CI log
amadan: log truncated — showing the last 500249 bytes of 548298
status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/caps_pass.go capabilityPass E4 linux:internal/host/agent.go:runAdoptUnderRootRelease root-route
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go productionProofBindingSource B3 linux:internal/host/namedrecovery.go:productionNamedUnitRecovery Root-owned current and previous pointers replace health history as executable authority; cache only record discovery.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go relocationAfter C linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission Admission dispatch preserves landing handover and delegates relocating probing to its typed after-admission owner.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go RootHistoryPass.begin E1 linux:internal/release/adopt.go:adoptHost Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Complete E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostbox/stopinventory_db.go StopInventoryDB.ReadStopInventory C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal root-input
plan14_input_inventory_test.go:379: J4 internal/host/relocationreleases.go ReleaseObligation.Complete C linux:internal/host/relocationeffects.go:RelocationEffects.Release Release obligation completion reads fresh claim before verifying and recording root stop receipt.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go rootRestartKey E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go directory.Sync A+F+G linux:internal/rootstate/state.go:Sync rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go Ops.systemctl E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/release/heldwake.go DecideHeldWake E3 linux:internal/host/buildstate.go:buildStates.beforeExec root-input;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go enrolled E1 linux:internal/historyreadback/workflow.go:Operation.Deliver E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_identity.go rememberRootFloorSystemIdentity F linux:internal/host/systemapply.go:systemApplier.verifyPointer rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=re-fetches and verifies signed pointer equality before retaining its executable identity
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationRead E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.boot E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_boot.go rootFloorAllowsPrev F linux:internal/host/movesfloorgate.go:floorGateMain rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=signed prev identity must satisfy both local protocol floors and root downgrade completeness; sidecars never grant
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go directory.write A+F+G linux:internal/rootstate/state_linux.go:directory.Write rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go Respond E1 linux:internal/host/roothistory_readback.go:historyReadbackPublisher.publish Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.installRecoveryInventory C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go Server.handleAPIRestartScope E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/hold.go ChangeHold C root-route
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go type generationLaunchPermit E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go generationRetirement.verify E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go rootMovesFloorIdentity F linux:internal/host/guardarm.go:RunSystemGuardArm rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root-only census reader supplies deployment/box/enrollment; edge mode cannot call it
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go type HistoryRecovery E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory.go ClaimRootHTTP.recoverRootInventory C+E1 linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/console/boxselect.go Server.selectMoveBoxes F rev3=PROPOSED-p3;identity=carlos console serve, console.service uid carlos-console;basis=applies accepted/generation refusal only to advertised root-floor participants; legacy selection retains main exactly
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_linux.go migrateRootClaimAuthority G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=under offline exclusion dispatches signed import or fresh root-journal collection before publishing retained completion; legacy importer remains signature-gated
plan14_input_inventory_test.go:379: J4 internal/host/relocationowners.go relocationAfterAdmission C linux:internal/host/relocationowners.go:RelocationSource.Open After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rootRestartChecks.live B3+E1 linux:internal/host/roothistory_recovery.go:linkRootHistory Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RestartTarget E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootview.go FenceView.admit G linux:internal/hostguard/guard.go:Guard.With rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=read-only root view applies same predecessor-completion requirement as locked admission
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go systemApplier.rootProtocolAllowsBinary F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held
plan14_input_inventory_test.go:379: J4 internal/host/guardexec.go recoverLockHeld F linux:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go legacyGuardEntries D linux:internal/host/guardtransaction.go:installFloorHook Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go materializeHeld C+E1+E2 linux:internal/release/materializeheld.go:MaterializeHeldUnderWithPins root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/activator/backend_exec.go ExecBackend.seedUnit E2 linux:internal/activator/backend_exec.go:ExecBackend.Seed E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.refresh E3 linux:internal/host/buildstate.go:buildStates.wakeTarget route-and-input
plan14_input_inventory_test.go:379: J4 internal/host/movesinstall.go recoveryInstallSource C+G linux:internal/host/movesrecover.go:recoverRun.install root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_linux.go readHeldRenderHash C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go type HistoryRecoveryRetirement E1 linux:history_cli.go:historyCommandWithSave Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimready_linux.go claimParentPID B3 linux:internal/host/claimready_linux.go:claimProbePeer root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.RegisterLanding C linux:internal/host/claimassembly.go:ClaimAssembly.Build Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go productionGenerationAbsence E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/rootstate/live_linux.go directory.LiveHeld A+D linux:internal/rootstate/live.go:LiveHeld fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go type stageCheck E2 linux:internal/release/adopt.go:type passConfig E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go legacyRollbackRestart B3 linux:internal/host/rootrestart.go:rollbackUnitRestart rev3=merge-ruling-6;basis=Restore main reset-failed, restart and D1 settle even after an operator reset; retain main error wrapping and diagnostics.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Bindings E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/host/claimowners.go ClaimOwnerDispatch.Select C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers_linux.go installationCoverage C+G linux:internal/host/claimstop_writers_linux.go:rootInstallationCoverage root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory.go ClaimRootHTTP.commitRootInventoryPending E2 linux:internal/host/rootinventory.go:ClaimRootHTTP.withRootInventoryHistory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go coldNamespaceEmpty C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go checkLegacySchema C linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals root-input
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.Execute D linux:internal/host/rootexecution_transport.go:ClaimRootHTTP.serveExecution Retry transient authority reads within existing admission slack; bounded replay and permanent mismatches remain enforced.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go settingsTarget E3 linux:internal/release/adopt.go:adoptHost Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_settle.go ClaimRootHTTP.beginExecutionRecoveryFence D linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_maintenance.go rootHistoryMaintenance.run E1 linux:internal/host/roothistory.go:openRootHistory Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/rollout/failures.go FailureBook.markLocked E1+E3 linux:internal/rollout/failures.go:FailureBook.MarkHoldRan fix1-merge-review;basis=Advances durable app restriction generations so old grants cannot clear new failures.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go trusted A linux:internal/rootstate/file_linux.go:OpenTrustedFile root-input
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/participant.go Participant.sameInstallation C linux:internal/hostrelocate/participant.go:Participant.Step Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session.
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go type RootInstallation E2 linux:internal/host/rootinstallation.go:rootInstallationHostApp E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/caps/caps.go Set.UnmarshalJSON E4 linux:cli.go:readCapabilities root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation.go productionClaimLocal.Prepare D linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go LaunchJournal.Create C linux:internal/hostbox/launchjournal.go:LaunchJournal.Prelaunch root-input
plan14_input_inventory_test.go:379: J4 internal/registry/remote.go serveRemote E2 linux:internal/registry/remote.go:ServeRemote Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_authority.go ClaimRootHTTP.executionAuthority D linux:internal/host/rootexecution_migration.go:ClaimRootHTTP.executionAuthorityWithMigration Fresh claim, deployment binding and root installation authorize participation, including the retained source only.
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery_active.go namedUnitRecovery.recover B3+E1 linux:internal/host/namedrecovery_pass.go:namedUnitRecovery.passOption E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_payload_other.go generationPayloadFiles E2 darwin:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go StageHeldVerified C+E1+E2 linux:internal/host/movesstage.go:var heldStageVerified root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go environmentNames E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go readLineFrom F linux:internal/host/movesfloor.go:readLine root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go rootGenerationSource.reserve E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go heldProofAdmit C+E1 linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/relocationhandover.go relocationCompletedHandover.completedPrior C linux:internal/host/claimhandover_crossbox.go:wireCompletedHandover Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_production.go claimLaunchFor D linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch Production root runtime receives the unit-aware kernel wrapper before startup recovery.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.activationRule F linux:internal/host/systemapply.go:systemApplier.activationAllowed rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=preliminary activation refuses against both local protocol bounds before existing hold checks
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go journalPrepare C linux:internal/hostbox/journalservice.go:journalCall root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests_source.go rootRestartRequestSource.target E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_evidence.go readMigrationStop G linux:internal/host/rootmigration_collect_linux.go:recoverMigrationStop rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.notePrev F linux:internal/host/systemapply.go:systemApplier.decidePrev rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-config-sync.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_other.go EnsurePublicDir A+B4 darwin:internal/host/rootrestart.go:productionRootRestartChecks fix1;basis=Non-Linux shared-directory setup fails closed.
plan14_input_inventory_test.go:379: J4 internal/rootstate/authorityfile_linux.go openAuthorityFile E2 linux:internal/rootstate/authorityfile_linux.go:OpenAuthorityFile E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveaccess.go claimMoveLaunchSource C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go systemdUnits.JournalTail B3 linux:internal/host/unitsettle.go:settleUnit root-input
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease.go heldReleaseVia.claim C+E1 linux:internal/host/movesheldrelease.go:heldReleaseVia.request root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/worker.go Worker.Step C+D linux:internal/host/relocatepass.go:RelocationRuntime.once Worker transitions revalidate claim and fence and consume verified root stop receipts; generic transition timing remains legacy.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go scanRebootCgroups C+G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.recoverSettlement D linux:internal/hostexec/rootbroker.go:RootBroker.Recover Recovery serializes settlement with in-flight requests and requires cleanup, exact conditional release and CC9. TestPlan14ExecutionRecoverySettlesWithoutControllerToken and TestPlan14ExecutionRecoveryJoinsRemoteWrite.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go type HistoryHostStatus E1 linux:internal/release/roothistory_status.go:type HistoryMigrationStatus Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/movespass.go armPhase1 B2+C linux:internal/host/movespass.go:armMovesPass rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the S1 probe hook refusing a row whose import gate is set; main's B2,C authority retained
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_read.go rootExecutionRead D linux:internal/host/rootexecution_read.go:productionClaimLocal.checkRootParticipation Production root observer selects the descriptor-checked participation reader.
plan14_input_inventory_test.go:379: J4 internal/rootstate/live_linux.go directory.liveFile A+D linux:internal/rootstate/live_linux.go:directory.HoldLive fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go generationHash E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go openGenerationLaunchInventory E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_census_other.go productionGenerationKernelCensus E2 darwin:internal/host/rootgenerationpins.go:productionRootGenerationPins E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/activator/containment.go ExecBackend.spawnInCgroupAtTier E2 linux:internal/activator/backend_exec.go:ExecBackend.seedChild E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:379: J4 internal/hostexec/pending_linux.go tryExistingPendingLock D linux:internal/hostexec/pending_linux.go:recoverPending root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile.go Reconciler.holdOnly C linux:internal/hostbox/reconcile.go:Reconciler.installWithWork Hold-only write rechecks claim, record and source inventory under local lock without root RPC there.
plan14_input_inventory_test.go:379: J4 internal/release/buildstate.go Consumed.ForeignTo E3 linux:internal/host/buildstate.go:buildStates.beforeExec ForeignTo binds consumed decisions to account/app before root release history can be reused.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go rootFloorJudge.judge F linux:internal/host/systemapply.go:systemApplier.notePrev rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=revokes previous verdict before observation; unknown history checks signed current without accepted acknowledgement
plan14_input_inventory_test.go:379: J4 internal/instancectl/claimlaunch_snapshot_linux.go claimRootDir C+G linux:internal/instancectl/claimlaunch_snapshot.go:ClaimUnits.freezeLaunch root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go MaterializeHeldUnderWithPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_boot.go rootFloorBootCandidate F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=local-only selection requires previous verdict plus idle proof; fallback current must be signed and support all readable denies
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback.go readRollbackAttempt B3 linux:internal/host/rootrollback.go:rootRestartChecks.finish canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.authority C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate.
plan14_input_inventory_test.go:379: J4 internal/host/versionsweep.go sweepStagedVersionsPass E2 linux:internal/host/agent.go:runAdoptUnderRootRelease E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:379: J4 internal/hostbox/migration_census_other.go CheckMigrationRoots G rev3=PROPOSED-p3;identity=non-Linux unsupported stub; no production caller on this checkpoint;basis=returns ErrUnsupported without scanning or granting migration authority
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go Guard.Activate C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build Pending intent and durable quarantine remain denial conditions.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration.go RunSystemJournalMigrate G linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup
plan14_input_inventory_test.go:379: J4 internal/hostbox/hold.go RegistryHoldPolicy C linux:internal/host/claimassembly.go:ClaimAssembly.Build root-route
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go RootHistory.ReceiveReconstruction E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_containment.go validateClaimJournalContainment C+G linux:internal/host/claimjournal_transport.go:ClaimRootHTTP.serveJournal root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/wakepolicy.go Policy.check C linux:internal/hostbox/wakepolicy.go:Policy.Check root-input
plan14_input_inventory_test.go:379: J4 internal/release/bake.go LoadFirstSeen E1+E3 linux:internal/release/adopt.go:PassFilter root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go relocationBefore C linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission Before-admission dispatch binds relocation executor and probe phase before typed handover.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_parked.go generationRetirementRecords E2 linux:internal/host/rootgeneration_parked.go:generationReadRetirements E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go systemApplier.guardTransaction D linux:internal/host/guardtransaction.go:systemApplier.beginGuard Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go rootRestartRecord.advance E1 linux:internal/release/rootrestart_history.go:RootRestarts.Finish E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostexec/pending_linux.go recoverPending D linux:internal/hostexec/pending_linux.go:RecoverPending root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go LinuxStopKernel.readContainedJournal C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/heldstage.go retireEndedHeldRefusals C+E1 linux:internal/host/heldstage.go:heldStagePass root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_readback.go publishRootHistoryReadback E1 linux:internal/host/roothistory.go:openRootHistory Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimowners.go claimServingOwners.launchDigest C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimowners.go claimServingOwners.serving C+G linux:internal/host/claimowners.go:claimServingOwners.Select root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationRootTask E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go RootGenerations.writeCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/claimretire_local.go claimArtifactRetirement.Retire C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go VerifyHeldLiveUnder C+E1 linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Under-lock held verification enforces claim-aware shape and delegates root proof validation.
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootview.go RootAuthority.viewLocked C+G linux:internal/hostguard/rootview.go:RootAuthority.Installation rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartRequestLeg E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Reads the new host-retry log while preserving root-signed grant verification and ordinary restart gates.
plan14_input_inventory_test.go:379: J4 internal/release/program.go ArtifactProgram E1 linux:internal/release/program.go:ReleaseProgram root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go rootRestartChecks.mintRefusals B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation_relocation.go productionClaimLocal.Acknowledged D linux:internal/host/relocatepass.go:NewRelocationRuntime Relocation acknowledgement waits for bound controller readiness; participates in execution admission.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go requireReceiptOfInstallation C linux:internal/hostclaim/relocation.go:RecordLocalInstall Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go type GenerationReservation E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/host/proofobserve.go proofObserver.recordSettled B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-5;basis=Ordinary unstamped and derived routes do not resolve deployment records for post-restart health observation.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go ToProbing C linux:internal/hostrelocate/participant.go:Participant.Step Probe transition requires exact local-install receipt at target enrollment and install stamp before admission.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_requirements.go productionGenerationCreation E2 linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go materializeHeldChecked E2 linux:internal/release/materializeheld.go:serveHeldStageRequest E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly.go ClaimRoleAssembly.PreflightLaunch C+G linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go claimUnitStopKernel.settleUnits C+G linux:internal/host/claimlaunch_root.go:claimUnitStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/pending_linux.go controllerProcessStart D linux:internal/hostexec/rootprocess_linux.go:ControllerAlive root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.checkLocal C+G linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckLocal Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery.
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.settle D linux:internal/hostexec/rootbroker.go:RootBroker.recoverSettlement On uncertain ETag or delete conflict require both root and remote expiry, then conditionally delete the current ETag.
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go rootRestartChecks.copyRecoveryHistory E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go restartValue E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/ratchet.go DigestRatchet.marked E1 linux:internal/release/ratchet.go:DigestRatchet.Admit root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_replace.go replacementReconstruction E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go rootProtocolLegacy F linux:internal/host/rootmovesfloor_source.go:rootFloorLegacy rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded agent-writable JSON and line mirrors contribute only increasing denies; neither can establish accepted state
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go ClaimAssembly.relocationBuildAuthority C+D linux:internal/host/relocationbuild.go:ClaimAssembly.relocationBuild Relocation build revalidates operation, captured install stamp, prepared pin and execution participation before writes.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go validRootRestart E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.Reserve E2 linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalpath.go checkJournalPath C linux:internal/hostbox/launchjournal.go:OpenLaunchJournal root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_read.go productionClaimLocal.checkRootParticipation D linux:internal/host/rootexecution_client.go:productionClaimLocal.Check Root observer binds participation to enrolled actor; TestPlan14ExecutionRootLocalIgnoresAgentAbsence.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go PublishHistoryReconstruction E1 Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go ColdHandover.retireIntended C linux:internal/hostbox/coldhandover.go:ColdHandover.Run route-and-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go syncFile C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go Disk.VerifyFile F linux:internal/hostfloor/image_linux.go:Disk.Exec root-input
plan14_input_inventory_test.go:379: J4 internal/release/ratchet.go DigestRatchet.note E1 linux:internal/release/ratchet.go:DigestRatchet.Admit root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrecovery_rebind.go ClaimRootHTTP.rebindRecoveryInventory C linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory Retain fresh claim and inventory checks and refuse a box listed Lost.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.launchRecord C+G linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/consumedfence.go publishGate E3 linux:internal/release/consumedfence.go:publishConsumed root-route;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/consumedfence_linux.go lockConsumedPublish E3 linux:internal/release/consumedfence.go:publishConsumed root-input;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/proof.go FileSHA256 B3 linux:internal/host/proofask.go:mintAsker.stagedSHA root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile.go activationReader.Read C linux:internal/host/rootinstallation.go:rootInstallationHostApp root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/fence.go StopAuthorityMatches C linux:internal/host/claimwakestop.go:ClaimAssembly.collectCapturedStop root-input
plan14_input_inventory_test.go:379: J4 internal/release/buildstate.go ReadConsumed E3 linux:internal/host/updatesreport.go:updatesReader root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootinstallation.go rootInstallationHostApp E2 linux:internal/host/claimstop_run.go:RunInstanceControl E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go ClaimAssembly.relocationInstall B2+C+E2 linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Finish E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 history_cli.go historyCommandWithSave E1 linux:history_cli.go:historyCommand E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback_resume.go recoverRootRestarts B3 linux:internal/host/agent.go:runAdoptUnderRootRelease Recover every attempt independently, skip settled writes and remove leftover capabilities.
