carlos / platform Public

census: overlay census-ruling-292 for #292's shutdown gates, termination proof, retried release and root's legacy start/stop ordering

Plan 14 root-read overlay internal/provision/testdata/plan14-root-reads-292.tsv,
loaded after reserved285 (the last overlay on main) in the census test and
pinned by TestPlan14Overlay292PreservesLegacySeal. Twelve rows, all
accepted-legacy with rev3=census-ruling-292, as platform-1e ruled and
extended:

- agent-side, with the ruling's boundary sentence verbatim: changed
  Service.BeginSidecarRequest, begin, doWake, sweepOnce, wake,
  ExecBackend.spawnUnitFrom, Service.cleanupFailedWake,
  Service.reapUnprovenWake; new ExecBackend.LegacyRunGone,
  SplitBackend.LegacyRunGone, Service.legacyRunGone. The proof rows say
  the termination proof only decides release-or-keep (unknown or error
  means keep); the release rows say RetryRelease only repeats the same
  conditional delete against the same ETag; spawnUnitFrom says what
  changed and that it does not widen what is spawned or how; begin and
  wake carry the claims note.
- root-side, J2,J4 as instance-control's legacy handlers: type Server
  (was diagnostic H3), with the root clause verbatim.

Envelopes refreshed: internal/activator, internal/lease,
internal/instancectl. Legacy seal e736a5e2... (zddr4) becomes
3b2506dd2ab3986d0df0ceda7f596e5a46ea4d1dfbc17b1d0fd8d5f176e8038d, pinned next to the
load with a comment naming the ruling; exactly twelve new frozen
declarations, none removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 23a368816246f8679c3119ee9809ac4c6fb556a1 parent c560c60

3 files changed, +117 −0

internal/provision/plan14_legacy_identity_test.go +77 −0
internal/provision/plan14_root_reads_test.go +10 −0
internal/provision/testdata/plan14-root-reads-292.tsv +30 −0

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	350.330s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.139s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.202s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.707s
ok  	github.com/carlosframework/platform/internal/activator	238.193s
ok  	github.com/carlosframework/platform/internal/agentsock	0.018s
ok  	github.com/carlosframework/platform/internal/alerting	0.003s
ok  	github.com/carlosframework/platform/internal/analytics	0.021s
ok  	github.com/carlosframework/platform/internal/appconfig	2.389s
ok  	github.com/carlosframework/platform/internal/apperr	0.071s
ok  	github.com/carlosframework/platform/internal/applog	0.130s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.670s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.007s
ok  	github.com/carlosframework/platform/internal/caps	0.011s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.730s
ok  	github.com/carlosframework/platform/internal/changelog	0.304s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	364.528s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.024s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.233s
ok  	github.com/carlosframework/platform/internal/doorkey	0.007s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	26.081s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.122s
ok  	github.com/carlosframework/platform/internal/gate	1.655s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.016s
ok  	github.com/carlosframework/platform/internal/geoip	0.030s
ok  	github.com/carlosframework/platform/internal/host	129.524s
ok  	github.com/carlosframework/platform/internal/hostactors	0.600s
ok  	github.com/carlosframework/platform/internal/hostbox	2.194s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.536s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.017s
ok  	github.com/carlosframework/platform/internal/hostexec	4.785s
ok  	github.com/carlosframework/platform/internal/hostfence	0.034s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.407s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.017s
ok  	github.com/carlosframework/platform/internal/hostguard	1.006s
ok  	github.com/carlosframework/platform/internal/hostops	1.458s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.015s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.015s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.447s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.139s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.016s
ok  	github.com/carlosframework/platform/internal/infraview	0.017s
ok  	github.com/carlosframework/platform/internal/instancectl	3.490s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.715s
ok  	github.com/carlosframework/platform/internal/instancefs	0.019s
ok  	github.com/carlosframework/platform/internal/instancekey	0.016s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.023s
ok  	github.com/carlosframework/platform/internal/layout	1.446s
ok  	github.com/carlosframework/platform/internal/lease	9.810s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.007s
ok  	github.com/carlosframework/platform/internal/ledger	0.014s
ok  	github.com/carlosframework/platform/internal/mail	0.166s
ok  	github.com/carlosframework/platform/internal/maintenance	0.080s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.524s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.071s
ok  	github.com/carlosframework/platform/internal/metrics	0.004s
ok  	github.com/carlosframework/platform/internal/moves	20.994s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.786s
ok  	github.com/carlosframework/platform/internal/objstore	0.174s
ok  	github.com/carlosframework/platform/internal/ops	0.159s
ok  	github.com/carlosframework/platform/internal/park	0.196s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	12.980s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.007s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	4.026s
ok  	github.com/carlosframework/platform/internal/relay	7.232s
ok  	github.com/carlosframework/platform/internal/release	19.237s
ok  	github.com/carlosframework/platform/internal/rollout	3.692s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.007s
ok  	github.com/carlosframework/platform/internal/rootstate	0.024s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.275s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.472s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.536s
ok  	github.com/carlosframework/platform/internal/status	0.040s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.186s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.006s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.006s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.551s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/14 16:12:59 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DE7164C50BA6E7, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.021s
minio contract: PASS

