carlos / platform Public

harness: re-arm in place by the owner's conditions, G4 PASS on 8a313548

claude 5 days ago 322398aa3b79933675266ba5e38c23b78f1515d7 parent 70fc0d3

15 files changed, +392 −0

harness/RUNLOG.md +30 −0
harness/patches/f3-hostfloor-run-stdout.patch +14 −0
harness/scenarios/cohort1/blocks/acceptance.host.sh +25 −0
harness/scenarios/cohort1/blocks/b4-after.sh +17 −0
harness/scenarios/cohort1/blocks/b4-pair.sh +25 −0
harness/scenarios/cohort1/blocks/b4-resume.sophie.sh +30 −0
harness/scenarios/cohort1/blocks/b4.sh +35 −0
harness/scenarios/cohort1/blocks/g5.host.sh +10 −0
harness/scenarios/cohort1/blocks/place-parent.host.sh +31 −0
harness/scenarios/cohort1/blocks/rearm-roll.host.sh +28 −0
harness/scenarios/cohort1/blocks/rearm-strict.host.sh +29 −0
harness/scenarios/cohort1/blocks/rearm-strict.leo.sh +45 −0
harness/scenarios/cohort1/blocks/rearm.host.sh +27 −0
harness/scenarios/cohort1/blocks/rearm2.host.sh +25 −0
harness/scenarios/cohort1/blocks/rearm3.host.sh +21 −0