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go legacyCheckedUnitRestart B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-6;basis=Restore main stamped-unit restart and D1 settle, including diagnostics; only clock, readiness and health-hook adapters differ.
plan14_input_inventory_test.go:379: J4 internal/rootstate/link_linux.go directory.readLink A+E1 linux:internal/rootstate/link_linux.go:ReadTrustedLink Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go systemApplier.seedsActivationRefusal F linux:internal/host/systemapply.go:systemApplier.activationRule rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckRootRegisteredRow C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Crash census exception admits only the row named by root pending registration; all other census checks remain required.
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go checkUnresolvedRecoveries E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationUnescape E2 linux:internal/host/rootgeneration_kernel_linux.go:generationMounts E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction_linux.go readClaimEvidenceKey C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers.go ClaimStopCoordinator.WritersStopped C+G linux:internal/host/claimstop_writers.go:ClaimStopHTTP.serveWritersStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesstage.go heldReleaseStaged C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationTaskFDs E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_parked.go productionGenerationRetirements E2 linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go readLine F linux:internal/host/movesfloor.go:withMovesFields root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedpark_linux.go TypedParker.verifyDestination C linux:internal/hostbox/typedpark_linux.go:TypedParker.Park root-input
plan14_input_inventory_test.go:379: J4 internal/instancectl/claimexec.go ClaimUnits.prepareExecGate C+G linux:internal/instancectl/claimunit.go:ClaimUnits.start root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/pins.go GenerationPins E2 linux:internal/release/adopt.go:PassFilter root-route
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go Ops.query E4 linux:internal/caps/converge.go:Ops.applyUnitState root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration_linux.go currentClaimEdgeMaskAt C+G linux:internal/host/claimjournal_migration_linux.go:claimEdgeMaskStillOwned root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/rollback.go upstream B3 linux:internal/release/rollback.go:processGroup root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.prepareRollback B3 linux:internal/host/rootrestart.go:productionRootRestartChecks trusted deployment record and root unit binding; durable per-attempt rollback and recovery
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_readback.go historyReadbackPublisher.publish E1 linux:internal/host/roothistory_readback.go:publishRootHistoryReadback Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go OpenLaunchJournal C linux:internal/host/claimjournal_migration.go:var openClaimRootJournal root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go readGeneration C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/recoveryfence.go Guard.recordNames C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go Guard.With C linux:internal/hostbox/work.go:selectedWork.With Recheck remote root denial immediately before the protected effect.
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.mintAndLog E1 linux:internal/host/proofroot.go:proofRoot.around E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rollbackUnitRestart B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback.
plan14_input_inventory_test.go:379: J4 internal/release/proofgate.go ProofGate.bindRecording B3 linux:internal/release/roothistory_pass.go:passConfig.bindProof root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostops/completion_fence.go ProductionAuthority.completionFence C Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion.
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_linux.go verifiedClaimExecutable C+G linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Launch root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_timer.go ClaimRootHTTP.verifyInventoryTimer C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending root installation and fence authority; recovery rebind and timer identity
plan14_input_inventory_test.go:379: J4 internal/release/rootbake.go RootHistory.LoadBake E1 linux:internal/release/adopt.go:PassFilter E1 strict root bake and app completeness revisions; backward clocks refuse and visible records are durably recommitted.
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go rootFloorBinary.forSeeds F linux:internal/host/rootseedsfloor.go:readRootSeedsBinary rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=uses independently signed SeedsProtocol as the protocol compared against seeds bounds
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-adopt.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.forHost B3 linux:internal/host/rootrestart.go:productionRootRestartChecks canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/relocatepass.go RelocationRuntime.finishCompletion C+D linux:internal/host/relocatepass.go:RelocationRuntime.once Completion dispatch requires authoritative completed operation and current executor before discharge.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/participation.go checkLegacyParticipation D linux:internal/hostfloor/disk.go:Disk.Begin Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.applyPointers E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.pass root-route
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go restartIntentID E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocating.go ConvertCommittedLanding C linux:internal/hostrelocate/worker.go:Worker.ConvertLanding Committed landing conversion verifies exact target termination fence and record commit before transferring installation authority.
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.heldWakeInput E3 linux:internal/host/buildstate.go:buildStates.beforeExec Held wake reads tenant-bound consumed decisions, refusal ledger and installed release; no downgrade to diagnostic.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go stageHeld C+E1+E2 linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.Read E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/claimassembly.go ClaimAssembly.Build C+G linux:internal/host/claimassembly.go:productionClaimFactory Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go recoveryControllerAt C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor_linux.go movesDir.removedDuringOpen F linux:internal/host/movesfloor_linux.go:movesDir.lockNamed root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.start E1+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go RootGenerationPins.StagedPins E2 linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartGenPass E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:379: J4 internal/release/claim_identity.go CheckRouteReleaseIdentity C+E1 linux:internal/host/claimproduction.go:claimInputPolicy root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimretire_transport.go retirementAcknowledgement C+G linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/sweep.go LivePins B3+E2 linux:internal/host/versionsweep.go:sweepStagedVersions Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go productionRootRestartChecks B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rootRestartChecks.runningVersion B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-6;basis=Without a census return no running build, so main's cur stays the rollback target and no record is resolved; census-backed retention unchanged.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go generationRetirement.retire E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retireAll E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go legacyRootRestart B3+G linux:internal/host/roothistory_creation.go:productionCreationHistory E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go PublishHistoryRecoveryRetirement E1 Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimretire_transport.go type ClaimRootHTTP E1 linux:internal/host/claimstop_run.go:RunInstanceControl E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_census.go rootMigrationCollector.collect G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go writeColdJournal C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/park.go Regional.observe C linux:internal/hostbox/regionalworker.go:RegionalWorker.runHost root-input
plan14_input_inventory_test.go:379: J4 internal/instancectl/legacy_claim_cleanup.go Server.clearLegacyClaimLaunch C+G linux:internal/instancectl/server.go:Server.handleStart root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_maintenance.go type rootHistoryMaintenance E1 linux:internal/host/roothistory.go:openRootHistory Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go rootRestartRequests.run E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state.go type Store A+B3 linux:internal/host/claimassembly.go:NewProductionRootClaimStop descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go Guard.AbandonRootInventory C linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go JournalService.CheckLegacyMigration C linux:internal/host/claimjournal_migration.go:checkClaimJournalMigration root-input
plan14_input_inventory_test.go:379: J4 internal/release/pins.go BoxPins E2 linux:internal/release/adopt.go:PassFilter route-and-input
plan14_input_inventory_test.go:379: J4 internal/host/claimrecoveryjournal.go claimRecoveryJournal.successor C+G linux:internal/host/claimrecoveryjournal.go:claimCrossBoxHandover.completeRecovery root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RestartBinding.valid E1 linux:internal/release/rootrestart_history.go:RootRestarts.read E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go openRootProtocolFloors F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=checked root ancestry and leaf ownership for separate moves or seeds public/private stores
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.sourceEvidence C+G linux:internal/host/claimhandover_crossbox.go:claimCrossBoxHandover.After root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedpark_linux.go TypedParker.CaptureArtifact C linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended root-input
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.deny D linux:internal/hostexec/rootbroker.go:RootBroker.Close D2 compares the current root token before durable loss and live-lock revocation; cleanup is bounded independently of request cancellation.
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go productionClaimRegional.Authorize C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/worker.go Worker.ConvertLanding C linux:internal/host/relocatepass.go:convertFencedLanding Landing conversion requires verified local worker and termination-fence authority before claim conversion.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory.go RootHistory.read E1 linux:internal/release/roothistory.go:RootHistory.RecordInstalledProgram Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationReconciler.reconcile E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/activator/containment.go ExecBackend.startRole E2 linux:internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:379: J4 internal/caps/caps.go ValidCapabilities E4 linux:cli.go:readCapabilities root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/rolelaunch.go LaunchJournal.UnitReservation C linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go rootGenerationSource.resolve E2 linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
plan14_input_inventory_test.go:379: J4 internal/hostbox/retirement_timers.go retirementWithTimers C+E2 linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/relocationattempts.go relocationAttemptReader.ReadAttempt C linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authoritativeAttempt Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration.
plan14_input_inventory_test.go:379: J4 internal/hostops/backfill_seeds.go CollectCensusSeeds G linux:internal/host/rootmigration_census.go:rootMigrationCollector.collect rev3=census-ruling-seeded-instances;basis=no caller in the tree yet; G wires the census collector that will call it: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
plan14_input_inventory_test.go:379: J4 history_cli.go historySave E1 linux:history_cli.go:historyCommand E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/agent.go makeRestartRoute B3 linux:internal/host/agent.go:adoptLoop root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go pointerBoundUnit B3 linux:internal/host/rootrestart.go:restartBoundUnit rev3=merge-ruling-4;basis=Only PID-zero stopped or restarting states may bind without process identity; inactive units are never woken.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go validHex E1 linux:internal/historyreadback/workflow.go:Operation.checked Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery.go type namedUnitRecovery E1 linux:internal/host/namedrecovery.go:productionNamedUnitRecovery E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/hostbox/generationinventory.go OpenGenerationLaunchReader E2 linux:internal/host/rootgeneration_inventory.go:openGenerationLaunchInventory E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/claimunit.go var readClaimUnitFile C+G linux:internal/host/claimunit.go:readClaimUnitSettings root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go RouteAccount B3+E3+E4 linux:cli.go:runRoute root-route;kept=B3,E3,E4;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go capabilityPlan E4 linux:internal/release/adopt.go:adoptHost root-route
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go ClaimAssembly.relocationVerifyLocal C linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed.
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery.go namedUnitRecovery.originalRefusal E1 linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/rootstate/file_linux.go Identity A+B3 linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveparks.go openProductionClaimMoveWake C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal.
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go ColdRestore.Install C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.resolve B3 linux:internal/host/roothistory.go:openRootHistory fix1;basis=Binds deployment or root-managed named-unit evidence, trusted unit identity and digest history; registry names are hints only.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_requirements.go rootInventoryArtifacts E2 linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go resolveRestartScope E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/caps_pass.go stampDBPaths E4 linux:internal/host/caps_pass.go:capabilityPass root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go verifyStopKernelMounts C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go rootRestartChecks.noteLegacy B3 linux:internal/host/rootrestart.go:rollbackUnitRestart rev3=merge-ruling-4;basis=Log the no-census legacy restart once through the pass-shared diagnostic latch.
plan14_input_inventory_test.go:379: J4 internal/host/claimready_other.go claimProbeSocketReady B3 darwin:internal/host/claimconstruction.go:claimGroupDWiring root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers_linux.go rootInstallationCoverage C+G linux:internal/host/claimstop_writers_linux.go:verifyNoProcessAt root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go StageHeld C+E1 root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationMinor E2 E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.PrepareState C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go passConfig.recordRefusal E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationOwner E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state.go Sync A+F+G linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalnamespace_linux.go prepareJournalDirectory C+G linux:internal/hostbox/journalnamespace_linux.go:PrepareRootJournalDirectory rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go writeGeneration C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:379: J4 internal/release/healthy_root.go rootHealthyStore B+B4 linux:internal/release/healthy_root.go:recordRootHealthy fix1;basis=Normalizes the no-account operator app to the existing ops namespace before opening the root-owned public history.
plan14_input_inventory_test.go:379: J4 internal/host/relocationreleases.go ReleaseObligation.Queue C linux:internal/host/relocationeffects.go:RelocationEffects.Release Queues exact relocation release retirement obligation and preserves already discharged receipt replay.
plan14_input_inventory_test.go:379: J4 internal/host/claimrelocationrelease.go RelocationReleaseReceipts.Complete C+G linux:internal/host/relocationreleases.go:verifyDischargedReceipt root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restart.go bounceExecRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:379: J4 internal/hostfloor/image_linux.go Disk.Run F linux:internal/host/guardtransaction.go:systemApplier.guardRun root-input
plan14_input_inventory_test.go:379: J4 internal/host/proofobserve.go recordSettled B3 root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go NewJournalService C linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go JournalService.execute C+D linux:internal/hostbox/journalservice.go:JournalService.Execute Delegates journal transaction with original request hashing; root-generated inventory substitution uses the separate internal entry point.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go ServeHeldStageRequests E2 E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_recovery.go linkRootHistory B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go type Receipt E1 linux:internal/historyreadback/workflow.go:Operation.Read Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go scanStopCgroupsMode C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/production.go Ledger.UpdateRequired D linux:internal/rootparticipation/production.go:OpenForUpdate Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type rootRestartRecord E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory.go ClaimRootHTTP.withRootInventoryHistory E1 linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.layoutReversalReasons F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.heldBuild E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.report root-route
plan14_input_inventory_test.go:379: J4 internal/provision/rootrecord.go IndexRecords B3+C linux:internal/provision/rootrecord.go:FindRecordByHost Discover hosts once, reject duplicate keys, and classify partial discovery as retry rather than permission refusal.
plan14_input_inventory_test.go:379: J4 internal/host/claimwakestop.go ClaimAssembly.collectCapturedStop C+G linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationRetainedFiles E2 linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_boot.go withRootFloorGuardCandidate F linux:internal/host/guardexec.go:RunSystemGuardExec rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=holds moves then seeds locks across selector callback; checks signed candidate against both bounds and allows independently checked current fallback
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_linux.go ClaimRoleAssembly.Launch C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.refusal E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.gate root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go copyLegacyJournal C linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/participation.go CheckParticipation D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/pins.go StagedPaths.addReal E2 linux:internal/release/pins.go:BoxPins root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootview.go RootAuthority.View C linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution Root host lock serializes views; quarantine and pending intent deny admission.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go digest E1 linux:internal/historyreadback/readback.go:RequestKey Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RestartProgress E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/restart.go loadRestartMarks E1+E3 linux:internal/host/restart.go:restartPass root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go ColdHandover.Run C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover route-and-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.boot E2 linux:internal/host/rootgeneration_census_linux.go:generationKernel.census E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/hostbox/work.go WorkSource.Select C linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationLinkRef E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_creation.go rootHistoryCreation E1 linux:internal/host/roothistory.go:openRootHistory E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.absent E2 linux:internal/host/rootgeneration_census_linux.go:generationKernel.census E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/hostguard/writerstop.go RecoveryWriterStop C linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.beginExecutionRecoveryFence root-input
plan14_input_inventory_test.go:379: J4 internal/host/relocatepass.go NewRelocationRuntime C+D linux:internal/host/relocatepass.go:startRelocationPass Relocation runtime binds verified enrollment, source, participant and typed stop/fence providers; generic placement stays legacy.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go type generationKernel E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go rootJudgeMovesPrevWithSource F linux:internal/host/movesfloor.go:rootJudgePrevWithSource rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction_linux.go productionStopControllers.VerifiedController C+G linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofask.go mintAsker.stagedSHA B3 linux:internal/host/proofask.go:mintAsker.tick root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile.go Reconciler.Install C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go syncSibling E2 linux:internal/release/adopt.go:stageFrom E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_startup.go verifyRootMigrationRetained F+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory
plan14_input_inventory_test.go:379: J4 internal/rootstate/file_linux.go CheckPublicConfig A+B3 linux:internal/host/proofnamed.go:proofBindingSource.trustedBytes fix1;basis=Checks root:root ownership, exact 0644 mode and single-link regular-file identity on the already opened operator configuration descriptor.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go rootFloorJudge.refresh F linux:internal/host/rootmovesfloor_refresh.go:rootRefreshAndJudgeMovesPrev rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootview.go Guard.fenceLocked C+G linux:internal/hostguard/recoveryfence.go:Guard.ResumeFence rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.beforeExec E3 linux:internal/host/buildstate.go:buildStateHook Consumed request is tenant-bound before execution; unread registry refuses before state merge.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go backfillManifestDigest E2 linux:internal/release/adopt.go:adoptHost E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/registry/registry.go routeArgs E3 linux:internal/registry/registry.go:Registry.Upsert rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever a route is inserted: Upsert, the cold handover restore and the import journal's inserts: the bind list from Registry.Upsert's body (and RestoreClaimRows'), with seed_source and import_gate added; E3, the same family as Registry.Upsert, whose body it came from
plan14_input_inventory_test.go:379: J4 internal/historyreadback/completion.go ReadRetirement E1 linux:internal/historyreadback/workflow.go:Operation.Read Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go routeByHost E1+E3 linux:internal/host/restartscope.go:restartScopeLeg root-route
plan14_input_inventory_test.go:379: J4 internal/hostguard/generationinventory.go RootAuthority.generationInstallation E2 linux:internal/hostguard/generationinventory.go:RootAuthority.GenerationInstallations E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/activator/workerswap.go Service.ReplaceWorker E2 linux:internal/rollout/worker.go:scheduler.executeWorker E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
plan14_input_inventory_test.go:379: J4 internal/host/caps_pass.go buildPlans E4 linux:internal/host/caps_pass.go:capabilityPass root-route
plan14_input_inventory_test.go:379: J4 internal/host/movesinstall.go installRun.local_ C+G linux:internal/host/movesinstall.go:installGeneration root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go type historyRecoveryRecord E1 linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go const RootRestartsDir E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Fail E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerationpins.go type generationPinSource E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go generationRetirement.closed E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go RootAuthority.read C+G linux:internal/hostguard/root.go:Guard.Capture rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go Guard.locked C linux:internal/hostguard/fence.go:Guard.CompleteFence rev3=merge-ruling-4;basis=Only positively unsafe legacy locks durably quarantine; timeout and I/O errors return without changing root installation state.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go generationFileIdentity E2 linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_startup.go verifyRootMigrationFloors F+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks installed and guard signed binaries against both locally retained protocol bounds without remote access
plan14_input_inventory_test.go:379: J4 internal/host/claimwakeassembly.go ClaimWakeAssembly.readiness C+G linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go applyRetries E1+E3 linux:internal/host/restart.go:restartRequestLeg fix1-merge-review;basis=Verifies the deployment-root signature and account/app/host/book/epoch before lifting a restriction.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationStart E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.controllerGone E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/hostbox/stopjournal_reader.go LaunchJournal.ReadStopKernelJournal C linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go RootAuthority.write C+G linux:internal/hostguard/record_unix.go:recordDir.write rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go type GenerationOwner E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_boot.go rootFloorJournalPresent F linux:internal/host/guardexec.go:RunSystemGuardExec rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=checked authority-file presence selects recovery without opening a deployment store
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveparks.go refusingClaimMoveWake C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/roothistory.go recordRootProgram E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go const rootGenerationCompletenessLimit E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.projection F linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go restartBoundUnit B3 linux:internal/host/rootrestart.go:rollbackUnitRestart E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go systemdUnits.StartTime B3 linux:internal/host/proofobserve.go:proofObserver.observe kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStateRegions E3 linux:internal/host/buildstate.go:newBuildStates root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rootRestartRouteWith B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads.
