run: would consider swapping a.shop.example.com for import sd_adpo4xu54w5ncs7sad3dayfxs4
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_wbscwhwze2aafrgsqup2zu3zji rolled back to its original route
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_wbscwhwze2aafrgsqup2zu3zji: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_wbscwhwze2aafrgsqup2zu3zji is cleaned up and its journal row retired
2026/10/25 12:03:29 provision: a.shop.example.com: import sd_zkrobpn2e5atppl4xxlxgcopyq left alone: the import journal holds seed sd_ehpwn4buv62sadbteivrhfbnjy at swapped
2026/10/25 12:03:29 provision: a.shop.example.com: not minting import sd_77y3nnnefodtu7kgu2gkdkcvvy: it is swapped but not committed, and only its swap makes its row
2026/10/25 12:03:29 provision: a.shop.example.com: not minting import sd_h2a2qxqtjv4p2xegnplggg4bqi: it is placed but not committed, and only its swap makes its row
2026/10/25 12:03:29 provision: a.shop.example.com: swapped for import sd_rpvyzfijd4ul5t6bknehwwa75q (the original route is journaled)
2026/10/25 12:03:29 provision: a.shop.example.com: not minting import sd_rpvyzfijd4ul5t6bknehwwa75q: it is swapped but not committed, and only its swap makes its row
2026/10/25 12:03:29 provision: a.shop.example.com: not minting import sd_rpvyzfijd4ul5t6bknehwwa75q: it is placed but not committed, and only its swap makes its row
2026/10/25 12:03:29 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 12:03:29 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/25 12:03:30 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/25 12:03:30 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/25 12:03:30 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/25 12:03:30 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/25 12:03:30 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 12:03:30 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/25 12:03:30 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/25 12:03:30 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 12:03:30 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/25 12:03:30 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/25 12:03:30 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/25 12:03:30 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/25 12:03:30 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 12:03:30 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/25 12:03:30 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 12:03:30 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 12:03:30 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/25 12:03:30 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 12:03:30 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 12:03:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:30 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/25 12:03:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:30 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 12:03:30 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 12:03:30 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 12:03:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 12:03:30 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 12:03:30 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 12:03:30 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 12:03:30 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/25 12:03:30 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:30 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 12:03:30 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 12:03:30 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:30 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 12:03:30 provision: an app's records could not be listed: they are skipped
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:30 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 12:03:30 provision: removed retired instance route one.example.com (record gone)