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	307.245s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.822s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.258s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.720s
?   	github.com/carlosframework/platform/harness/apps/wakecheck	[no test files]
ok  	github.com/carlosframework/platform/internal/activator	251.141s
ok  	github.com/carlosframework/platform/internal/agentsock	0.020s
ok  	github.com/carlosframework/platform/internal/alerting	0.003s
ok  	github.com/carlosframework/platform/internal/analytics	0.025s
ok  	github.com/carlosframework/platform/internal/appconfig	2.501s
ok  	github.com/carlosframework/platform/internal/apperr	0.110s
ok  	github.com/carlosframework/platform/internal/applog	0.177s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.005s
ok  	github.com/carlosframework/platform/internal/boxid	0.905s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.017s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.728s
ok  	github.com/carlosframework/platform/internal/changelog	0.337s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.875s
ok  	github.com/carlosframework/platform/internal/clamd	0.060s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	405.860s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.244s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.011s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.395s
ok  	github.com/carlosframework/platform/internal/doorkey	0.007s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	44.863s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.146s
ok  	github.com/carlosframework/platform/internal/gate	1.661s
ok  	github.com/carlosframework/platform/internal/genselect	0.018s
ok  	github.com/carlosframework/platform/internal/geo	0.014s
ok  	github.com/carlosframework/platform/internal/geoip	0.034s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.168s
ok  	github.com/carlosframework/platform/internal/host	180.171s
ok  	github.com/carlosframework/platform/internal/hostactors	6.561s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.004s
ok  	github.com/carlosframework/platform/internal/hostbox	2.601s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.555s
ok  	github.com/carlosframework/platform/internal/hostenv	0.004s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.010s
ok  	github.com/carlosframework/platform/internal/hostexec	4.745s
ok  	github.com/carlosframework/platform/internal/hostfence	0.041s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.358s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	1.031s
ok  	github.com/carlosframework/platform/internal/hostops	1.622s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.464s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.141s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.002s
ok  	github.com/carlosframework/platform/internal/instancectl	5.209s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.727s
ok  	github.com/carlosframework/platform/internal/instancefs	0.007s
ok  	github.com/carlosframework/platform/internal/instancekey	0.002s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.008s
ok  	github.com/carlosframework/platform/internal/layout	1.566s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.003s
ok  	github.com/carlosframework/platform/internal/lease	9.791s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.007s
ok  	github.com/carlosframework/platform/internal/ledger	0.012s
ok  	github.com/carlosframework/platform/internal/mail	0.163s
ok  	github.com/carlosframework/platform/internal/maintenance	0.076s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.491s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.069s
ok  	github.com/carlosframework/platform/internal/metrics	0.004s
ok  	github.com/carlosframework/platform/internal/moves	20.891s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.756s
ok  	github.com/carlosframework/platform/internal/objstore	0.165s
ok  	github.com/carlosframework/platform/internal/ops	0.175s
ok  	github.com/carlosframework/platform/internal/park	0.199s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
2026/10/20 09:01:00 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/20 09:01:00 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/20 09:01:00 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/20 09:01:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/20 09:01:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/20 09:01:01 provision: an app's records could not be listed: they are skipped
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:01 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/20 09:01:01 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/20 09:01:01 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/20 09:01:01 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/20 09:01:01 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/20 09:01:01 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/20 09:01:01 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/20 09:01:01 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/20 09:01:01 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/20 09:01:01 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/20 09:01:01 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/20 09:01:01 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/20 09:01:01 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/20 09:01:01 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:01 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:01 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:01 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/20 09:01:01 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/20 09:01:01 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/20 09:01:01 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/20 09:01:01 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:01 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:01 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan14RootReadCensus (4.54s)
    plan14_root_reads_test.go:940: root read census: 115 discrepancies
        changed root read internal/hostfence/writer.go:OpenRootFenceStore; review class, task, sites and digest
        changed root source envelope harness
        changed root source envelope harness/apps/wakecheck
        changed root source envelope harness/boxes
        changed root source envelope harness/boxes/shims
        changed root source envelope harness/checks
        changed root source envelope harness/console
        changed root source envelope harness/infra
        changed root source envelope harness/infra-copies/747f699/dev
        changed root source envelope harness/infra-copies/a0b3f5a/dev
        changed root source envelope harness/infra-copies/a0b3f5a/scripts
        changed root source envelope harness/infra-copies/pr47
        changed root source envelope harness/operator
        changed root source envelope harness/release
        changed root source envelope harness/scenarios
        changed root source envelope harness/scenarios/cohort1
        changed root source envelope harness/scenarios/cohort1/blocks
        changed root source envelope harness/stand-ins
        changed root source envelope internal/host
        changed root source envelope internal/hostfence
        changed root source envelope internal/publicrelease
        changed root source envelope internal/s3compat
        unclassified root read harness/apps/wakecheck/main.go:main file:Exec@333,file:Exec@804,file:Open@277,file:QueryRow@870
        unclassified root read harness/boxes/boxes-up.sh:external file:external@0
        unclassified root read harness/boxes/dmi-shim.sh:external file:external@0
        unclassified root read harness/boxes/layout-probe.sh:external file:external@0
        unclassified root read harness/boxes/shims/systemd-zram-setup@.service:external file:external@0
        unclassified root read harness/boxes/vendor-shims.sh:external file:external@0
        unclassified root read harness/checks/check2.sh:external file:external@0
        unclassified root read harness/checks/check5.sh:external file:external@0
        unclassified root read harness/checks/check6.sh:external file:external@0
        unclassified root read harness/checks/check6b.sh:external file:external@0
        unclassified root read harness/checks/check7.sh:external file:external@0
        unclassified root read harness/checks/check8.sh:external file:external@0
        unclassified root read harness/checks/fix5.sh:external file:external@0
        unclassified root read harness/checks/run6b.sh:external file:external@0
        unclassified root read harness/checks/snap-base.sh:external file:external@0
        unclassified root read harness/checks/snap-boot.sh:external file:external@0
        unclassified root read harness/checks/ssmsmoke.sh:external file:external@0
        unclassified root read harness/console/console-ext4.sh:external file:external@0
        unclassified root read harness/console/console-setup.sh:external file:external@0
        unclassified root read harness/console/signin.sh:external file:external@0
        unclassified root read harness/console/system-update.sh:external file:external@0
        unclassified root read harness/donor-user-data.sh:external file:external@0
        unclassified root read harness/evidence.sh:external file:external@0
        unclassified root read harness/host-setup.sh:external file:external@0
        unclassified root read harness/host-user-data.sh:external file:external@0
        unclassified root read harness/hrun.sh:external file:external@0
        unclassified root read harness/infra-copies/747f699/dev/host-init.sh:external file:external@0
        unclassified root read harness/infra-copies/a0b3f5a/dev/host-init.sh:external file:external@0
        unclassified root read harness/infra-copies/a0b3f5a/scripts/bootstrap-box.sh:external file:external@0
        unclassified root read harness/infra-copies/a0b3f5a/scripts/ship-app.sh:external file:external@0
        unclassified root read harness/infra-copies/a0b3f5a/scripts/update-platform-binary.sh:external file:external@0
        unclassified root read harness/infra-copies/pr47/probe.sh:external file:external@0
        unclassified root read harness/infra-copies/pr47/remediation.sh:external file:external@0
        unclassified root read harness/infra/infra-setup.sh:external file:external@0
        unclassified root read harness/operator/operator-setup.sh:external file:external@0
        unclassified root read harness/release/release-setup.sh:external file:external@0
        unclassified root read harness/release/release-window.sh:external file:external@0
        unclassified root read harness/release/step7-operator.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/50-publish-record.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/51-open-signer.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/51-roster-resume.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/51-roster.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/61-sign.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/61a-install-channel.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/62-guard-arm.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/63-run.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/63-sophie.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7-console-report.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7-evidence-key.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7-run.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7-runtime.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/74-run.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7a-leo.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/7a-run.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/acceptance.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b1.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b2.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b4-after.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b4-pair.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b4-resume.sophie.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b4.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/b5.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/g4-roll.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/g5.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/p9.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/place-parent.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/pw-seed.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm-roll.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm-strict.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm-strict.leo.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm2.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/rearm3.host.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/reports.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/run-leo.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w-env.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w-identity.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w-open-signer.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w-sums.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w81.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w81b.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w82.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w82b.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w84.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/blocks/w9.box.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/box-helpers.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/signer-helpers.sh:external file:external@0
        unclassified root read harness/scenarios/cohort1/ssm.sh:external file:external@0
        unclassified root read harness/scenarios/sync.sh:external file:external@0
        unclassified root read harness/snapshot.sh:external file:external@0
        unclassified root read harness/stand-ins/certs.sh:external file:external@0
        unclassified root read internal/s3compat/harness.go:readHarnessFile file:ReadFile@189,file:Stat@55
        changed reclassified declaration internal/hostfence/writer.go:OpenRootFenceStore
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: converged acme.go.tito.io channel stable -> edge
2026/10/20 09:01:12 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/20 09:01:12 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/20 09:01:12 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/20 09:01:12 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: converged acme.go.tito.io hibernate false -> true
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:12 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/20 09:01:12 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: converged acme.go.tito.io status-named false -> true
2026/10/20 09:01:13 provision: converged acme.go.tito.io status-named true -> false
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/20 09:01:13 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/20 09:01:13 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/20 09:01:13 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/20 09:01:13 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/20 09:01:13 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/20 09:01:13 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/20 09:01:13 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/20 09:01:13 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:13 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/20 09:01:13 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/20 09:01:13 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/20 09:01:13 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/20 09:01:13 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:13 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/20 09:01:13 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/20 09:01:13 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/20 09:01:13 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/20 09:01:13 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/20 09:01:13 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: converged acme.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/20 09:01:13 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/20 09:01:13 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/20 09:01:13 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/20 09:01:13 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/20 09:01:13 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/20 09:01:13 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/20 09:01:13 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/20 09:01:13 provision: dry-run: would converge owned.go.tito.io seed
2026/10/20 09:01:13 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/20 09:01:13 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/20 09:01:13 provision: converged owned.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/20 09:01:13 provision: converged owned.go.tito.io hibernate false -> true
2026/10/20 09:01:13 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/20 09:01:13 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: removed retired static route site.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/20 09:01:13 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/20 09:01:13 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:13 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:13 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/20 09:01:13 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/20 09:01:13 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/20 09:01:13 provision: converged acme.go.tito.io channel stable -> edge
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/20 09:01:13 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/20 09:01:13 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/20 09:01:13 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/20 09:01:13 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/20 09:01:13 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/20 09:01:14 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/20 09:01:14 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/20 09:01:14 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/20 09:01:14 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/20 09:01:14 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/20 09:01:14 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/20 09:01:14 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/20 09:01:14 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/20 09:01:14 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:14 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/20 09:01:14 provision: a.shop.example.com: swapped for import sd_tdsm5mqd5pli6hibqemd32552e (the original route is journaled)
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_tdsm5mqd5pli6hibqemd32552e committed: its gate is cleared and its journal row dropped
2026/10/20 09:01:14 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_qrhc3t6j2t4qitmss47j25ufby rolled back to its original route
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_qrhc3t6j2t4qitmss47j25ufby: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_qrhc3t6j2t4qitmss47j25ufby is cleaned up and its journal row retired
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_fii6dcaiv7y2j4vjkxflelt36u rolled back to its original route
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_fii6dcaiv7y2j4vjkxflelt36u: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_fii6dcaiv7y2j4vjkxflelt36u is cleaned up and its journal row retired
2026/10/20 09:01:14 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_bqd425us6hrml7enolwhbvnsre
2026/10/20 09:01:14 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/20 09:01:14 provision: dry-run: would converge a.shop.example.com seed source
2026/10/20 09:01:14 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:14 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/20 09:01:14 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/20 09:01:14 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_w4kh5pajd5vsckg4yeyaek54p4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_zzqewwgwot7rgnxppkoqqdxnhm cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_tso3gdvauz3q2rh7jahonjrk7e is journaled, but this box cannot act on imports; its row is left alone
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_qjdgaaqytycajcf7dvnj3dxtk4 is journaled, but this box cannot act on imports; its row is left alone
2026/10/20 09:01:14 provision: a.shop.example.com: import sd_6tty5n6wjzmlwfhbrft3vm3fha is journaled, but this box cannot act on imports; its row is left alone
2026/10/20 09:01:15 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/20 09:01:15 provision: b.shop.example.com: import sd_s3v7mfc2qyoban3rxve2igzshm left alone this pass: the import journal could not be read
2026/10/20 09:01:15 provision: c.shop.example.com: import sd_cuf5c6miughl4n7fychzkwwz7e left alone this pass: the import journal could not be read
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_vx6cliiplyztopmiq6jq3hav2q committed: its gate is cleared and its journal row dropped
2026/10/20 09:01:15 provision: a.shop.example.com: not converging import sd_id3fjyckga6h6wxoxece6tagk4: it is swapped but not committed, and the row on this box has no import gate
2026/10/20 09:01:15 provision: a.shop.example.com: not converging import sd_tkkkaou6ulm7rgfodxdb56xoam: it is swapped but not committed, and the row on this box has no import gate
2026/10/20 09:01:15 provision: a.shop.example.com: not converging import sd_jjxbf2omwhrsjlkmqo3vgvee3q: it is placed but not committed, and the row on this box has no import gate
2026/10/20 09:01:15 provision: a.shop.example.com: not converging import sd_xkqphkicvxzcvyiqlyllojqodq: it is placed but not committed, and the row on this box has no import gate
2026/10/20 09:01:15 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:15 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/20 09:01:15 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_ndtsasezrm5fldv7hztxoqnvzy committed: its gate is cleared and its journal row dropped
2026/10/20 09:01:15 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:15 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:15 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/20 09:01:15 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_itatpu4ai4rnwzam2koyh67fli: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_itatpu4ai4rnwzam2koyh67fli rolled back (no box had swapped it)
2026/10/20 09:01:15 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/20 09:01:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:15 provision: removed instance route acme.go.tito.io (its seed sd_ufwfr3nbcc54s2lxwmmqamsbfe was aborted); the next pass rolls it back
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_ufwfr3nbcc54s2lxwmmqamsbfe: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_ufwfr3nbcc54s2lxwmmqamsbfe rolled back (no box had swapped it)
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_bc2jm53uhbk2nx477d3rigkpui has a row this pass may not remove; leaving the seed aborted
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_5eph63qy3dgsdb2exhlfdtbvv4 rolled back (no box had swapped it)
2026/10/20 09:01:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:15 provision: removed instance route acme.go.tito.io (its seed sd_swjs4em5wkb7oacpyb3cwy3rji was aborted); the next pass rolls it back
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_swjs4em5wkb7oacpyb3cwy3rji has no route on this box: its local data is removed
2026/10/20 09:01:15 provision: acme.go.tito.io: aborted seed sd_swjs4em5wkb7oacpyb3cwy3rji rolled back (no box had swapped it)
2026/10/20 09:01:15 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_4egykhubyqaodyeptsccbuglwa (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_4egykhubyqaodyeptsccbuglwa rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_4egykhubyqaodyeptsccbuglwa is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_cqrnabwkp23ryqtyz4f7fulqiy (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_cqrnabwkp23ryqtyz4f7fulqiy rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_cqrnabwkp23ryqtyz4f7fulqiy is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_6dkecediu3kkin6iuh7cjxl4ca (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_6dkecediu3kkin6iuh7cjxl4ca rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_6dkecediu3kkin6iuh7cjxl4ca: the host's replica is left alone: its record no longer names this seed
