carlos / platform Public

ship: --check puts a process's variables on argv only, never in the runtime CLI's environment (rootfs Plan 1 Task 11, review fix round 2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude agent, operated by paul@keymail.dev 5ba6076754ba78547ffcbe57a743e925ab01627e parent f0fc5cb
4 files changed, +185 −163
  • ship_check.go +35 −33
  • ship_check_test.go +110 −77
  • ship_runtime.go +7 −41
  • ship_runtime_test.go +33 −12

CI failed — run details

CI log
=== gate ===
.amadan/test-gate.sh
go: downloading github.com/KarpelesLab/squashfs v1.2.0
go: downloading github.com/KarpelesLab/squashfs v1.2.0
=== launchctx (1 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (19 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (181 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.668s
ok  	github.com/carlosframework/platform/cmd/moveprobe	12.028s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.806s
ok  	github.com/carlosframework/platform/internal/activator	59.795s
ok  	github.com/carlosframework/platform/internal/agentsock	0.045s
ok  	github.com/carlosframework/platform/internal/alerting	0.010s
ok  	github.com/carlosframework/platform/internal/analytics	0.029s
ok  	github.com/carlosframework/platform/internal/appconfig	3.122s
ok  	github.com/carlosframework/platform/internal/apperr	0.164s
ok  	github.com/carlosframework/platform/internal/applog	0.288s
ok  	github.com/carlosframework/platform/internal/awsinv	0.011s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.009s
ok  	github.com/carlosframework/platform/internal/boxid	0.885s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.012s
ok  	github.com/carlosframework/platform/internal/caps	0.042s
ok  	github.com/carlosframework/platform/internal/certwarm	0.003s
ok  	github.com/carlosframework/platform/internal/cgroup	0.840s
ok  	github.com/carlosframework/platform/internal/changelog	0.626s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.431s
ok  	github.com/carlosframework/platform/internal/clamd	0.067s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.347s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.019s
ok  	github.com/carlosframework/platform/internal/dbquery	0.009s
ok  	github.com/carlosframework/platform/internal/dbreads	2.242s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.007s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.007s
ok  	github.com/carlosframework/platform/internal/docsite	0.042s
ok  	github.com/carlosframework/platform/internal/domains	2.899s
ok  	github.com/carlosframework/platform/internal/doorkey	0.012s
ok  	github.com/carlosframework/platform/internal/economics	0.008s
ok  	github.com/carlosframework/platform/internal/edge	47.630s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.011s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.141s
ok  	github.com/carlosframework/platform/internal/gate	1.654s
ok  	github.com/carlosframework/platform/internal/genselect	0.016s
ok  	github.com/carlosframework/platform/internal/geo	0.026s
ok  	github.com/carlosframework/platform/internal/geoip	0.030s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.157s
ok  	github.com/carlosframework/platform/internal/host	150.588s
ok  	github.com/carlosframework/platform/internal/hostactors	5.727s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.010s
ok  	github.com/carlosframework/platform/internal/hostbox	3.009s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.868s
ok  	github.com/carlosframework/platform/internal/hostenv	0.006s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.010s
ok  	github.com/carlosframework/platform/internal/hostexec	5.289s
ok  	github.com/carlosframework/platform/internal/hostfence	0.064s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.325s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.028s
ok  	github.com/carlosframework/platform/internal/hostguard	1.107s
ok  	github.com/carlosframework/platform/internal/hostops	1.993s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.003s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.006s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.640s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.213s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.003s
ok  	github.com/carlosframework/platform/internal/infraview	0.006s
ok  	github.com/carlosframework/platform/internal/instancectl	5.243s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.819s
ok  	github.com/carlosframework/platform/internal/instancefs	0.011s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.026s
ok  	github.com/carlosframework/platform/internal/layout	1.732s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.004s
ok  	github.com/carlosframework/platform/internal/lease	10.187s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.620s
ok  	github.com/carlosframework/platform/internal/ledger	0.045s
ok  	github.com/carlosframework/platform/internal/mail	0.323s
ok  	github.com/carlosframework/platform/internal/maintenance	0.095s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.573s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.100s
ok  	github.com/carlosframework/platform/internal/metrics	0.010s
ok  	github.com/carlosframework/platform/internal/moves	27.567s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.036s
ok  	github.com/carlosframework/platform/internal/objstore	0.276s
ok  	github.com/carlosframework/platform/internal/ops	0.210s
ok  	github.com/carlosframework/platform/internal/park	0.304s
ok  	github.com/carlosframework/platform/internal/plans	0.007s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
2026/10/25 00:11:46 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:46 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:46 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:46 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/25 00:11:46 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:46 provision: an app's records could not be listed: they are skipped