2026/10/25 12:03:30 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: removed retired instance route one.example.com (record gone)
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: record view: change index unusable (get refused): walking
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 12:03:30 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 12:03:30 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 12:03:30 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 12:03:30 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 12:03:30 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 12:03:30 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 12:03:30 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 12:03:30 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/25 12:03:30 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 12:03:30 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/25 12:03:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (11.67s)
plan14_root_reads_test.go:600: root read census: 22 discrepancies
changed registry schema
changed root read internal/host/buildstate.go:buildStates.retained; review class, task, sites and digest
changed root read internal/registry/registry.go:Registry.Upsert; review class, task, sites and digest
changed root read internal/registry/registry.go:Registry.migrate; review class, task, sites and digest
changed root read internal/registry/registry.go:routeArgs; review class, task, sites and digest
changed root read internal/registry/registry.go:scanRoute; review class, task, sites and digest
changed root read internal/release/adopt.go:adoptHost; review class, task, sites and digest
changed root source envelope internal/host
changed root source envelope internal/host/units
changed root source envelope internal/instancectl
changed root source envelope internal/registry
changed root source envelope internal/release
stale root read internal/release/adopt.go:stageFrom
stale root read internal/release/adopt.go:type stageCheck
unclassified root read internal/host/units/carlos-instance-rootfs-cmd@.service:external file:external@0
unclassified root read internal/host/units/carlos-instance-rootfs-gen@.service:external file:external@0
unclassified root read internal/host/units/carlos-instance-rootfs-probe.service:external file:external@0
unclassified root read internal/host/units/carlos-instance-rootfs-worker@.service:external file:external@0
unclassified root read internal/host/units/carlos-instance-rootfs@.service:external file:external@0
changed legacy declaration internal/registry/registry.go:Registry.migrate
changed legacy declaration internal/registry/registry.go:scanRoute
changed reclassified declaration internal/registry/registry.go:Registry.Upsert
make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL github.com/carlosframework/platform/internal/provision 20.874s
ok github.com/carlosframework/platform/internal/publicrelease 0.009s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.791s
ok github.com/carlosframework/platform/internal/relay 7.200s
ok github.com/carlosframework/platform/internal/release 27.083s
ok github.com/carlosframework/platform/internal/rollout 3.812s
ok github.com/carlosframework/platform/internal/rolloutwords 0.006s
ok github.com/carlosframework/platform/internal/rootaws 0.008s
ok github.com/carlosframework/platform/internal/rootfsimage 0.226s
ok github.com/carlosframework/platform/internal/rootparticipation 0.060s
ok github.com/carlosframework/platform/internal/rootstate 0.029s
ok github.com/carlosframework/platform/internal/runs 0.581s
ok github.com/carlosframework/platform/internal/s3compat 0.006s
ok github.com/carlosframework/platform/internal/safefile 0.008s
ok github.com/carlosframework/platform/internal/schedule 2.905s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/engines 3.037s
ok github.com/carlosframework/platform/internal/sim/hostlife 11.266s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.898s
ok github.com/carlosframework/platform/internal/status 0.111s