diff --git a/internal/provision/plan14_legacy_identity_test.go b/internal/provision/plan14_legacy_identity_test.go

index 532c38815..fe0ec9bb3 100644

--- a/internal/provision/plan14_legacy_identity_test.go

+++ b/internal/provision/plan14_legacy_identity_test.go

@@ -317,3 +317,80 @@ func TestPlan14Zddr4OverlayPreservesLegacySeal(t *testing.T) {

t.Fatal("unapproved legacy fingerprint accepted")

}

+// Census ruling 292 (amadan #292, platform-1e, extended): the edge-restart

+// lease overlay, loaded after reserved285, the last overlay before it.

+func TestPlan14Overlay292PreservesLegacySeal(t *testing.T) {

+ root := censusRoot(t)

+ inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}

+ for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv", "plan14-root-reads-zddr4.tsv", "plan14-root-reads-reserved285.tsv"} {

+ if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {

+ t.Fatal(err)

+ }

+ if errs := checkRootReadLegacy(inv, "e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d"); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ original := make(map[string]bool, len(inv.Legacy))

+ for hash := range inv.Legacy {

+ original[hash] = true

+ }

+ if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-292.tsv", &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ for hash := range original {

+ if !inv.Legacy[hash] {

+ t.Fatalf("292 removed original freeze %s", hash)

+ }

+ if len(inv.Legacy) != len(original)+12 {

+ t.Fatal("census ruling 292 permits exactly twelve new frozen declarations")

+ }

+ // Census ruling 292 seal: eight changed activator rows (begin,

+ // BeginSidecarRequest, doWake, sweepOnce, wake, spawnUnitFrom,

+ // cleanupFailedWake, reapUnprovenWake), three new proof units

+ // (ExecBackend.LegacyRunGone, SplitBackend.LegacyRunGone,

+ // legacyRunGone) and instance-control's Server declaration.

+ const seal = "3b2506dd2ab3986d0df0ceda7f596e5a46ea4d1dfbc17b1d0fd8d5f176e8038d"

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ agent := []string{

+ "internal/activator/activator.go:Service.BeginSidecarRequest",

+ "internal/activator/activator.go:Service.begin",

+ "internal/activator/activator.go:Service.doWake",

+ "internal/activator/activator.go:Service.sweepOnce",

+ "internal/activator/activator.go:Service.wake",

+ "internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom",

+ "internal/activator/backend_exec.go:ExecBackend.LegacyRunGone",

+ "internal/activator/backend_unit.go:SplitBackend.LegacyRunGone",

+ "internal/activator/containment.go:Service.legacyRunGone",

+ "internal/activator/maintenance.go:Service.cleanupFailedWake",

+ "internal/activator/opset.go:Service.reapUnprovenWake",

+ }

+ const boundary = "Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record."

+ const rootClause = "Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read."

+ check := func(key, rev3, suffix string) {

+ t.Helper()

+ e, ok := inv.Entries[key]

+ if !ok || e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3="+rev3+";") || !strings.HasSuffix(e.Basis, suffix) {

+ t.Fatalf("wrong 292 disposition for %s: %+v", key, e)

+ }

+ if f, ok := inv.Frozen[key]; !ok || rootReadLegacyFingerprint(f) != rootReadLegacyFingerprint(e) {

+ t.Fatalf("%s is not frozen as classified", key)

+ }

+ for _, key := range agent {

+ check(key, "census-ruling-292", boundary)

+ }

+ check("internal/instancectl/server.go:type Server", "census-ruling-292,J2,J4", rootClause)