2026/10/25 00:11:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:46 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:11:46 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:11:46 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:11:46 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:11:46 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:11:46 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:11:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:11:46 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:11:46 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:11:46 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:11:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:11:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:11:46 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:11:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:11:46 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:11:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:46 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:11:47 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:11:47 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:11:47 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:11:47 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:11:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:47 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:11:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:47 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:47 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:47 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:11:47 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:11:47 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/25 00:11:47 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/25 00:11:47 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:47 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:47 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (0.73s)
    plan9_b8_census_test.go:372: record-write census rejected 3 site(s); update the explicit inventory only after reviewing the source:
          changed site internal/release/rootfs_ship.go:establishShipKind: source differs from the reviewed digest
          changed site main.go:main: source differs from the reviewed digest
          unlisted site ship_check.go:const#2 [lit:instances]: review it, classify it, and update its explicit inventory entry
2026/10/25 00:11:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:11:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:48 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/25 00:11:49 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/25 00:11:49 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/25 00:11:49 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io hibernate false -> true
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged acme.go.tito.io status-named false -> true
2026/10/25 00:11:49 provision: converged acme.go.tito.io status-named true -> false
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:11:49 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:11:49 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:11:49 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:11:49 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/25 00:11:49 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:11:49 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:11:49 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:11:49 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:11:49 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:49 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:11:49 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/25 00:11:49 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/25 00:11:49 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:49 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:11:49 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:49 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/25 00:11:49 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:11:49 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:49 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:11:49 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:49 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:11:49 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:49 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:49 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/25 00:11:49 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:11:49 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/25 00:11:49 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:49 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:11:49 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/25 00:11:49 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/25 00:11:49 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:11:49 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/25 00:11:49 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/25 00:11:49 provision: dry-run: would converge owned.go.tito.io seed
2026/10/25 00:11:49 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:49 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:11:49 provision: converged owned.go.tito.io channel stable -> edge
2026/10/25 00:11:49 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/25 00:11:49 provision: converged owned.go.tito.io hibernate false -> true
2026/10/25 00:11:49 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/25 00:11:49 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/25 00:11:49 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: removed retired static route site.go.tito.io (record gone)
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:49 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/25 00:11:50 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/25 00:11:50 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:50 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:50 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:11:50 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:11:50 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:11:50 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:11:50 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/25 00:11:50 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:11:50 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:11:50 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:11:50 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:11:50 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/25 00:11:50 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/25 00:11:50 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:11:50 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/25 00:11:50 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/25 00:11:50 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:11:50 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/25 00:11:50 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:11:50 