carlos / platform Public

census: console invite delivery proposal (awaiting platform-1e)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Paul Campbell pushed by claude agent, operated by paul@keymail.dev 5aef01dbc62cb46c6dd40a46969905fbfef241c7 parent 05cfbec
2 files changed, +231 −0
  • docs/superpowers/notes/census-proposal-console-invite-delivery.md +205 −0
  • internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv +26 −0

CI failed — run details

CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	320.751s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.868s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.423s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.716s
ok  	github.com/carlosframework/platform/internal/activator	251.406s
ok  	github.com/carlosframework/platform/internal/agentsock	0.020s
ok  	github.com/carlosframework/platform/internal/alerting	0.007s
ok  	github.com/carlosframework/platform/internal/analytics	0.026s
ok  	github.com/carlosframework/platform/internal/appconfig	2.505s
ok  	github.com/carlosframework/platform/internal/apperr	0.086s
ok  	github.com/carlosframework/platform/internal/applog	0.145s
ok  	github.com/carlosframework/platform/internal/awsinv	0.004s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.005s
ok  	github.com/carlosframework/platform/internal/boxid	0.582s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.011s
ok  	github.com/carlosframework/platform/internal/caps	0.014s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.709s
ok  	github.com/carlosframework/platform/internal/changelog	0.329s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.028s
ok  	github.com/carlosframework/platform/internal/clamd	0.057s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	407.446s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.773s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.005s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.005s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.377s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.005s
ok  	github.com/carlosframework/platform/internal/edge	45.080s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.133s
ok  	github.com/carlosframework/platform/internal/gate	1.655s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.018s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.157s
ok  	github.com/carlosframework/platform/internal/host	186.662s
ok  	github.com/carlosframework/platform/internal/hostactors	5.535s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.005s
ok  	github.com/carlosframework/platform/internal/hostbox	2.824s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.617s
ok  	github.com/carlosframework/platform/internal/hostenv	0.009s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.007s
ok  	github.com/carlosframework/platform/internal/hostexec	4.995s
ok  	github.com/carlosframework/platform/internal/hostfence	0.032s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.462s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	1.000s
ok  	github.com/carlosframework/platform/internal/hostops	1.637s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.003s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.496s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.147s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.002s
ok  	github.com/carlosframework/platform/internal/instancectl	5.228s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.747s
ok  	github.com/carlosframework/platform/internal/instancefs	0.008s
ok  	github.com/carlosframework/platform/internal/instancekey	0.002s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.010s
ok  	github.com/carlosframework/platform/internal/layout	1.574s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.004s
ok  	github.com/carlosframework/platform/internal/lease	9.822s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.010s
ok  	github.com/carlosframework/platform/internal/ledger	0.013s
ok  	github.com/carlosframework/platform/internal/mail	0.183s
ok  	github.com/carlosframework/platform/internal/maintenance	0.082s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.537s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.089s
ok  	github.com/carlosframework/platform/internal/metrics	0.007s
ok  	github.com/carlosframework/platform/internal/moves	21.118s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.820s
ok  	github.com/carlosframework/platform/internal/objstore	0.186s
ok  	github.com/carlosframework/platform/internal/ops	0.182s
ok  	github.com/carlosframework/platform/internal/park	0.213s
ok  	github.com/carlosframework/platform/internal/privatefile	0.009s
2026/10/18 09:05:01 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/18 09:05:01 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/18 09:05:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/18 09:05:01 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/18 09:05:01 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/18 09:05:01 provision: an app's records could not be listed: they are skipped
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:01 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/18 09:05:01 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/18 09:05:01 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/18 09:05:01 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/18 09:05:01 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/18 09:05:01 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/18 09:05:01 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/18 09:05:01 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/18 09:05:01 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/18 09:05:01 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/18 09:05:01 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/18 09:05:01 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/18 09:05:01 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/18 09:05:01 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:01 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:01 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:01 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:01 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:01 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:01 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:01 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:01 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/18 09:05:02 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/18 09:05:02 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/18 09:05:02 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/18 09:05:02 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:02 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:02 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan14RootReadCensus (4.75s)
    plan14_root_reads_test.go:841: root read census: 18 discrepancies
        changed root read cmd/console/main.go:serve; review class, task, sites and digest
        changed root read infra/modules/region-host/main.tf:external; review class, task, sites and digest
        changed root read infra/modules/region-host/variables.tf:external; review class, task, sites and digest
        changed root read internal/console/keymail.go:Keymail.do; review class, task, sites and digest
        changed root read internal/console/server.go:NewServer; review class, task, sites and digest
        changed root source envelope cmd/console
        changed root source envelope infra/modules/region-host
        changed root source envelope internal/console
        changed root source envelope internal/mail
        stale root read internal/console/keymail.go:Keymail.SendApp
        unclassified root read internal/console/keymail.go:Keymail.sealEnvelope file:Read@387
        unclassified root read internal/console/store.go:Store.CountPendingInvites file:QueryRow@102
        changed legacy declaration cmd/console/main.go:serve
        changed legacy declaration infra/modules/region-host/main.tf:external
        changed legacy declaration infra/modules/region-host/variables.tf:external
        changed legacy declaration internal/console/keymail.go:Keymail.SendApp
        changed legacy declaration internal/console/keymail.go:Keymail.do
        changed legacy declaration internal/console/server.go:NewServer
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io channel stable -> edge
2026/10/18 09:05:34 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/18 09:05:34 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/18 09:05:34 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/18 09:05:34 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io hibernate false -> true
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged acme.go.tito.io status-named false -> true
2026/10/18 09:05:34 provision: converged acme.go.tito.io status-named true -> false