ok github.com/carlosframework/platform/internal/steering 0.014s
ok github.com/carlosframework/platform/internal/stopevidence 0.363s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.006s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.005s
ok github.com/carlosframework/platform/internal/unixdial 0.004s
ok github.com/carlosframework/platform/internal/updatewords 0.008s
ok github.com/carlosframework/platform/internal/usage 0.013s
ok github.com/carlosframework/platform/internal/version 0.003s
ok github.com/carlosframework/platform/internal/vet 1.972s
FAIL
=== internal_console@0 (70 s)
ok github.com/carlosframework/platform/internal/console 67.609s
=== internal_console@1 (46 s)
ok github.com/carlosframework/platform/internal/console 44.020s
=== internal_console@2 (42 s)
ok github.com/carlosframework/platform/internal/console 39.861s
=== internal_console@3 (43 s)
ok github.com/carlosframework/platform/internal/console 40.794s
=== internal_console@4 (44 s)
ok github.com/carlosframework/platform/internal/console 42.187s
=== internal_console@5 (46 s)
ok github.com/carlosframework/platform/internal/console 43.848s
=== internal_console@6 (47 s)
ok github.com/carlosframework/platform/internal/console 45.009s
=== internal_console@7 (52 s)
ok github.com/carlosframework/platform/internal/console 50.075s
=== internal_host@0 (64 s)
ok github.com/carlosframework/platform/internal/host 61.917s
=== internal_host@1 (32 s)
ok github.com/carlosframework/platform/internal/host 30.401s
=== internal_host@2 (31 s)
ok github.com/carlosframework/platform/internal/host 29.024s
=== internal_host@3 (33 s)
ok github.com/carlosframework/platform/internal/host 30.534s
=== root@0 (71 s)
ok github.com/carlosframework/platform 69.033s
=== root@1 (49 s)
ok github.com/carlosframework/platform 47.205s
=== root@2 (62 s)
ok github.com/carlosframework/platform 60.064s
=== root@3 (53 s)
ok github.com/carlosframework/platform 50.952s
=== root@4 (58 s)
ok github.com/carlosframework/platform 55.870s
Failure summary:
--- rest
--- FAIL: TestPlan14RootReadCensus (11.67s)
plan14_root_reads_test.go:600: root read census: 22 discrepancies
FAIL github.com/carlosframework/platform/internal/provision 20.874s
FAILED: rest
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/internal/host/units/carlos-instance-rootfs-cmd@.service b/internal/host/units/carlos-instance-rootfs-cmd@.service| index 02ebbd06e..3cadbaf7e 100644 |
| --- a/internal/host/units/carlos-instance-rootfs-cmd@.service |
| +++ b/internal/host/units/carlos-instance-rootfs-cmd@.service |
| @@ -85,9 +85,11 @@ BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/cmd/launch.json:/opt/carlos/ |
| RootImageOptions=ro,nosuid,nodev |
| MountAPIVFS=yes |
| # Kept: on an image root this makes the root and the image's /etc |
| -# read-only (squashfs already is); /proc, /dev and /run stay |
| -# writable-implicit. The probe's root-read-only check: a create at / and |
| -# at /etc answers EROFS. |
| +# read-only (squashfs already is). systemd 257 exempts only the API file |
| +# systems /dev, /proc and /sys; /run, a fresh tmpfs under MountAPIVFS=, is |
| +# read-only too, and the unit's only writable paths are its two binds |
| +# (ReadWritePaths=, outside this block). The probe's root-read-only check: |
| +# a create at / and at /etc answers EROFS. |
| ProtectSystem=strict |
| # Kept: the image's /data mount point (ship adds it) becomes an empty |
| # read-only tmpfs, and the bind outside this block reveals exactly one |
diff --git a/internal/host/units/carlos-instance-rootfs-gen@.service b/internal/host/units/carlos-instance-rootfs-gen@.service| index fff3496df..42d8bb25d 100644 |
| --- a/internal/host/units/carlos-instance-rootfs-gen@.service |
| +++ b/internal/host/units/carlos-instance-rootfs-gen@.service |
| @@ -65,9 +65,11 @@ StandardError=inherit |
| RootImageOptions=ro,nosuid,nodev |
| MountAPIVFS=yes |
| # Kept: on an image root this makes the root and the image's /etc |
| -# read-only (squashfs already is); /proc, /dev and /run stay |