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/participant.go Participant.Sweep C+D Sweep reads fresh claim before retiring a participant; absence never manufactures a local discharge.
plan14_input_inventory_test.go:379: J4 internal/rootstate/authorityfile_linux.go OpenAuthorityFile E2 linux:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.report E1+E3 linux:internal/host/rollout.go:rolloutStatusProbe fix1-merge-review;basis=Reports only durable published restriction epochs and the supported retry protocol; reports do not grant authority.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go RootHistory.RetainRecovery E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/registry/registry.go Registry.Upsert E3 linux:cli.go:runAdd rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged, in the process that holds a remote handle, root passes included: main's body with its insert defaults moved to normalizeRoute and its bind list to routeArgs, and two columns added (seed_source, import_gate); the conflict clause, with the tenant-change rule E3 names, is unchanged; main's E3 authority retained
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go type GenerationProcess E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/release/sweep.go SweepStaged E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go type GenerationEvidence E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_proof.go legacyJournalProof C+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.plan E1+E3 linux:internal/host/rolloutdeclined.go:honourDeclinedFailures root-route
plan14_input_inventory_test.go:379: J4 internal/release/restartscope.go RestartScope.Selects E1+E3 linux:internal/host/restartscope.go:scopedHosts root-route
plan14_input_inventory_test.go:379: J4 internal/rootstate/live.go LiveHeld A+D linux:internal/hostexec/rootread.go:ReadRoot fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go ColdHandover.Recover C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending A provably superseded cold admission can abandon its barrier without discarding its receipt.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.Before C+G linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers_linux.go LinuxStopKernel.VerifyNoProcess C+G linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go heldShape C+E1 linux:internal/release/materializeheld.go:VerifyHeldLive root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go HistoryStatusKey E1 linux:internal/release/roothistory_status.go:RootHistory.ProjectMigrationStatus Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go productionRestartRequestPass E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go GenerationEvidence.valid E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/activator/rolelaunch_linux.go RoleLaunch.prepareRoleReservation C root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation.go productionClaimLocal.prepareLegacyWith D linux:internal/host/rootexecution_client.go:productionClaimLocal.prepareWith Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_runtime.go var openClaimExecutionAuthority D linux:internal/host/claimassembly.go:NewProductionRootClaimStop Instance-control owns broker, checked store, monitor and bounded cleanup lifetime.
plan14_input_inventory_test.go:379: J4 internal/host/seedsfloor.go readLocalSeedsFloor F linux:internal/host/seedsfloor.go:withSeedsFields rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root); also the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), for its hourly refresh and its edges file: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
plan14_input_inventory_test.go:379: J4 internal/registry/importjournal.go Registry.ImportJournalHosts G linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote rev3=census-ruling-seeded-instances;basis=its SQLite arm as carlos, in the agent or the registry child (carlos __registry-child); its remote arm in whichever process holds a remote handle, and a root pass does. No caller in the tree yet, outside the child's dispatch: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.unitBinding B3+E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover Reads canonical deployment record, claim, unit file identities and systemd facts without assuming a running PID. Existing running/rollback binding uses the same verifier. Fixtures: TestPlan14SignedNamedRecoveryAuthority and TestPlan14ProofBindingProvenance.
plan14_input_inventory_test.go:379: J4 internal/hostbox/generationinventory.go LaunchJournal.GenerationLaunches E2 linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_collect_linux.go migrationStopKernel.RecoverStopped G linux:internal/host/claimstop_recovery.go:ClaimStopCoordinator.RecoverStopped rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream
plan14_input_inventory_test.go:379: J4 internal/hostexec/local_unix.go localDir.write D linux:internal/hostexec/rootmirror.go:ProjectRootClient root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go RootHistory.recoveryRefusals E1 linux:internal/release/roothistory.go:RootHistory.Refusals Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go type Scope E1 linux:history_cli.go:historyCommandWithSave Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedpark_linux.go openParent C linux:internal/hostbox/typedpark_linux.go:TypedParker.Park root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/record_unix.go recordDir.write C linux:internal/hostguard/root.go:Guard.AbandonRootInventory root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go restoreLive C+E1 linux:internal/release/materializeheld.go:publishHeld root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimretire_transport.go ClaimRootHTTP.retire C+G linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go prepareStatus E1 linux:internal/historyreadback/workflow.go:PrepareOperation E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/image_linux.go OpenProtected F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go RootHistory.recoveryRetirementDigest E1 linux:internal/release/roothistory_retirement.go:RootHistory.recoveryRetired Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.holdOf E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.heldBuild root-route
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationInventoryDigest E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_recovery.go resumeHistoryRestart B3+E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go readLegacyJournals C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go restartEffectFailed B3 linux:internal/host/rootrestart.go:restartBoundUnit E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.
plan14_input_inventory_test.go:379: J4 internal/host/claimstate_linux.go prepareClaimDatabaseOwner C+G root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go rootRestartRequests.consume E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go generationDigest E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/claimconstruction.go refusingRootWake C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/guardarm.go guardArmIdle F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/production.go ActivationReady D+G linux:internal/host/claimstop_run.go:RunInstanceControl Refuse claims activation without complete census and registered verifier; Part 3 G remains mandatory.
plan14_input_inventory_test.go:379: J4 internal/hostexec/controller.go Controller.authority D linux:internal/hostexec/controller.go:Open root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go historyRecoveryKey E1 linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go HistoryReconstructionKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/proofgate.go ProofGate.admit B3 linux:internal/release/adopt.go:adoptHost root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_reconstruct.go RootHistory.reconstructionImages E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory.go RootHistory.Refusals E1 linux:internal/release/roothistory_app.go:RootHistory.MintRefusals E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimwakeassembly.go claimSocketReady C+G linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.refresh F linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal refresh ratchets accepted history; unknown history persists only observed denies and never advertises accepted
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.skipGet E1+E3 linux:internal/host/agent.go:convergeLegFor root-route
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootmigration_inventory.go RootAuthority.MigrationInstallations C+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0; also root claim startup uid 0;basis=read-only root installation enumeration includes incomplete records and never repairs before preflight
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.BeginUpdateWith D linux:internal/hostfloor/disk.go:Disk.Begin Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation_stale.go participationCleanupRead.Read D linux:internal/host/rootinstallation.go:rootInstallationHostApp root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go type generationInventory E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartCandidates E1+E3 linux:internal/host/restart.go:restartApps root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/work.go Serving C linux:internal/hostbox/wakepolicy.go:Policy.check root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go RootHistory.recoveryOutcomes E1 linux:internal/release/roothistory.go:RootHistory.Refusals Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go recheck E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go RequestStatus E1 E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go const generationCompletenessKey E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/claimcleanup_identity.go claimCleanupEnrollment.configureSigner C+G linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckLocal C linux:internal/host/claimassembly.go:ClaimAssembly.Build Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go stageFrom E2 linux:internal/release/adopt.go:ensureStagedDigest E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go RemoveDurable F linux:internal/hostfloor/disk.go:Disk.Begin root-input
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go FenceSource C linux:internal/hostrelocate/worker.go:Worker.Step Source-loss transition independently verifies termination fence and enrollment before revoking its participation.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.task E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory.go openRootHistory E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go GenerationProcess.valid E2 linux:internal/release/rootgenerations.go:validGeneration E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/seedsfloor.go systemApplier.armSeedsFloor F linux:internal/host/systemapply.go:systemApplier.armFloor rev3=PROPOSED-p3;identity=carlos system apply uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot
plan14_input_inventory_test.go:379: J4 internal/host/claimstop.go ClaimStopCoordinator.witnessNoProcess C+G linux:internal/host/claimstop.go:ClaimStopCoordinator.FenceAndStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go generationRetirement.retireAll E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback_resume.go resumeRootRestart B3+E1 linux:internal/host/rootrollback_resume.go:recoverRootRestarts Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_run.go instanceRegistryHostApp C+G linux:internal/host/claimstop_run.go:RunInstanceControl root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimwakestop.go ClaimAssembly.collectRetirementStop C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build route-and-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartPass E1+E3 linux:internal/host/agent.go:runAdoptUnderRootRelease root-route
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go withPrevLock F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate root-input
plan14_input_inventory_test.go:379: J4 internal/host/restart.go dispatchBoundedWakes E1+E3 linux:internal/host/restart.go:cycleWorkers root-route
plan14_input_inventory_test.go:379: J4 internal/host/relocationflush.go ReleasePositionsFile.Recorded C linux:internal/host/relocationeffects.go:RelocationEffects.flushStopped Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go RootHistoryPass.recheck E1 linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go wireClaimAdmission C+D linux:internal/host/claimhandover_crossbox.go:wireProductionAdmission Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go LinuxStopKernel.recoverAfterReboot C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go settingsApply E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go type Request E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journaltrust_linux.go checkTrustedJournalDir C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-input
plan14_input_inventory_test.go:379: J4 internal/host/seedsfloor.go withSeedsFields F linux:internal/host/edgesfile.go:edgesFileLoop rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.ownedRow C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install Extracted row writer retains complete typed inventory and immutable route identity around guarded write.
plan14_input_inventory_test.go:379: J4 history_cli.go historyReadFile E1 linux:history_cli.go:historyCommandWithSave E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_install.go rootLandingIdentity C linux:internal/host/rootinventory_install.go:ClaimRootHTTP.rootLandingRoute Landing target identity binds executor, participants, enrollment and region before first root registration.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go type HistoryMigrationStatus E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationMounts E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.
plan14_input_inventory_test.go:379: J4 internal/hostbox/generationpayload.go LaunchJournal.GenerationPayloads E2 linux:internal/host/rootgeneration_inventory.go:generationInventoryAt E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/report.go ReadEnrollment F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go install C linux:internal/hostclaim/relocation.go:ToInstalling Install transition allocates authoritative stamp and pinned release, records target before effects and removes prior local receipt.
plan14_input_inventory_test.go:379: J4 internal/host/movespass.go armMovesPass B+C linux:internal/host/agent.go:runAgent Agent moves construction passes registration client and existing guarded publication and park providers.
plan14_input_inventory_test.go:379: J4 internal/host/retention.go retentionPass E2 linux:internal/host/agent.go:retentionLoop root-route
plan14_input_inventory_test.go:379: J4 internal/hostguard/coldhandover.go Guard.AbandonColdHandover C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt.
plan14_input_inventory_test.go:379: J4 internal/hostbox/stopinventory_db.go StopInventoryDB.inventoryVersion C linux:internal/hostbox/inventory_expected.go:StopInventoryDB.Snapshot root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.CaptureInventory C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.RegisterLanding root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go CapabilityRoute E4 linux:internal/host/adopt_advice.go:adviseHostRoleGateMissing root-route;kept=E4;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartSeed E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Baselines both request logs without applying historical ordinary restarts; signed retry grants remain independently verified.
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.Install C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Configure Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rootStartRoute B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-4;basis=Use main systemctl start for legacy non-NotUp recovery while retaining checked rollback when authority binds.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_linux.go migrationExecutionEmpty G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_linux.go randomMigrationID G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=cryptographic nonce identifies newly collected stop evidence, never authorizes a stop
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedpark_linux.go TypedParker.VerifyEmptyDirectory C linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/journaltrust_linux.go readTrustedJournal C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover root-input
plan14_input_inventory_test.go:379: J4 internal/provision/reconcile.go mintHeld C linux:internal/provision/reconcile.go:Reconcile Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior.
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.MintHeldUnder C linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership.
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootmigration.go RootAuthority.CompleteMigrationInventory C+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root completed fence receipt and retained session deny required before installing recovered inventory revision
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.wakeTarget E3 linux:internal/host/agent.go:runAgent root-route
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go execBounceable E1+E3 linux:internal/host/restart.go:bounceExecRoutes root-route
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-system-recover.service external F linux:internal/host/bootstrap.go:var unitsFS rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
plan14_input_inventory_test.go:379: J4 internal/hostbox/relocationrows.go RelocationRow C linux:internal/hostbox/reconcile.go:Reconciler.rowDecision Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go RootHistory.MigrationStatusWithSources E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/hostexec/participation.go PreinstallationParticipant D linux:internal/host/rootexecution_authority.go:ClaimRootHTTP.executionAuthority D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority.
plan14_input_inventory_test.go:379: J4 internal/release/programhistory.go ReadPrograms E1+E3 linux:internal/release/adopt.go:adoptHost root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootrebind.go Guard.RebindRootInventory E2 linux:internal/host/rootrecovery_rebind.go:ClaimRootHTTP.rebindRecoveryInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go UpdateIdle F linux:internal/host/claimreport.go:claimReport root-input
plan14_input_inventory_test.go:379: J4 internal/host/heldstage.go heldStageRow C+E1 linux:internal/host/heldstage.go:heldStageAuthority root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimcleanup_identity.go verifyClaimCleanupEnrollment C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_recovery.go claimInitialSourceRecovery C+G linux:internal/host/claimwakestop.go:ClaimAssembly.stopCapturedSession root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/registry/remote_dispatch.go Registry.dispatchRemote E2 linux:internal/registry/remote.go:serveRemote Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerationpins.go generationPinSource.StagedPins E2 linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/claimcensus.go claimUnitCensus C+G linux:internal/host/claimcensus.go:claimGlobalSharedPaths root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/relocationowners.go relocationBeforeAdmission C linux:internal/host/relocationowners.go:RelocationSource.Open Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationGroupGone E2 linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go type generationReconciler E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_requirements.go generationRequiredInventory E2 linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go rootSeedsAllowsBinary F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=checks signed executable seeds protocol and release against locally retained root bound without network
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.floorArmed F linux:internal/host/systemapply.go:systemApplier.activationGuard rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go LaunchJournal.SessionLaunches C linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop root-input
plan14_input_inventory_test.go:379: J4 internal/release/consumedfence.go publishConsumed E3 linux:internal/release/adopt.go:settingsTarget root-route;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventory_expected.go StopInventoryDB.SnapshotRequest C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go const RootHistoryStatusDir E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_launch.go ClaimLaunchRoot.rootInstalledProgram E1 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go Ops.checkStateDirShape E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go const RootRestartAbsent E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go validGeneration E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.launchLocked E1+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_payload_linux.go generationPayloadFiles E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
plan14_input_inventory_test.go:379: J4 internal/host/proofobserve.go proofObserver.observe B3 linux:internal/host/proofobserve.go:proofObserver.recordSettled fix1;basis=Observes only the canonically bound unit, executable and readiness, including the installed console guard wrapper.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go journalIdentity C linux:internal/hostbox/generationinventory.go:LaunchJournal.GenerationLaunches root-input
plan14_input_inventory_test.go:379: J4 internal/release/refusal.go ListRefusals E1+E3 linux:internal/host/refusalwatch.go:refusalWatch.tick root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go readRootSeedsBinary F linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=delegates checked signed executable read then selects seeds protocol
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.gate E1+E3 linux:internal/host/rolloutdeclined.go:honourDeclinedFailures root-route
plan14_input_inventory_test.go:379: J4 internal/activator/workerbuild.go Service.startWorker E2 linux:internal/activator/activator.go:Service.doWake E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.observeAndRecord B3+E1 linux:internal/host/proofroot.go:proofRoot.mintAndLog E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofBindingSource.installedConsoleVersion B3 fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RestartTarget.valid E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go readRootProtocolBound F linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.carryRequest E3 linux:internal/host/buildstate.go:moveCarry Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary.