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/18 09:05:34 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/18 09:05:34 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/18 09:05:34 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/18 09:05:34 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/18 09:05:34 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/18 09:05:34 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/18 09:05:34 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/18 09:05:34 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/18 09:05:34 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:34 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/18 09:05:34 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/18 09:05:34 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/18 09:05:34 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:34 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/18 09:05:34 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:34 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:34 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/18 09:05:34 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/18 09:05:35 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:35 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/18 09:05:35 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/18 09:05:35 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/18 09:05:35 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: converged acme.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/18 09:05:35 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/18 09:05:35 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/18 09:05:35 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/18 09:05:35 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/18 09:05:35 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/18 09:05:35 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/18 09:05:35 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/18 09:05:35 provision: dry-run: would converge owned.go.tito.io seed
2026/10/18 09:05:35 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/18 09:05:35 provision: converged owned.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/18 09:05:35 provision: converged owned.go.tito.io hibernate false -> true
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/18 09:05:35 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/18 09:05:35 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: removed retired static route site.go.tito.io (record gone)
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/18 09:05:35 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/18 09:05:35 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:35 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/18 09:05:35 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/18 09:05:35 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/18 09:05:35 provision: converged acme.go.tito.io channel stable -> edge
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/18 09:05:35 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/18 09:05:35 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/18 09:05:35 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/18 09:05:35 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/18 09:05:35 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/18 09:05:35 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/18 09:05:35 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/18 09:05:35 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/18 09:05:35 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/18 09:05:35 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/18 09:05:35 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/18 09:05:35 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/18 09:05:35 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/18 09:05:35 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:35 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/18 09:05:35 provision: a.shop.example.com: swapped for import sd_v4piqphuifhf6zscbhtkuv6e4m (the original route is journaled)
2026/10/18 09:05:35 provision: a.shop.example.com: import sd_v4piqphuifhf6zscbhtkuv6e4m committed: its gate is cleared and its journal row dropped
2026/10/18 09:05:35 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_hy3njxg3dbizihdokg4xcugh6u rolled back to its original route
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_hy3njxg3dbizihdokg4xcugh6u: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_hy3njxg3dbizihdokg4xcugh6u is cleaned up and its journal row retired
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_toeyksy5ugkxi35msdismfh6iy rolled back to its original route
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_toeyksy5ugkxi35msdismfh6iy: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_toeyksy5ugkxi35msdismfh6iy is cleaned up and its journal row retired
2026/10/18 09:05:36 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_vuawe7l3msz6dmex5qryx36q5e
2026/10/18 09:05:36 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/18 09:05:36 provision: dry-run: would converge a.shop.example.com seed source
2026/10/18 09:05:36 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/18 09:05:36 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/18 09:05:36 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_kzkljdxenv675skwym32g5j43q cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_ljl523whi6g4mbotak6wnltpd4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_clz5eu34vij3rxaxkh3hmju5vq is journaled, but this box cannot act on imports; its row is left alone
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_fpqca2l7qjk4nc22rsgbkk2mye is journaled, but this box cannot act on imports; its row is left alone
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_nxsnew4gscofzoioe4mji5egee is journaled, but this box cannot act on imports; its row is left alone
2026/10/18 09:05:36 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/18 09:05:36 provision: b.shop.example.com: import sd_bnvkpldo2txdvotqgmyyqrqcsy left alone this pass: the import journal could not be read
2026/10/18 09:05:36 provision: c.shop.example.com: import sd_wf5z7cz45tnb4gck5y3wpakyui left alone this pass: the import journal could not be read
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_b7grt7adjl3h3xgvw5rp75vfiu committed: its gate is cleared and its journal row dropped
2026/10/18 09:05:36 provision: a.shop.example.com: not converging import sd_o6226j7s72rsnzx7mu4ds2dxte: it is swapped but not committed, and the row on this box has no import gate
2026/10/18 09:05:36 provision: a.shop.example.com: not converging import sd_krqpj24ggbkmbbaa5thk3xuyze: it is swapped but not committed, and the row on this box has no import gate
2026/10/18 09:05:36 provision: a.shop.example.com: not converging import sd_rjigxuu3v5ykxshkeablvjg6cy: it is placed but not committed, and the row on this box has no import gate
2026/10/18 09:05:36 provision: a.shop.example.com: not converging import sd_5k6tl2pcevxi3uutyxpi65wj3i: it is placed but not committed, and the row on this box has no import gate
2026/10/18 09:05:36 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/18 09:05:36 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_ci77jomt6nd6fzl7al2wgf6ixi committed: its gate is cleared and its journal row dropped
2026/10/18 09:05:36 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:36 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:36 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/18 09:05:36 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_gdum37d4ghwbt2d6md4yoa3u6e: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_gdum37d4ghwbt2d6md4yoa3u6e rolled back (no box had swapped it)
2026/10/18 09:05:36 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/18 09:05:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:36 provision: removed instance route acme.go.tito.io (its seed sd_33eqbohk7y7f4gwvd4fjwnnpmi was aborted); the next pass rolls it back
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_33eqbohk7y7f4gwvd4fjwnnpmi: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_33eqbohk7y7f4gwvd4fjwnnpmi rolled back (no box had swapped it)
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_6pmwigkcmhfgbhzupx5357ewa4 has a row this pass may not remove; leaving the seed aborted
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_caiogarm4ezc7lluwnyfhslt2y rolled back (no box had swapped it)
2026/10/18 09:05:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:36 provision: removed instance route acme.go.tito.io (its seed sd_qcc3shaacdprymce3rev2eqzze was aborted); the next pass rolls it back
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_qcc3shaacdprymce3rev2eqzze has no route on this box: its local data is removed
2026/10/18 09:05:36 provision: acme.go.tito.io: aborted seed sd_qcc3shaacdprymce3rev2eqzze rolled back (no box had swapped it)
2026/10/18 09:05:36 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:36 provision: a.shop.example.com: swapped for import sd_c6kjs4tey3zezqcrabrkzuj3re (the original route is journaled)
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_c6kjs4tey3zezqcrabrkzuj3re rolled back to its original route
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_c6kjs4tey3zezqcrabrkzuj3re is cleaned up and its journal row retired