| -# writable-implicit. The probe's root-read-only check: a create at / and |
| -# at /etc answers EROFS. |
| +# read-only (squashfs already is). systemd 257 exempts only the API file |
| +# systems /dev, /proc and /sys; /run, a fresh tmpfs under MountAPIVFS=, is |
| +# read-only too, and the unit's only writable paths are its two binds |
| +# (ReadWritePaths=, outside this block). The probe's root-read-only check: |
| +# a create at / and at /etc answers EROFS. |
| ProtectSystem=strict |
| # Kept: the image's /data mount point (ship adds it) becomes an empty |
| # read-only tmpfs, and the bind outside this block reveals exactly one |
diff --git a/internal/host/units/carlos-instance-rootfs-probe.service b/internal/host/units/carlos-instance-rootfs-probe.service| index fe4eb2f09..7844cd787 100644 |
| --- a/internal/host/units/carlos-instance-rootfs-probe.service |
| +++ b/internal/host/units/carlos-instance-rootfs-probe.service |
| @@ -57,9 +57,11 @@ BindReadOnlyPaths=/run/carlos-control/exe/_probe/rootfs/run/launch.json:/opt/car |
| RootImageOptions=ro,nosuid,nodev |
| MountAPIVFS=yes |
| # Kept: on an image root this makes the root and the image's /etc |
| -# read-only (squashfs already is); /proc, /dev and /run stay |
| -# writable-implicit. The probe's root-read-only check: a create at / and |
| -# at /etc answers EROFS. |
| +# read-only (squashfs already is). systemd 257 exempts only the API file |
| +# systems /dev, /proc and /sys; /run, a fresh tmpfs under MountAPIVFS=, is |
| +# read-only too, and the unit's only writable paths are its two binds |
| +# (ReadWritePaths=, outside this block). The probe's root-read-only check: |
| +# a create at / and at /etc answers EROFS. |
| ProtectSystem=strict |
| # Kept: the image's /data mount point (ship adds it) becomes an empty |
| # read-only tmpfs, and the bind outside this block reveals exactly one |
diff --git a/internal/host/units/carlos-instance-rootfs-worker@.service b/internal/host/units/carlos-instance-rootfs-worker@.service| index 14094b19f..87dc44236 100644 |
| --- a/internal/host/units/carlos-instance-rootfs-worker@.service |
| +++ b/internal/host/units/carlos-instance-rootfs-worker@.service |
| @@ -77,9 +77,11 @@ StandardError=inherit |
| RootImageOptions=ro,nosuid,nodev |
| MountAPIVFS=yes |
| # Kept: on an image root this makes the root and the image's /etc |
| -# read-only (squashfs already is); /proc, /dev and /run stay |
| -# writable-implicit. The probe's root-read-only check: a create at / and |
| -# at /etc answers EROFS. |
| +# read-only (squashfs already is). systemd 257 exempts only the API file |
| +# systems /dev, /proc and /sys; /run, a fresh tmpfs under MountAPIVFS=, is |
| +# read-only too, and the unit's only writable paths are its two binds |
| +# (ReadWritePaths=, outside this block). The probe's root-read-only check: |
| +# a create at / and at /etc answers EROFS. |
| ProtectSystem=strict |
| # Kept: the image's /data mount point (ship adds it) becomes an empty |
| # read-only tmpfs, and the bind outside this block reveals exactly one |
diff --git a/internal/host/units/carlos-instance-rootfs@.service b/internal/host/units/carlos-instance-rootfs@.service| index 45965d43d..194a34dff 100644 |
| --- a/internal/host/units/carlos-instance-rootfs@.service |
| +++ b/internal/host/units/carlos-instance-rootfs@.service |
| @@ -107,9 +107,11 @@ BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/run/launch.json:/opt/carlos/ |
| RootImageOptions=ro,nosuid,nodev |
| MountAPIVFS=yes |
| # Kept: on an image root this makes the root and the image's /etc |
| -# read-only (squashfs already is); /proc, /dev and /run stay |
| -# writable-implicit. The probe's root-read-only check: a create at / and |
| -# at /etc answers EROFS. |
| +# read-only (squashfs already is). systemd 257 exempts only the API file |
| +# systems /dev, /proc and /sys; /run, a fresh tmpfs under MountAPIVFS=, is |
| +# read-only too, and the unit's only writable paths are its two binds |