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_6dkecediu3kkin6iuh7cjxl4ca is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_hcbb5rz5b7hp57sfa2gvcvlpwu (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_hcbb5rz5b7hp57sfa2gvcvlpwu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_hcbb5rz5b7hp57sfa2gvcvlpwu rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_hcbb5rz5b7hp57sfa2gvcvlpwu is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_2riffjtsrxvu5solzng52ecua4 (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_2riffjtsrxvu5solzng52ecua4 rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_jn5slsmrfqo37thr7blrbcc34u (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_jn5slsmrfqo37thr7blrbcc34u is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_wxe7ueiout3xqvy47azc247yma (the original route is journaled)
2026/10/20 09:01:15 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_wxe7ueiout3xqvy47azc247yma left alone this pass: its record could not be read
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_w7wwt2poyy4wf7lel4bpjvljry (the original route is journaled)
2026/10/20 09:01:15 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_w7wwt2poyy4wf7lel4bpjvljry left alone this pass: its record could not be read
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_2zg3ipz56lzsh3vhx3mjij4gli (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_2zg3ipz56lzsh3vhx3mjij4gli: close the import gate: constraint failed: injected (1811)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_2zg3ipz56lzsh3vhx3mjij4gli rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_2zg3ipz56lzsh3vhx3mjij4gli is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_zn7pnb2mtgwe5mdtsgad3f5uci (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_zn7pnb2mtgwe5mdtsgad3f5uci: close the import gate: constraint failed: injected (1811)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_zn7pnb2mtgwe5mdtsgad3f5uci rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_zn7pnb2mtgwe5mdtsgad3f5uci is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_3innhvpk5itztsh6xrkrwwzmki (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_3innhvpk5itztsh6xrkrwwzmki rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_3innhvpk5itztsh6xrkrwwzmki rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_3innhvpk5itztsh6xrkrwwzmki is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_djheqoxkhmgbcor2i3ckgk272y (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_djheqoxkhmgbcor2i3ckgk272y rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_djheqoxkhmgbcor2i3ckgk272y is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_t4pruarbygzlqomjla7hgaobru (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_t4pruarbygzlqomjla7hgaobru: retire its instance key: injected failure at retire-key
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_t4pruarbygzlqomjla7hgaobru rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_t4pruarbygzlqomjla7hgaobru is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_7rbtprtr2pvwdxaarwyvenk25a (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_7rbtprtr2pvwdxaarwyvenk25a rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_7rbtprtr2pvwdxaarwyvenk25a is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_p5ispfbzmtyv3bxk3v42clanbi (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_p5ispfbzmtyv3bxk3v42clanbi: remove its local data: injected failure at remove-local
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_p5ispfbzmtyv3bxk3v42clanbi rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_p5ispfbzmtyv3bxk3v42clanbi is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_roc5wjgvxe2tktvxhem5pgw2sa (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_roc5wjgvxe2tktvxhem5pgw2sa rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_roc5wjgvxe2tktvxhem5pgw2sa is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_glkqo2crgrucwcdqd7zmrtq37q (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_glkqo2crgrucwcdqd7zmrtq37q: remove its local data: injected failure at remove-local-done
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_glkqo2crgrucwcdqd7zmrtq37q rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_glkqo2crgrucwcdqd7zmrtq37q is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_ikvswxpeuggqtfo7ycqcg5pbke (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_ikvswxpeuggqtfo7ycqcg5pbke rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_ikvswxpeuggqtfo7ycqcg5pbke is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_wjqrz5bsgius5tanqgxs5nob5u (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_wjqrz5bsgius5tanqgxs5nob5u: restore the original route: constraint failed: injected (1811)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_wjqrz5bsgius5tanqgxs5nob5u rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_wjqrz5bsgius5tanqgxs5nob5u is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_uhgerb7qk532d45zjn37vyzagy (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_uhgerb7qk532d45zjn37vyzagy: restore the original route: constraint failed: injected (1811)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_uhgerb7qk532d45zjn37vyzagy rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_uhgerb7qk532d45zjn37vyzagy is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_nswya7lpfiml2ccpwdbokkvnmi (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_nswya7lpfiml2ccpwdbokkvnmi is cleaned up and its journal row retired
2026/10/20 09:01:15 provision: a.shop.example.com: swapped for import sd_etjvgzah5v57olpg56fsfzsm3y (the original route is journaled)
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_etjvgzah5v57olpg56fsfzsm3y rolled back to its original route
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_etjvgzah5v57olpg56fsfzsm3y: delete its snapshot: injected failure at delete-snapshot
2026/10/20 09:01:15 provision: a.shop.example.com: import sd_etjvgzah5v57olpg56fsfzsm3y is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_mw6u5bxjw2a5syeakpkz4hnn3m (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_mw6u5bxjw2a5syeakpkz4hnn3m rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_mw6u5bxjw2a5syeakpkz4hnn3m is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_dsbhfaxzw5yfxa6xu36yqgr2da (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_dsbhfaxzw5yfxa6xu36yqgr2da rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_dsbhfaxzw5yfxa6xu36yqgr2da: delete the host's replica: injected failure at delete-replica
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_dsbhfaxzw5yfxa6xu36yqgr2da is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_gb5thn5qastvakzqv3ldew6sqe (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_gb5thn5qastvakzqv3ldew6sqe rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_gb5thn5qastvakzqv3ldew6sqe is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_kw6n45nc5nkppy6tuyxre5sdvu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_kw6n45nc5nkppy6tuyxre5sdvu rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_kw6n45nc5nkppy6tuyxre5sdvu: retire its journal row: constraint failed: injected (1811)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_kw6n45nc5nkppy6tuyxre5sdvu is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_t6uz7fczb2eukbkz7krvglyuhq (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_t6uz7fczb2eukbkz7krvglyuhq rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_t6uz7fczb2eukbkz7krvglyuhq: retire its journal row: constraint failed: injected (1811)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_t6uz7fczb2eukbkz7krvglyuhq is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_qit5fr3ual5uhgqrcjoq5jkhke (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_qit5fr3ual5uhgqrcjoq5jkhke rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_qit5fr3ual5uhgqrcjoq5jkhke is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: mark import sd_qit5fr3ual5uhgqrcjoq5jkhke rolled back: injected failure at cas
2026/10/20 09:01:16 provision: a.shop.example.com: aborted seed sd_qit5fr3ual5uhgqrcjoq5jkhke rolled back (no box had swapped it)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_3nrs3czxun2zfuljoqsje24odu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_3nrs3czxun2zfuljoqsje24odu rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_3nrs3czxun2zfuljoqsje24odu is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: aborted seed sd_3nrs3czxun2zfuljoqsje24odu rolled back (no box had swapped it)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_biojx2x5hlqolpcvyx7gm6vhmu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_biojx2x5hlqolpcvyx7gm6vhmu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_biojx2x5hlqolpcvyx7gm6vhmu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_biojx2x5hlqolpcvyx7gm6vhmu rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_biojx2x5hlqolpcvyx7gm6vhmu is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_2fzk7xjkcxh4npyddkvyaeuczq (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_2fzk7xjkcxh4npyddkvyaeuczq rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_2fzk7xjkcxh4npyddkvyaeuczq is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_qnwyxv7i7xv5i3voit5mohgwna (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_qnwyxv7i7xv5i3voit5mohgwna rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_qnwyxv7i7xv5i3voit5mohgwna is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_juzbekh33ylwolkqptdj6jsvxe (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_juzbekh33ylwolkqptdj6jsvxe rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_juzbekh33ylwolkqptdj6jsvxe is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_rjftnwjrgibyac5eowtdxggbdu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_rjftnwjrgibyac5eowtdxggbdu rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_rjftnwjrgibyac5eowtdxggbdu is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_anmbxspklszxs6uqbszk6q4ie4 (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_anmbxspklszxs6uqbszk6q4ie4 rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_anmbxspklszxs6uqbszk6q4ie4 is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_cnksfxin6krzuqr5xxi2ex2ig4 (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_cnksfxin6krzuqr5xxi2ex2ig4 rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_cnksfxin6krzuqr5xxi2ex2ig4 is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_nrljnclr53xtyhc7w6y73li4uu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_nrljnclr53xtyhc7w6y73li4uu rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_nrljnclr53xtyhc7w6y73li4uu is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_p6dfdgjt3gjowojgrkbbsn4yzy (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_p6dfdgjt3gjowojgrkbbsn4yzy has no route on this box: its local data is removed and no route is put back
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_p6dfdgjt3gjowojgrkbbsn4yzy is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_4duozfpe3thabprgoikhyh547u (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_k7kbwhnlguerxnb5iz4ttqxvpa (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_sua6x32hzfc7u2inmeh3ziuuvm (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_sua6x32hzfc7u2inmeh3ziuuvm cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_7x43mhldihk7qvrffcj2cptmlm (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_7x43mhldihk7qvrffcj2cptmlm is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/20 09:01:16 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/20 09:01:16 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_2t6xkja4zb4wgjbxyhpdh5gqoa (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_dzztfrx5642kvnffyugqfdof5i (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_crwdin6566klxfrc7wsjukbwxa (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_su4kdp3ogeo6tnf6gocaewtwve (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_4tm56zmrwya2at7t3ayc5tvvti (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_4tm56zmrwya2at7t3ayc5tvvti rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_rxai7vsjfuri6sljk3nphuyzha (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_rxai7vsjfuri6sljk3nphuyzha has no route on this box: its local data is removed and no route is put back
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_rxai7vsjfuri6sljk3nphuyzha is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_t4hto7cwgire767vimlam6eeuq (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_t4hto7cwgire767vimlam6eeuq: remove its local data: injected failure at remove-local
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_t4hto7cwgire767vimlam6eeuq is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_vtucjn67sjenf66iqwf7gacbwu (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_vtucjn67sjenf66iqwf7gacbwu: a route appeared at the host, so its local database is left and the rollback waits
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_sqyr77whldnvmygbckbojfivze (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_sqyr77whldnvmygbckbojfivze rollback deferred: no fence generation: registry busy
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_joe3hrzspiydketrhw77mlels4 (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_joe3hrzspiydketrhw77mlels4 rollback deferred: no fence generation: the generation source answered 0
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_c6gwpnr5p5ctrwrh3l7n2yrhry (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_khrs6ejs2lasxhagpd6rnebwpi (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_ifpbg3gfgkh5xulc5w3urrxdom (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/20 09:01:16 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_ygcndqbq6rh6x3rmcvgftzxise (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_ygcndqbq6rh6x3rmcvgftzxise rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_ygcndqbq6rh6x3rmcvgftzxise is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_axmsoxadrnunxf6nquqxhaah2m (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_axmsoxadrnunxf6nquqxhaah2m rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_axmsoxadrnunxf6nquqxhaah2m is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_pwjk5u5lhwt6s7m4lgj5ov3a3e (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_pwjk5u5lhwt6s7m4lgj5ov3a3e rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_pwjk5u5lhwt6s7m4lgj5ov3a3e is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_7qizox63ro7nsdtvxdmsan5frm (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_7qizox63ro7nsdtvxdmsan5frm: retire its instance key: the env file is a symlink
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_7qizox63ro7nsdtvxdmsan5frm rolled back to its original route
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_7qizox63ro7nsdtvxdmsan5frm is cleaned up and its journal row retired
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_vfo57zom2v4ohpll5lbonnzu54 (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/20 09:01:16 provision: a.shop.example.com: swapped for import sd_ppirkdmjmvafman5f6v7l7e2qa (the original route is journaled)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_6x7f3dae6ra3e5x4yknngjxfei refused: there is no route at a.shop.example.com to replace
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_3bucgmcyfcaws6y44tyxm34ily refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_nnu5kpmqornduj5e5ycwzmmdsy refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_l57fiqns7rz35lwwelaubepg4u refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_axhi2n64ku2cm32mfub6gsmzkq refused: the route belongs to app other
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_sn3l7nmqgk44i5ax5imcoxfn2y refused: the route is filed under another account
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_u7kcion62dpfp4cktidgfyl5x4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_kg2qvbxlabav6zkbmnucjdff6y refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_ga45qrsaenwmi67s576xvafqia refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_l24qprcm3qbvoadzfmzyhaxzge refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_nktcpjohwrhbzywwzlcdahwxem refused: the route is not an address route this import can take over (socket)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_iuiw3icv76e3usfvc3dhhsvcha refused: the route is not an address route this import can take over (no address)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_6pipeuidsjae2wuh32cadkzoxe refused: the route is not an address route this import can take over (provisioned)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_2ggy424lswiaspc6bxc2f7etoq refused: the route is not an address route this import can take over (kind static)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_mybdfpbugiaht3skto3mge4iwy refused: the route is not an address route this import can take over (backing)
2026/10/20 09:01:16 provision: a.shop.example.com: import sd_pkravlcptjezzk2auzp6uh7nw4 refused: the route is not an address route this import can take over (tunnel)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_76qiql5jdptoahyrpeqkuy4aaa refused: the route is not an address route this import can take over (caps)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_ibav2ktya573rdpu4damcn6kku refused: the route is not an address route this import can take over (platform)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_6yt4yqt5bfsdlmjn4dt5z454su refused: the route is not an address route this import can take over (canary)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_zdx5i4txnolu3jkifa26v7s7ca refused: the route is not an address route this import can take over (kind sidecar)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_snho3nv2kmosnqklsvfqxigtsm refused: the route is not an address route this import can take over (region)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_orumq7t36ojex4osipk7ou4mse refused: the route is not an address route this import can take over (fleet_box)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_22jtmpc76yewpyrjv2job3h24i refused: the route is not an address route this import can take over (hibernate)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_r74moeovfxrvd4jdccw3wuxt7u refused: the route is not an address route this import can take over (claim_owner)
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_m66z5dcyu5x26u76vhom3epptu refused: this box does not run instances nested
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_waowjjlupb7mnl3fofve33cit4 refused: this box does not run instances nested
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_klbrjxx7yb5qeih5e4of73xune refused: claim control is on for this box
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_rm42lkivm64rfew5qiq4jvjvmi (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_stqeq6mcbmvbi2y2nle6aktb3i (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/20 09:01:17 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_j4sdhr6accnglewaaetnni2bji: its verify hash is not a sha256
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_25s4jypjf4cybbfha2lwnvbhey: its verify hash is not a sha256
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_qdc3l7u3iqzc4hqmjhorqihja4: its verify hash is not a sha256
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/20 09:01:17 provision: A.shop.example.com/..: not swapping for import sd_zthvb62ufjjcsdbh2ts5jefwiy: its host or seed id is malformed (seeds: not a host)
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_etgqnxl6c6pwhvmgngzo2bklnu: its record does not describe a nested, hibernating instance
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_e53d7plvdcxgcwlx7l2ze3c4hu: its record does not describe a nested, hibernating instance
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_rb3reikqkmm74mgsaotutkipkq: its record does not describe a nested, hibernating instance
2026/10/20 09:01:17 provision: a.shop.example.com: not swapping for import sd_pucohpmwbtzwz67ngi6xfkxuqe: its record does not describe a nested, hibernating instance
2026/10/20 09:01:17 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_ickhgbkqkvpz6tc4qsc7n5mnt4 (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_oxcwe2huhrls6dzgknwptzfdka (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_65btk677biqoevt7myojk6nvwy (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/20 09:01:17 provision: dry-run: would consider swapping a.shop.example.com for import sd_ajcmtwvbowdmibjxegsmye4vsq
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_q2ug6of2cehrgcpm3eeqogbocm rolled back to its original route
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_q2ug6of2cehrgcpm3eeqogbocm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_q2ug6of2cehrgcpm3eeqogbocm is cleaned up and its journal row retired
2026/10/20 09:01:17 provision: a.shop.example.com: import sd_zzrgype7z6kdq7nyrgfgcbdq6y left alone: the import journal holds seed sd_j3q2x2of4acrty74cfbh47uphi at swapped
2026/10/20 09:01:17 provision: a.shop.example.com: not minting import sd_emy2lqwl7xfm6w6bo3kysflmaq: it is swapped but not committed, and only its swap makes its row
2026/10/20 09:01:17 provision: a.shop.example.com: not minting import sd_hyiy6vuple2ar7k4ceguppd5xu: it is placed but not committed, and only its swap makes its row
2026/10/20 09:01:17 provision: a.shop.example.com: swapped for import sd_nohx6w67sozvdbeqmmjldpe7rm (the original route is journaled)
2026/10/20 09:01:17 provision: a.shop.example.com: not minting import sd_nohx6w67sozvdbeqmmjldpe7rm: it is swapped but not committed, and only its swap makes its row
2026/10/20 09:01:17 provision: a.shop.example.com: not minting import sd_nohx6w67sozvdbeqmmjldpe7rm: it is placed but not committed, and only its swap makes its row
2026/10/20 09:01:17 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/20 09:01:17 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/20 09:01:17 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/20 09:01:17 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/20 09:01:17 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/20 09:01:17 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/20 09:01:17 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/20 09:01:17 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/20 09:01:17 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/20 09:01:17 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/20 09:01:17 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/20 09:01:17 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/20 09:01:17 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/20 09:01:17 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/20 09:01:17 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/20 09:01:17 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/20 09:01:17 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/20 09:01:17 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/20 09:01:17 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/20 09:01:17 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/20 09:01:17 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/20 09:01:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:17 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/20 09:01:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:17 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/20 09:01:17 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/20 09:01:17 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/20 09:01:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/20 09:01:17 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/20 09:01:17 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/20 09:01:17 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	16.946s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.367s
ok  	github.com/carlosframework/platform/internal/relay	7.213s
ok  	github.com/carlosframework/platform/internal/release	23.852s
ok  	github.com/carlosframework/platform/internal/rollout	3.622s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.006s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.057s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.569s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.474s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	8.654s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.612s
ok  	github.com/carlosframework/platform/internal/status	0.058s
ok  	github.com/carlosframework/platform/internal/steering	0.005s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.169s
ok  	github.com/carlosframework/platform/internal/svcrole	0.003s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.003s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.537s
FAIL
make: *** [Makefile:18: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/harness/RUNLOG.md b/harness/RUNLOG.md