2026/10/18 09:05:36 provision: a.shop.example.com: swapped for import sd_vou3bf7bkgcd5c24cy24adypfq (the original route is journaled)
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_vou3bf7bkgcd5c24cy24adypfq rolled back to its original route
2026/10/18 09:05:36 provision: a.shop.example.com: import sd_vou3bf7bkgcd5c24cy24adypfq is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ldrgcz5y5decxctnwp62a2w2m4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ldrgcz5y5decxctnwp62a2w2m4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ldrgcz5y5decxctnwp62a2w2m4: the host's replica is left alone: its record no longer names this seed
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ldrgcz5y5decxctnwp62a2w2m4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_kht5nprrfbouc3p55as37gxcwm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_kht5nprrfbouc3p55as37gxcwm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_kht5nprrfbouc3p55as37gxcwm rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_kht5nprrfbouc3p55as37gxcwm is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_3f7egikxtrx2hkjp5r6giu52x4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_3f7egikxtrx2hkjp5r6giu52x4 rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_rqpb2rxwfn4bht3upjpizgdcgq (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_rqpb2rxwfn4bht3upjpizgdcgq is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ihr6rrbcnxwkbzwnmlgxnqe6xi (the original route is journaled)
2026/10/18 09:05:37 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ihr6rrbcnxwkbzwnmlgxnqe6xi left alone this pass: its record could not be read
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_izuoqtrny4uuoa76nrvpb5psf4 (the original route is journaled)
2026/10/18 09:05:37 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_izuoqtrny4uuoa76nrvpb5psf4 left alone this pass: its record could not be read
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_do2udm3434igqowzezbfozbney (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_do2udm3434igqowzezbfozbney: close the import gate: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_do2udm3434igqowzezbfozbney rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_do2udm3434igqowzezbfozbney is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_q3ikhr2tmh4i3qlwkosdtu6u5u (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_q3ikhr2tmh4i3qlwkosdtu6u5u: close the import gate: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_q3ikhr2tmh4i3qlwkosdtu6u5u rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_q3ikhr2tmh4i3qlwkosdtu6u5u is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_jfrb7hlcpw4h6qg4ahcyjxbxpq (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_jfrb7hlcpw4h6qg4ahcyjxbxpq rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_jfrb7hlcpw4h6qg4ahcyjxbxpq rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_jfrb7hlcpw4h6qg4ahcyjxbxpq is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_co5cgfmo2euqvt46bciwrrw6gq (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_co5cgfmo2euqvt46bciwrrw6gq rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_co5cgfmo2euqvt46bciwrrw6gq is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_qhtbyf2r27ceg5fmm6zlp72ytq (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_qhtbyf2r27ceg5fmm6zlp72ytq: retire its instance key: injected failure at retire-key
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_qhtbyf2r27ceg5fmm6zlp72ytq rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_qhtbyf2r27ceg5fmm6zlp72ytq is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_tnmsmyb6al73opldeqz2x76rb4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tnmsmyb6al73opldeqz2x76rb4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tnmsmyb6al73opldeqz2x76rb4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_6fn7nc2te4t3skkulc3khxy3m4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_6fn7nc2te4t3skkulc3khxy3m4: remove its local data: injected failure at remove-local
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_6fn7nc2te4t3skkulc3khxy3m4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_6fn7nc2te4t3skkulc3khxy3m4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_5zs6ndinqbrmqod4hi2v4hmsaa (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_5zs6ndinqbrmqod4hi2v4hmsaa rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_5zs6ndinqbrmqod4hi2v4hmsaa is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_5s7wzr2wdqza4spl2a3jbmrgsm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_5s7wzr2wdqza4spl2a3jbmrgsm: remove its local data: injected failure at remove-local-done
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_5s7wzr2wdqza4spl2a3jbmrgsm rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_5s7wzr2wdqza4spl2a3jbmrgsm is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_nigswsur6k6tute7g23p4jxa54 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_nigswsur6k6tute7g23p4jxa54 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_nigswsur6k6tute7g23p4jxa54 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_tzzw44ac7gsr2i6xj6pa5tdree (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tzzw44ac7gsr2i6xj6pa5tdree: restore the original route: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tzzw44ac7gsr2i6xj6pa5tdree rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tzzw44ac7gsr2i6xj6pa5tdree is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_zeqebjorh55r23j3ybguyeoutm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_zeqebjorh55r23j3ybguyeoutm: restore the original route: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_zeqebjorh55r23j3ybguyeoutm rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_zeqebjorh55r23j3ybguyeoutm is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_wwa2puezv4lfrz5fkyw6ydej5m (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_wwa2puezv4lfrz5fkyw6ydej5m is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_dpjckgof37rvz3b5echex25od4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_dpjckgof37rvz3b5echex25od4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_dpjckgof37rvz3b5echex25od4: delete its snapshot: injected failure at delete-snapshot
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_dpjckgof37rvz3b5echex25od4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_mfcwaf4qano3hbkyv75akmzxp4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_mfcwaf4qano3hbkyv75akmzxp4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_mfcwaf4qano3hbkyv75akmzxp4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_a75n6nir44nsjcykaagmaapsga (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_a75n6nir44nsjcykaagmaapsga rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_a75n6nir44nsjcykaagmaapsga: delete the host's replica: injected failure at delete-replica
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_a75n6nir44nsjcykaagmaapsga is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ilsxx5w7xxhuhnzpfqw4lbxkxy (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ilsxx5w7xxhuhnzpfqw4lbxkxy rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ilsxx5w7xxhuhnzpfqw4lbxkxy is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_4eedyslcg24sdj7zdvvlg44ynm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_4eedyslcg24sdj7zdvvlg44ynm rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_4eedyslcg24sdj7zdvvlg44ynm: retire its journal row: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_4eedyslcg24sdj7zdvvlg44ynm is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_r26st2pmbhb5lnfi4tpfjo3qee (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_r26st2pmbhb5lnfi4tpfjo3qee rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_r26st2pmbhb5lnfi4tpfjo3qee: retire its journal row: constraint failed: injected (1811)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_r26st2pmbhb5lnfi4tpfjo3qee is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_srxtp3a7i5ulu5gliknyaerlyu (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_srxtp3a7i5ulu5gliknyaerlyu rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_srxtp3a7i5ulu5gliknyaerlyu is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: mark import sd_srxtp3a7i5ulu5gliknyaerlyu rolled back: injected failure at cas