| +# (ReadWritePaths=, outside this block). The probe's root-read-only check: |
| +# a create at / and at /etc answers EROFS. |
| ProtectSystem=strict |
| # Kept: the image's /data mount point (ship adds it) becomes an empty |
| # read-only tmpfs, and the bind outside this block reveals exactly one |
diff --git a/internal/host/units_rootfs_test.go b/internal/host/units_rootfs_test.go| index f95634363..d832ca0fd 100644 |
| --- a/internal/host/units_rootfs_test.go |
| +++ b/internal/host/units_rootfs_test.go |
| @@ -7,17 +7,35 @@ import ( |
| var rootfsTemplates = []string{"carlos-instance-rootfs@.service", "carlos-instance-rootfs-gen@.service", "carlos-instance-rootfs-worker@.service", "carlos-instance-rootfs-cmd@.service", "carlos-instance-rootfs-probe.service"} |
| +const ( |
| + rootfsBlockStart = "# --- the rootfs namespace" |
| + rootfsBlockEnd = "# --- per-service resources" |
| +) |
| + |
| func rootfsBlock(t *testing.T, name string) string { |
| t.Helper() |
| u := readUnit(t, name) |
| - start := strings.Index(u, "# --- the rootfs namespace") |
| - end := strings.Index(u, "# --- per-service resources") |
| + start := strings.Index(u, rootfsBlockStart) |
| + end := strings.Index(u, rootfsBlockEnd) |
| if start < 0 || end < 0 || end < start { |
| t.Fatalf("%s: rootfs namespace block markers missing", name) |
| } |
| return u[start:end] |
| } |
| +// rootfsOutsideBlock is the unit's text before and after the shared block: |
| +// the per-template lines. |
| +func rootfsOutsideBlock(t *testing.T, name string) string { |
| + t.Helper() |
| + u := readUnit(t, name) |
| + start := strings.Index(u, rootfsBlockStart) |
| + end := strings.Index(u, rootfsBlockEnd) |
| + if start < 0 || end < 0 || end < start { |
| + t.Fatalf("%s: rootfs namespace block markers missing", name) |
| + } |
| + return u[:start] + u[end:] |
| +} |
| + |
| // The five rootfs units carry one restated namespace block, byte for byte, |
| // so a property the rootfs probe proves is the property a rootfs tenant |
| // gets (spec §5.3, §8; the binary templates' TestInstanceTemplatesShareOneNamespace). |
| @@ -103,10 +121,63 @@ func TestRootfsNamespaceRestatesTheBinaryBlock(t *testing.T) { |
| } |
| } |
| -// C3 in the unit files: every bind source a rootfs unit names is the |
| +// systemd takes the LAST assignment of a key, so a per-template line that |
| +// reuses a key the block sets would undo the block: a tail |
| +// MemoryDenyWriteExecute=no, an empty TemporaryFileSystem=. Outside the |
| +// block no rootfs unit may set a key the block sets, except a non-empty |
| +// BindReadOnlyPaths= (a list key, which appends; an empty one would reset |
| +// the list and drop the platform binary). |
| +func TestRootfsTemplatesNeverReassignABlockKey(t *testing.T) { |
| + t.Parallel() |
| + key := func(d string) string { k, _, _ := strings.Cut(d, "="); return k } |
| + blockKeys := map[string]bool{} |
| + for _, d := range directives(rootfsBlock(t, "carlos-instance-rootfs@.service")) { |
| + blockKeys[key(d)] = true |
| + } |
| + for _, name := range rootfsTemplates { |
| + for _, d := range directives(rootfsOutsideBlock(t, name)) { |
| + k := key(d) |
| + if !blockKeys[k] { |
| + continue |
| + } |
| + if k == "BindReadOnlyPaths" && strings.TrimSpace(strings.TrimPrefix(d, "BindReadOnlyPaths=")) != "" { |
| + continue |
| + } |
| + t.Errorf("%s sets %q outside the shared block; the last assignment wins, so this overrides the block", name, d) |
| + } |
| + } |
| +} |
| + |
| +// Nothing in a rootfs unit re-opens what the fence closes (the resolver |
| +// allow lives on carlos-instances.slice, set per box at run time), hands |
| +// the unit a cgroup subtree, or runs an Exec line with a prefix: "+", "!" |
| +// and "!!" drop User= and the Private*/Protect* settings for that command |
| +// (codex R3-2), and no other prefix is wanted either, so every Exec value |
| +// is an absolute path. |
| +func TestRootfsTemplatesCarryNoEscapeHatch(t *testing.T) { |
| + t.Parallel() |