index 04ba8688c..87786e570 100644

--- a/harness/RUNLOG.md

+++ b/harness/RUNLOG.md

@@ -999,3 +999,33 @@ against the signed sums; `systemd-run --quiet --wait --pipe --collect -p Environ

(roster rev 10 -> 11, activations `[]`); `system status`: leo and dennis `current` v0.28.7.

- Nothing refused because the applying binary was neither the installed nor the guarded one.

Snapshot `rearm-released-v0.28.7`.

+## Run 6: 8a313548, G4 by the operator recovery "re-arm in place" (ruled ACCEPTED by the claim owner)

+A first pass (08:44-08:54Z, `blocks/rearm-roll.host.sh`) rolled leo to v0.28.8 that way, but its apply

+line carried `--quiet --collect --unit=...` and it checked the staged binary against the sums only;

+the owner's conditions arrived after it started. It was therefore **redone exactly by the ruling** from

+snapshot `rearm-released-v0.28.7` (leo and dennis v0.28.7, stable at v0.28.7, no activation held,

+v0.28.8's identity published, `/root/carlos-v0.28.8` staged root 0700). Driver

+`blocks/rearm-strict.host.sh`, leo commands `blocks/rearm-strict.leo.sh` (the runbook block, below).

+**G4 (recovery road): PASS** (08:56-09:00Z):

+```

+SUMS_SHA = IDENT_SHA = c890e10fcc1ad2cffe4e9dab9313323a31aadac252134d247acfe2840b006901

+1 08:56:18.131Z systemctl stop carlos-system-update.path -> ActiveState=inactive

+ 08:56:18.232Z carlos system update --channel stable --version v0.28.8 --file ... --yes -> pointed router/stable at v0.28.8

+2 cache: fetched by the agent (not staged by hand); its sha256 = the identity's router sha

+3 staged /root/carlos-v0.28.8 c890e10f... = signed sums = identity (root:root 700)

+4 systemd-run --wait --pipe -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 /root/carlos-v0.28.8 system apply

+ Running as unit: run-p302-i267569.service / Finished with result: success / status=0/SUCCESS / runtime 19.165s

+ (stdout of the apply itself: empty; stderr: empty)

+5 applied.json {"version": "v0.28.8", "channel": "stable", "at": "2026-10-20T08:56:53.717Z"}

+ result.json outcome "applied", promoted_at 08:56:18Z

+ guard identities: v0.28.5.json v0.28.7.json v0.28.8.json; completed.json d1959277cbc920a93ee8afe5884771f5

+ edge pid 513 exe = the release (sha256 of /proc/513/exe = c890e10f...), NRestarts=0, started 08:56:36Z

+ carlos v0.28.8, carlos.prev v0.28.7

+ leo's report 08:57:37Z: release v0.28.8, binary c890e10f..., activation_id d1959277..., activation_complete true

+ roster 09:00:18Z: rev 13, activations []

+ system status: kathleen-juggling stable v0.28.8 current (dennis behind -> v0.28.8 inside the 5 m spread)

+6 systemctl start carlos-system-update.path -> active; shred -u /root/carlos-v0.28.8 -> shredded

+```

diff --git a/harness/patches/f3-hostfloor-run-stdout.patch b/harness/patches/f3-hostfloor-run-stdout.patch

new file mode 100644

index 000000000..2b8043d56

--- /dev/null

+++ b/harness/patches/f3-hostfloor-run-stdout.patch

@@ -0,0 +1,14 @@

+--- /home/paulca/.cache/tmp/claude-1001/winbuild5/image_linux.go.orig 2026-10-20 09:19:29.341348605 +0100

++++ internal/hostfloor/image_linux.go 2026-10-20 09:19:29.345348502 +0100

+@@ -70,7 +70,10 @@

+ }

+ cmd := exec.CommandContext(ctx, "/proc/self/fd/3", args...)