2026/10/18 09:05:37 provision: a.shop.example.com: aborted seed sd_srxtp3a7i5ulu5gliknyaerlyu rolled back (no box had swapped it)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ibzbqiiwo3r22em5kntbcofigu (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ibzbqiiwo3r22em5kntbcofigu rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ibzbqiiwo3r22em5kntbcofigu is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: aborted seed sd_ibzbqiiwo3r22em5kntbcofigu rolled back (no box had swapped it)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_xiv2tyl6sauzni5acfix3n4i5y (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_xiv2tyl6sauzni5acfix3n4i5y rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_xiv2tyl6sauzni5acfix3n4i5y rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_xiv2tyl6sauzni5acfix3n4i5y rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_xiv2tyl6sauzni5acfix3n4i5y is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ghpvvwldwjutm7753ep25oovgm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ghpvvwldwjutm7753ep25oovgm rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ghpvvwldwjutm7753ep25oovgm is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_vrzpmz3y26c5aplhuzxtqnh5ce (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vrzpmz3y26c5aplhuzxtqnh5ce rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vrzpmz3y26c5aplhuzxtqnh5ce is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ei34kaekrfi7yuvsdquin67wca (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ei34kaekrfi7yuvsdquin67wca rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ei34kaekrfi7yuvsdquin67wca is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_2tr7i4fwp3tiokiooo3ee4vlbu (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_2tr7i4fwp3tiokiooo3ee4vlbu rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_2tr7i4fwp3tiokiooo3ee4vlbu is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_euecx4tw6b7snupbgkytxsejoe (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_euecx4tw6b7snupbgkytxsejoe rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_euecx4tw6b7snupbgkytxsejoe is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_oojnpxmnvlrbtezewdckf6uii4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_oojnpxmnvlrbtezewdckf6uii4 rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_oojnpxmnvlrbtezewdckf6uii4 is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_bqnyofefdh7wydyp7cnxzvnhiu (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_bqnyofefdh7wydyp7cnxzvnhiu rolled back to its original route
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_bqnyofefdh7wydyp7cnxzvnhiu is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_u4rjvqn3vlcrp6miqyscoltj3e (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_u4rjvqn3vlcrp6miqyscoltj3e has no route on this box: its local data is removed and no route is put back
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_u4rjvqn3vlcrp6miqyscoltj3e is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_fc7uumleabwqmfs3xmnizxawey (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_4mykqwnkgouvmve5dksb2admzm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_mez7wotyel2oevyjf4mx2pnati (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_mez7wotyel2oevyjf4mx2pnati cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_ct5t664mu6ay7x4w5qbxm2wnxi (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_ct5t664mu6ay7x4w5qbxm2wnxi is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/18 09:05:37 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/18 09:05:37 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_5hddfajpoiavph33u7al3by5cq (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_556lzmjklzys7u7abimu6dqnry (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_4e4xqths33htnsht7xmtuplhzu (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_lwnuo4fx2ssshvr7hmy46m3cjy (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_6sclgryxybzy4tkzgdexrfw6dm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_6sclgryxybzy4tkzgdexrfw6dm rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_vkdyv3f3ubfsasctywyd43toxa (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vkdyv3f3ubfsasctywyd43toxa has no route on this box: its local data is removed and no route is put back
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vkdyv3f3ubfsasctywyd43toxa is cleaned up and its journal row retired
2026/10/18 09:05:37 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_vpsfa4wiozdcmlsjcadghomoym (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vpsfa4wiozdcmlsjcadghomoym: remove its local data: injected failure at remove-local
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_vpsfa4wiozdcmlsjcadghomoym is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_dhn3h6aodcikv2i753bi2nanza (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_dhn3h6aodcikv2i753bi2nanza: a route appeared at the host, so its local database is left and the rollback waits
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_kpjocwujxm25rwmwab5pha6oz4 (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_kpjocwujxm25rwmwab5pha6oz4 rollback deferred: no fence generation: registry busy
2026/10/18 09:05:37 provision: a.shop.example.com: swapped for import sd_tya5ujb7lzapfk7yqekoepuogm (the original route is journaled)
2026/10/18 09:05:37 provision: a.shop.example.com: import sd_tya5ujb7lzapfk7yqekoepuogm rollback deferred: no fence generation: the generation source answered 0
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_xt3zm5ntxk5kjvzd3ctltrlswa (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_kaxxzypihwj2miscdqwvw6aaou (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_4rg65eow2szstgvgxyzfuk7ety (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_otisot4hl6arnnyuwtq2ib3vxe (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_otisot4hl6arnnyuwtq2ib3vxe rolled back to its original route
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_otisot4hl6arnnyuwtq2ib3vxe is cleaned up and its journal row retired
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_goboclh3loxul34yfbec3ajjsi (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_goboclh3loxul34yfbec3ajjsi rolled back to its original route
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_goboclh3loxul34yfbec3ajjsi is cleaned up and its journal row retired
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_czzpkury5qtu7azkfwdcxydqmy (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_czzpkury5qtu7azkfwdcxydqmy rolled back to its original route
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_czzpkury5qtu7azkfwdcxydqmy is cleaned up and its journal row retired
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_mtcjs7tfuwaln7dedaeygmxg5u (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_mtcjs7tfuwaln7dedaeygmxg5u: retire its instance key: the env file is a symlink
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_mtcjs7tfuwaln7dedaeygmxg5u rolled back to its original route
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_mtcjs7tfuwaln7dedaeygmxg5u is cleaned up and its journal row retired
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_xod2gwxqrbiou5zq4x37vrgg4i (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_k5vpeicbmhdnql7wtnp6r6q2ce (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_gg22ms3e2say5zzw5dr7izz2um refused: there is no route at a.shop.example.com to replace
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_2ow7ceptiqdaqql4tn6rqed7vq refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_ora263zrotefyy66cm5zzudkja refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_qyttyzhyeiuprwp54cwh34x6eq refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_2rx6sl6gpns6x3tehrjai22aye refused: the route belongs to app other
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_ebdz4jvqma6637ykxqjgllemmu refused: the route is filed under another account
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_thgzxs24vh6jrtrml52we6ae6u refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_5hqotojbukdva3yupgpvh2afqi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_ztupdu6dgl2fatwth6qz2up5ra refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_bjluh4xssl5g2io4q52uggfzde refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_if4gauuay57gjn3ihgtjaoypwa refused: the route is not an address route this import can take over (socket)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_fnoqh6snloadfk3un5iyzoulpq refused: the route is not an address route this import can take over (no address)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_erlpgppfa7vhu5eblg6bfcwami refused: the route is not an address route this import can take over (provisioned)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_ocieeoenqv4jspet445rqys4jy refused: the route is not an address route this import can take over (kind static)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_xjqy5omcfxyxlwaxsaunw4lu6y refused: the route is not an address route this import can take over (backing)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_igp7rt3573kzmjux2h2duoaeti refused: the route is not an address route this import can take over (tunnel)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_5yxfgjgl7nfn6pd7cd5udf2nxe refused: the route is not an address route this import can take over (caps)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_mpxeombemq7d42kwupk6cvatqu refused: the route is not an address route this import can take over (platform)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_r4vatlkishdt7zefuwoilfgnia refused: the route is not an address route this import can take over (canary)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_fw65c2fcwmz44nluajbinohbse refused: the route is not an address route this import can take over (kind sidecar)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_y6idz2rszv5eqps6hdcyhikkf4 refused: the route is not an address route this import can take over (region)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_pi4mfy5iicedmj6ewvtfk4d72a refused: the route is not an address route this import can take over (fleet_box)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_fniffkpws4bqiz5lastdpujr2e refused: the route is not an address route this import can take over (hibernate)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_byxv7gbz6qfjuxdbe335exxfs4 refused: the route is not an address route this import can take over (claim_owner)