+ for _, key := range []string{"internal/activator/activator.go:Service.begin", "internal/activator/activator.go:Service.wake"} {

+ if !strings.Contains(inv.Entries[key].Basis, "claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released.") {

+ t.Fatalf("%s lacks the claims note", key)

+ }

+ inv.Legacy[strings.Repeat("0", 64)] = true

+ if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {

+ t.Fatal("unapproved legacy fingerprint accepted")

+ }

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index d1c2bb971..0d0fd0ab5 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -674,6 +674,16 @@ func TestPlan14RootReadCensus(t *testing.T) {

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-reserved285.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-292.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ // Census ruling 292 (amadan #292, platform-1e, extended): the agent's

+ // shutdown gates, the legacy run unit's termination proof, the retried

+ // conditional lease release, and root's per-host ordering of legacy run

+ // starts against stops (type Server, J2,J4). Eight changed activator

+ // rows, three new proof units and the reclassified instance-control

+ // Server declaration add twelve frozen declarations.

+ seal = "3b2506dd2ab3986d0df0ceda7f596e5a46ea4d1dfbc17b1d0fd8d5f176e8038d"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-292.tsv b/internal/provision/testdata/plan14-root-reads-292.tsv

new file mode 100644

index 000000000..95aa8f35a

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-292.tsv

@@ -0,0 +1,30 @@

+# Plan 14 census ruling 292 (amadan #292, the edge-restart lease strand; Astra rounds 1 to 3): the agent's shutdown gates, the legacy run unit's termination proof before an aborted start's lease goes, the retried conditional lease release, and root's per-host ordering of legacy run starts against stops. Approved by platform-1e as census-ruling-292, extended for the proof units and the instance-control rows.

+# Agent-side boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. Root-side boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read. If any agent-side unit here ever runs as root, or any unit reads beyond that boundary, it stops being legacy and needs the Plan 14 owner's ruling. Earlier overlays are immutable.

+@legacy da7f39bcd686e64850d4ecf625bc938a416c621b77f5d1103782de0c99e03e56 internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a sidecar-marked request is answered as asleep and an exited child is left to Shutdown's own stop, never recycled as an unexpected exit. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@259,registry:Host@333 93734e46bc8257b10ed6cb3c3af4146165a92a83d50ce1b44e0d030356d39b6b

+internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a sidecar-marked request is answered as asleep and an exited child is left to Shutdown's own stop, never recycled as an unexpected exit. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@259,registry:Host@333 93734e46bc8257b10ed6cb3c3af4146165a92a83d50ce1b44e0d030356d39b6b

+@legacy 9ab43c1b1c04a27a3efa4a2f24b8030c4cfdcbd9e2a0c225d6e0eebc02011927 internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a request is refused (errShuttingDown) on every pass of its loop, before it can wake or recycle anything. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1702,registry:Host@1781,registry:Host@326,registry:Host@910,whole:Route@1711,whole:Route@1718 2f4449d5665d0e84c17a6618e2aa4cd6394808b169c7f05a3f27f634f626b010

+internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a request is refused (errShuttingDown) on every pass of its loop, before it can wake or recycle anything. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1702,registry:Host@1781,registry:Host@326,registry:Host@910,whole:Route@1711,whole:Route@1718 2f4449d5665d0e84c17a6618e2aa4cd6394808b169c7f05a3f27f634f626b010

+@legacy b6bfb87b76a780fe09bccdec6637427719cc2cf891a8ddd946c2802415d6de00 internal/activator/activator.go Service.doWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a failed start of the legacy run unit is marked for the termination proof before its lease goes, and every bail-out gives the lease back through giveBack, which keeps a failed release for retry. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:DBPath@1032,registry:DBPath@1048,registry:DBPath@1175,registry:DBPath@1186,registry:DBPath@20307,registry:Host@1014,registry:Host@1166,registry:Host@1277,registry:Host@174,registry:Host@2137,registry:Host@3858,registry:Host@861,registry:Host@936,registry:Replication@20342,registry:Seed@11113,registry:Socket@1061,registry:Socket@1077,registry:Socket@1200,registry:Socket@1211,whole:Route@10018,whole:Route@11214,whole:Route@11285,whole:Route@1231,whole:Route@1237,whole:Route@1303,whole:Route@1311,whole:Route@13669,whole:Route@15527,whole:Route@159,whole:Route@16173,whole:Route@17480,whole:Route@17634,whole:Route@17990,whole:Route@18084,whole:Route@18756,whole:Route@19755,whole:Route@19903,whole:Route@2027,whole:Route@20416,whole:Route@21314,whole:Route@21409,whole:Route@3481,whole:Route@3740,whole:Route@3810,whole:Route@3816,whole:Route@3885,whole:Route@3893,whole:Route@4681,whole:Route@5680,whole:Route@6713,whole:Route@7594,whole:Route@9176,whole:Route@9368,whole:Route@959 7e6b169869d79b18322cc09d5a7cdb48eb207e9de12d55363ae1295120d5a712