plan14_input_inventory_test.go:379: J4 internal/rollout/failures.go OpenFailureBook E1+E3 linux:internal/host/updatesroot.go:updatesPassOption fix1-merge-review;basis=Loads schema-three durable generations and refuses unsafe identity recovery on entropy failure.
plan14_input_inventory_test.go:379: J4 internal/provision/rootrecord.go RecordIndex.Find B3+C linux:internal/provision/rootrecord.go:FindRecordByHost Use cached key identity but read and validate current record body and ETag.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests_source.go rootRestartRequestSource.installation E1 linux:internal/host/roothistory_creation.go:rootRestartRequestSource.creation E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_census_linux.go productionGenerationKernelCensus E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go refreshRootMovesFloor F linux:internal/host/systemapply.go:systemApplier.armFloor rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal adopt/update combines remote object with independent deny-only legacy evidence under root floor lock
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-system-update.service external F linux:internal/host/bootstrap.go:var unitsFS rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
plan14_input_inventory_test.go:379: J4 internal/hostbox/wakepolicy.go relocationProbe C linux:internal/hostbox/wakepolicy.go:Policy.check root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/remote.go CheckRemote F linux:internal/hostexec/controller.go:Config.checkRemoteUpdateIdentity root-input
plan14_input_inventory_test.go:379: J4 internal/release/proofgate.go ProofGate.bind B3 linux:internal/release/roothistory_pass.go:passConfig.bindProof root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration.go migrateClaimJournalsWith G linux:internal/host/claimjournal_migration.go:RunSystemJournalMigrate rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import
plan14_input_inventory_test.go:379: J4 internal/host/agent.go runAdoptWithEnsureSystemUnits B3+C+D+E1+E2+E3+E4+F linux:internal/host/agent.go:runAdopt E1 selects the checked private history, canonical named-unit provider and root mint inventory under release exclusion with claims off or on; reconstruction and restart consumption remain incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_creation.go productionCreationHistory E1 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.recoverIfNeeded F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.publishRelease C+E1+E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go relocationInstallAuthority C linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go restartVerifiedOrdinaryUnit B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-4;basis=Retain the checked ordinary-unit path for strict census-backed operation.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go ReadStatus E1 linux:internal/historyreadback/workflow.go:Operation.Read Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go publish E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.write E2 linux:internal/release/rootgenerations.go:RootGenerations.Retire E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/activator/activator.go Service.respawnWorkerLocked E2 linux:internal/activator/activator.go:Service.convergeWorkerLocked E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
plan14_input_inventory_test.go:379: J4 internal/host/guardarm.go RunSystemGuardArm F linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration_linux.go createClaimEdgeMask C+G linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_transport.go ClaimRootHTTP.serveJournal C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/movesfloorgate_linux.go readFloorGateFile F linux:internal/host/movesfloorgate_linux.go:floorAllowsPrev root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/renewing.go RenewingLeases.Acquire C linux:internal/host/movespass.go:armPhase1 root-input
plan14_input_inventory_test.go:379: J4 internal/host/caps_pass.go stagedManifestOfLiveVersion E4 linux:internal/host/agent.go:runAgent root-route
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor_linux.go openMovesDir F linux:internal/host/movesfloor.go:withFloorLock root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/retirement.go Guard.WithNoInstallation C linux:internal/host/claimproduction.go:claimAdminTokens.With Use the already-held root host lock for empty-installation authority checks.
plan14_input_inventory_test.go:379: J4 internal/host/claimconstruction.go claimConstructionProcessStart C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/heldstage.go heldStageAuthority C+E1 linux:internal/host/heldstage.go:heldStagePass route-and-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostguard/record_unix.go openDirectory C linux:internal/hostguard/flock_unix.go:acquire root-input
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go verifyHeldLive B2+C+E1 linux:internal/release/materializeheld.go:VerifyHeldLive Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_recovery.go type historyRollbackLink E1 linux:internal/host/roothistory_recovery.go:linkRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go RootGenerations.Reservations E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootmigration.go migrationDenied C+G linux:internal/hostguard/rootmigration.go:RootAuthority.CompleteMigrationInventory rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.write E3 linux:internal/host/buildstate.go:buildStates.beforeExec root-input
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_recovery.go historyRestartAttempt B3+E1 linux:internal/host/rootrestart.go:checkedUnitRestart Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go type generationMount E2 linux:internal/host/rootgeneration_kernel_linux.go:generationMounts E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizedReconstruction F rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go RunSystemApply D+F linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root system apply takes D3 release exclusion only for census participation before normal apply
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RootRestarts E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.selected C+G linux:internal/host/claimmoveaccess.go:claimMoveReadWork.With root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go directory.Names A linux:internal/hostexec/rootbroker.go:RootBroker.Recover root-input
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go relocationActivationReader.Read C linux:internal/host/rootinstallation.go:rootInstallationHostApp Activation reader obtains a fresh claim and applies typed relocation installation authority before activation.
plan14_input_inventory_test.go:379: J4 internal/host/retention.go buildStatePins E2 linux:internal/host/agent.go:runAgent root-route
plan14_input_inventory_test.go:379: J4 internal/release/healthy.go ReadHealthy B+B4 linux:internal/host/proofbinding.go:productionProofBindingSource root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RestartIntent E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go RootHistory.RecoveryRetired E1 linux:internal/host/recoveryrefusals.go:checkUnresolvedRecoveries Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go logRestartRequestError E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.heldGenerationPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/systemunits.go ensureSystemUnits F linux:internal/host/agent.go:runAdopt root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_creation.go rootRestartRequestSource.creation E1 linux:internal/host/roothistory_creation.go:rootHistoryCreation E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go Guard.CommitRootInventoryArtifacts G linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_parked.go generationPhysicalPayloads E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/claimbackfill.go newClaimBackfill C+G linux:internal/host/agent.go:instancesLoop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.EndUpdateWith D linux:internal/hostfloor/disk.go:Disk.EndParticipation Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.record F linux:internal/host/rootmovesfloor.go:rootMovesFloors.localBound rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=bounded strict private JSON read requires matching deployment, box and enrollment
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go rootFloorLegacy F linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=selects existing moves mirror paths for denial-only generic legacy reader
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go scanStopDescriptors C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restart.go cycleWorkers E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go passConfig.generationWriteCheck E2 linux:internal/release/adopt.go:PassFilter E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:379: J4 internal/hostbox/writer.go Writer.Published C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go type RootHistoryPass B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.write D linux:internal/hostexec/rootbroker.go:RootBroker.settle fix1;basis=Bounds replay to the latest acquisition and preceding settlement, rotates renewal tokens, and holds broker-only OFD liveness.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go openRootMovesFloors F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=selects fixed moves namespace then delegates checked root store opening
plan14_input_inventory_test.go:379: J4 internal/host/claimwakewriters.go claimWakeAttempt.StopWriters C+G linux:internal/host/claimstop_writers.go:ClaimAssembly.writersStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.localBound F linux:internal/host/rootmovesfloor_boot.go:rootFloorBootCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance
plan14_input_inventory_test.go:379: J4 internal/release/rollback.go processGroup B3+E1+E3 linux:internal/release/rollback.go:rollbackGroup root-route;kept=B3,E1,E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.retry D linux:internal/hostexec/rootbroker.go:RootBroker.Execute Bound transport retries by original monotonic slack and context; never extend a permit.
plan14_input_inventory_test.go:379: J4 internal/hostexec/clock_linux.go BootID D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/flock_unix.go acquire C linux:internal/hostguard/guard.go:Guard.locked rev3=merge-ruling-4;basis=Descriptor checks classify nonregular or foreign-owner locks as unsafe; honest contention waits with bounded exponential backoff.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.activationGuard F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=final activation holds root moves and seeds locks and checks each local bound before effect; main route holds retained on legacy path
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofRouteReady B3 linux:internal/host/proofobserve.go:productionProofObserver kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_recovery.go rootRestartChecks.settleHistory B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.floorAllowsForward F linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=network-free forward recovery checks both locally retained protocol release minima
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/participant.go Participant.Step C+D linux:internal/host/relocatepass.go:RelocationRuntime.once Participant re-reads claim and installation identity around effects; root stop receipts and fresh participation bound probes, with generic orchestration retained.
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootclient.go requestIdentity D linux:internal/hostexec/rootclient.go:RootClient.close D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently.
plan14_input_inventory_test.go:379: J4 internal/release/rollback.go writeGroupRefusals E1 linux:internal/release/adopt.go:adoptHost E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile.go Reconciler.installWithWork C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote Install dispatch preserves serving registration and distinguishes hold-only relocation from installation.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go journalPrune C linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/begun.go ReadBegun F linux:internal/host/guardtransaction.go:systemApplier.guardFinished root-input
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go scanClaims E4 linux:internal/caps/converge.go:Ops.checkClaimsOnDisk root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/image_linux.go Disk.Exec F linux:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go recoveryResultKey E1 linux:internal/host/rootrollback.go:settleRollbackAttempt Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.Observe C+G linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimwakeassembly.go ClaimWakeAssembly.Build C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build route-and-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease.go decodeHeldReleaseRequest C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.ServeHTTP root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go systemctlVerb B3 linux:internal/host/unitsettle.go:systemdUnits.ResetFailed root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimunit.go claimUnitContent E1 linux:internal/host/bootstrap.go:bootstrapWith E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go restartRouteRows E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/relocationowners.go ClaimAssembly.relocationReleaseHold C+D linux:internal/host/relocatepass.go:newCompletionRuntime Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationInstallation E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.heldHost E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.skipHost root-route
plan14_input_inventory_test.go:379: J4 internal/release/rollback.go rollbackGroup B3+E1+E3 linux:internal/release/adopt.go:adoptHost root-route;kept=B3,E1,E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go type RootGenerations E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go readDropIn E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.recordLive B3 linux:internal/host/proofroot.go:proofRoot.around rev3=merge-ruling-5;basis=Exclude ordinary unstamped and derived routes before pre-pass binding and health observation.
plan14_input_inventory_test.go:379: J4 internal/hostguard/record_unix.go recordDir.openRecord C linux:internal/hostguard/record_unix.go:recordDir.read root-input
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/production.go Open D linux:internal/rootparticipation/production.go:ActivationReady Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_startup.go verifyRootMigrationState F+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=binds complete root census and durable complete migration record to deployment box enrollment and migration generation
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go Ops.checkClaimsOnDisk E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go readProductionRosterRow C+G linux:internal/host/movessources.go:productionRosterRegion root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go descendSync A linux:internal/rootstate/state_linux.go:descend root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_production.go WithProductionClaimLaunch E1+E2 linux:internal/host/claimstop_run.go:RunInstanceControl E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go routeWithHost E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.tenant C+G linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostclaim/store.go Read C+D+G linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease root-input;kept=C,D,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go readLocalFloor F linux:internal/host/movesfloor.go:withMovesFields root-input
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.retryHost E1+E3 linux:internal/host/rolloutdeclined.go:rolloutRetryHost fix1-merge-review;basis=Refuses retry while a failure-book save is owed; verifies the signed current book/epoch grant before clearing.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.startRecorded E1+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.start E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_status.go RootHistory.ProjectMigrationStatus E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.stageRelease E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go readRootLegacyFloorJSON F rev3=PROPOSED-p3;identity=test-only compatibility wrapper; production uses readRootLegacyProtocolJSON from adopt/apply uid 0;basis=selects moves JSON for bounded denial-only reader; no recovery or boot call
plan14_input_inventory_test.go:379: J4 internal/caps/render.go RenderService E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.Route C+G linux:internal/host/moveswakesource.go:movesReadRoute root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation.go productionClaimLocal.participateHost D linux:internal/host/claimparticipation.go:productionClaimLocal.participate Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_production.go NewProductionClaimStopHandler C+G linux:internal/host/claimassembly.go:NewProductionRootClaimStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go Open A linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationTree E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go RootGenerations.invalidateCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/hostbox/migration_census_linux.go CheckMigrationRoots G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=offline scan requires every managed payload to match independent retained inode/type inventory or explicit shared path rules
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.VerifyDigest C+G linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authorize root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostguard/recoveryfence.go Guard.PendingFences C linux:internal/host/claimstop_recovery.go:ClaimStopHTTP.RecoverPending Root-only read lock avoids an agent-held legacy lock at startup.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go JournalService.journalMigrationMarker C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go StoreReader.Read C linux:internal/host/rootinstallation.go:rootInstallationHostApp root-input
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go serveHeldStageRequest E2 linux:internal/release/materializeheld.go:ServeHeldStageRequestsWithPins E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:379: J4 internal/provision/rootrecord.go FindRecordByHost B3+C linux:internal/host/rootrecord_claim.go:rootClaimRecord Discovery delegates to the collision-checking index and still reads the selected record afresh.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_migration.go ClaimRootHTTP.executionAuthorityWithMigration D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go historyRetirementKey E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimrecoveryreceipt.go claimCrossBoxHandover.recoveryStopReceipt C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.recoveryEvidence root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go censusRule.check C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal root-input
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go VerifyHeldLive C+E1 linux:internal/host/movesstage.go:heldReleasePublished Held verification wrapper retains selected held lock and delegates root proof validation of live bytes.
plan14_input_inventory_test.go:379: J4 internal/host/movespass.go movesWorker.liftFences C linux:internal/host/movespass.go:movesPass root-route;kept=C;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go MaterializeHeldUnder C+E1+E2 linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/systemparticipation.go systemApplier.clearUpdateBegun D linux:internal/host/systemparticipation.go:systemApplier.settleUpdateBegun Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventoryscope.go ValidateAgentInventory C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-route
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go RootGenerations.Completeness E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go record.admits G linux:internal/hostguard/guard.go:Guard.With rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt
plan14_input_inventory_test.go:379: J4 internal/hostbox/regionalworker.go RegionalWorker.Census C linux:internal/hostbox/regionalworker.go:RegionalWorker.Run root-input
plan14_input_inventory_test.go:379: J4 internal/hostexec/local_unix.go localDir.read D linux:internal/hostexec/rootmirror.go:ProjectRootClient root-input
plan14_input_inventory_test.go:379: J4 internal/provision/reconcile.go RouteFor C+E3 linux:internal/provision/reconcile.go:Reconcile rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos); also root, in the claim root's landing registration (ClaimRootHTTP.rootLandingRoute) and the relocation install (relocationRecord): main's body with one more field: the row's seed column, derived from the record's seed (SeedColumn). Every caller gets it, the two root ones included, so a root-registered row for a seeded record now carries the seed the activator places from; main's C,E3 authority retained
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_outcomes.go validHistoryRecovery E1 linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationInventoryAt E2 linux:internal/host/rootgeneration_inventory.go:productionGenerationInventory E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.retained E3 linux:internal/host/buildstate.go:buildStates.heldTarget root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers.go ClaimAssembly.WritersStopped C+G linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration.go rootMigrationSnapshot.fingerprint G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=binds exclusion and membership across observations/restart while allowing boot metadata and independently recovered payload revision
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go bounceScopedRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.Retire E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.skipRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go withRootSeedsFields F linux:internal/host/seedsfloor.go:withSeedsFields rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=advertises only checked synced root seeds projection matching deployment and box; no valid projection stays quarantined
plan14_input_inventory_test.go:379: J4 internal/host/claimconstruction.go var openClaimRootAuthority C linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/versionsweep.go sweepStagedVersions E2 linux:internal/host/versionsweep.go:sweepStagedVersionsPass root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go lockJournalMigration C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofBindingSource.capturedVersion B3 fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.Check E2 linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.check E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_reconstruct.go RootHistory.ReconstructionStatus E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_observations.go claimUnitStopKernel.VerifyWritersStopped C+G linux:internal/host/claimstop_writers.go:ClaimStopCoordinator.WritersStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_recovery_policy.go RootHistory.recoveryDenials E1 linux:internal/release/roothistory.go:RootHistory.Blocks E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/movesinstall.go installRun.installAuthority C+G linux:internal/host/movesinstall.go:installRun.local_ root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go MaterializeHeld E2 linux:internal/host/movesstage.go:var heldMaterialize E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:379: J4 internal/host/rootroute.go proofBindingSource.claimIdentity B3 linux:internal/host/rootroute.go:proofBindingSource.needsRestart canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers_linux.go emptyContainmentAt C+G linux:internal/host/claimstop_writers_linux.go:noProcessGroups root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartEligible E1+E3 linux:internal/host/rollout.go:feedRestarts root-route
plan14_input_inventory_test.go:379: J4 internal/hostfloor/image_linux.go ExecutingHash F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimstop.go ClaimStopCoordinator.FenceAndStop C+G linux:internal/host/claimstop_transport.go:ClaimStopHTTP.ServeHTTP root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/probe_unix.go probeExisting D linux:internal/hostexec/probe_unix.go:probeLifetime root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory.go ClaimRootHTTP.verifyInventoryPath C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_collect_linux.go type migrationStopKernel G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.Run D+F linux:internal/host/systemapply.go:RunSystemApply root-input;kept=D,F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go systemdUnits.Show B3 linux:internal/host/agent.go:agentCheckedUnitRestart root-input
plan14_input_inventory_test.go:379: J4 internal/console/browserrestart.go Server.handleBrowserRestart E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration_linux.go recoverLegacyClaimEdgeMask C+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/edgesfile.go edgesFileWriteClaims F linux:internal/host/edgesfile.go:edgesFileLoop root-route;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.stillLive B3 linux:internal/host/proofroot.go:proofRoot.mintAndLog route-and-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/stopinventory_db.go OpenStopInventoryDB C root-input
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofBindingSource.trustedBytes B3 linux:internal/host/proofnamed.go:proofBindingSource.record fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
plan14_input_inventory_test.go:379: J4 internal/rootstate/shared_linux.go ensurePublicChild A+B4 linux:internal/rootstate/shared_linux.go:EnsurePublicDir fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go rootFloorBinary.supports F linux:internal/host/guardarm.go:RunSystemGuardArm rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_creation.go RootHistory.ConsumeCreation E1 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go judgeRootSeedsPrev F linux:internal/host/systemapply.go:systemApplier.notePrev rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go retryRequests E1+E3 linux:internal/host/restartscope.go:applyRetries root-route
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.UpdateID D linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation_probestop.go RecordProbeStop C linux:internal/hostrelocate/participant.go:Participant.Step Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_settle.go ClaimRootHTTP.cleanupExecution D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_census_linux.go checkedGenerationTree E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootserving.go RootBroker.servingView D linux:internal/hostexec/rootbroker.go:RootBroker.Execute Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration.go rootMigration.write G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go systemdUnits.Exe B3 linux:internal/host/unitsettle.go:settleUnit root-input
plan14_input_inventory_test.go:379: J4 internal/release/pins.go nextGenerationsSeq E2 linux:internal/release/pins.go:WriteGenerations root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory.go RootHistory.readRecord E1 linux:internal/release/roothistory.go:RootHistory.read Root reconstruction reads exact durable records and preserves pending restrictions during signed replacement. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:379: J4 internal/host/relocatepass.go newCompletionRuntime C+D linux:internal/host/relocatepass.go:NewRelocationRuntime Completion-only runtime treats registry and journal hostnames as discovery and verifies claim and bound identity before discharge.