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_ty2ddu2wat3otmy5wnxpqrvsn4 refused: this box does not run instances nested
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_sv56msn24j5rwo7fwg2o7nwbsa refused: this box does not run instances nested
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_5srv3wwfjjhlsexoujh64s6mgq refused: claim control is on for this box
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_sakvwwunfdlovnckufu23nuzta (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_3is2s3rbfw6m5d3n4rdb4ko7fi (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_2mz5govzr73np5hdhvmtx2qkse: its verify hash is not a sha256
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_tpr7tv7vxodvdsghimldatsyga: its verify hash is not a sha256
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_ptkdvl6rg5qenctj53gvocagre: its verify hash is not a sha256
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/18 09:05:38 provision: A.shop.example.com/..: not swapping for import sd_hfiypn6nzfcu43me6aaerlmavm: its host or seed id is malformed (seeds: not a host)
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_q6zb7fofcj2zkqevfzomhzovai: its record does not describe a nested, hibernating instance
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_ffs7byajb7ih67uutc3whqhsby: its record does not describe a nested, hibernating instance
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_h3goquwmndeqouo33ga4gtktsa: its record does not describe a nested, hibernating instance
2026/10/18 09:05:38 provision: a.shop.example.com: not swapping for import sd_qiio2vtzkizvwmowa36a4a7rfu: its record does not describe a nested, hibernating instance
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_3tgyrkcj2vszc7tv3knvpyrypu (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_gjj2ma7vvewoq2j2u645muunk4 (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_mfibv3kd7rcjm3h55j2yx4j3tm (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/18 09:05:38 provision: dry-run: would consider swapping a.shop.example.com for import sd_7auz33ljoallheb3bnp5yyhzvi
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_hcgd5w2zzhspyl5f66cssw5bki rolled back to its original route
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_hcgd5w2zzhspyl5f66cssw5bki: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_hcgd5w2zzhspyl5f66cssw5bki is cleaned up and its journal row retired
2026/10/18 09:05:38 provision: a.shop.example.com: import sd_tnkgwxeji3hzb7oykfcuzspxje left alone: the import journal holds seed sd_n3rj2l3rr2rawgtu3edxfwdtfy at swapped
2026/10/18 09:05:38 provision: a.shop.example.com: not minting import sd_i2fqtu5ru5oryg5v6hmsh4yt3u: it is swapped but not committed, and only its swap makes its row
2026/10/18 09:05:38 provision: a.shop.example.com: not minting import sd_atfu6yedqy7ljpzz4tszg6m3c4: it is placed but not committed, and only its swap makes its row
2026/10/18 09:05:38 provision: a.shop.example.com: swapped for import sd_nijtciotbootqtqe6ma545n32a (the original route is journaled)
2026/10/18 09:05:38 provision: a.shop.example.com: not minting import sd_nijtciotbootqtqe6ma545n32a: it is swapped but not committed, and only its swap makes its row
2026/10/18 09:05:38 provision: a.shop.example.com: not minting import sd_nijtciotbootqtqe6ma545n32a: it is placed but not committed, and only its swap makes its row
2026/10/18 09:05:38 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/18 09:05:38 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/18 09:05:39 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/18 09:05:39 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/18 09:05:39 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/18 09:05:39 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/18 09:05:39 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/18 09:05:39 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/18 09:05:39 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/18 09:05:39 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/18 09:05:39 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/18 09:05:39 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/18 09:05:39 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/18 09:05:39 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/18 09:05:39 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/18 09:05:39 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/18 09:05:39 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/18 09:05:39 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/18 09:05:39 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/18 09:05:39 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/18 09:05:39 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/18 09:05:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:39 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/18 09:05:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:39 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/18 09:05:39 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/18 09:05:39 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/18 09:05:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/18 09:05:39 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/18 09:05:39 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/18 09:05:39 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	38.068s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.010s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.483s
ok  	github.com/carlosframework/platform/internal/relay	7.239s
ok  	github.com/carlosframework/platform/internal/release	22.637s
ok  	github.com/carlosframework/platform/internal/rollout	3.857s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.062s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.574s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.516s
ok  	github.com/carlosframework/platform/internal/seeds	0.012s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	10.030s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.940s
ok  	github.com/carlosframework/platform/internal/status	0.066s
ok  	github.com/carlosframework/platform/internal/steering	0.007s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.346s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.005s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.583s
FAIL
make: *** [Makefile:18: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/notes/census-proposal-console-invite-delivery.md b/docs/superpowers/notes/census-proposal-console-invite-delivery.md
new file mode 100644
index 000000000..0fd573a37
--- /dev/null
+++ b/docs/superpowers/notes/census-proposal-console-invite-delivery.md
@@ -0,0 +1,205 @@
+# Census: console invite delivery
+
+Status: PROPOSED, awaiting platform-1e. Nothing here is ruled. The overlay
+is drafted, the test does not load it yet, and the seal in the test is not
+moved. platform-1e rules as the Plan 14 census owner.
+
+Branch `design-console-invite-delivery`, head 05cfbec0, with origin/main
+merged in at c80e2f3b. Design:
+`docs/superpowers/specs/2026-09-28-console-invite-delivery-design.md`.
+
+## What changed
+
+An owner's invite goes out by Keymail federation first (into the invitee's
+main inbox, sent as the console, no grant needed). If Keymail can't deliver,
+it goes by the console's own email. If that fails too, the owner gets the link
+to pass on. Two limits refuse an invite before its row exists: 20 waiting per
+account, and 20 an hour.
+
+What the root-read census sees:
+
+- `internal/console/keymail.go`: `Keymail.do` returns a typed
+ `keymailError` for a non-200 answer. SendApp's envelope sealing moves,
+ unchanged, into a new `Keymail.sealEnvelope`, which `SendApp` and the new
+ `SendFederated` (keymailfed.go) share.
+- `internal/console/server.go`: `NewServer` sets the invite delivery fields.
+ `handleInvite` is rewritten, but it has no read site of its own.
+- `internal/console/store.go`: new `Store.CountPendingInvites`.
+- `cmd/console/main.go`: `serve()` builds the console mailer
+ (`consoleMailer`) and starts its identity ensure in a goroutine.
+- `infra/modules/region-host`: an optional `ses:SendEmail` grant on the host
+ role (`main.tf`), and the two variables that switch it on (`variables.tf`).
+- New files with no read site: `internal/console/consolemail.go`,
+ `keymailfed.go`, `keymailpow.go`, `internal/mail/consolemail.go`,
+ `internal/mail/sessend.go`. `internal/mail/walk.go` gains the console-mail
+ teardown guards.
+
+None of this runs as root. The root `carlos` binary links neither
+`internal/console` nor `internal/mail`: `go list -deps .` names neither, and
+the only importers of `internal/mail` are `cmd/console` and
+`internal/console`. The `.tf` files are run by tofu on an operator's machine.
+No binary embeds them and no box reads them.