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:50 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:51 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:51 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:11:51 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:51 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:11:51 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/25 00:11:51 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/25 00:11:51 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:11:51 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:11:51 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:51 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:51 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:51 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:11:51 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:51 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:11:51 provision: a.shop.example.com: swapped for import sd_hxdscvzepgycytxwheqmrbkpmu (the original route is journaled)
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_hxdscvzepgycytxwheqmrbkpmu committed: its gate is cleared and its journal row dropped
2026/10/25 00:11:51 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_xjfnrgcykeiysot4lxamzsnp2y rolled back to its original route
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_xjfnrgcykeiysot4lxamzsnp2y: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_xjfnrgcykeiysot4lxamzsnp2y is cleaned up and its journal row retired
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_frugsbbwh6a6yakdcfx5yn27pm rolled back to its original route
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_frugsbbwh6a6yakdcfx5yn27pm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:11:51 provision: a.shop.example.com: import sd_frugsbbwh6a6yakdcfx5yn27pm is cleaned up and its journal row retired
2026/10/25 00:11:51 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_ldgo4w3e46zv3vc6swd7xqmnea
2026/10/25 00:11:52 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/25 00:11:52 provision: dry-run: would converge a.shop.example.com seed source
2026/10/25 00:11:52 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:52 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/25 00:11:52 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/25 00:11:52 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_cqxkilvh7gpnfgzljbeyabgvnm cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_7qubr3jbyidjczuutfhpbnnqqy cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_otz6hs37h3iq4lll2j4mkffwma is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_evoorkjw7qpfz4bjku6ltpaaoy is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_2rnby2y3pu2dqtl3kdznts7icy is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:11:52 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/25 00:11:52 provision: c.shop.example.com: import sd_3g2ppmefzkoabchtj5ebauzwsa left alone this pass: the import journal could not be read
2026/10/25 00:11:52 provision: b.shop.example.com: import sd_hscbeiv7ed5qusq54khtselmwm left alone this pass: the import journal could not be read
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_ah7ahk6b4ymqcj2ekteiaavqle committed: its gate is cleared and its journal row dropped
2026/10/25 00:11:52 provision: a.shop.example.com: not converging import sd_rz5pr72kudvfjom4ir4h53xnjm: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:11:52 provision: a.shop.example.com: not converging import sd_m3dmc2pegrjoupvytv65oefvhy: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:11:52 provision: a.shop.example.com: not converging import sd_yakdwtkoax7enbtdhzwylxnmzy: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:11:52 provision: a.shop.example.com: not converging import sd_hnsykcajprilanqbxnvmeobtxi: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:11:52 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:52 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/25 00:11:52 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_n22k5u4mc6n3tmu4vg5omjl2vu committed: its gate is cleared and its journal row dropped
2026/10/25 00:11:52 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:52 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:52 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:52 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/25 00:11:52 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_a3as5zuw4e6pie3qtndad3pdim: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_a3as5zuw4e6pie3qtndad3pdim rolled back (no box had swapped it)
2026/10/25 00:11:52 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/25 00:11:52 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:52 provision: removed instance route acme.go.tito.io (its seed sd_ol5mosuo5tmrqe52j442k2znrm was aborted); the next pass rolls it back
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_ol5mosuo5tmrqe52j442k2znrm: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_ol5mosuo5tmrqe52j442k2znrm rolled back (no box had swapped it)
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_ugirxfbeyp4nwn7gqqmeefx624 has a row this pass may not remove; leaving the seed aborted
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_mgs77xrasbw66zwl5x2ra62nf4 rolled back (no box had swapped it)
2026/10/25 00:11:52 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:52 provision: removed instance route acme.go.tito.io (its seed sd_f5svteivudbu56uayygzo77rze was aborted); the next pass rolls it back
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_f5svteivudbu56uayygzo77rze has no route on this box: its local data is removed
2026/10/25 00:11:52 provision: acme.go.tito.io: aborted seed sd_f5svteivudbu56uayygzo77rze rolled back (no box had swapped it)
2026/10/25 00:11:52 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_dud6jws6n7cwkoxqkum4eqngrq (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_dud6jws6n7cwkoxqkum4eqngrq rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_dud6jws6n7cwkoxqkum4eqngrq is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_aq5rpdbps6qqknmf367en5v5fu (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_aq5rpdbps6qqknmf367en5v5fu rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_aq5rpdbps6qqknmf367en5v5fu is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_4dxkkcdjevcxig4lm4ii6hycs4 (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_4dxkkcdjevcxig4lm4ii6hycs4 rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_4dxkkcdjevcxig4lm4ii6hycs4: the host's replica is left alone: its record no longer names this seed