+internal/activator/activator.go Service.doWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a failed start of the legacy run unit is marked for the termination proof before its lease goes, and every bail-out gives the lease back through giveBack, which keeps a failed release for retry. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:DBPath@1032,registry:DBPath@1048,registry:DBPath@1175,registry:DBPath@1186,registry:DBPath@20307,registry:Host@1014,registry:Host@1166,registry:Host@1277,registry:Host@174,registry:Host@2137,registry:Host@3858,registry:Host@861,registry:Host@936,registry:Replication@20342,registry:Seed@11113,registry:Socket@1061,registry:Socket@1077,registry:Socket@1200,registry:Socket@1211,whole:Route@10018,whole:Route@11214,whole:Route@11285,whole:Route@1231,whole:Route@1237,whole:Route@1303,whole:Route@1311,whole:Route@13669,whole:Route@15527,whole:Route@159,whole:Route@16173,whole:Route@17480,whole:Route@17634,whole:Route@17990,whole:Route@18084,whole:Route@18756,whole:Route@19755,whole:Route@19903,whole:Route@2027,whole:Route@20416,whole:Route@21314,whole:Route@21409,whole:Route@3481,whole:Route@3740,whole:Route@3810,whole:Route@3816,whole:Route@3885,whole:Route@3893,whole:Route@4681,whole:Route@5680,whole:Route@6713,whole:Route@7594,whole:Route@9176,whole:Route@9368,whole:Route@959 7e6b169869d79b18322cc09d5a7cdb48eb207e9de12d55363ae1295120d5a712

+@legacy 4f1feca518693fadcefc38fae71c707ad244308ae62f88db3f6af44f538ee9c1 internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, the sweep returns before it recycles, due-wakes or starts anything. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Hibernate@12146,registry:Hibernate@21304,registry:Hibernate@5109,registry:Hibernate@6767,registry:Hibernate@9147,registry:Host@21373,registry:Host@21431,registry:Host@21824,registry:Host@22555,registry:Host@22637,registry:Host@23702,registry:Host@23881,registry:Host@23930,registry:NextDue@22510,registry:Status@21320,whole:Route@12148,whole:Route@14068,whole:Route@15778,whole:Route@15968,whole:Route@16261,whole:Route@16433,whole:Route@16580,whole:Route@20791,whole:Route@22224,whole:Route@22564,whole:Route@22571,whole:Route@23517,whole:Route@23914,whole:Route@5111,whole:Route@6769,whole:Route@9149 55664900e468c0ef1b3bef3bee3699a7341622ebbd94634da6820d0cc4a9d579

+internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, the sweep returns before it recycles, due-wakes or starts anything. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Hibernate@12146,registry:Hibernate@21304,registry:Hibernate@5109,registry:Hibernate@6767,registry:Hibernate@9147,registry:Host@21373,registry:Host@21431,registry:Host@21824,registry:Host@22555,registry:Host@22637,registry:Host@23702,registry:Host@23881,registry:Host@23930,registry:NextDue@22510,registry:Status@21320,whole:Route@12148,whole:Route@14068,whole:Route@15778,whole:Route@15968,whole:Route@16261,whole:Route@16433,whole:Route@16580,whole:Route@20791,whole:Route@22224,whole:Route@22564,whole:Route@22571,whole:Route@23517,whole:Route@23914,whole:Route@5111,whole:Route@6769,whole:Route@9149 55664900e468c0ef1b3bef3bee3699a7341622ebbd94634da6820d0cc4a9d579