+
+## Root-read census (TestPlan14RootReadCensus)
+
+Overlay `internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv`,
+to load last, after `plan14-root-reads-box-publish-record.tsv`.
+
+After the merge the test reports 18 discrepancies. With the overlay loaded,
+17 clear and one is left, "changed legacy freeze; separate scope ruling
+required", which is the seal. With the proposed seal set as well, every
+`TestPlan14*` test passes. I checked that on a scratch edit of the test and
+then reverted it.
+
+Every row is accepted-legacy and tagged `rev3=PROPOSED-console-invite-delivery`.
+Each basis names the executing identity, in the form census rulings carlos-run
+and seeded-instances use for console rows ("the console (cmd/console serve
+under console.service, user carlos-console): ...").
+
+### Changed units, re-frozen with their read sites unchanged
+
+Each of these was a "changed root read" and a "changed legacy declaration".
+
+1. **`cmd/console/main.go:serve`**: data-literal@3446,4547,4784, digest
+ `a9ecdd3b…9825`. Main froze it under seeded-instances at
+ @3331,4432,4669. The same three literals moved by 115 bytes, which is the
+ one inserted line at main.go:297 (`consoleMail, ensureConsoleMail :=
+ consoleMailer(...)`). The literals are the `CARLOS_REGISTRY` default
+ `/data/registry.db` (main.go:333) and the `CONSOLE_DB` default
+ `/data/console/console.db`, used twice (main.go:352 and 355). The other
+ changes are `ConsoleMail: consoleMail` in Config, and a goroutine bounded at
+ two minutes that runs `ensureConsoleMail` (main.go:457). The mailer is built
+ over the release store, provisioner and DNS writer that serve already holds.
+ `consoleMailer` itself (main.go:995) has no read site.
+ **Proposed:** accepted-legacy, the console.
+
+2. **`internal/console/server.go:NewServer`**: data-literal@9108, digest
+ `4d82a686…b032`. Main had it at @8926. The literal is the route pattern
+ `"GET /a/{sqid}/apps/{app}/logs/data"` (server.go:1416), not a path. The
+ change sets `consoleMail`, `inviteTimeout` and `inviteKeymailShare`
+ (server.go:1309), and binds `sendFederated` beside `sendApp`
+ (server.go:1329). No goroutine is started. The record-write census
+ re-digested the same unit in 05cfbec0.
+ **Proposed:** accepted-legacy, the console.
+
+3. **`internal/console/keymail.go:Keymail.do`**: file:ReadAll@594, which is
+ the same site as on main. Only the digest moved, to `e2f193e4…e7be`. The
+ read is `io.ReadAll(io.LimitReader(res.Body, 1<<20))` (keymail.go:344),
+ which reads Keymail's HTTP response body. The change is the error value
+ (keymail.go:356). Its Error() text is the same as before, and it adds
+ Status and Msg so that `IsKeymailBlocked` can classify the answer.
+ **Proposed:** accepted-legacy, the console.
+
+4. **`infra/modules/region-host/main.tf:external`**: digest
+ `6ae47ec3…9c5b`. Adds `aws_iam_role_policy.host_console_mail`
+ (main.tf:702). It has count 0 unless `console_mail_from` is set. It grants
+ `ses:SendEmail` on the one sending identity, the `carlos-bab` configuration
+ set and its tenants, on condition that `ses:FromAddress` equals
+ `console_mail_from` (main.tf:717).
+ **Proposed:** accepted-legacy, tofu on an operator's machine. No read is
+ added. See question 3: this is an authority grant on the box's role, not a
+ read.
+
+5. **`infra/modules/region-host/variables.tf:external`**: digest
+ `ffdad585…250e`. Adds `console_mail_from` (variables.tf:221, validated as
+ one lowercase address) and `console_mail_region` (variables.tf:231). Both
+ are empty by default.
+ **Proposed:** accepted-legacy, tofu on an operator's machine.
+
+### New units
+
+6. **`internal/console/keymail.go:Keymail.sealEnvelope`**:
+ "unclassified root read … file:Read@387", digest `b140fde1…7658`.
+ `file:Read@387` is `rand.Read(idb)` at keymail.go:258, and `rand` is
+ `crypto/rand` (keymail.go:21). It reads the 16-byte envelope id from the
+ kernel's random source. It reads no file, store or box state. It is the
+ site main froze in `SendApp` as file:Read@949 (accepted-legacy, J4
+ root-input), moved over unchanged with the rest of the sealing.
+ **Proposed:** accepted-legacy, the console, the same class as the site it
+ came from.
+
+7. **`internal/console/store.go:Store.CountPendingInvites`**:
+ "unclassified root read … file:QueryRow@102", digest `1733078d…18e5`. One
+ SQLite `QueryRow` (store.go:1400): `SELECT COUNT(*) FROM invites WHERE
+ account_id = ? AND accepted_at = 0 AND expires_at >= ?`. It runs on the
+ console's own database (`CONSOLE_DB`). Its one caller is handleInvite's
+ pending cap (server.go:2446), and it can only refuse an invite. Its
+ siblings `Store.PendingInvites`, `CreateInvite` and `RevokeInvite` are
+ accepted-legacy (J4 root-input) on main, and so are all 84 `store.go`
+ rows.
+ **Proposed:** accepted-legacy, the console.
+
+### Retired unit
+
+8. **`internal/console/keymail.go:Keymail.SendApp`**: "stale root read" and
+ "changed legacy declaration". It is still declared (keymail.go:279) and
+ reads nothing now. Its one read moved into `sealEnvelope`, which it calls
+ at keymail.go:293. A frozen legacy row cannot have empty kinds (the
+ compare reports it stale), so it has to be retired, not re-frozen.
+ **Proposed:** `@remove` and `@removed … H3`, the form census ruling
+ carlos-run used for `apiSession.getJSON` and `ensureExe`. The loader
+ accepts an H3 removal only with a `census-ruling-` basis, so the row reads
+ `census-ruling-console-invite-delivery (PROPOSED, awaiting platform-1e):
+ …`. A removal is not part of the seal.
+
+### Source envelopes
+
+9. The four "changed root source envelope" rows are re-pinned:
+ - `cmd/console` to `2af70021…c0c6`
+ - `infra/modules/region-host` to `82e90b10…56e7`
+ - `internal/console` to `18fc22e0…5756`
+ - `internal/mail` to `c45dd340…e317`
+
+ The scan finds no read site in any new file. In the changed files, the only
+ read-site changes are units 1 to 8. One thing the scanner does not see:
+ `mail.NewSESEmailSender` (sessend.go:22) calls
+ `awsconfig.LoadDefaultConfig`. That is the console's own credential
+ chain, which on a box is the host role. It is already listed in
+ `TestClaimAuthoritySourceCensus` as a send-only SES client (05cfbec0).