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.checkHeldInventory C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckHeld Held-inventory validator requires exact box/enrollment, ownership and single materialized route.
plan14_input_inventory_test.go:379: J4 internal/release/program.go FileProgram E1 linux:internal/release/adopt.go:adoptHost root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease.go heldReleaseVia.publish C+E1 linux:internal/host/movesstage.go:heldReleasePublished root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go loadPinned C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_stopped_linux.go verifyMigrationStopped G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go type GenerationCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/hostguard/generationinventory.go RootAuthority.GenerationInstallations E2 linux:internal/host/rootgeneration_inventory.go:generationInventoryAt E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/hostops/production_delete.go ProductionAuthority.StartDeleteClaim C Production delete obtains verified completed-box fence before permitting claim transition across completion barrier.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.member C+G linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.mint B3+E1 linux:internal/host/proofroot.go:proofRoot.mintAndLog E1 production uses canonical observed programs and complete root refusal inventory; legacy diagnostics do not grant root mint authority.
plan14_input_inventory_test.go:379: J4 internal/host/claimowners.go claimServingOwners.Select C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/coldhandover.go LaunchJournal.HasInstallationEffects C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimwakeassembly.go claimSameWriter C+G linux:internal/host/claimretire_local.go:claimArtifactRetirement.Recover root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go Guard.freshObserved C linux:internal/hostguard/guard.go:Guard.fresh root-input
plan14_input_inventory_test.go:379: J4 internal/rootstate/file_other.go CheckPublicConfig A+B3 darwin:internal/host/proofnamed.go:proofBindingSource.trustedBytes fix1;basis=Non-Linux descriptor checks fail closed.
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.Retire C+E2 linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go RequestKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go refreshRootSeedsFloor F linux:internal/host/seedsfloor.go:systemApplier.armSeedsFloor rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=merges authoritative store floor with denial-only legacy seeds maxima into durable independent root state
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.binding B3 linux:internal/host/proofbinding.go:proofBindingSource.forHost Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration.go migrateClaimJournals G rev3=PROPOSED-p3;identity=test-only wrapper; production offline uid 0 CLI calls migrateClaimJournalsWith with full=true;basis=retains legacy import/mask behavior for tests; no production caller
plan14_input_inventory_test.go:379: J4 internal/host/guardexec.go RunSystemGuardExec F linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover root units uid 0; edge unit uid carlos; console unit uid carlos-console;basis=root apply/recover selects signed image from local bound; non-root edge bypasses private floor entirely
plan14_input_inventory_test.go:379: J4 internal/hostexec/local_unix.go openDir D linux:internal/hostexec/local_unix.go:openLocal root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go passConfig.recheckHistory E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go RootHistory.RetireRecovery E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/signedhead.go StageSignedHead E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.
plan14_input_inventory_test.go:379: J4 internal/release/sweep.go treeStats E2 linux:internal/release/sweep.go:SweepStaged root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_writers_linux.go agentUnitCgroup C+G linux:internal/host/claimstop_kernel_linux.go:newProductionStopKernel root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go type rootGenerationSource E2 linux:internal/host/claimlaunch_root.go:type ClaimLaunchRoot E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration.go rootMigration.census G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=writes pending or complete root census and revokes failed completion; currently lacks ledger transaction lock and resets revision on completed retry (cp3 review finding 4, not fixed)
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_boot.go rootFloorPrevVerdict F linux:internal/host/rootmovesfloor_boot.go:rootFloorBootCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches actual signed previous binary to identity and accepted generation before allowing its gate
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootview.go RootAuthority.Installation E2 linux:internal/host/rootinstallation.go:rootInstallationHostApp E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration.go rootMigrationSnapshot.preflight G linux:internal/host/rootmigration_startup.go:verifyRootMigrationState rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refuses active moves, unfinished seeds, incomplete inventories or mismatched migration identity before effects
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.decidePrev F linux:internal/host/systemapply.go:systemApplier.install root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/unitsettle.go routeReady B3 linux:internal/host/agent.go:agentCheckedUnitRestart root-route
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.rollback B3 linux:internal/host/rootrestart.go:productionRootRestartChecks canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/rootroute.go sameProofCandidate B3 linux:internal/host/proofbinding.go:proofBindingSource.resolve canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go readProvingKey B3 linux:internal/host/agent.go:runAdoptUnderRootRelease root-input
plan14_input_inventory_test.go:379: J4 internal/safefile/file_linux.go writeAt A+F+G linux:internal/safefile/file_linux.go:Write rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation
plan14_input_inventory_test.go:379: J4 internal/host/moveswakesource.go movesWakeSources.Open B2+C linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go PinFailover C linux:internal/hostrelocate/worker.go:Worker.Step Failover pinning requires recorded source fence and completed acknowledgement barrier.
plan14_input_inventory_test.go:379: J4 internal/rootstate/live.go HoldLive A+D linux:internal/hostexec/rootbroker.go:RootBroker.write fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.persist F linux:internal/host/rootmovesfloor.go:rootMovesFloors.refresh rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.refreshAll E3 linux:internal/host/agent.go:fastConvergeLoop root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimunit.go readClaimUnitSettings C+G linux:internal/host/bootstrap.go:bootstrapWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.Monitor D linux:internal/hostexec/rootbroker.go:RootBroker.Run Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go rootRestartRoute B3 kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:379: J4 internal/release/bake.go LoadFirstSeenMigrating E1+E3 linux:internal/release/adopt.go:PassFilter root-input
plan14_input_inventory_test.go:379: J4 internal/host/relocatepass.go RelocationRuntime.once C+D linux:internal/host/relocatepass.go:RelocationRuntime.Run Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/image_other.go Disk.Exec F darwin:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go generationPayloadBindings E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_startup.go verifyRootMigrationStartup F+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks root-owned migration records and typed journal revisions before issuing startup grants; absent census leaves main path intact
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration.go rootMigration.run G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed exclusion and repeated census precede pending root grant barrier, prepared/fenced/recovered/complete writes; signed report is last
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go readRootFloorBinary F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.rebindRecoveryRows C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.installRecoveryInventory root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go withRootMovesFields F linux:internal/host/movesfloor.go:withMovesFields rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationNames E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go rootJudgePrevWithSource F linux:internal/host/movesfloor.go:rootJudgePrev rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes
plan14_input_inventory_test.go:379: J4 internal/caps/converge.go Ops.ensureUser E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.Prelaunch C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/proofask.go mintAsker.tick B3 linux:internal/host/agent.go:fastConvergeLoop route-and-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go passConfig.bindProof E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofBindingSource.record B3 linux:internal/host/rootroute.go:proofBindingSource.needsRestart Record key selection uses indexed discovery; local root-managed unit authority is unchanged.
plan14_input_inventory_test.go:379: J4 internal/instancectl/peer_tuple_linux.go procStart C+G linux:internal/instancectl/peer_tuple_linux.go:AuthenticatePeerTuple root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/roothistory.go boundRootHistory E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/rootstate/link_linux.go ReadTrustedLink A+E1 linux:internal/host/namedrecovery.go:productionNamedUnitRecovery Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go validRequest E1 linux:internal/historyreadback/workflow.go:Operation.checked Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Observe E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go productionClaimRoster.Actor C+G linux:internal/hostbox/identity.go:IdentityProvider.Verify root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.EndUpdate D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/instancectl/claimexec_socket_linux.go claimListenExecSocket C+G linux:internal/instancectl/claimexec.go:ClaimUnits.prepareExecGate root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/heldstage.go heldStageCheck C+E1 linux:internal/host/heldstage.go:heldStageAuthority route-and-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.install F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=checks signed staged image against both protocol minima inside final locked activation before binary rename
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go Adoptable C+E3 linux:internal/host/proofask.go:mintAsker.tick root-route;kept=C,E3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrecord_claim.go rootClaimRecord C linux:internal/host/rootinstallation.go:rootInstallationHostApp root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go type proofRoot E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_creation.go RootHistory.FreshInstallation E1 linux:internal/host/rootgeneration_requirements.go:productionGenerationCreation E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_census_linux.go generationKernel.census E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.Launch C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go judgePrevWith F linux:internal/host/systemapply.go:systemApplier.notePrev route-and-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go retirementEvidence E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.Launch C+G linux:internal/host/moveswakesource.go:movesReadLaunch root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback.go settleRollbackAttempt B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/console/apirestartscope.go hostNames E1+E3 root-route
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_collect_linux.go recoverMigrationStop G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go keepsBuildState E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-system-update.path external F linux:internal/host/bootstrap.go:var unitsFS root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/rolelaunch.go strictRoleLaunch C linux:internal/hostbox/rolelaunch.go:DecodeRoleLaunchRequest root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.write E1 linux:internal/release/rootrestart_history.go:RootRestarts.Finish E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-stage.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go JournalService.holdsLegacyRows C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go GenerationBinding.valid E2 linux:internal/release/rootgenerations.go:RootGenerations.Read E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/claimwakestop.go ClaimAssembly.localStopIdentity C+G linux:internal/host/claimparticipation.go:productionClaimLocal.bind root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostfloor/controllers_linux.go EnsureControllerDir F linux:internal/host/guardarm.go:guardArmControllers root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_reconstruct.go RootHistory.Reconstruct E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:379: J4 internal/safefile/file_linux.go writeAtSteps A+F+G linux:internal/safefile/file_linux.go:writeAt rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement
plan14_input_inventory_test.go:379: J4 internal/host/proofroot.go proofRoot.around B3+B4 linux:internal/host/agent.go:runAdoptUnderRootRelease Continue minting observations for unaffected routes even when adoption reports a route error.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_linux.go rootMigrationLegacySuspects G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go rootRestartChecks.allowLegacy B3+G linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-4;basis=Evaluate the explicit census selector; omitted test selector remains strict.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go rootFloorAdvertisementFor F linux:internal/host/rootmovesfloor_refresh.go:withRootMovesFields rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict
plan14_input_inventory_test.go:379: J4 internal/host/systemparticipation.go systemApplier.beginExecutableChange D linux:internal/host/systemapply.go:systemApplier.install Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/floor.go Read F linux:internal/host/hostfencepass.go:hostFenceOnce root-input
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.idle D linux:internal/rootparticipation/ledger.go:Ledger.RecoverAcquisition D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_kernel_linux.go claimLaunchProcessIdentity C+G linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/buildstate.go BuildStateCopy.Read E3 linux:internal/release/heldwake.go:DecideHeldWake root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go RootHistory.ReceiveRecoveryRetirements E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.stop C+G linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_recovery.go recoverRootExecution D linux:internal/host/guardtransaction.go:var recoverPendingControllers Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go historyRecoveryDigest E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go installFloorHook D linux:internal/host/systemapply.go:RunSystemApply Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go PublishHeld C+E1 root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/local_unix.go tryAcquireNamed D linux:internal/hostexec/local_unix.go:tryAcquire root-input
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease.go newHeldReleaseRequestID C+E1 linux:internal/host/movesheldrelease.go:heldReleaseVia.request root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.readCensus D linux:internal/rootparticipation/ledger.go:Ledger.Census Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/rootstate/live_linux.go directory.HoldLive A+D linux:internal/rootstate/live.go:HoldLive fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
plan14_input_inventory_test.go:379: J4 internal/release/updatetarget.go Target E3 linux:internal/release/adopt.go:settingsTarget root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootroute.go proofBindingSource.needsRestart B3 linux:internal/host/rootrestart.go:productionRootRestartChecks Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch.
plan14_input_inventory_test.go:379: J4 internal/host/bootstrap.go const tmpfilesConf A+C+G linux:internal/host/bootstrap.go:bootstrapWith root-input;kept=A,C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go ProductionClaimOwnerProvider.OpenClaimOwners C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly Production owner factory wires bounded C8 and relocation providers and closes partial construction on error.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_other.go Open A darwin:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease root-input
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go JournalService.executeWithInventory C linux:internal/hostbox/journalservice.go:JournalService.ExecuteRootInventory Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt.
plan14_input_inventory_test.go:379: J4 internal/hostguard/record_unix.go recordDir.read C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/instancectl/peer_tuple_linux.go AuthenticatePeerTuple C+G linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback.go captureRollback B3+E1 linux:internal/host/roothistory_recovery.go:linkRootHistory Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/host/legacyrestart.go legacySettleOptions B3 linux:internal/host/legacyrestart.go:legacyRollbackRestart rev3=merge-ruling-4;basis=Legacy settle uses main readiness inputs and limits; these do not authorize root health history.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go JournalService.Replay C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending root-input
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.replayed C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_run.go RunInstanceControl C+D+G linux:main.go:main Refuse premature claim activation and continue serving recovery after per-host startup failures.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go StageHeldVerifiedWithPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.stageRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/agent.go agentCheckedUnitRestart B3 linux:internal/host/agent.go:adoptLoop kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBindingSource.recovered B3+E1 linux:internal/host/rootrestart.go:productionRootRestartChecks Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/activator/rolelaunch_root_linux.go RoleLaunch.startIsolated C linux:internal/activator/rolelaunch_linux.go:RoleLaunch.Start root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/activator/backend_exec.go ExecBackend.spawnInCgroupGated E2 linux:internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:379: J4 internal/host/restart.go restartApps E1+E3 linux:internal/host/restart.go:restartPass root-route
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go rootRestartChecks.retainRecoveryHistory E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.mintRefusals Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_readback.go type historyReadbackPublisher E1 linux:internal/host/roothistory_readback.go:publishRootHistoryReadback Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go type movesHeldReleaseRoot E2 linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go LaunchJournal.Read C linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution root-input
plan14_input_inventory_test.go:379: J4 internal/host/agent.go runAdoptUnderRootRelease B3+E1+E2 linux:internal/host/agent.go:runAdoptWithEnsureSystemUnits E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus. E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go restartRequestPass E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/hostguard/root.go type InstallationArtifacts E2 linux:internal/hostguard/root.go:type RootInstallation E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.heldRoute E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.skipRoutes root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/roleintention_linux.go LaunchJournal.ResolveRoleIntentions C linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.resolveRoleIntentions root-input
plan14_input_inventory_test.go:379: J4 internal/host/movesstage.go heldReleaseProbeRelease C+E1 linux:internal/host/moveswakesource.go:movesWakeSources.Open root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go PinAfterRelease C linux:internal/hostrelocate/worker.go:Worker.Step Pin transition verifies source release authority and exact journal phase before removing execution authority.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests_source.go type rootRestartRequestSource E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go JournalService.MigrateLegacy C linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_recovery_policy.go RootHistory.RetireD1 E1 linux:internal/release/adopt.go:adoptHost E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_refresh.go rootRefreshAndJudgeMovesPrev F linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return
plan14_input_inventory_test.go:379: J4 internal/hostexec/controller.go ClearStale D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go Disk.Load F linux:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:379: J4 internal/release/pins.go SettingsRefs E2 linux:internal/release/pins.go:BoxPins root-route
plan14_input_inventory_test.go:379: J4 internal/host/relocationwake.go RelocationWakeInputs.Select C linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly Relocation wake binds prepared generation, release receipt and install stamp before admission; launch payload selection remains legacy.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go JournalService.Execute C linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedretire.go writeJournal C linux:internal/hostbox/typedretire.go:TypedRetirement.Run root-input
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go adoptHost B3+E1+E2+E3+E4 linux:internal/release/adopt.go:PassFilter E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.BeginUpdate D linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/host/claimstop_kernel_linux.go stopIdentity C+G linux:internal/host/claimstop_kernel_linux.go:scanStopCgroupsMode root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/reconcile.go Reconciler.completedHold C linux:internal/hostbox/reconcile.go:Reconciler.checkOn Completed relocation catch-up can hold only its recorded old source row and creates no installation authority.