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_4dxkkcdjevcxig4lm4ii6hycs4 is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_sotoefr75oi3mmtawmsit6n6du (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_sotoefr75oi3mmtawmsit6n6du rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_sotoefr75oi3mmtawmsit6n6du rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_sotoefr75oi3mmtawmsit6n6du is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_5ukrsc53www55yhqeu6uheu26a (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_5ukrsc53www55yhqeu6uheu26a rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_zl7jqplq7wg63t7a4om5xwso2m (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_zl7jqplq7wg63t7a4om5xwso2m is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_2i4snhoy6j7ln2slklxapnem5a (the original route is journaled)
2026/10/25 00:11:52 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_2i4snhoy6j7ln2slklxapnem5a left alone this pass: its record could not be read
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_ilh7oemoivi6nc227fkirf4kxa (the original route is journaled)
2026/10/25 00:11:52 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_ilh7oemoivi6nc227fkirf4kxa left alone this pass: its record could not be read
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_lroehmud4bhda6cnv6ibgvx7di (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lroehmud4bhda6cnv6ibgvx7di: close the import gate: constraint failed: injected (1811)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lroehmud4bhda6cnv6ibgvx7di rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lroehmud4bhda6cnv6ibgvx7di is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_lsymmkrzy7nzoacu66bpxcpep4 (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lsymmkrzy7nzoacu66bpxcpep4: close the import gate: constraint failed: injected (1811)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lsymmkrzy7nzoacu66bpxcpep4 rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_lsymmkrzy7nzoacu66bpxcpep4 is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_7xruhpoqvvtal5a3irkw7pa3ci (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_7xruhpoqvvtal5a3irkw7pa3ci rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_7xruhpoqvvtal5a3irkw7pa3ci rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_7xruhpoqvvtal5a3irkw7pa3ci is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_3652dy5cv426enhbo3sws2xrbm (the original route is journaled)
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_3652dy5cv426enhbo3sws2xrbm rolled back to its original route
2026/10/25 00:11:52 provision: a.shop.example.com: import sd_3652dy5cv426enhbo3sws2xrbm is cleaned up and its journal row retired
2026/10/25 00:11:52 provision: a.shop.example.com: swapped for import sd_dkrsmydz3wjzbtn52z5qlb35yi (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_dkrsmydz3wjzbtn52z5qlb35yi: retire its instance key: injected failure at retire-key
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_dkrsmydz3wjzbtn52z5qlb35yi rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_dkrsmydz3wjzbtn52z5qlb35yi is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_bacamfcdjnxwdeditbgutpw3ay (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_bacamfcdjnxwdeditbgutpw3ay rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_bacamfcdjnxwdeditbgutpw3ay is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_houaja57gbgtxwe3qzjsj47vsu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_houaja57gbgtxwe3qzjsj47vsu: remove its local data: injected failure at remove-local
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_houaja57gbgtxwe3qzjsj47vsu rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_houaja57gbgtxwe3qzjsj47vsu is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_5jo2apbskmtrsuteohafyjotcq (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_5jo2apbskmtrsuteohafyjotcq rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_5jo2apbskmtrsuteohafyjotcq is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_b57rouw65wblovgna44hixwjce (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_b57rouw65wblovgna44hixwjce: remove its local data: injected failure at remove-local-done
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_b57rouw65wblovgna44hixwjce rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_b57rouw65wblovgna44hixwjce is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_dyfw6dsohptrbceukfv32lw5r4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_dyfw6dsohptrbceukfv32lw5r4 rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_dyfw6dsohptrbceukfv32lw5r4 is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_h35t4tjpr5cawnpbqj2ppsvzti (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_h35t4tjpr5cawnpbqj2ppsvzti: restore the original route: constraint failed: injected (1811)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_h35t4tjpr5cawnpbqj2ppsvzti rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_h35t4tjpr5cawnpbqj2ppsvzti is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_hy4iyce7dijwcjbdl7yurddafm (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_hy4iyce7dijwcjbdl7yurddafm: restore the original route: constraint failed: injected (1811)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_hy4iyce7dijwcjbdl7yurddafm rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_hy4iyce7dijwcjbdl7yurddafm is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_xxdr7vssgqum745dyndzwahi6e (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_xxdr7vssgqum745dyndzwahi6e is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_gq3vbjrtawprnfiqkzejtquole (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_gq3vbjrtawprnfiqkzejtquole rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_gq3vbjrtawprnfiqkzejtquole: delete its snapshot: injected failure at delete-snapshot
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_gq3vbjrtawprnfiqkzejtquole is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_rxxlu45wov5idl5lrjlv5sr6o4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_rxxlu45wov5idl5lrjlv5sr6o4 rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_rxxlu45wov5idl5lrjlv5sr6o4 is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_lqovd4augfwgueymir7yzmsqmq (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_lqovd4augfwgueymir7yzmsqmq rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_lqovd4augfwgueymir7yzmsqmq: delete the host's replica: injected failure at delete-replica