+
+### Seal
+
+The overlay adds seven `@legacy` rows, which takes the frozen set from 2147
+to 2154. Computed with the overlay loaded after box-publish-record:
+
+- As drafted (the marker kept on ruling, as census ruling seed did):
+ **`5ebadd0439ec247784a13739c74ab7363e22a3a9fb8da3d7ef03a76f1ab75468`**
+- If platform-1e wants the tag rewritten to
+ `rev3=census-ruling-console-invite-delivery` instead:
+ `fcdf9de0ba39db40d6bc7d1d2137d4f40d8248df8d286a380b2eae4e8b31d7a3`
+
+The test edit, for platform-1e to make or authorize. It goes after the
+box-publish-record load in `TestPlan14RootReadCensus`:
+
+```go
+ // Census overlay console-invite-delivery (console invite delivery),
+ // loaded last, under census-ruling-console-invite-delivery (platform-1e):
+ // ... the ruling's lines ...
+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv"), &inv, true); err != nil {
+ t.Fatal(err)
+ }
+ seal = "5ebadd0439ec247784a13739c74ab7363e22a3a9fb8da3d7ef03a76f1ab75468"
+```
+
+## Questions for platform-1e
+
+1. Do you accept the seven units (1 to 7) as accepted legacy, under the
+ executing identities named (the console as carlos-console, and tofu on an
+ operator's machine), with seal `5ebadd04…5468`?
+2. Should `Keymail.SendApp` be retired by an H3 census-ruling removal (the
+ carlos-run getJSON form), now that its only read lives in `sealEnvelope`?
+3. The `ses:SendEmail` grant is on the shared host role. Any process that
+ holds the box's role credentials (root, the agent or the console) can send
+ as `console_mail_from`, and only as that address. That is a grant, not a
+ read. Is it inside this census's scope, or does it need its own ruling
+ elsewhere?
+4. Keep the `PROPOSED-console-invite-delivery` marker in the frozen bases
+ (seal `5ebadd04…`), or rewrite it to a `census-ruling-` tag (seal
+ `fcdf9de0…`)?
+5. This is not a census item, but you own host claims, so it is flagged for
+ you. The console mailer is built over the raw release store, not
+ `claimMailStore()`. Its `EnsureDomain` and `VerifyDomain` on
+ `ops/console-mail` would skip the claim mail gate when HostClaim is on.
+ Switching to the gated store would fail today, because `console-mail` is
+ not a registered app. HostClaim is off by default, so nothing changes now.
+ Should this block the merge, or wait for a HostClaim design decision?
diff --git a/internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv b/internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv
new file mode 100644
index 000000000..b48449b30
--- /dev/null
+++ b/internal/provision/testdata/plan14-root-reads-console-invite-delivery.tsv
@@ -0,0 +1,26 @@
+# Plan 14 census overlay console-invite-delivery (console invite delivery: Keymail federation first, then the console's own email, then the hand-off link; docs/superpowers/specs/2026-09-28-console-invite-delivery-design.md), loaded last, after box-publish-record. PROPOSED, NOT RULED: every row is a draft for platform-1e, the census owner; the proposal and its questions are docs/superpowers/notes/census-proposal-console-invite-delivery.md. Until platform-1e rules, the test does not load this file and its seal is not moved.
+# Every unit here runs in the console (cmd/console, user carlos-console) or in tofu on an operator's machine. The root carlos binary links neither internal/console nor internal/mail (go list -deps . names neither; only cmd/console and internal/console import internal/mail). No unit here makes or feeds a root decision, so each is proposed accepted legacy, its basis naming the executing identity, as main's console rows are (census rulings carlos-run and seeded-instances).
+# The rev3 tag is PROPOSED-console-invite-delivery. If ruled as written, the marker text is kept (census ruling seed's practice), because frozen rows fingerprint their basis; the proposed seal in the note is computed with it.
+# Five changed units are re-frozen with their read sites unchanged (serve, NewServer, Keymail.do, and the two region-host files). Two units are new: Keymail.sealEnvelope (crypto/rand.Read, the site SendApp held) and Store.CountPendingInvites (one SQLite QueryRow). Keymail.SendApp is still declared and reads nothing now, so it is retired as census ruling carlos-run retired apiSession.getJSON and ensureExe.
+@legacy f577afc656d082a1433a824c2c2f00715a36c1ecdc7c1899c7db248767483835 cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the console mailer built once (consoleMailer, over the release store, mail provisioner and DNS writer serve already holds), handed to NewServer as Config.ConsoleMail, and its identity ensure started in a goroutine bounded at two minutes beside the alert watcher; read sites unchanged: the same three /data literals (the registry and console database defaults), each moved by the one inserted line data-literal@3446,data-literal@4547,data-literal@4784 a9ecdd3b5d5155bf81f72ae95fd71c9b5a479873f0f62dd9cc1747f3411b9825
+cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the console mailer built once (consoleMailer, over the release store, mail provisioner and DNS writer serve already holds), handed to NewServer as Config.ConsoleMail, and its identity ensure started in a goroutine bounded at two minutes beside the alert watcher; read sites unchanged: the same three /data literals (the registry and console database defaults), each moved by the one inserted line data-literal@3446,data-literal@4547,data-literal@4784 a9ecdd3b5d5155bf81f72ae95fd71c9b5a479873f0f62dd9cc1747f3411b9825
+@legacy a85ea996fc7d687c114ca9ca5475ef5f9b94fe9b2c38e678f47ae7dcbf54b4c1 infra/modules/region-host/main.tf external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's module with one optional aws_iam_role_policy, host_console_mail, count 0 unless console_mail_from is set; it grants the host role ses:SendEmail on the one sending identity, the carlos-bab configuration set and its tenants, conditioned on ses:FromAddress equal to console_mail_from; no read is added and nothing on a box reads the file file:external@0 6ae47ec38e0dbace114634c73575dc00970461521c3bce3e36baeb7942229c5b
+infra/modules/region-host/main.tf external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's module with one optional aws_iam_role_policy, host_console_mail, count 0 unless console_mail_from is set; it grants the host role ses:SendEmail on the one sending identity, the carlos-bab configuration set and its tenants, conditioned on ses:FromAddress equal to console_mail_from; no read is added and nothing on a box reads the file file:external@0 6ae47ec38e0dbace114634c73575dc00970461521c3bce3e36baeb7942229c5b