+@legacy eba2b8a74d4615e23626ac96c87ef8b192de7f42c0a430f978adafeec871db6f internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a wake that starts after Shutdown began is cancelled before its lease, and one that finishes is stopped, with swaps on or off. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Socket@6807,registry:Socket@6968,whole:Route@2091,whole:Route@2148,whole:Route@5344,whole:Route@6760,whole:Route@6809,whole:Route@6970,whole:Route@8209,whole:Route@8230 25e8f2be15ec434d2bc414e0d144a3f77bd433a81b08f5a0be5be212df24071c

+internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a wake that starts after Shutdown began is cancelled before its lease, and one that finishes is stopped, with swaps on or off. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Socket@6807,registry:Socket@6968,whole:Route@2091,whole:Route@2148,whole:Route@5344,whole:Route@6760,whole:Route@6809,whole:Route@6970,whole:Route@8209,whole:Route@8230 25e8f2be15ec434d2bc414e0d144a3f77bd433a81b08f5a0be5be212df24071c

+@legacy aa5ac6f18801ee88c600b00d7f964d5d5c68f4c1c9a745066dabd5fd9eb04c79 internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; what changed: a failed start of the original run unit (generation 0) that root may still carry out is marked legacyStartUncertain, its text unchanged, so the failed wake's cleanup proves the unit stopped before the lease goes. It does not widen what is spawned or how. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1071,registry:Host@1473,registry:Host@1576,registry:Host@1994,registry:Host@2474,registry:Host@3400,registry:Host@3986,registry:Host@4256,registry:Host@4476,registry:Host@4661,registry:Host@5056,registry:Host@5337,registry:Host@5399,registry:Host@5552,registry:Host@5591,registry:Host@5870,registry:Host@5964,whole:Route@1167,whole:Route@1402,whole:Route@194,whole:Route@2678,whole:Route@4309,whole:Route@5490,whole:Route@5649,whole:Route@758,whole:Route@856 036895b3ad78d31d9b788f85ce11736ed21adadfa3d6a04683de5cef1b3fe963

+internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; what changed: a failed start of the original run unit (generation 0) that root may still carry out is marked legacyStartUncertain, its text unchanged, so the failed wake's cleanup proves the unit stopped before the lease goes. It does not widen what is spawned or how. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1071,registry:Host@1473,registry:Host@1576,registry:Host@1994,registry:Host@2474,registry:Host@3400,registry:Host@3986,registry:Host@4256,registry:Host@4476,registry:Host@4661,registry:Host@5056,registry:Host@5337,registry:Host@5399,registry:Host@5552,registry:Host@5591,registry:Host@5870,registry:Host@5964,whole:Route@1167,whole:Route@1402,whole:Route@194,whole:Route@2678,whole:Route@4309,whole:Route@5490,whole:Route@5649,whole:Route@758,whole:Route@856 036895b3ad78d31d9b788f85ce11736ed21adadfa3d6a04683de5cef1b3fe963

+@legacy 64b4b59426a6ca65d46cd603776efb3b340f5353d7b3479a3c934c85c644b5a4 internal/activator/backend_exec.go ExecBackend.LegacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; stops the host's original run unit through instance-control's existing /stop and proves it gone from systemctl show state and cgroup.events, as the exit observer reads. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@174,registry:Host@225,registry:Host@268,registry:Host@623 59ee0ef2591b7596fdeedd65786dac0b671e54140055247c5caef3a576347f3d

+internal/activator/backend_exec.go ExecBackend.LegacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; stops the host's original run unit through instance-control's existing /stop and proves it gone from systemctl show state and cgroup.events, as the exit observer reads. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@174,registry:Host@225,registry:Host@268,registry:Host@623 59ee0ef2591b7596fdeedd65786dac0b671e54140055247c5caef3a576347f3d

+@legacy 28136608ac1b1e67bf0844caebd2011456b6bf560a984e925a026cf6ef403f47 internal/activator/backend_unit.go SplitBackend.LegacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; forwards an exec row to the exec half's LegacyRunGone and refuses a unit-backed row, reading Backing as SplitBackend.Layout does. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. file:Exec@240,registry:Backing@89,registry:Host@200,registry:Host@305,whole:Route@364 13f8a08cb85de111beae3e48dfb48fe64a2269f7d6fbb0539d7e68dc674f16aa

+internal/activator/backend_unit.go SplitBackend.LegacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; forwards an exec row to the exec half's LegacyRunGone and refuses a unit-backed row, reading Backing as SplitBackend.Layout does. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. file:Exec@240,registry:Backing@89,registry:Host@200,registry:Host@305,whole:Route@364 13f8a08cb85de111beae3e48dfb48fe64a2269f7d6fbb0539d7e68dc674f16aa