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery_pass.go namedUnitRecovery.passOption B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Production recovery wrapper preserves main exit status for per-host failures; only remaining named routes can probe the census for history selection. Ordinary routes make no census or binding-store reads. Fixtures: TestPlan14ERecoveryOrdinaryPass, TestPlan14Fix4AdoptPerHostFailureExitsZero, TestPlan14Fix5MainEquivalence.
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go claimServingLaunchSource C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rollout/failures.go FailureBook.recordLocked E1+E3 linux:internal/rollout/failures.go:FailureBook.reconcileLocked fix1-merge-review;basis=Marks restriction state dirty and advances its generation before publication.
plan14_input_inventory_test.go:379: J4 internal/hostguard/guard.go Guard.readLocked C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences Read-only access takes only the root host lock.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/completion.go ReadReconstruction E1 linux:internal/historyreadback/workflow.go:Operation.Read Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_creation.go rootHistoryInstallation E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_requirements.go ClaimRootHTTP.verifyInventoryTimers E2 linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/instancectl/claimunit.go ClaimUnits.cgroupEmpty C+G linux:internal/instancectl/claimunit.go:ClaimUnits.Gone root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go Disk.WithParticipation D linux:internal/hostfloor/disk.go:Disk.Begin Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go RootGenerations.Started E2 linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.started E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationMajor E2 E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go withEffectiveMovesFloorLock F linux:internal/host/systemapply.go:systemApplier.activationGuard rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=locks moves then seeds private root stores across final activation; no census uses unchanged legacy lock
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go rootRefreshAndJudgeSeedsPrev F linux:internal/host/movesfloor.go:rootJudgePrevWithSource rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path
plan14_input_inventory_test.go:379: J4 internal/release/updatetarget.go NextConsumed E3 linux:internal/release/adopt.go:settingsTarget Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy.
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_production.go WithProductionMovesHeldRelease B2+C+E1+E2 linux:internal/host/claimstop_run.go:RunInstanceControl Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go type generationRetirement E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go generationRetirement.closure E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_rows.go generationRegistryInventory E2 linux:internal/host/rootgeneration_rows.go:productionGenerationRegistryInventory E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchhosts.go LaunchJournal.HostLaunches C linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.Begin E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go readEffectiveMovesFloor F linux:internal/host/systemapply.go:systemApplier.activationRule rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go restartScopePass E1+E3 linux:internal/host/restart.go:restartRequestLeg fix1-merge-review;basis=Hands historical signed retry entries to the common verifier; unknown selectors do not widen scope.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_retirement.go productionRetireGenerations E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/movesfinal.go sourceFinal.parkLocal C linux:internal/host/movesfinal.go:sourceFinal.run root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go publishHeld C+E1 linux:internal/release/materializeheld.go:materializeHeld root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesstage.go heldReleasePublished C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go rootJudgePrev F linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt combines moves and seeds verdict errors; both root ratchets implemented; R6 safety corrections pending
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_inventory.go productionGenerationInventory E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/host/claimrelocation.go openClaimRelocationOwners C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Relocation owner constructor receives existing serving sources and verified identity inside feature gate.
plan14_input_inventory_test.go:379: J4 internal/host/guardroster.go readGuardRoster F linux:internal/host/guardarm.go:RunSystemGuardArm root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go systemApplier.checkGuardRecovery D linux:internal/host/systemapply.go:systemApplier.Run Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_reconstruct.go RootHistory.resumeReconstruction E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go generationLaunchPermit.started E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/restartscope.go scopedHosts E1+E3 linux:internal/host/restartscope.go:bounceScopedRoutes root-route
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/worker.go Worker.self C+D linux:internal/hostrelocate/worker.go:Worker.ConvertLanding Worker identity requires current active directory enrollment, home-region match and termination-fence check.
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalmigration_linux.go legacyJournalFiles C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootread.go ReadRoot D linux:internal/host/rootexecution_read.go:readRootExecution fix1;basis=Queries broker OFD lock ownership without acquiring a lock; rechecks unchanged durable evidence and monotonic expiry.
plan14_input_inventory_test.go:379: J4 internal/host/roothistory_creation.go type rootHistoryAccess E1 linux:internal/host/claimretire_transport.go:type ClaimRootHTTP E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_requirements.go type generationRecord E2 linux:internal/host/rootgeneration_inventory.go:type generationInventory E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/proofobserve.go productionProofObserver B3+B4 linux:internal/host/agent.go:runAdoptUnderRootRelease Reuse per-pass record discovery; continue independent observation and root health writes.
plan14_input_inventory_test.go:379: J4 internal/host/movesfiles.go relocationPreparedManifest C linux:internal/host/movesfiles.go:movesFiles.preparedBinding Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_requirements.go inventoryTimerNames E2 linux:internal/host/rootgeneration_requirements.go:generationRequiredInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/release/pins.go GenerationVersions E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_other.go productionGenerationAbsence E2 darwin:internal/host/rootgeneration_retirement.go:productionRetireGenerations E21: non-Linux production generation retirement refuses. Darwin, Windows and Linux ARM64 compile gates; no non-Linux retirement authority.
plan14_input_inventory_test.go:379: J4 internal/hostbox/regionalworker.go RegionalWorker.runHost C linux:internal/hostbox/regionalworker.go:RegionalWorker.Run root-input
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.read D linux:internal/hostexec/rootbroker.go:RootBroker.Recover D1/D2 decode the retained root participation record; missing or malformed state grants nothing.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go RootHistoryPass.CompleteAttempt B3+E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go Disk.Begin D linux:internal/host/guardtransaction.go:systemApplier.beginGuard Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/instancectl/server.go runWithClaim C+D+G linux:internal/instancectl/claim.go:RunWithClaim Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration_linux.go var claimSystemctl C+G linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesheldrelease_root.go publishVersion C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/proofgate.go ProofGate.hold B3 linux:internal/release/proofgate.go:ProofGate.admit root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.Acquire D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion.
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofBindingSource.findRecord B3 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover rev3=merge-ruling-5;basis=Cache index success or failure once per pass; selected records and ETags remain freshly read.
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RestartBinding E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go const RootGenerationsDir E2 linux:internal/host/rootgenerations_launch.go:productionRootGenerations E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/claimroleassembly_linux.go ClaimRoleAssembly.PrepareState C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/hostbox/restore.go syncDir C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_startup.go var openRootMigrationParticipation G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=fixed production participation opener remains rootparticipation.OpenForUpdate; package tests substitute explicit no-census fixtures without accessing the machine store
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.armFloor F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go readBeneathLine F linux:internal/host/movesfloor.go:syncLocalFloor root-input
plan14_input_inventory_test.go:379: J4 internal/host/versionsweep.go settingsPins E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-route
plan14_input_inventory_test.go:379: J4 internal/hostbox/journalservice.go JournalService.read C linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory root-input
plan14_input_inventory_test.go:379: J4 internal/hostfloor/report.go Disk.Running F linux:internal/host/claimreport.go:claimReport root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/record_unix.go recordDir.writeUsing C linux:internal/hostguard/record_unix.go:recordDir.write root-input
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go CompleteRelocation C linux:internal/hostrelocate/worker.go:Worker.Step Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.After C+G linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_client.go productionClaimLocal.prepareWith D linux:internal/host/claimparticipation.go:productionClaimLocal.Prepare Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority.
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_settle.go ClaimRootHTTP.settleExecution D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_delivery.go HistoryRecoveryRetirementKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerations_launch.go productionRootGenerations E2 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_execpermit.go ClaimLaunchRoot.execPermit D linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.controllerGone E2 linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/host/claimrecovery_remote.go claimCrossBoxHandover.installRecoveryRemote C linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root installation and fence authority; recovery rebind and timer identity
plan14_input_inventory_test.go:379: J4 internal/host/rootexecution_runtime.go newClaimExecutionRuntime D linux:internal/host/claimassembly.go:NewProductionRootClaimStop Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility.
plan14_input_inventory_test.go:379: J4 internal/rootstate/authorityfile_other.go OpenAuthorityFile E2 darwin:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:379: J4 internal/registry/registry.go normalizeRoute E3 linux:internal/registry/registry.go:Registry.Upsert rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever Upsert's SQLite arm and the import swap run: the insert defaults from Registry.Upsert's body; E3, the same family as Registry.Upsert, whose body they came from
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_pass.go RootHistoryPass.selectRoute E1 linux:internal/release/adopt.go:PassFilter E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_creation.go RootHistory.RecordCreation E1 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests.go type rootRestartRequests E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/hostbox/stopinventory_db.go StopInventoryDB.ReadExactStopInventory C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart_requests_source.go rootRestartRequestSource.inventory E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerations.go type GenerationBinding E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_parked.go generationRetirements E2 linux:internal/host/rootgeneration_parked.go:generationPhysicalPayloads E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go LaunchJournal.mutate C linux:internal/hostbox/rolelaunch.go:LaunchJournal.CloseWriters root-input
plan14_input_inventory_test.go:379: J4 internal/host/units/carlos-instance-control.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rollout/failures.go newBookID E1+E3 linux:internal/rollout/failures.go:OpenFailureBook fix1-merge-review;basis=Uses the named entropy source and propagates failure; retains authority classification despite no scanner-recognized direct read.
plan14_input_inventory_test.go:379: J4 internal/host/claimowners.go claimServingOwners.launch C+G linux:internal/host/claimowners.go:claimServingOwners.Select root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventoryscope.go ReconcileAdapter.retirementRoute C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-route
plan14_input_inventory_test.go:379: J4 internal/hostexec/controller.go Open D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith root-input
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go type RestartSnapshot E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_authority.go ClaimLaunchRoot.authorize D linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_reconstruct.go RootHistory.reconstructionState E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.reconstructionReady E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:379: J4 internal/release/healthy_root.go readRootHealthy B+B4 linux:internal/release/healthy.go:ReadHealthy root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizeReconstruction F rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller
plan14_input_inventory_test.go:379: J4 internal/host/rootseedsfloor.go rootSeedsFloorDir F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=selects fixed seeds namespace separate from moves retained floor
plan14_input_inventory_test.go:379: J4 internal/host/agent.go fastConvergeLoop B3 linux:internal/host/agent.go:runAgent rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained
plan14_input_inventory_test.go:379: J4 internal/release/healthy_root.go addRootHealthy B+B4 linux:internal/release/healthy_root.go:recordRootHealthy root-input
plan14_input_inventory_test.go:379: J4 internal/host/rootroute.go rootRecordRoute B3 linux:internal/host/rootroute.go:proofBindingSource.needsRestart trusted deployment record and root unit binding; durable per-attempt rollback and recovery
plan14_input_inventory_test.go:379: J4 internal/host/proofnamed.go proofExecPath B3 linux:internal/host/proofobserve.go:proofObserver.observe fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
plan14_input_inventory_test.go:379: J4 internal/host/seedsfloor.go judgeSeedsPrev F linux:internal/host/systemapply.go:systemApplier.notePrev rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) through notePrev, and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root) through rootJudgeSeedsPrev: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.afterRecovery C+G linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootrollback.go loadRollback B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/production.go OpenForUpdate D linux:internal/host/rootmovesfloor_source.go:rootMovesFloorIdentity Unactivated absent census does not block update or recovery; retained census remains authoritative.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go StartRelocation C Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy.
plan14_input_inventory_test.go:379: J4 internal/host/agent.go makeStartRoute B3 linux:internal/host/agent.go:adoptLoop root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go directory.Write A+F+G linux:internal/hostexec/rootbroker.go:RootBroker.deny rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=delegates to shared validated durable-write implementation; production syscall behavior unchanged
plan14_input_inventory_test.go:379: J4 internal/historyreadback/workflow.go Operation.Read E1 linux:history_cli.go:historyCommandWithSave E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go type passConfig E2 linux:internal/release/adopt.go:BakeDir E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:379: J4 internal/host/bootstrap.go bootstrapWith A+C+G linux:internal/host/bootstrap.go:RunBootstrap root-input;kept=A,C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.recoveryEvidence C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_other.go migrateRootClaimAuthority G darwin:internal/host/claimjournal_migration.go:migrateClaimJournalsWith rev3=PROPOSED-p3;identity=non-Linux offline journal-migrate CLI;basis=unsupported-platform stub returns ErrUnsupported without reading or granting migration authority
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootmigration.go migrationAdmissionDenied G linux:internal/hostguard/root.go:Guard.CommitRootInventoryArtifacts rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go systemApplier.guardRun F linux:internal/host/systemapply.go:systemApplier.onDiskBuild rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request
plan14_input_inventory_test.go:379: J4 internal/host/relocationeffects.go RelocationEffects.EnsureLocal C linux:internal/hostrelocate/participant.go:Participant.Step Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization.
plan14_input_inventory_test.go:379: J4 internal/historyreadback/readback.go validStatus E1 linux:internal/historyreadback/readback.go:ReadStatus Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go stageGenerationSibling E2 linux:internal/release/adopt.go:backfillManifestDigest E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go restartOrdinaryUnit B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-4;basis=No-census derived-unit try-restart is unconditional and nonfatal, matching main for absent rows and systemd lookup failures.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_requirements.go generationRetainedTimers E2 linux:internal/host/rootgeneration_rows.go:generationRegistryInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_migration_linux.go quiesceLegacyClaimJournals C+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor.go withMovesFields F linux:internal/host/edgesfile.go:edgesFileLoop rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent uses root-owned public projection when participating and its original writable mirror otherwise
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go productionSysOps D+F linux:internal/host/agent.go:runAdopt root-input;kept=D,F;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/buildstate.go buildStates.heldTarget E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go claimInputPolicy C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.pointerLoop E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Delegates each iteration to pass; retains ownership of the retry/restriction authority path despite no direct read.
plan14_input_inventory_test.go:379: J4 internal/host/proofbinding.go proofBinding.authorizedRecovery B3+E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/materializeheld.go ServeHeldStageRequestsWithPins E2 linux:internal/host/heldstage.go:heldStagePass E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:379: J4 internal/host/movesinstall.go installRun.configured C+E1 linux:internal/host/movesinstall.go:installGeneration Configured landing now validates root-created registration before render and held publication; source recovery keeps existing typed rebind.
plan14_input_inventory_test.go:379: J4 internal/release/proofpolicy.go LoadProofPolicy B3 linux:internal/host/proofask.go:mintAsker.tick root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.registerRemote C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/hostguard/rootmigration.go RootAuthority.RetainMigrationDeny C+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority
plan14_input_inventory_test.go:379: J4 internal/host/claim_evidence_producer.go ConfigureStopEvidence C+G linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/rootparticipation/ledger.go Ledger.Census D linux:internal/rootparticipation/production.go:ActivationReady Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:379: J4 internal/host/guardtransaction.go systemApplier.beginGuard D linux:internal/host/systemapply.go:systemApplier.Run Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:379: J4 internal/host/agent.go agentRollbackUnitRestart B3 linux:internal/host/agent.go:adoptLoop kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
plan14_input_inventory_test.go:379: J4 internal/host/rootrestart.go checkedUnitRestart B3+E1 linux:internal/host/rootrestart.go:rootRestartRouteWith Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:379: J4 internal/rootstate/state_linux.go directory.Remove A+B3 linux:internal/host/rootrollback.go:captureRollback descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationPathRef E2 linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 internal/console/seedfloor.go Server.seedRegionReady F rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness
plan14_input_inventory_test.go:379: J4 internal/hostbox/rolelaunch.go LaunchJournal.UnitIntentions C linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input
plan14_input_inventory_test.go:379: J4 internal/host/relocationinstall.go ClaimAssembly.relocationReceipt C linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects Local-install receipt reader refuses malformed operation materialization; claim receipt digest is checked by its consumers.
plan14_input_inventory_test.go:379: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckHeld C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install Hold-only source checks its own row-owned installation inventory rather than the target holder stamp.