+ cmd.ExtraFiles = []*os.File{f}

+- out, err := cmd.CombinedOutput()

++ // HARNESS F3 (the parent-side road, not a reviewed fix): stdout only, as the

++ // unguarded ops.run does, so a child's stderr (rootaws's ALERT, bootstrap's

++ // progress lines) never reaches the callers that parse the output.

++ out, err := cmd.Output()

+ return string(out), err

+ }

+ func ExecutingHash() (string, error) {

diff --git a/harness/scenarios/cohort1/blocks/acceptance.host.sh b/harness/scenarios/cohort1/blocks/acceptance.host.sh

new file mode 100755

index 000000000..4483cc782

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/acceptance.host.sh

@@ -0,0 +1,25 @@

+#!/bin/bash

+# Step 10, acceptance 1 to 4 on claimtrial2 (host root). HARNESS: the runbook's DOCS-T1 curl to leo's

+# public address becomes a curl from the infra container to leo's bridge address 203.0.113.21 with the

+# H13 CA; host=leo where dev says host=ip-172-31-19-180; "carlos logs" is read, and the sleep is also

+# read from leo's units. Usage: acceptance.host.sh 1|2|3|4

+set -uo pipefail

+HOST=claimtrial2.dev.harness.test

+incus file push /run/harness/keys/ca.pem infra/root/harness-ca.pem --uid 0 --gid 0 --mode 0644 -q

+wake() { echo "$(date -u +%T.%3NZ) $(incus exec infra -- curl -s -m 60 --cacert /root/harness-ca.pem -w ' [%{http_code} %{time_total}s]' --resolve $HOST:443:203.0.113.21 https://$HOST/ | tr '\n' ' ')"; }

+gen() { incus exec leo -- systemctl list-units --all --plain --no-legend "carlos-instance-gen@$HOST:*"; }

+asleep_wait() {

+ echo "waiting for the idle stop ($(date -u +%T))"

+ for i in $(seq 1 120); do

+ if [ -z "$(incus exec leo -- systemctl list-units --plain --no-legend --state=active,activating "carlos-instance-gen@$HOST:*")" ]; then echo "asleep at $(date -u +%T)"; break; fi

+ sleep 15

+ done

+ runuser -l operator -c "carlos logs --app claimtrial2 --account bab --console http://127.0.0.1:8090 --since 30m 2>&1 | tail -4"

+case $1 in

+1) wake; gen ;;

+2|3) asleep_wait; wake; gen ;;

+4) wake >/dev/null; incus exec leo -- bash -c 'pid=$(systemctl show -p MainPID --value "carlos-instance-gen@'"$HOST"':*"); echo "pid=$pid"; ls /proc/$pid/root/data/instances/; readlink /proc/$pid/ns/mnt /proc/1/ns/mnt'

+ runuser -l operator -c "carlos status --layout --console http://127.0.0.1:8090 2>&1 | grep -E 'kathleen|claimtrial2'" ;;

+esac

diff --git a/harness/scenarios/cohort1/blocks/b4-after.sh b/harness/scenarios/cohort1/blocks/b4-after.sh

new file mode 100755

index 000000000..b2406be7c

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/b4-after.sh

@@ -0,0 +1,17 @@

+#!/bin/bash

+# B4 step 5 (no clock), harness values; the TLS hello to the issuer is H13's certs.sh (host root, run separately).

+set -uo pipefail

+. ~/cohort1/values.env

+export AWS_PROFILE=harness

+aws s3 cp s3://harness-deployment/control/hosts/claimtrial2.dev.harness.test.json - | jq '{kind: .op.kind, exec: .op.exec, writer: .holder.writer_box}'

+aws s3 cp s3://harness-deployment/control/housekeeper-lease/lock.json - | jq -r '.owner'

+aws s3 ls s3://harness-deployment/control/certs/claimtrial2.dev.harness.test

+~/cohort1/ssm.sh eu-west-1 "$LEO" 'python3 -c "

+import sqlite3

+c=sqlite3.connect(\"file:/data/registry.db?mode=ro\",uri=True)

+for r in c.execute(\"select host,app,pool,hibernate from routes order by host\"): print(r)"'

+~/cohort1/ssm.sh eu-west-1 "$SOPHIE" 'python3 -c "

+import sqlite3

+c=sqlite3.connect(\"file:/data/registry.db?mode=ro\",uri=True)

+for r in c.execute(\"select host,app,pool,hibernate from routes order by host\"): print(r)"'

diff --git a/harness/scenarios/cohort1/blocks/b4-pair.sh b/harness/scenarios/cohort1/blocks/b4-pair.sh

new file mode 100644

index 000000000..20e0df716

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/b4-pair.sh

@@ -0,0 +1,25 @@

+# B4 step 4, the timed pair (runbook's b4-pair.sh), harness values: bucket, console, host, sophie's

+# report key status/boxes/ada-letterpress.json, profile harness.

+set -euo pipefail

+. ~/cohort1/box-helpers.sh

+export AWS_PROFILE=harness

+cd ~/cohort1/out

+DEV=http://127.0.0.1:8090

+H2=claimtrial2.dev.harness.test

+CR='cd /root/claim-trial && /opt/carlos/carlos system claims console-report --bucket harness-deployment --aws-region eu-west-1 --expect-revision "$(cat rev)" --console-id "$(cat console-id)" --public-key "$(cat release.pub)"'

+lm() { date -u -d "$(aws --region eu-west-1 s3api head-object --bucket harness-deployment --key status/boxes/ada-letterpress.json --query LastModified --output text)" +%s; }

+date -u +%FT%TZ

+box_inspect "$SOPHIE"

+ssm_run "$SOPHIE" "$CR --dry-run"

+LAST=$(lm)

+AGE=$(( $(date -u +%s) - LAST ))

+echo "sophie's report written $(date -u -d "@$LAST" +%FT%TZ), ${AGE}s ago"

+if [ "$AGE" -ge 210 ]; then

+ echo "next tick within 90s: waiting for it"

+ until [ "$(lm)" != "$LAST" ]; do sleep 5; done

+fi

+date -u +%FT%T.%3NZ

+ssm_run "$SOPHIE" "$CR"

+date -u +%FT%T.%3NZ

+carlos instances create --app claimtrial2 --account bab --host $H2 --console $DEV --no-prompt

+date -u +%FT%T.%3NZ

diff --git a/harness/scenarios/cohort1/blocks/b4-resume.sophie.sh b/harness/scenarios/cohort1/blocks/b4-resume.sophie.sh

new file mode 100644

index 000000000..27581ffa0

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/b4-resume.sophie.sh

@@ -0,0 +1,30 @@

+# B4 step 2 on sophie: the "Paused state" resume block, verbatim but for the bucket

+# (carlos-dev-640012953448 -> harness-deployment), stopping before its console-report (B4 step 2 says so).

+set -euo pipefail

+umask 077

+D=/root/claim-trial/paused-20261019

+[ "$(sha256sum /etc/carlos/claim-console.env | cut -c1-64)" = c1ae2900db31295090d2f4f2f9b5f6cdcca07e74545a6b1a9da039c3abf5c412 ]

+[ "$(sha256sum "$D/claim-console.env" | cut -c1-64)" = 5df17bac42a91a02d90584edc5476c045400af57e467b2ea0815ba50b7e31d03 ]

+[ "$(sha256sum "$D/91-claim-runtime.conf" | cut -c1-64)" = 815226c31a8ff4485f64ccaf9cbcd3d3a866105991aa5b03760c9890e9dae938 ]

+cmp "$D/91-claim-runtime.conf" /etc/systemd/system/console.service.d/91-claim-runtime.conf

+cp -p "$D/claim-console.env" /etc/carlos/.claim-console.env.resume

+mv -T /etc/carlos/.claim-console.env.resume /etc/carlos/claim-console.env

+cd /root/claim-trial

+PUB=$(cat release.pub)

+CID=$(cat console-id)

+REV=$(cat rev)

+/opt/carlos/carlos system claims console-config --roster /root/claim-trial/roster.json --expect-revision "$REV" \

+ --bucket harness-deployment --console-id "$CID" --public-key "$PUB" --enable-console-runtime --dry-run

+/opt/carlos/carlos system claims console-config --roster /root/claim-trial/roster.json --expect-revision "$REV" \

+ --bucket harness-deployment --console-id "$CID" --public-key "$PUB" --enable-console-runtime