+@legacy 7549e1150abccb1e9f62229dbc25c435adb23bf1a08e013273b9a68c06e9462b internal/activator/containment.go Service.legacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; runs the backend's termination proof for the route under its own budget, never past Shutdown's. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. whole:Route@573 680bd2d7f55e99e5aef3b3ec89a00465811b87dc2a68ad8e4b3364443156f43f

+internal/activator/containment.go Service.legacyRunGone legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; runs the backend's termination proof for the route under its own budget, never past Shutdown's. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. whole:Route@573 680bd2d7f55e99e5aef3b3ec89a00465811b87dc2a68ad8e4b3364443156f43f

+@legacy 0ea3b4516b2fa8a7b311af9bc14a061666175ad7b05942c32f76d4982c2ba3af internal/activator/maintenance.go Service.cleanupFailedWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; an aborted legacy run unit start is proven stopped before its lease goes, else retained with its lease; a failed release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1824,registry:Host@2031,registry:Host@2666,registry:Host@3006,registry:Host@3618,whole:Route@1691,whole:Route@2056,whole:Route@2060,whole:Route@2348,whole:Route@3031,whole:Route@3035 533ae97a1d2801faf9b0ef74eba10c268a7bac158e289aa296880fddf757c3eb

+internal/activator/maintenance.go Service.cleanupFailedWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; an aborted legacy run unit start is proven stopped before its lease goes, else retained with its lease; a failed release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. registry:Host@1824,registry:Host@2031,registry:Host@2666,registry:Host@3006,registry:Host@3618,whole:Route@1691,whole:Route@2056,whole:Route@2060,whole:Route@2348,whole:Route@3031,whole:Route@3035 533ae97a1d2801faf9b0ef74eba10c268a7bac158e289aa296880fddf757c3eb

+@legacy 0a1e28f9d86865b0e22a7e0fc5562e93dfce43c985abd065f76e12d1576d0f2d internal/activator/opset.go Service.reapUnprovenWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a retained legacy start is retried through the same termination proof, and a failed raw release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. whole:Route@439,whole:Route@493 8543c417e6a98553b8500975d41679d8257495d6c077116aab2ada1d50aba647

+internal/activator/opset.go Service.reapUnprovenWake legacy accepted-legacy accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a retained legacy start is retried through the same termination proof, and a failed raw release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. whole:Route@439,whole:Route@493 8543c417e6a98553b8500975d41679d8257495d6c077116aab2ada1d50aba647

+@legacy 80ed90a720baa7c64ac4413dff85f60f86bb78848f29c96ab448573a8cc13873 internal/instancectl/server.go type Server legacy accepted-legacy accepted-legacy;rev3=census-ruling-292,J2,J4;basis=Census ruling 292: changed row, root-run (was diagnostic H3); the declaration gains the per-host legacy start attempts, stop counts, accept-order barriers, the connection counter and a test join budget, and still executes no decision. Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read. file:Statfs@2708 3d2ba16fd871c32390edd658501aca37d335e881dbeb5d09b050d3f013d3f734

+internal/instancectl/server.go type Server legacy accepted-legacy accepted-legacy;rev3=census-ruling-292,J2,J4;basis=Census ruling 292: changed row, root-run (was diagnostic H3); the declaration gains the per-host legacy start attempts, stop counts, accept-order barriers, the connection counter and a test join budget, and still executes no decision. Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read. file:Statfs@2708 3d2ba16fd871c32390edd658501aca37d335e881dbeb5d09b050d3f013d3f734

+# Envelopes, census ruling 292: each changed root source envelope below is accepted only because the units inside it are the ones listed above. internal/lease adds Held.ReleaseOwed and Held.RetryRelease: RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. internal/instancectl adds legacystart.go (root, J2,J4): root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read.

+@coverage internal/activator 88538744825ca92fbb551105a60cc823d9e86b9ee6ecaedff9365f2f68a87710

+@coverage internal/lease 7ca044ef2fac40a860e9e80c83834929227fbefe32d55b1e61a60893ae129cb4

+@coverage internal/instancectl a4317dea0de2980ce53afe3c0cfc0f0b17bdefda683073674e63e21cd980fc73