| + for _, name := range rootfsTemplates { |
| + for _, d := range directives(readUnit(t, name)) { |
| + if strings.HasPrefix(d, "IPAddressAllow=") { |
| + t.Errorf("%s carries %q; the resolver allow belongs on carlos-instances.slice", name, d) |
| + } |
| + if strings.HasPrefix(d, "Delegate=") { |
| + t.Errorf("%s carries %q; a tenant never gets a cgroup subtree", name, d) |
| + } |
| + for _, exec := range []string{"ExecStart=", "ExecStartPre=", "ExecStartPost=", "ExecStop=", "ExecStopPost=", "ExecReload=", "ExecCondition="} { |
| + if v, ok := strings.CutPrefix(d, exec); ok && !strings.HasPrefix(v, "/") { |
| + t.Errorf("%s: %q carries an Exec prefix; the command must be a bare absolute path", name, d) |
| + } |
| + } |
| + } |
| + } |
| +} |
| + |
| +// C3 in the unit files: every mount source a rootfs unit names is the |
| // instance's own two directories, the platform binary, or root's exe |
| // layout for that unit. Nothing from the version store, the live links or |
| -// another instance can be bound, whatever the control service writes. |
| +// another instance can be mounted, whatever the control service writes, |
| +// through any of systemd's mount keys. |
| func TestRootfsTemplatesBindOnlyTheInstancesOwnAndRoots(t *testing.T) { |
| t.Parallel() |
| allowed := func(src, name string) bool { |
| @@ -124,7 +195,7 @@ func TestRootfsTemplatesBindOnlyTheInstancesOwnAndRoots(t *testing.T) { |
| } |
| for _, name := range rootfsTemplates { |
| for _, d := range directives(readUnit(t, name)) { |
| - for _, key := range []string{"BindPaths=", "BindReadOnlyPaths=", "RootImage="} { |
| + for _, key := range []string{"BindPaths=", "BindReadOnlyPaths=", "RootImage=", "RootDirectory=", "MountImages=", "ExtensionImages=", "ExtensionDirectories="} { |
| if !strings.HasPrefix(d, key) { |
| continue |
| } |
| @@ -144,19 +215,31 @@ func TestRootfsTemplatesBindOnlyTheInstancesOwnAndRoots(t *testing.T) { |
| func TestRootfsTemplatesPerUnitLines(t *testing.T) { |
| t.Parallel() |
| + // The coupling, stop budget and resource lines every tenant template |
| + // carries (the table's "same" cells). |
| + common := []string{"BindsTo=carlos-edge.service", |
| + "Requires=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount", |
| + "After=carlos-edge.service data-instances.mount run-carlos-instances.mount run-carlos-logs.mount", |
| + "KillMode=mixed", "TimeoutStopSec=20", "TasksMax=256", "OOMScoreAdjust=500", "OOMPolicy=kill", "User=carlos", "Group=carlos"} |
| for name, wants := range map[string][]string{ |
| - "carlos-instance-rootfs@.service": {"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs run %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs run %I", |
| + "carlos-instance-rootfs@.service": append([]string{"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs run %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs run %I", |
| "RootImage=/run/carlos-control/exe/%I/rootfs/run/image", |
| "BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/run/launch.json:/opt/carlos/launch.json /run/carlos-control/exe/%I/rootfs/run/resolv.conf:/etc/resolv.conf", |
| - "BindPaths=/data/instances/%I /run/carlos/instances/%I", "WorkingDirectory=/data/instances/%I", "StandardOutput=file:/run/carlos/logs/%I.run.sock", |
| - "Slice=carlos-instances-%i.slice", "Restart=no", "KillMode=mixed", "TimeoutStopSec=20", "BindsTo=carlos-edge.service", |
| - "Requires=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount", "SuccessExitStatus=129 130 141 143", "TasksMax=256", "OOMScoreAdjust=500", "OOMPolicy=kill", "User=carlos"}, |
| - "carlos-instance-rootfs-gen@.service": {"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs run %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs run %I", "WorkingDirectory=/data/instances", "SuccessExitStatus=129 130 141 143", "Restart=no", "User=carlos"}, |