+systemctl restart console.service

+systemctl is-active console.service

+# 7.4's checks (the environ read waits for the exec; see Runbook corrections C1)

+for i in $(seq 1 40); do p=$(systemctl show -p MainPID --value console.service); [ "$(readlink /proc/$p/exe)" = /opt/carlos/system/console/console ] && break; sleep 0.25; done

+echo "claim-console.env $(sha256sum /etc/carlos/claim-console.env | cut -c1-8) $(stat -c '%s %a %U' /etc/carlos/claim-console.env)"

+echo "pid $p exe $(readlink /proc/$p/exe) user $(stat -c %U /proc/$p) $(tr '\0' '\n' < /proc/$p/environ | grep '^CARLOS_HOST_CLAIM=')"

+systemctl show console.service -p NRestarts -p ExecMainStartTimestamp

+sleep 3

+journalctl -u console.service --since "$(systemctl show -p ActiveEnterTimestamp --value console.service)" --no-pager | grep -cE "run sweep: off on a host-claim console|seeds pass: off on a host-claim console" || true

+journalctl -u console.service --since "-2min" --no-pager | tail -12

+curl -s -o /dev/null -w "healthz %{http_code}\n" http://127.0.0.1:8090/healthz

diff --git a/harness/scenarios/cohort1/blocks/b4.sh b/harness/scenarios/cohort1/blocks/b4.sh

new file mode 100755

index 000000000..d7aa5201f

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/b4.sh

@@ -0,0 +1,35 @@

+#!/bin/bash

+# Block B4 from the operator (steps 1 to 3; step 4 is b4-pair.sh, step 5 b4-after.sh).

+# HARNESS: build = the wakecheck stand-in (~/cohort1/pw/linux-arm64, 4a79c656...), console and

+# domain values from values.env, bucket harness-deployment, profile harness.

+set -euo pipefail

+. ~/cohort1/values.env

+. ~/cohort1/box-helpers.sh

+export AWS_PROFILE=harness

+cd ~/cohort1/out

+echo "== 1 $(date -u +%FT%TZ)"

+sha256sum ~/cohort1/pw/linux-arm64

+aws s3 ls s3://harness-deployment/apps/bab/claimtrial2/ || echo "(nothing under apps/bab/claimtrial2/)"

+echo "== 2 box_inspect sophie $(date -u +%FT%TZ)"

+box_inspect "$SOPHIE" >/dev/null; echo "rev $(cat box-rev)"

+B=$(aws s3api head-object --bucket harness-deployment --key status/consoles/dev-console.json --query LastModified --output text); echo "dev-console.json before: $B"

+echo "== 2 resume block on sophie $(date -u +%FT%T.%3NZ)"

+../ssm.sh eu-west-1 "$SOPHIE" "$(cat ../blocks/b4-resume.sophie.sh)"

+for i in $(seq 1 40); do A=$(aws s3api head-object --bucket harness-deployment --key status/consoles/dev-console.json --query LastModified --output text); [ "$A" != "$B" ] && break; sleep 3; done

+echo "dev-console.json moved: $A ($(date -u +%FT%TZ))"

+aws s3 cp --quiet s3://harness-deployment/status/consoles/dev-console.json - | jq -c '{generated_at, host_claim_enabled: (.metrics.host_claim_enabled // .host_claim_enabled), release: (.metrics.release // .release)}' || true

+echo "== 3 $(date -u +%FT%TZ)"

+DEV=$CONSOLE

+date -u +%FT%TZ

+carlos apps create --app claimtrial2 --account bab --console $DEV

+date -u +%FT%TZ

+carlos ship --app claimtrial2 --account bab --console $DEV --version wc4 \

+ --label "dev claim trial tenant 2, wakecheck wc4 build" --no-prompt ~/cohort1/pw/linux-arm64

+date -u +%FT%TZ

+carlos promote --app claimtrial2 --account bab --console $DEV --no-prompt wc4 edge

+date -u +%FT%TZ

+CARLOS_DEPLOYMENT_BUCKET=harness-deployment \

+ carlos instances enable --app claimtrial2 --account bab --domain dev.harness.test --pool cohort1 --channel edge

+date -u +%FT%TZ

+aws s3 cp s3://harness-deployment/apps/bab/claimtrial2/instances.json -

+echo "B4 1-3 END $(date -u +%FT%TZ)"

diff --git a/harness/scenarios/cohort1/blocks/g5.host.sh b/harness/scenarios/cohort1/blocks/g5.host.sh

new file mode 100755

index 000000000..bbb63d1a4

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/g5.host.sh

@@ -0,0 +1,10 @@

+#!/bin/bash

+# Gate G5 driver (host root): dev's CARLOS_SWAP=overlap on leo and sophie first (seeded by hand: dev's

+# boxes have carried it since the 2026-10-14 ZDD arm; the harness boxes never had it), then B1

+# (operator), B2 on leo, sophie and dennis (attended root shells: incus exec), B5 again, snapshot post-b5.

+set -uo pipefail

+for b in leo sophie; do incus exec $b -- bash -c 'grep -q "^CARLOS_SWAP=" /etc/carlos/host.env || { printf "CARLOS_SWAP=overlap\n" >> /etc/carlos/host.env; systemctl restart carlos-edge.service; }; grep "^CARLOS_SWAP=" /etc/carlos/host.env; systemctl is-active carlos-edge.service'; done

+sleep 10

+echo "== B1"; runuser -l operator -c "bash ~/cohort1/blocks/b1.sh" 2>&1 | grep -v ALERT

+for b in leo sophie dennis; do echo "== B2 on $b $(date -u +%T)"; incus exec $b -- bash < /home/operator/cohort1/blocks/b2.box.sh; echo "[$b B2 exit=$?]"; done

+echo "== B5 again"; runuser -l operator -c "TMPDIR=/home/operator/cohort1/tmp bash ~/cohort1/blocks/b5.sh" 2>&1 | grep -v ALERT

diff --git a/harness/scenarios/cohort1/blocks/place-parent.host.sh b/harness/scenarios/cohort1/blocks/place-parent.host.sh

new file mode 100755

index 000000000..276400c18

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/place-parent.host.sh

@@ -0,0 +1,31 @@

+#!/bin/bash

+# The parent-side road, simulated (coordinator, 2026-10-20): place by hand on leo, inside the harness only,

+# the parent updater P = 8376a468 + harness patch + F3 (stdout-only hostfloor.Disk.Run), harness tag v0.28.6,

+# whose identity publish-identity wrote under the test release key. The guard accepts an image only if one

+# root-signed identity in /opt/carlos/system/guard/identities names its sha256 (hostfloor Disk.VerifyFile),

+# so the identity goes there first, in the form guard-arm left the v0.28.5 one; then /opt/carlos/carlos is

+# replaced atomically; carlos.prev is left as it is; the edge restarts through guard-exec.

+set -euo pipefail

+ID=/home/operator/cohort1/out/identity.v0.28.6.json

+P=/root/harness/release/v0.28.6/carlos-linux-arm64

+test "$(sha256sum < $P | cut -d' ' -f1)" = 243e7543e12d7713dd0bac2c3b1ccb78488234e35c5b16021df62da68a5dfe1f

+echo "== before"; incus exec leo -- bash -c 'ls -la /opt/carlos/system/guard/ /opt/carlos/system/guard/identities/; sha256sum /opt/carlos/system/guard/identities/* /opt/carlos/carlos /opt/carlos/carlos.prev | cut -c1-16,65-; /opt/carlos/carlos version 2>/dev/null'

+N=$(incus exec leo -- ls /opt/carlos/system/guard/identities/ | head -1)

+echo "existing identity file name: $N"

+incus file push $ID leo/root/identity.v0.28.6.json --uid 0 --gid 0 --mode 0600 -q

+incus file push $P leo/root/carlos-p --uid 0 --gid 0 --mode 0755 -q

+incus exec leo -- bash -s <<'B'

+set -euo pipefail

+G=/opt/carlos/system/guard/identities

+old=$(ls $G | head -1)

+mode=$(stat -c %a "$G/$old"); case "$old" in *.json) new=v0.28.6.json;; *) new=v0.28.6;; esac

+[[ "$old" =~ ^v[0-9] ]] || new=$(echo "$old" | sed 's/v0\.28\.5/v0.28.6/')

+[ "$new" != "$old" ] || { echo "cannot derive a name from $old"; exit 1; }

+install -m "$mode" -o root -g root /root/identity.v0.28.6.json "$G/.$new.tmp"; mv -T "$G/.$new.tmp" "$G/$new"

+install -m 0755 -o root -g root /root/carlos-p /opt/carlos/.carlos.harness-p; mv -T /opt/carlos/.carlos.harness-p /opt/carlos/carlos

+rm -f /root/carlos-p /root/identity.v0.28.6.json

+ls -la $G; /opt/carlos/carlos version 2>/dev/null

+systemctl restart carlos-edge.service; sleep 5; systemctl is-active carlos-edge.service

+systemctl show carlos-edge.service -p NRestarts -p ExecMainStartTimestamp; readlink /proc/$(systemctl show -p MainPID --value carlos-edge.service)/exe

diff --git a/harness/scenarios/cohort1/blocks/rearm-roll.host.sh b/harness/scenarios/cohort1/blocks/rearm-roll.host.sh

new file mode 100755

index 000000000..b9f4d4430

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm-roll.host.sh

@@ -0,0 +1,28 @@

+#!/bin/bash

+# Roll leo to v0.28.8 (8a313548) through the re-arm in place road, so leo's own updater becomes the

+# fixed one: stop carlos-system-update.path on leo (the 8376a468 updater would refuse and delete the

+# cache), promote v0.28.8 to stable, wait for the agent's cache, apply with /root/carlos-v0.28.8 in the

+# service's environment, start the path again. Dennis rolls by itself (unarmed).