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery.go namedUnitRecovery.repair E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/claimwakestop.go ClaimAssembly.stopRetryAttempt C+G linux:internal/host/claimwakestop.go:ClaimAssembly.bindClaimWakeStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.restoreFiles F linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded rev3=PROPOSED-p3;identity=carlos adopt/system apply uid 0; system recovery and guard selectors uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize
plan14_input_inventory_test.go:379: J4 internal/hostbox/journaltrust_linux.go readTrustedJournalDir C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover root-input
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go backfillManifest E2 linux:internal/release/adopt.go:backfillManifestDigest E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/hostrelocate/worker.go Worker.Start C+D Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy.
plan14_input_inventory_test.go:379: J4 internal/host/claimstate_linux.go claimPrivatePathOwner C+G linux:internal/host/claimstate_linux.go:prepareClaimStateDirectory root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go repairSibling E2 linux:internal/release/adopt.go:stageFrom E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:379: J4 internal/host/relocationowners.go RelocationSource.Open C+D linux:internal/host/claimrelocation.go:openClaimRelocationOwners Relocation owner wiring binds verified actor, C8 provider and identity-checked requests; admission remains typed.
plan14_input_inventory_test.go:379: J4 internal/host/movesland.go landingRun.checking C linux:internal/host/movesland.go:landingRun.step Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple.
plan14_input_inventory_test.go:379: J4 internal/rollout/failures.go var randRead E1+E3 linux:internal/rollout/failures.go:newBookID fix1-merge-review;basis=Names the cryptographic entropy source for failure-book identity; remains retry replay authority.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go readRootLegacyProtocolJSON F linux:internal/host/rootmovesfloor_source.go:rootProtocolLegacy rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance
plan14_input_inventory_test.go:379: J4 internal/host/movesstage.go heldReleaseReady C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/movesstage.go writeHeldStageRequest C+E1 linux:internal/host/movesstage.go:heldReleaseReady root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostfloor/disk.go Durable F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:379: J4 internal/hostguard/writerstop.go operationWriter C linux:internal/hostguard/writerstop.go:LandingWriter root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimready_linux.go claimProbePeer B3 linux:internal/host/claimready_linux.go:claimProbeSocketReady root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 history_cli.go historySync E1 linux:history_cli.go:historySave E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor.go rootMovesFloors.selector F linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny
plan14_input_inventory_test.go:379: J4 internal/host/claimretire_local.go claimArtifactRetirement.Recover C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootmovesfloor_source.go readRootProtocolProjection F linux:internal/host/rootmovesfloor_source.go:readRootFloorProjection rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance
plan14_input_inventory_test.go:379: J4 internal/host/claimparticipation_stale.go productionClaimLocal.clearUntracked D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith Untracked participation cleanup now carries exact controller binding into retirement before stale-state clearing.
plan14_input_inventory_test.go:379: J4 internal/hostbox/launchjournal.go LaunchJournal.Prelaunch C linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Prelaunch root-input
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go PassFilter B3+E1+E2+E3 linux:internal/release/adopt.go:Pass Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
plan14_input_inventory_test.go:379: J4 internal/rootstate/file_linux.go OpenTrustedFile A+B3 linux:internal/host/rootgenerations_launch.go:productionRootGenerations kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationcompleteness.go RootGenerations.Certify E2 linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/host/agent.go runAgent B+C+D+F linux:internal/host/agent.go:RunAgent rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained
plan14_input_inventory_test.go:379: J4 internal/hostbox/typedpark_linux.go TypedParker.Park C linux:internal/hostbox/typedretire.go:TypedRetirement.Run root-input
plan14_input_inventory_test.go:379: J4 internal/host/namedrecovery.go namedUnitRecovery.checkHistory E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.verifyPointer F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists
plan14_input_inventory_test.go:379: J4 internal/host/claimproduction.go claimAdminTokens.With C+G linux:internal/host/claimproduction.go:claimServingLaunchSource root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:379: J4 internal/release/refusal.go ReadRefusal E1+E3 linux:internal/host/buildstate.go:buildStates.heldWakeInput root-input
plan14_input_inventory_test.go:379: J4 internal/host/recoveryrefusals.go recoveryHistoryOutcome E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go validHistoryRetirement E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:379: J4 internal/host/rootgenerationpins.go productionRootGenerationPins E2 linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:379: J4 internal/hostbox/generationpayload.go type GenerationPayload E2 linux:internal/host/rootgeneration_inventory.go:generationPayloadBindings E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
plan14_input_inventory_test.go:379: J4 internal/host/systemapply.go systemApplier.restoreVersion F linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census
plan14_input_inventory_test.go:379: J4 internal/host/claimjournal_containment_linux.go inspectClaimContainment C+G linux:internal/host/claimjournal_containment_linux.go:var claimContainmentInspect root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/hostexec/rootbroker.go RootBroker.acquire D linux:internal/hostexec/rootbroker.go:RootBroker.Execute Retry conditional writes and authority reads within original monotonic cutoff; reconcile uncertain writes by exact bytes.
plan14_input_inventory_test.go:379: J4 internal/host/rootgeneration_kernel_linux.go generationMaps E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:379: J4 proof_cli.go runProof E1 linux:main.go:main E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_install.go landingRegistrationMatches C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session.
plan14_input_inventory_test.go:379: J4 internal/host/claimmovefence.go claimBoxFenceVerifier C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/host/rootinventory_state_linux.go ClaimRoleAssembly.prepareStateInventory C linux:internal/host/rootinventory_state_linux.go:ClaimRoleAssembly.prepareStateRemote root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:379: J4 internal/release/roothistory.go RootHistory.Blocks E1 linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:379: J4 internal/host/claimlaunch_root.go type ClaimLaunchRoot E1+E2 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:379: J4 internal/hostbox/registryrows.go RegistryRows.RetireRowsJournal C linux:internal/hostbox/typedretire.go:TypedRetirement.Run root-route
plan14_input_inventory_test.go:379: J4 internal/host/rolloutdeclined.go failureHolds.pass E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.pointerLoop fix1-merge-review;basis=Saves the failure book before processing pointer retries; preserves signed retry and restriction checks.
plan14_input_inventory_test.go:379: J4 internal/host/movesfloor_linux.go movesDir.names F linux:internal/host/movesfloor_linux.go:movesDir.lockNamed root-input
plan14_input_inventory_test.go:379: J4 internal/host/claimconstruction.go OpenProductionClaimAssembly G linux:internal/host/claimconstruction.go:ensureProductionClaimAssembly rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path
plan14_input_inventory_test.go:379: J4 internal/release/rootrestart_history.go RootRestarts.read E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/rootgenerationpins.go type RootGenerationPins E2 linux:internal/host/rootgenerationpins.go:generationPinSource.StagedPins E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:379: J4 internal/hostclaim/relocation.go JournalRelease C linux:internal/hostrelocate/participant.go:Participant.Step Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy.
plan14_input_inventory_test.go:379: J4 internal/hostops/move_fence_release.go MoveRecoveryGrant.ReleaseFencedTarget C+D Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation.
plan14_input_inventory_test.go:379: J4 internal/host/movespass.go movesWorker.hostBlocked C linux:internal/host/movesfinal.go:movesWorker.sweepFinalJournals root-input;kept=C;scope=protected-decision-only
plan14_input_inventory_test.go:379: J4 internal/release/roothistory_retirement.go RootHistory.recoveryRetired E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:379: J4 internal/release/adopt.go WithRunningVersion B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=fix3-Astra-P2;basis=Root-only hook supplies verified current or previous running authority before replacing pointers.
plan14_input_inventory_test.go:379: J4 internal/host/rootmigration_production_linux.go publishMigrationReceipt G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reconstructs immutable key/digest from original signed receipt bytes without changing evidence time
plan14_input_inventory_test.go:386: family B missing erasure fixture
plan14_input_inventory_test.go:386: family B2 missing erasure fixture
plan14_input_inventory_test.go:386: family B3 missing erasure fixture
plan14_input_inventory_test.go:386: family B4 missing erasure fixture
plan14_input_inventory_test.go:386: family D missing hostile fixture
plan14_input_inventory_test.go:386: family E3 missing erasure fixture
plan14_input_inventory_test.go:386: family E3 missing hostile fixture
plan14_input_inventory_test.go:386: family E3 missing positive fixture
plan14_input_inventory_test.go:386: family E3 missing rename fixture
plan14_input_inventory_test.go:386: family E3 missing retry fixture
plan14_input_inventory_test.go:386: family E4 missing erasure fixture
plan14_input_inventory_test.go:386: family E4 missing hostile fixture
plan14_input_inventory_test.go:386: family E4 missing positive fixture
plan14_input_inventory_test.go:386: family E4 missing rename fixture
plan14_input_inventory_test.go:386: family E4 missing retry fixture
plan14_input_inventory_test.go:386: internal/activator/rolelaunch_linux.go:RoleLaunch.prepareRoleReservation: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:Server.handleAPIRestartScope: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:environmentNames: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:hostNames: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:resolveRestartScope: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:restartRouteRows: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/apirestartscope.go:routeWithHost: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/boxselect.go:Server.selectMoveBoxes: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/browserrestart.go:Server.handleBrowserRestart: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/console/seedfloor.go:Server.seedRegionReady: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/historyreadback/readback.go:RequestStatus: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/claimjournal_migration.go:migrateClaimJournals: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/claimstate_linux.go:prepareClaimDatabaseOwner: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/movesfloor.go:rootJudgeMovesPrev: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/proofnamed.go:proofBindingSource.capturedVersion: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/proofnamed.go:proofBindingSource.installedConsoleVersion: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/proofobserve.go:recordSettled: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootgeneration_kernel_linux.go:generationMajor: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootgeneration_kernel_linux.go:generationMinor: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootmovesfloor.go:rootMovesFloors.reconstruct: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizeReconstruction: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizedReconstruction: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootmovesfloor_source.go:readRootLegacyFloorJSON: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/host/rootrestart.go:rootRestartRoute: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostbox/hold.go:ChangeHold: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostbox/migration_census_other.go:CheckMigrationRoots: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostbox/stopinventory_db.go:OpenStopInventoryDB: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostclaim/relocation.go:StartRelocation: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostfloor/participation.go:CheckParticipation: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostguard/root.go:Guard.CommitRootInventory: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostops/completion_fence.go:ProductionAuthority.completionFence: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostops/move_fence_release.go:MoveRecoveryGrant.ReleaseFencedTarget: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostops/production_delete.go:ProductionAuthority.StartDeleteClaim: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostrelocate/participant.go:Participant.Sweep: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/hostrelocate/worker.go:Worker.Start: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/release/materializeheld.go:PublishHeld: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/release/materializeheld.go:ServeHeldStageRequests: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/release/materializeheld.go:StageHeld: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/release/roothistory_delivery.go:PublishHistoryReconstruction: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/release/roothistory_delivery.go:PublishHistoryRecoveryRetirement: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:386: internal/rootparticipation/ledger.go:Ledger.EndUpdate: no production caller reachable from root entrypoint
plan14_input_inventory_test.go:390: authority coverage: 12442 reachable declarations; 817 failures
2026/10/15 16:38:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 16:38:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/15 16:38:47 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/15 16:38:47 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/15 16:38:47 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io hibernate false -> true
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io status-named false -> true
2026/10/15 16:38:47 provision: converged acme.go.tito.io status-named true -> false
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 16:38:47 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 16:38:47 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 16:38:47 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 16:38:47 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/15 16:38:47 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/15 16:38:47 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 16:38:47 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 16:38:47 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 16:38:47 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:47 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 16:38:47 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/15 16:38:47 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/15 16:38:47 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 16:38:47 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 16:38:47 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 16:38:47 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/15 16:38:47 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 16:38:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 16:38:47 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 16:38:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 16:38:47 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 16:38:47 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 16:38:47 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 16:38:47 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/15 16:38:47 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 16:38:47 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/15 16:38:47 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 16:38:47 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 16:38:47 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/15 16:38:47 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/15 16:38:47 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/15 16:38:47 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/15 16:38:47 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/15 16:38:47 provision: dry-run: would converge owned.go.tito.io seed
2026/10/15 16:38:47 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 16:38:47 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/15 16:38:47 provision: converged owned.go.tito.io channel stable -> edge
2026/10/15 16:38:47 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/15 16:38:47 provision: converged owned.go.tito.io hibernate false -> true
2026/10/15 16:38:47 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/15 16:38:47 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/15 16:38:47 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: removed retired static route site.go.tito.io (record gone)
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/15 16:38:47 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/15 16:38:47 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/15 16:38:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:47 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:48 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 16:38:48 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 16:38:48 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 16:38:48 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 16:38:48 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 16:38:48 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/15 16:38:48 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 16:38:48 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 16:38:48 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 16:38:48 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 16:38:48 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/15 16:38:48 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/15 16:38:48 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 16:38:48 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/15 16:38:48 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/15 16:38:48 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 16:38:48 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/15 16:38:48 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 16:38:48 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:48 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/15 16:38:48 provision: a.shop.example.com: swapped for import sd_a5euataxopuojkjdw5bjfjdk3u (the original route is journaled)
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_a5euataxopuojkjdw5bjfjdk3u committed: its gate is cleared and its journal row dropped
2026/10/15 16:38:48 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_ksfgtp2lfzcvp3etevghkv6nta rolled back to its original route
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_ksfgtp2lfzcvp3etevghkv6nta: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_ksfgtp2lfzcvp3etevghkv6nta is cleaned up and its journal row retired
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_j2fnwcmgdde24pcsxmltrfzfwq rolled back to its original route
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_j2fnwcmgdde24pcsxmltrfzfwq: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_j2fnwcmgdde24pcsxmltrfzfwq is cleaned up and its journal row retired
2026/10/15 16:38:48 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_tdtc3zymilsflrrwiwax7euoyu
2026/10/15 16:38:48 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/15 16:38:48 provision: dry-run: would converge a.shop.example.com seed source
2026/10/15 16:38:48 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:48 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/15 16:38:48 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/15 16:38:48 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_h7zqfppoaqvzvr5mcoshq3v7gy cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_4ydsuwzfpj2ca74f4xz6uvfdxm cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_v7o6uiivixfibps2ccwlxibzvm is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_fmacac5dgr5oejgt6h3azmckee is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_ctk2hygcvsa4t5t2dopntigdwa is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 16:38:48 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/15 16:38:48 provision: b.shop.example.com: import sd_wdnykiuybrwijof4e554nwxziq left alone this pass: the import journal could not be read
2026/10/15 16:38:48 provision: c.shop.example.com: import sd_zmmvekb6vfe5ingeb7q3ppqqjm left alone this pass: the import journal could not be read
2026/10/15 16:38:48 provision: a.shop.example.com: import sd_tngyfbd5zrldejpsgjisck5vva committed: its gate is cleared and its journal row dropped
2026/10/15 16:38:48 provision: a.shop.example.com: not converging import sd_sbwd6gpcg3we5vfdssxs42s4ki: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 16:38:48 provision: a.shop.example.com: not converging import sd_vy4uaq2cms5sg5mnh7wurw6jha: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 16:38:48 provision: a.shop.example.com: not converging import sd_kf7wybl2hjidyxq2fiqnxrpgde: it is placed but not committed, and the row on this box has no import gate
2026/10/15 16:38:48 provision: a.shop.example.com: not converging import sd_zahz43m2hbw6fgx2ve4oqexuq4: it is placed but not committed, and the row on this box has no import gate
2026/10/15 16:38:48 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:48 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/15 16:38:48 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_srw26k4r7f3wgxj4tqg3kbvfhy committed: its gate is cleared and its journal row dropped
2026/10/15 16:38:49 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:49 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:49 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/15 16:38:49 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_cs7lmkf5psso5acuel5fj4bsse: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_cs7lmkf5psso5acuel5fj4bsse rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/15 16:38:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:49 provision: removed instance route acme.go.tito.io (its seed sd_nx42c6rhpbbwromcethojwakeq was aborted); the next pass rolls it back
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_nx42c6rhpbbwromcethojwakeq: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_nx42c6rhpbbwromcethojwakeq rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_gcje54e766qafk3nl3hnmykl2u has a row this pass may not remove; leaving the seed aborted
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_heolqwnnkgmxf2m3iy6jnlewcy rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:49 provision: removed instance route acme.go.tito.io (its seed sd_lvosh73rq7zrnxrwkt2kblvzu4 was aborted); the next pass rolls it back
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_lvosh73rq7zrnxrwkt2kblvzu4 has no route on this box: its local data is removed
2026/10/15 16:38:49 provision: acme.go.tito.io: aborted seed sd_lvosh73rq7zrnxrwkt2kblvzu4 rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_tatgchftnpynhj2q3ouivzxhfi (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_tatgchftnpynhj2q3ouivzxhfi rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_tatgchftnpynhj2q3ouivzxhfi is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_b7tzyhz6yfv4lbvobabbmyliye (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_b7tzyhz6yfv4lbvobabbmyliye rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_b7tzyhz6yfv4lbvobabbmyliye is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_che2e2np7g652wssjulqtmzcvq (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_che2e2np7g652wssjulqtmzcvq rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_che2e2np7g652wssjulqtmzcvq: the host's replica is left alone: its record no longer names this seed