+@legacy 210e2c3df25a8b865d8f60924e195192c56a5e6cefac87eca9580989afee69c8 infra/modules/region-host/variables.tf external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's variables with console_mail_from (validated as one lowercase address) and console_mail_region, both empty by default; no read is added and nothing on a box reads the file file:external@0 ffdad585e18d905f0f4a97b9b666777200fd505868bcd5bde0cfeae216b6250e
+infra/modules/region-host/variables.tf external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's variables with console_mail_from (validated as one lowercase address) and console_mail_region, both empty by default; no read is added and nothing on a box reads the file file:external@0 ffdad585e18d905f0f4a97b9b666777200fd505868bcd5bde0cfeae216b6250e
+@legacy 2c587335836974df572918d80b0080df3eac80aee8552bc810d8b75a2d428661 internal/console/keymail.go Keymail.do legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with a non-200 answer returned as the typed keymailError (the same Error text, plus Status and Msg for IsKeymailBlocked); its one read, io.ReadAll of Keymail's HTTP response body capped at 1 MiB, unchanged file:ReadAll@594 e2f193e479472dff43846bb8d212124a1439b5765684648d499e607e30ede7be
+internal/console/keymail.go Keymail.do legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with a non-200 answer returned as the typed keymailError (the same Error text, plus Status and Msg for IsKeymailBlocked); its one read, io.ReadAll of Keymail's HTTP response body capped at 1 MiB, unchanged file:ReadAll@594 e2f193e479472dff43846bb8d212124a1439b5765684648d499e607e30ede7be
+@legacy 59b99596ef6858d4a311958122a1b649da32059b2e558bd4956a23801eb53d18 internal/console/keymail.go Keymail.sealEnvelope legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): new: SendApp's envelope sealing moved unchanged into its own method, which SendApp and SendFederated share; its one read is crypto/rand.Read of the 16-byte envelope id from the kernel's random source, the site SendApp held as file:Read@949 (accepted-legacy, J4 root-input, on main); no file, no store, no box state file:Read@387 b140fde1ca8b9b45403e55e72eebfb922ad5847c43c2ca836324ad6b46d77658
+internal/console/keymail.go Keymail.sealEnvelope legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): new: SendApp's envelope sealing moved unchanged into its own method, which SendApp and SendFederated share; its one read is crypto/rand.Read of the 16-byte envelope id from the kernel's random source, the site SendApp held as file:Read@949 (accepted-legacy, J4 root-input, on main); no file, no store, no box state file:Read@387 b140fde1ca8b9b45403e55e72eebfb922ad5847c43c2ca836324ad6b46d77658
+@legacy 8a13ba0424ef597844cb340b2ef9bc058ea07a5b8322bdca084937824f5cfac9 internal/console/server.go NewServer legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the invite delivery fields set (consoleMail from Config.ConsoleMail, inviteTimeout, inviteKeymailShare) and sendFederated bound to km.SendFederated beside sendApp; no goroutine; read sites unchanged: the one data-literal is the route pattern GET /a/{sqid}/apps/{app}/logs/data, not a path data-literal@9108 4d82a68616a6754966ced46d8d12541fcda64de9e1856c3440a127a9c533b032
+internal/console/server.go NewServer legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the invite delivery fields set (consoleMail from Config.ConsoleMail, inviteTimeout, inviteKeymailShare) and sendFederated bound to km.SendFederated beside sendApp; no goroutine; read sites unchanged: the one data-literal is the route pattern GET /a/{sqid}/apps/{app}/logs/data, not a path data-literal@9108 4d82a68616a6754966ced46d8d12541fcda64de9e1856c3440a127a9c533b032
+@legacy e876524dcb39500eb7a44ebb7b340e84bdeaf25fa9a2b4192159d2b5a72af67a internal/console/store.go Store.CountPendingInvites legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): new: one SQLite QueryRow, a COUNT(*) of an account's unaccepted, unexpired rows in the console's own invites table (CONSOLE_DB), for handleInvite's pending cap; it only refuses an invite; the same class as Store.PendingInvites, CreateInvite and RevokeInvite (accepted-legacy, J4 root-input, on main) file:QueryRow@102 1733078d53728ce629a956cf10c77e43ce9fe4fab21b1a45c408743bddb818e5
+internal/console/store.go Store.CountPendingInvites legacy accepted-legacy accepted-legacy;rev3=PROPOSED-console-invite-delivery;basis=the console (cmd/console serve under console.service, user carlos-console): new: one SQLite QueryRow, a COUNT(*) of an account's unaccepted, unexpired rows in the console's own invites table (CONSOLE_DB), for handleInvite's pending cap; it only refuses an invite; the same class as Store.PendingInvites, CreateInvite and RevokeInvite (accepted-legacy, J4 root-input, on main) file:QueryRow@102 1733078d53728ce629a956cf10c77e43ce9fe4fab21b1a45c408743bddb818e5
+# PROPOSED: Keymail.SendApp retired (H3, the carlos-run form). The loader needs the census-ruling- prefix on an H3 removal; the parenthesis says it is not yet given. A removal is not in the seal.
+@remove internal/console/keymail.go Keymail.SendApp
+@removed internal/console/keymail.go Keymail.SendApp H3 census-ruling-console-invite-delivery (PROPOSED, awaiting platform-1e): still declared, and reads nothing now: its one read, crypto/rand.Read of the envelope id, moved unchanged into Keymail.sealEnvelope, an accepted-legacy row in this overlay. It runs in the console as carlos-console.
+# PROPOSED: envelopes re-pinned. cmd/console: main.go (serve, consoleMailer). infra/modules/region-host: main.tf and variables.tf (rows above). internal/console: consolemail.go, keymailfed.go and keymailpow.go are new and the scan finds no read site in them; appsettings.go, keymail.go, server.go and store.go changed, and their only read-site changes are the rows above. internal/mail: consolemail.go and sessend.go are new, walk.go gains the console-mail guards; the scan finds no read site in any of them (NewSESEmailSender's SDK config load is the console's default credential chain, the host role, and is in TestClaimAuthoritySourceCensus as a send-only client).
+@coverage cmd/console 2af70021a578df584ca6cb189f65e72c821335579a1e783d947a9b476a77c0c6
+@coverage infra/modules/region-host 82e90b1086ae4b88cc311f7cac50074de1c1636252bf5b6acdc15cc393d856e7
+@coverage internal/console 18fc22e075cea71c813348099c6698d6f73b2047ff92fc5b2f2cd52408255756
+@coverage internal/mail c45dd340c6db8c403fb002e98386c812d848dc5a4dbc526c586e3571bbf6e317