+set -uo pipefail

+TAG=v0.28.8

+incus exec leo -- sh -c 'systemctl stop carlos-system-update.path; systemctl show carlos-system-update.path -p ActiveState'

+bash /root/harness/snapshot.sh create rearm-released-v0.28.7 | tail -1

+T0=$(date -u +%s)

+fresh() { runuser -l operator -c 'for b in ada-letterpress kathleen-juggling noor-marquetry; do date -u -d "$(aws s3api head-object --bucket harness-deployment --key status/boxes/$b.json --query LastModified --output text)" +%s; done' | sort -n | head -1; }

+for i in $(seq 1 60); do [ "$(fresh)" -gt "$T0" ] && break; sleep 10; done; echo "box reports fresh at $(date -u +%T)"

+incus exec leo -- sh -c 'systemctl stop carlos-system-update.path; systemctl show carlos-system-update.path -p ActiveState'

+echo "== promote $(date -u +%T)"; runuser -l operator -c "carlos system update --console http://127.0.0.1:8090 --channel stable --version $TAG --file ~/release-$TAG/carlos-linux-arm64 --platform linux-arm64 --yes" 2>&1 | grep -v ALERT

+incus exec leo -- bash -s <<B

+for i in \$(seq 1 120); do [ -f /data/system/router/$TAG/carlos ] && break; sleep 5; done

+echo "cache: \$(ls -la --time-style=+%T /data/system/router/$TAG/carlos 2>&1)"

+echo "== apply \$(date -u +%T.%3NZ)"

+systemd-run --quiet --wait --pipe --collect --unit=harness-rearm-roll -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 /root/carlos-$TAG system apply > /root/rearm-roll.out 2> /root/rearm-roll.err

+echo "rc=\$? \$(date -u +%T.%3NZ)"; echo "-- stdout:"; cat /root/rearm-roll.out; echo "-- stderr:"; cat /root/rearm-roll.err

+/opt/carlos/carlos version; /opt/carlos/carlos.prev version; ls /opt/carlos/system/guard/identities; cat /opt/carlos/system/router/result.json; echo; echo "completed: \$(cat /opt/carlos/system/guard/completed.json)"

+systemctl start carlos-system-update.path; systemctl show carlos-system-update.path -p ActiveState

+systemctl show carlos-edge.service -p ActiveState -p NRestarts -p ExecMainStartTimestamp

+rm -f /root/carlos-$TAG /root/SHA256SUMS.$TAG.txt /root/rearm*.out /root/rearm*.err

+insp() { runuser -l operator -c 'carlos system claims inspect --bucket harness-deployment --aws-region eu-west-1 --public-key "$(cat ~/release.pub)" 2>/dev/null | jq -c "{rev: .roster.revision, activations: (.roster.activations | keys)}"'; }

+for i in $(seq 1 40); do a=$(insp); case "$a" in *'"activations":[]'*) echo "$(date -u +%T) RELEASED $a"; break;; esac; sleep 15; done

+runuser -l operator -c "carlos system status --console http://127.0.0.1:8090" 2>&1 | grep -v ALERT

diff --git a/harness/scenarios/cohort1/blocks/rearm-strict.host.sh b/harness/scenarios/cohort1/blocks/rearm-strict.host.sh

new file mode 100755

index 000000000..9898c720c

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm-strict.host.sh

@@ -0,0 +1,29 @@

+#!/bin/bash

+# Drives rearm-strict.leo.sh from the host (operator steps in the operator shell), from snapshot

+# rearm-released-v0.28.7 (stable at v0.28.7, no activation held, v0.28.8 identity published,

+# /root/carlos-v0.28.8 staged on leo root 0700).

+set -uo pipefail

+TAG=v0.28.8

+T0=$(date -u +%s)

+bash /root/harness/snapshot.sh restore rearm-released-v0.28.7 | tail -1

+for i in $(seq 1 60); do [ "$(fresh)" -gt "$T0" ] && break; sleep 10; done; echo "box reports fresh at $(date -u +%T)"

+SUMS_SHA=$(grep ' carlos-linux-arm64$' /root/harness/release/$TAG/SHA256SUMS.txt | cut -d' ' -f1)

+IDENT_SHA=$(runuser -l operator -c "aws s3 cp --quiet s3://harness-deployment/control/system/router/releases/$TAG.json -" | python3 -c '

+import json,sys,base64

+d=json.load(sys.stdin)

+if "payload" in d and isinstance(d["payload"],str): d=json.loads(base64.b64decode(d["payload"]))

+c=d.get("current") or d.get("release") or d

+print(c["artifacts"]["linux-arm64"]["sha256"])')

+echo "SUMS_SHA=$SUMS_SHA IDENT_SHA=$IDENT_SHA"

+[ "$SUMS_SHA" = "$IDENT_SHA" ] || { echo STOP; exit 1; }

+B=$(sed -e "s/__TAG__/$TAG/" -e "s/__SUMS_SHA__/$SUMS_SHA/" -e "s/__IDENT_SHA__/$IDENT_SHA/" /home/operator/cohort1/blocks/rearm-strict.leo.sh)

+echo "== 1 stop the path $(date -u +%T.%3NZ)"; incus exec leo -- bash -c "$B" -- stop

+echo "== promote $(date -u +%T.%3NZ)"; runuser -l operator -c "carlos system update --console http://127.0.0.1:8090 --channel stable --version $TAG --file ~/release-$TAG/carlos-linux-arm64 --platform linux-arm64 --yes" 2>&1 | grep -v ALERT

+echo "== 2-6 on leo $(date -u +%T.%3NZ)"; incus exec leo -- bash -c "$B" -- apply; echo "leo block exit=$? $(date -u +%T.%3NZ)"

+echo "== 5 operator-side evidence"

+T1=$(date -u +%s); for i in $(seq 1 60); do t=$(runuser -l operator -c 'date -u -d "$(aws s3api head-object --bucket harness-deployment --key status/boxes/kathleen-juggling.json --query LastModified --output text)" +%s'); [ "$t" -gt "$T1" ] && break; sleep 10; done

+runuser -l operator -c 'aws s3 cp s3://harness-deployment/status/boxes/kathleen-juggling.json - | jq -c "{generated_at, release: .metrics.release, binary: .metrics.binary_sha256[0:16], activation_id: .metrics.activation_id, activation_complete: .metrics.activation_complete}"'

+for i in $(seq 1 40); do a=$(insp); case "$a" in *'"activations":[]'*) echo "$(date -u +%T) roster $a"; break;; esac; sleep 15; done

+runuser -l operator -c "carlos system status --console http://127.0.0.1:8090" 2>&1 | grep -v ALERT

diff --git a/harness/scenarios/cohort1/blocks/rearm-strict.leo.sh b/harness/scenarios/cohort1/blocks/rearm-strict.leo.sh

new file mode 100644

index 000000000..4ad53e14d

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm-strict.leo.sh

@@ -0,0 +1,45 @@

+# The operator recovery "re-arm in place", as ruled ACCEPTED by the claim owner (conditions 1 to 6),

+# leo-side commands in one root shell. TAG and the two expected sha256s are set at the top:

+# SUMS_SHA = the carlos-linux-arm64 line of the release's signed SHA256SUMS.txt (signature verified first)

+# IDENT_SHA = .current.artifacts["linux-arm64"].sha256 of control/system/router/releases/<TAG>.json

+# Step 1 (stop the path) runs BEFORE the operator's promote; steps 2 onwards after it.

+set -euo pipefail

+TAG=__TAG__; SUMS_SHA=__SUMS_SHA__; IDENT_SHA=__IDENT_SHA__

+case "${1:-}" in

+stop)

+ # 1. before the promote

+ systemctl stop carlos-system-update.path

+ systemctl show carlos-system-update.path -p ActiveState

+ ;;

+apply)

+ # 2. the agent's cache, checked against the signed pointer's sha (= the identity's router sha here)

+ for i in $(seq 1 120); do [ -f "/data/system/router/$TAG/carlos" ] && break; sleep 5; done

+ if [ -f "/data/system/router/$TAG/carlos" ]; then echo "cache: fetched by the agent"; else echo "cache: MISSING, staging by hand is needed"; exit 3; fi

+ test "$(sha256sum < "/data/system/router/$TAG/carlos" | cut -d' ' -f1)" = "$IDENT_SHA"

+ # 3. the staged binary against both

+ test "$(stat -c '%U:%G %a' "/root/carlos-$TAG")" = 'root:root 700'

+ H=$(sha256sum < "/root/carlos-$TAG" | cut -d' ' -f1)

+ test "$H" = "$SUMS_SHA"

+ test "$H" = "$IDENT_SHA"

+ echo "staged /root/carlos-$TAG $H = signed sums = identity"

+ # 4. the apply, exactly

+ systemd-run --wait --pipe -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 "/root/carlos-$TAG" system apply

+ # 5. evidence (box side)

+ cat /opt/carlos/system/router/applied.json; echo

+ cat /opt/carlos/system/router/result.json; echo

+ grep -q '"outcome": "applied"' /opt/carlos/system/router/result.json

+ test "$(grep -o '"version": "[^"]*"' /opt/carlos/system/router/applied.json)" = "\"version\": \"$TAG\""