| - "carlos-instance-rootfs-worker@.service": {"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs worker %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs worker %I", "WorkingDirectory=/data/instances", "SuccessExitStatus=129 130 141 143", "Restart=no", "BindsTo=carlos-edge.service", "User=carlos"}, |
| - "carlos-instance-rootfs-cmd@.service": {"Type=oneshot", "RemainAfterExit=yes", "TimeoutStartSec=6h5m", "ExecStart=/opt/carlos/carlos instance-exec --rootfs cmd %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs cmd %I", |
| - "RootImage=/run/carlos-control/exe/%I/rootfs/cmd/image", "StandardOutput=file:/run/carlos/logs/%I.cmd.sock", "StandardError=file:/run/carlos/logs/%I.cmd-err.sock", "WorkingDirectory=/data/instances/%I", "User=carlos"}, |
| + "BindPaths=/data/instances/%I /run/carlos/instances/%I", "ReadWritePaths=/data/instances/%I /run/carlos/instances/%I", "WorkingDirectory=/data/instances/%I", "StandardOutput=file:/run/carlos/logs/%I.run.sock", |
| + "Slice=carlos-instances-%i.slice", "Restart=no", "SuccessExitStatus=129 130 141 143"}, common...), |
| + "carlos-instance-rootfs-gen@.service": append([]string{"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs run %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs run %I", "WorkingDirectory=/data/instances", "SuccessExitStatus=129 130 141 143", "Restart=no"}, common...), |
| + "carlos-instance-rootfs-worker@.service": append([]string{"Type=simple", "ExecStart=/opt/carlos/carlos instance-exec --rootfs worker %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs worker %I", "WorkingDirectory=/data/instances", "SuccessExitStatus=129 130 141 143", "Restart=no"}, common...), |
| + // The command has exactly the instance's reach (C5): the same |
| + // slice, whose parent carlos-instances.slice carries the only |
| + // box-address fence (#367), the same two directories and the |
| + // cmd pair of root's files. |
| + "carlos-instance-rootfs-cmd@.service": append([]string{"Type=oneshot", "RemainAfterExit=yes", "TimeoutStartSec=6h5m", "ExecStart=/opt/carlos/carlos instance-exec --rootfs cmd %I", "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs cmd %I", |
| + "RootImage=/run/carlos-control/exe/%I/rootfs/cmd/image", |
| + "BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/cmd/launch.json:/opt/carlos/launch.json /run/carlos-control/exe/%I/rootfs/cmd/resolv.conf:/etc/resolv.conf", |
| + "BindPaths=/data/instances/%I /run/carlos/instances/%I", "ReadWritePaths=/data/instances/%I /run/carlos/instances/%I", "Slice=carlos-instances-%i.slice", |
| + "StandardOutput=file:/run/carlos/logs/%I.cmd.sock", "StandardError=file:/run/carlos/logs/%I.cmd-err.sock", "WorkingDirectory=/data/instances/%I"}, common...), |
| "carlos-instance-rootfs-probe.service": {"Type=oneshot", "ExecStart=/opt/carlos/carlos instance-probe --rootfs", "RootImage=/run/carlos-control/exe/_probe/rootfs/run/image", |
| - "BindPaths=/data/instances/_probe /run/carlos/instances/_probe", "StandardOutput=truncate:/run/carlos-control/rootfs-probe.out", "Slice=carlos-instances.slice", "TasksMax=64", "MemoryMax=64M", "CPUQuota=50%", "CPUWeight=50", "IOWeight=50", "User=carlos", |
| + "BindPaths=/data/instances/_probe /run/carlos/instances/_probe", "ReadWritePaths=/data/instances/_probe /run/carlos/instances/_probe", "StandardOutput=truncate:/run/carlos-control/rootfs-probe.out", "Slice=carlos-instances.slice", "TasksMax=64", "MemoryMax=64M", "CPUQuota=50%", "CPUWeight=50", "IOWeight=50", "User=carlos", "Group=carlos", |
| "BindReadOnlyPaths=/run/carlos-control/exe/_probe/rootfs/run/launch.json:/opt/carlos/launch.json /run/carlos-control/exe/_probe/rootfs/run/resolv.conf:/etc/resolv.conf /run/carlos-control/exe/_probe/rootfs/run/box-addrs:/opt/carlos/box-addrs"}, |
| } { |
| u := readUnit(t, name) |
| @@ -171,6 +254,12 @@ func TestRootfsTemplatesPerUnitLines(t *testing.T) { |
| if name == "carlos-instance-rootfs-cmd@.service" && strings.Contains(u, "\nSuccessExitStatus=") { |
| t.Errorf("%s counts a signal's exit as success", name) |
| } |
| + // Exactly one WorkingDirectory= per tenant template, and none in |
| + // the probe, whose directory is _probe and whose cwd does not |