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_che2e2np7g652wssjulqtmzcvq is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_ca53tplyjfxkem2vzxvh5uxekm (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ca53tplyjfxkem2vzxvh5uxekm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ca53tplyjfxkem2vzxvh5uxekm rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ca53tplyjfxkem2vzxvh5uxekm is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_inotquj2rjwtn65wym6oaj4a3m (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_inotquj2rjwtn65wym6oaj4a3m rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_n3ef57dvc7saod4fj5bspxgw44 (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_n3ef57dvc7saod4fj5bspxgw44 is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_pefzw5fk7fa6t7pxkvkgclkhfy (the original route is journaled)
2026/10/15 16:38:49 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_pefzw5fk7fa6t7pxkvkgclkhfy left alone this pass: its record could not be read
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_zfnpb26en3xfefo5lpzzaggxuu (the original route is journaled)
2026/10/15 16:38:49 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_zfnpb26en3xfefo5lpzzaggxuu left alone this pass: its record could not be read
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_x426lg2tflogkuil6qgvvqn3hi (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_x426lg2tflogkuil6qgvvqn3hi: close the import gate: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_x426lg2tflogkuil6qgvvqn3hi rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_x426lg2tflogkuil6qgvvqn3hi is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_qfkcd3qrzxciz3r5axg3jcvcry (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_qfkcd3qrzxciz3r5axg3jcvcry: close the import gate: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_qfkcd3qrzxciz3r5axg3jcvcry rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_qfkcd3qrzxciz3r5axg3jcvcry is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_wkfehesc7lsosbg6zkcbozdg24 (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_wkfehesc7lsosbg6zkcbozdg24 rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_wkfehesc7lsosbg6zkcbozdg24 rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_wkfehesc7lsosbg6zkcbozdg24 is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_jjrdgmdogoo3xg5pvguwutugui (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_jjrdgmdogoo3xg5pvguwutugui rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_jjrdgmdogoo3xg5pvguwutugui is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_xym7b627zypcfdf5p73ztjswxu (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xym7b627zypcfdf5p73ztjswxu: retire its instance key: injected failure at retire-key
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xym7b627zypcfdf5p73ztjswxu rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xym7b627zypcfdf5p73ztjswxu is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_wzmrns6r7gmycte6s675rf5n6e (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_wzmrns6r7gmycte6s675rf5n6e rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_wzmrns6r7gmycte6s675rf5n6e is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_j557xxv6g6lmshsq4pitiy7xqa (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_j557xxv6g6lmshsq4pitiy7xqa: remove its local data: injected failure at remove-local
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_j557xxv6g6lmshsq4pitiy7xqa rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_j557xxv6g6lmshsq4pitiy7xqa is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_hrdhkyee6b2dl72okpj4cprk54 (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_hrdhkyee6b2dl72okpj4cprk54 rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_hrdhkyee6b2dl72okpj4cprk54 is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_52fu6zfwxlkesdkbup74lr32su (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_52fu6zfwxlkesdkbup74lr32su: remove its local data: injected failure at remove-local-done
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_52fu6zfwxlkesdkbup74lr32su rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_52fu6zfwxlkesdkbup74lr32su is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_ltdypch3nvi4kkyytjke7uqtoy (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ltdypch3nvi4kkyytjke7uqtoy rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ltdypch3nvi4kkyytjke7uqtoy is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_ui7swtuovv47czvdfqhcunhtwy (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ui7swtuovv47czvdfqhcunhtwy: restore the original route: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ui7swtuovv47czvdfqhcunhtwy rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ui7swtuovv47czvdfqhcunhtwy is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_iw4vw5ccom7awsmnrkz64pr6tq (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_iw4vw5ccom7awsmnrkz64pr6tq: restore the original route: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_iw4vw5ccom7awsmnrkz64pr6tq rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_iw4vw5ccom7awsmnrkz64pr6tq is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_tsdbbhjejrxcaimwspx2v7nsrm (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_tsdbbhjejrxcaimwspx2v7nsrm is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_y6mzxe5zufbq3swfy7oxfg4sju (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_y6mzxe5zufbq3swfy7oxfg4sju rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_y6mzxe5zufbq3swfy7oxfg4sju: delete its snapshot: injected failure at delete-snapshot
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_y6mzxe5zufbq3swfy7oxfg4sju is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_ofxxlxoqlww4vepkrocv6niuqe (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ofxxlxoqlww4vepkrocv6niuqe rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_ofxxlxoqlww4vepkrocv6niuqe is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_xiu6xt2zb2st65hv3r6gxdmmha (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xiu6xt2zb2st65hv3r6gxdmmha rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xiu6xt2zb2st65hv3r6gxdmmha: delete the host's replica: injected failure at delete-replica
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xiu6xt2zb2st65hv3r6gxdmmha is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_owzi54up54ie3kbyukf4kss4qe (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_owzi54up54ie3kbyukf4kss4qe rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_owzi54up54ie3kbyukf4kss4qe is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_avdytxrixmjbkvtkspcb7pqpq4 (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_avdytxrixmjbkvtkspcb7pqpq4 rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_avdytxrixmjbkvtkspcb7pqpq4: retire its journal row: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_avdytxrixmjbkvtkspcb7pqpq4 is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_xoasijahtypuw6q6jvsxgjsek4 (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xoasijahtypuw6q6jvsxgjsek4 rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xoasijahtypuw6q6jvsxgjsek4: retire its journal row: constraint failed: injected (1811)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_xoasijahtypuw6q6jvsxgjsek4 is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_677u3jap437pfyewjk7o7sk4mm (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_677u3jap437pfyewjk7o7sk4mm rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_677u3jap437pfyewjk7o7sk4mm is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: mark import sd_677u3jap437pfyewjk7o7sk4mm rolled back: injected failure at cas
2026/10/15 16:38:49 provision: a.shop.example.com: aborted seed sd_677u3jap437pfyewjk7o7sk4mm rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_2ffc6wxyhtvlgedn6ylnn6ykna (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_2ffc6wxyhtvlgedn6ylnn6ykna rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_2ffc6wxyhtvlgedn6ylnn6ykna is cleaned up and its journal row retired
2026/10/15 16:38:49 provision: a.shop.example.com: aborted seed sd_2ffc6wxyhtvlgedn6ylnn6ykna rolled back (no box had swapped it)
2026/10/15 16:38:49 provision: a.shop.example.com: swapped for import sd_n3hvn4tfokd7d2lkybrlnavypm (the original route is journaled)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_n3hvn4tfokd7d2lkybrlnavypm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_n3hvn4tfokd7d2lkybrlnavypm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_n3hvn4tfokd7d2lkybrlnavypm rolled back to its original route
2026/10/15 16:38:49 provision: a.shop.example.com: import sd_n3hvn4tfokd7d2lkybrlnavypm is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_4sco5gqdtyqwmot7ewo6kluyom (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4sco5gqdtyqwmot7ewo6kluyom rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4sco5gqdtyqwmot7ewo6kluyom is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_k64pyiohfwayzrce5xvw3sxzmy (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_k64pyiohfwayzrce5xvw3sxzmy rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_k64pyiohfwayzrce5xvw3sxzmy is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_lcwlzmjd765cpk7iikugvptaeq (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_lcwlzmjd765cpk7iikugvptaeq rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_lcwlzmjd765cpk7iikugvptaeq is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_ilzn6otwrm6mv5o2kvw5q6lpcm (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ilzn6otwrm6mv5o2kvw5q6lpcm rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ilzn6otwrm6mv5o2kvw5q6lpcm is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_vdaeuryubsiibrmx2sq5bpg5ay (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_vdaeuryubsiibrmx2sq5bpg5ay rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_vdaeuryubsiibrmx2sq5bpg5ay is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_gbu67nnymb5pjqm3xszpsrbwki (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_gbu67nnymb5pjqm3xszpsrbwki rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_gbu67nnymb5pjqm3xszpsrbwki is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_5g3kwuwp5ixqamfa23qulmk73a (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_5g3kwuwp5ixqamfa23qulmk73a rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_5g3kwuwp5ixqamfa23qulmk73a is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_lx5dbh4zgzdxfcbu7h75pifymi (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_lx5dbh4zgzdxfcbu7h75pifymi has no route on this box: its local data is removed and no route is put back
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_lx5dbh4zgzdxfcbu7h75pifymi is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_acbszfhzjl2wd2ltb6bxpke2za (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_iyj2z5vdzirvyipoqmgaqufdgq (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_exntmcva7lfvbggrrpvdzaisv4 (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_exntmcva7lfvbggrrpvdzaisv4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_riedzrqjwtp66jb5zxdsprgiqq (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_riedzrqjwtp66jb5zxdsprgiqq is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/15 16:38:50 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/15 16:38:50 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_zkvidu5shnsjtm3ml3ir7oy7ye (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_fqu2pkaxcyawxbwsussa52d2zi (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_h2rendwmju46k6jhtui7m6lcba (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_xe7sdd5a4qi7ch655dixub4pam (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_4sskd5l65jjmba7vfmwcisnqwm (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4sskd5l65jjmba7vfmwcisnqwm rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_whrm7x5mks5vtbuyty7fniriaa (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_whrm7x5mks5vtbuyty7fniriaa has no route on this box: its local data is removed and no route is put back
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_whrm7x5mks5vtbuyty7fniriaa is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_rzj7gqx7dwirao54osahyckl3e (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_rzj7gqx7dwirao54osahyckl3e: remove its local data: injected failure at remove-local
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_rzj7gqx7dwirao54osahyckl3e is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_nkhmcepb56ildo4f5kvhv7j5je (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_nkhmcepb56ildo4f5kvhv7j5je: a route appeared at the host, so its local database is left and the rollback waits
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_eu6z57u5t7tquloraldvghxtye (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_eu6z57u5t7tquloraldvghxtye rollback deferred: no fence generation: registry busy
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_lxiyzwcpkjz2pelbfrrxc7xp2q (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_lxiyzwcpkjz2pelbfrrxc7xp2q rollback deferred: no fence generation: the generation source answered 0
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_twkt6ojhwqonecp3rkf2morf3a (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_ncegevsa2xmomjtm2nrqgimuiy (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_3aaw2tlb232m3gjba6k7p7vene (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/15 16:38:50 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_7y2l6jeaj6d2thznbi4du25fpi (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_7y2l6jeaj6d2thznbi4du25fpi rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_7y2l6jeaj6d2thznbi4du25fpi is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_2jgvdnnmdvhzojj7p5bvc6phra (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_2jgvdnnmdvhzojj7p5bvc6phra rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_2jgvdnnmdvhzojj7p5bvc6phra is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_pfmu6lmmxvoztu5baexxn6pwyy (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_pfmu6lmmxvoztu5baexxn6pwyy rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_pfmu6lmmxvoztu5baexxn6pwyy is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_rfpu7pwgfqy4xyr7bl46jxzrkm (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_rfpu7pwgfqy4xyr7bl46jxzrkm: retire its instance key: the env file is a symlink
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_rfpu7pwgfqy4xyr7bl46jxzrkm rolled back to its original route
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_rfpu7pwgfqy4xyr7bl46jxzrkm is cleaned up and its journal row retired
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_rnjzhxtkxlcbzax4hn7q4yejky (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_2bgymyl47ok3q4i5tcq5km5ute (the original route is journaled)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_adwk2wpg4swnaii2wxceznn33m refused: there is no route at a.shop.example.com to replace
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4dips65jllkhu73wphb4sofu5a refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_u4dbcoew4r4rvjiyjv54t3xe6q refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_whweayuyqgby5s3altedcpzqvu refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_2m4jocpawa33c3svxocidvsytu refused: the route belongs to app other
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ecuzkmb33avw6l3tpn7yrmwhoa refused: the route is filed under another account
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_fdpbcdgurpqs7p3az55g6bnb6y refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_xs74o2hfa2mnpq5ugpwu3nappa refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_v7dujn7rjwud6jz6dekv6m43la refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_k3bqdgfq4zzeahntw7yosvjvci refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_jm74mxqiorxk5dum5z5ofeti6e refused: the route is not an address route this import can take over (socket)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_7dkie5syk6jnpyukbbzdcuya5q refused: the route is not an address route this import can take over (no address)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_veqcxsx2dafx2xla6wcbz3ddxe refused: the route is not an address route this import can take over (provisioned)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_mdgo6jdzw2vkwegigqvrt2sqai refused: the route is not an address route this import can take over (kind static)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_pwdfvzvivscmntmftdwtjtli74 refused: the route is not an address route this import can take over (backing)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ldr2ut7b7y4izvniln7rnx3rli refused: the route is not an address route this import can take over (tunnel)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_kwk2kclh2lmeavz3e7ve25xsiy refused: the route is not an address route this import can take over (caps)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_vdk552sojewof4a4vgix2lcigq refused: the route is not an address route this import can take over (platform)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4hageti7fjnrm2vclghuyw333q refused: the route is not an address route this import can take over (canary)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_xefk4vqn4gcjh27bfozzfnfslq refused: the route is not an address route this import can take over (kind sidecar)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_onc3itr7kxtupbvjpkobqif4km refused: the route is not an address route this import can take over (region)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_4prgvwzkcln6cz2lsf5rkioo74 refused: the route is not an address route this import can take over (fleet_box)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_o3hqn7vmh5dsxokexsnthkudlm refused: the route is not an address route this import can take over (hibernate)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_d64ne2rrm6kn643q6figwc5hee refused: the route is not an address route this import can take over (claim_owner)
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ds5nuqnjnjpic6cqjfubsopfx4 refused: this box does not run instances nested
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ofsj2peeizwzg7mid32wnhauxu refused: this box does not run instances nested
2026/10/15 16:38:50 provision: a.shop.example.com: import sd_ogslgoawie5qf4qr3kuep47fwe refused: claim control is on for this box
2026/10/15 16:38:50 provision: a.shop.example.com: swapped for import sd_d4fau4ppkzp2l3qo2b2xc4v2kq (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: swapped for import sd_2m5o3eprgktcpz77b4xaq2wqy4 (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/15 16:38:51 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_qqxgpz7ejf2vnecxpykkhhfp6e: its verify hash is not a sha256
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_llu4ureil7le3b2j3gwra7qlj4: its verify hash is not a sha256
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_snd3ehitctejfgd6oukb47rbeu: its verify hash is not a sha256
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/15 16:38:51 provision: A.shop.example.com/..: not swapping for import sd_yskgyn3woj67mwubsq3e5pcsly: its host or seed id is malformed (seeds: not a host)
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_mph2mr4i3rvqb72shiob5wn5ta: its record does not describe a nested, hibernating instance
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_wvkr7qvh4nhbbzjbwj3zeprdv4: its record does not describe a nested, hibernating instance
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_5ycyejyg57xlrsa5vxmzunxj4a: its record does not describe a nested, hibernating instance
2026/10/15 16:38:51 provision: a.shop.example.com: not swapping for import sd_smav7bz322yqyupgk67onf5qve: its record does not describe a nested, hibernating instance
2026/10/15 16:38:51 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/15 16:38:51 provision: a.shop.example.com: swapped for import sd_wjvtcl3m3qmv2uvbfejmtykgjq (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/15 16:38:51 provision: a.shop.example.com: swapped for import sd_amqftmijqzxtq2i35h252lqlvm (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: swapped for import sd_cofuvevo363mbieg6mpyb2c3fq (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/15 16:38:51 provision: dry-run: would consider swapping a.shop.example.com for import sd_qk6wnxs57c2be5fcvdiel2lpyi
2026/10/15 16:38:51 provision: a.shop.example.com: import sd_o743p2djajnecu33cofof6r3sq rolled back to its original route
2026/10/15 16:38:51 provision: a.shop.example.com: import sd_o743p2djajnecu33cofof6r3sq: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 16:38:51 provision: a.shop.example.com: import sd_o743p2djajnecu33cofof6r3sq is cleaned up and its journal row retired
2026/10/15 16:38:51 provision: a.shop.example.com: import sd_tweofncsapg7etihoan4ddawka left alone: the import journal holds seed sd_injzgbhwikiju6g524mt4qfgf4 at swapped
2026/10/15 16:38:51 provision: a.shop.example.com: not minting import sd_vyn73ldxpteg5kzrqgnrj3jw3a: it is swapped but not committed, and only its swap makes its row
2026/10/15 16:38:51 provision: a.shop.example.com: not minting import sd_uanumlub3vf7fjrekeow2gma7y: it is placed but not committed, and only its swap makes its row
2026/10/15 16:38:51 provision: a.shop.example.com: swapped for import sd_vjwbhgqjcakdhfgwbhyzw4rnfe (the original route is journaled)
2026/10/15 16:38:51 provision: a.shop.example.com: not minting import sd_vjwbhgqjcakdhfgwbhyzw4rnfe: it is swapped but not committed, and only its swap makes its row
2026/10/15 16:38:51 provision: a.shop.example.com: not minting import sd_vjwbhgqjcakdhfgwbhyzw4rnfe: it is placed but not committed, and only its swap makes its row
2026/10/15 16:38:51 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 16:38:51 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/15 16:38:51 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/15 16:38:51 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/15 16:38:51 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/15 16:38:51 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/15 16:38:51 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 16:38:51 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/15 16:38:51 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/15 16:38:51 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 16:38:51 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/15 16:38:51 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/15 16:38:51 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/15 16:38:51 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/15 16:38:51 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 16:38:51 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/15 16:38:51 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 16:38:51 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 16:38:51 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/15 16:38:51 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 16:38:51 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 16:38:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:51 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/15 16:38:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:51 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 16:38:51 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 16:38:51 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 16:38:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 16:38:51 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 16:38:51 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 16:38:51 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL github.com/carlosframework/platform/internal/provision 31.702s
ok github.com/carlosframework/platform/internal/publicrelease 0.009s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.310s
ok github.com/carlosframework/platform/internal/relay 7.224s
ok github.com/carlosframework/platform/internal/release 21.787s
ok github.com/carlosframework/platform/internal/rollout 3.724s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.006s
ok github.com/carlosframework/platform/internal/rootparticipation 0.007s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.561s
ok github.com/carlosframework/platform/internal/s3compat 0.004s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.468s
ok github.com/carlosframework/platform/internal/seeds 0.012s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.338s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.287s
ok github.com/carlosframework/platform/internal/status 0.037s
ok github.com/carlosframework/platform/internal/steering 0.005s
ok github.com/carlosframework/platform/internal/stopevidence 0.219s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.003s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.001s
ok github.com/carlosframework/platform/internal/vet 1.518s
FAIL
make: *** [Makefile:18: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
amadan