+ ls -la /opt/carlos/system/guard/identities; test -f "/opt/carlos/system/guard/identities/$TAG.json"

+ echo "completed.json: $(cat /opt/carlos/system/guard/completed.json)"

+ sleep 3

+ P=$(systemctl show -p MainPID --value carlos-edge.service)

+ test "$(sha256sum < /proc/$P/exe | cut -d' ' -f1)" = "$IDENT_SHA" && echo "edge pid $P exe = the release"

+ systemctl show carlos-edge.service -p NRestarts -p ActiveState -p ExecMainStartTimestamp

+ test "$(systemctl show -p NRestarts --value carlos-edge.service)" = 0

+ /opt/carlos/carlos version; /opt/carlos/carlos.prev version

+ # 6. the path unit back, the staged binary shredded

+ systemctl start carlos-system-update.path

+ systemctl show carlos-system-update.path -p ActiveState

+ shred -u "/root/carlos-$TAG"; test ! -e "/root/carlos-$TAG" && echo "shredded /root/carlos-$TAG"

+ ;;

+esac

diff --git a/harness/scenarios/cohort1/blocks/rearm.host.sh b/harness/scenarios/cohort1/blocks/rearm.host.sh

new file mode 100755

index 000000000..af95116d4

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm.host.sh

@@ -0,0 +1,27 @@

+#!/bin/bash

+# "Re-arm in place" (Paul's choice relayed by platform-1c; harness-only EXPERIMENT), host root.

+# From g4-fail-8376a468 (router/stable at v0.28.7 = 8376a468, leo refused, activation held).

+# 1. stage the v0.28.8 (8a313548) linux-arm64 binary at /root/carlos-v0.28.8 on leo, root 0700, sha256

+# checked against the signed SHA256SUMS;

+# 2. run `/root/carlos-v0.28.8 system apply` as root with exactly carlos-system-update.service's

+# environment: EnvironmentFile=-/etc/carlos/host.env, UMask=0022, no Environment= (systemctl show),

+# in a transient unit so systemd builds the environment the same way.

+set -uo pipefail

+TAG=v0.28.8; R=/root/harness/release/$TAG

+incus file push $R/carlos-linux-arm64 leo/root/carlos-$TAG --uid 0 --gid 0 --mode 0700 -q

+incus file push $R/SHA256SUMS.txt leo/root/SHA256SUMS.$TAG.txt --uid 0 --gid 0 --mode 0600 -q

+incus exec leo -- bash -s <<B

+set -u

+cd /root

+echo "== staged \$(date -u +%T.%3NZ)"; stat -c '%n %U:%G %a %s' /root/carlos-$TAG

+echo "\$(grep ' carlos-linux-arm64\$' SHA256SUMS.$TAG.txt | cut -d' ' -f1) /root/carlos-$TAG" | sha256sum -c

+echo "== before"; /opt/carlos/carlos version; /opt/carlos/carlos.prev version; ls /opt/carlos/system/guard/identities; cat /opt/carlos/system/router/applied.json 2>/dev/null; echo; cat /opt/carlos/system/guard/completed.json 2>/dev/null; echo

+systemctl show carlos-edge.service -p MainPID -p ExecMainStartTimestamp

+echo "== system apply \$(date -u +%T.%3NZ)"

+systemd-run --quiet --wait --pipe --collect --unit=harness-rearm-apply -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 /root/carlos-$TAG system apply > /root/rearm.out 2> /root/rearm.err

+echo "rc=\$? \$(date -u +%T.%3NZ)"

+echo "-- stdout:"; cat /root/rearm.out; echo "-- stderr:"; cat /root/rearm.err

+echo "== after"; /opt/carlos/carlos version; /opt/carlos/carlos.prev version; sha256sum /opt/carlos/carlos /opt/carlos/carlos.prev | cut -c1-16,65-; ls -la /opt/carlos/system/guard/identities; cat /opt/carlos/system/router/applied.json 2>/dev/null; echo; cat /opt/carlos/system/router/result.json 2>/dev/null; echo; cat /opt/carlos/system/guard/completed.json 2>/dev/null; echo

+systemctl show carlos-edge.service -p MainPID -p ExecMainStartTimestamp -p ActiveState -p NRestarts; readlink /proc/\$(systemctl show -p MainPID --value carlos-edge.service)/exe; systemctl show carlos-edge.service -p ExecStart --value | head -c 200; echo

diff --git a/harness/scenarios/cohort1/blocks/rearm2.host.sh b/harness/scenarios/cohort1/blocks/rearm2.host.sh

new file mode 100755

index 000000000..4a932ba15

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm2.host.sh

@@ -0,0 +1,25 @@

+#!/bin/bash

+# Re-arm in place, second try: the first refused because the agent's candidate cache

+# (/data/system/router/<version>/carlos, systemCacheParts) is removed after every refusal. Here the

+# trigger carlos-system-update.path is stopped (not masked) so the old guarded updater cannot take the

+# request, the agent is restarted so it fetches the candidate again, and the hand apply runs once the

+# cache is there. The path unit is started again afterwards.

+set -uo pipefail

+TAG=v0.28.8

+incus exec leo -- bash -s <<B

+set -u

+echo "== stop the trigger, restart the agent \$(date -u +%T.%3NZ)"

+systemctl stop carlos-system-update.path; systemctl show carlos-system-update.path -p ActiveState

+systemctl restart carlos-edge.service; systemctl is-active carlos-edge.service

+for i in \$(seq 1 90); do [ -f /data/system/router/v0.28.7/carlos ] && break; sleep 2; done

+ls -la /data/system/router/ /data/system/router/v0.28.7 2>&1; ls -la --time-style=+%T /data/system-update-requested 2>&1

+echo "== system apply \$(date -u +%T.%3NZ)"

+systemd-run --quiet --wait --pipe --collect --unit=harness-rearm-apply2 -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 /root/carlos-$TAG system apply > /root/rearm2.out 2> /root/rearm2.err

+echo "rc=\$? \$(date -u +%T.%3NZ)"

+echo "-- stdout:"; cat /root/rearm2.out; echo "-- stderr:"; cat /root/rearm2.err

+echo "== after"; /opt/carlos/carlos version; /opt/carlos/carlos.prev version; sha256sum /opt/carlos/carlos /opt/carlos/carlos.prev | cut -c1-16,65-; ls -la /opt/carlos/system/guard/identities; cat /opt/carlos/system/router/applied.json 2>/dev/null; echo; cat /opt/carlos/system/router/result.json 2>/dev/null; echo; echo "completed.json: \$(cat /opt/carlos/system/guard/completed.json 2>/dev/null)"

+systemctl start carlos-system-update.path; systemctl show carlos-system-update.path -p ActiveState

+sleep 5

+systemctl show carlos-edge.service -p MainPID -p ExecMainStartTimestamp -p ActiveState -p NRestarts; readlink /proc/\$(systemctl show -p MainPID --value carlos-edge.service)/exe

diff --git a/harness/scenarios/cohort1/blocks/rearm3.host.sh b/harness/scenarios/cohort1/blocks/rearm3.host.sh

new file mode 100755

index 000000000..e116f648d

--- /dev/null

+++ b/harness/scenarios/cohort1/blocks/rearm3.host.sh

@@ -0,0 +1,21 @@

+#!/bin/bash

+# Re-arm in place, third try: the agent never re-fetches a refused promote (a refusal is terminal:

+# internal/host/systemstate.go:77, systemparticipation.go:43), so its cache is put back by hand

+# exactly where systemCacheParts puts it (/data/system/router/<version>/carlos, carlos-owned); the

+# apply re-verifies its sha256 against the signed pointer (stageCandidate) before using it.

+set -uo pipefail

+TAG=v0.28.8

+incus exec leo -- install -d -o carlos -g carlos -m 0755 /data/system/router/v0.28.7

+incus file push /root/harness/release/v0.28.7/carlos-linux-arm64 leo/data/system/router/v0.28.7/carlos --uid $(incus exec leo -- id -u carlos) --gid $(incus exec leo -- id -g carlos) --mode 0644 -q

+incus exec leo -- bash -s <<B

+set -u

+ls -la /data/system/router/v0.28.7; sha256sum /data/system/router/v0.28.7/carlos | cut -c1-16; cat /data/system/router/requested.json; echo

+echo "== system apply \$(date -u +%T.%3NZ)"

+systemd-run --quiet --wait --pipe --collect --unit=harness-rearm-apply3 -p EnvironmentFile=-/etc/carlos/host.env -p UMask=0022 /root/carlos-$TAG system apply > /root/rearm3.out 2> /root/rearm3.err

+echo "rc=\$? \$(date -u +%T.%3NZ)"

+echo "-- stdout:"; cat /root/rearm3.out; echo "-- stderr:"; cat /root/rearm3.err

+echo "== after"; /opt/carlos/carlos version; /opt/carlos/carlos.prev version; sha256sum /opt/carlos/carlos /opt/carlos/carlos.prev | cut -c1-16,65-; ls -la /opt/carlos/system/guard/identities; cat /opt/carlos/system/router/applied.json 2>/dev/null; echo; cat /opt/carlos/system/router/result.json 2>/dev/null; echo; echo "completed.json: \$(cat /opt/carlos/system/guard/completed.json 2>/dev/null)"

+sleep 5

+systemctl show carlos-edge.service -p MainPID -p ExecMainStartTimestamp -p ActiveState -p NRestarts; readlink /proc/\$(systemctl show -p MainPID --value carlos-edge.service)/exe