| + // matter: a second line would silently win (#256 D). |
| + if n := strings.Count(u, "\nWorkingDirectory="); (name != "carlos-instance-rootfs-probe.service" && n != 1) || (name == "carlos-instance-rootfs-probe.service" && n != 0) { |
| + t.Errorf("%s has %d WorkingDirectory= lines", name, n) |
| + } |
| } |
| // The compound-instance templates key nothing by their instance string |
| // inside the namespace or anywhere by %i (zero-downtime plan 2 D1). |
| @@ -190,3 +279,75 @@ func TestRootfsTemplatesPerUnitLines(t *testing.T) { |
| } |
| } |
| } |
| + |
| +// The rootfs cmd template is the rootfs instance template outside its |
| +// named lines (run spec §5.4, codex 4, as TestCmdTemplateEqualsSeedOutsideTheNamedLines |
| +// holds the binary pair): the same uid, namespace, image layout, binds, |
| +// slice and working directory, so a command has exactly the instance's |
| +// reach (C5). Comments and blank lines are free; every directive is |
| +// compared, in order, after the named swaps and the lines only one of the |
| +// two carries (a oneshot has RemainAfterExit= and a start timeout; a |
| +// long-running instance has Restart= and the signal exit statuses). |
| +func TestRootfsCmdTemplateEqualsRootfsOutsideTheNamedLines(t *testing.T) { |
| + t.Parallel() |
| + swap := map[string]string{ |
| + "Description=carlos rootfs instance %I": "Description=carlos rootfs instance %I (cmd)", |
| + "Type=simple": "Type=oneshot", |
| + "ExecStart=/opt/carlos/carlos instance-exec --rootfs run %I": "ExecStart=/opt/carlos/carlos instance-exec --rootfs cmd %I", |
| + "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs run %I": "ExecStopPost=/opt/carlos/carlos instance-exit --rootfs cmd %I", |
| + "StandardOutput=file:/run/carlos/logs/%I.run.sock": "StandardOutput=file:/run/carlos/logs/%I.cmd.sock", |
| + "StandardError=inherit": "StandardError=file:/run/carlos/logs/%I.cmd-err.sock", |
| + "RootImage=/run/carlos-control/exe/%I/rootfs/run/image": "RootImage=/run/carlos-control/exe/%I/rootfs/cmd/image", |
| + "BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/run/launch.json:/opt/carlos/launch.json /run/carlos-control/exe/%I/rootfs/run/resolv.conf:/etc/resolv.conf": "BindReadOnlyPaths=/run/carlos-control/exe/%I/rootfs/cmd/launch.json:/opt/carlos/launch.json /run/carlos-control/exe/%I/rootfs/cmd/resolv.conf:/etc/resolv.conf", |
| + } |
| + onlyRun := map[string]bool{"Restart=no": true, "SuccessExitStatus=129 130 141 143": true} |
| + onlyCmd := map[string]bool{"RemainAfterExit=yes": true, "TimeoutStartSec=6h5m": true} |
| + lines := func(name string, drop map[string]bool) []string { |
| + var out []string |
| + seen := map[string]bool{} |
| + for _, line := range strings.Split(readUnit(t, name), "\n") { |
| + line = strings.TrimSpace(line) |
| + if line == "" || strings.HasPrefix(line, "#") { |
| + continue |
| + } |
| + if drop[line] { |
| + seen[line] = true |
| + continue |
| + } |
| + out = append(out, line) |
| + } |
| + for l := range drop { |
| + if !seen[l] { |
| + t.Errorf("%s no longer has %q, which this test names as its own", name, l) |
| + } |
| + } |
| + return out |
| + } |
| + run, cmd := lines("carlos-instance-rootfs@.service", onlyRun), lines("carlos-instance-rootfs-cmd@.service", onlyCmd) |
| + used := map[string]bool{} |
| + want := make([]string, len(run)) |
| + for i, l := range run { |
| + if c, ok := swap[l]; ok { |
| + want[i], used[l] = c, true |
| + continue |
| + } |
| + want[i] = l |
| + } |
| + for l := range swap { |
| + if !used[l] { |
| + t.Errorf("the rootfs instance template no longer has %q; the table names it as a cmd difference", l) |
| + } |
| + } |
| + for i := 0; i < len(want) || i < len(cmd); i++ { |
| + var w, g string |
| + if i < len(want) { |
| + w = want[i] |
| + } |
| + if i < len(cmd) { |
| + g = cmd[i] |
| + } |
| + if w != g { |
| + t.Fatalf("directive %d: rootfs cmd template has %q, want %q (the instance's line with the named swaps)", i, g, w) |
| + } |
| + } |
| +} |