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_lqovd4augfwgueymir7yzmsqmq is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_qd6sf6bkju37yjq7ymgfot5h2q (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_qd6sf6bkju37yjq7ymgfot5h2q rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_qd6sf6bkju37yjq7ymgfot5h2q is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_rpykmp3gffzj6257qjwet4ujce (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_rpykmp3gffzj6257qjwet4ujce rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_rpykmp3gffzj6257qjwet4ujce: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_rpykmp3gffzj6257qjwet4ujce is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_eq2qswypynk53ma2frd5vksyny (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_eq2qswypynk53ma2frd5vksyny rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_eq2qswypynk53ma2frd5vksyny: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_eq2qswypynk53ma2frd5vksyny is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_c7d7brjfdpein4dy5p2aajuj3a (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_c7d7brjfdpein4dy5p2aajuj3a rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_c7d7brjfdpein4dy5p2aajuj3a is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: mark import sd_c7d7brjfdpein4dy5p2aajuj3a rolled back: injected failure at cas
2026/10/25 00:11:53 provision: a.shop.example.com: aborted seed sd_c7d7brjfdpein4dy5p2aajuj3a rolled back (no box had swapped it)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_pnr7i32yrbzzeoswh64t5iloie (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_pnr7i32yrbzzeoswh64t5iloie rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_pnr7i32yrbzzeoswh64t5iloie is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: aborted seed sd_pnr7i32yrbzzeoswh64t5iloie rolled back (no box had swapped it)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_esez25xczdpluyr3aftvputcoy (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_esez25xczdpluyr3aftvputcoy rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_esez25xczdpluyr3aftvputcoy rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_esez25xczdpluyr3aftvputcoy rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_esez25xczdpluyr3aftvputcoy is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_yvh2gsp6mgtt6gwzi4usledwem (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_yvh2gsp6mgtt6gwzi4usledwem rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_yvh2gsp6mgtt6gwzi4usledwem is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_q3wew6ya4oam5iwhcq66u3g2nq (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_q3wew6ya4oam5iwhcq66u3g2nq rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_q3wew6ya4oam5iwhcq66u3g2nq is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_nday7bx6sqd7mls2ygjc4mfjde (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_nday7bx6sqd7mls2ygjc4mfjde rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_nday7bx6sqd7mls2ygjc4mfjde is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_4ptdt3hndujqsz2nmmvfhbnlze (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_4ptdt3hndujqsz2nmmvfhbnlze rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_4ptdt3hndujqsz2nmmvfhbnlze is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_7tc4bffbzg2levxatq42hg2rxi (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_7tc4bffbzg2levxatq42hg2rxi rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_7tc4bffbzg2levxatq42hg2rxi is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_3eweq5ncxhaulos6am6tgxqqm4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_3eweq5ncxhaulos6am6tgxqqm4 rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_3eweq5ncxhaulos6am6tgxqqm4 is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_bsfkkgho6rj3ilkg4sjsc2zk4i (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_bsfkkgho6rj3ilkg4sjsc2zk4i rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_bsfkkgho6rj3ilkg4sjsc2zk4i is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_mkhp4hh36khg7q6z2oyxa76dri (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_mkhp4hh36khg7q6z2oyxa76dri has no route on this box: its local data is removed and no route is put back
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_mkhp4hh36khg7q6z2oyxa76dri is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_b2uzj2grsrt33bjxhw6nl6gxxy (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_b4z4qdlgguw5ulchogwa2a42eu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_oqm26d2xcovpzwrcyjppyhwjii (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_oqm26d2xcovpzwrcyjppyhwjii cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_wewqcwcqm6djh434un6g643vgu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_wewqcwcqm6djh434un6g643vgu is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/25 00:11:53 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/25 00:11:53 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_pdfwptvxyjh2chvxqmboxjipwu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_663ecrvig3kpn3lwnwxihvmyzq (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_dnjd7lu5o3soq7ezidfmywzxpm (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_rlrvxx54tzqzrltq476vgnt6ie (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_ticzztgd67gi5t3t2zw4zwaqcu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_ticzztgd67gi5t3t2zw4zwaqcu rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_jay7csa63wyywec5kzscot34hy (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_jay7csa63wyywec5kzscot34hy has no route on this box: its local data is removed and no route is put back
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_jay7csa63wyywec5kzscot34hy is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_6e6qxjcmrnljwpdak6pcyup2e4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_6e6qxjcmrnljwpdak6pcyup2e4: remove its local data: injected failure at remove-local
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_6e6qxjcmrnljwpdak6pcyup2e4 is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_wxzdhibn4442dha32wxkmtsrra (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_wxzdhibn4442dha32wxkmtsrra: a route appeared at the host, so its local database is left and the rollback waits
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_z7tazpdn3kzhmtzgai3cmlgi4u (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_z7tazpdn3kzhmtzgai3cmlgi4u rollback deferred: no fence generation: registry busy
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_wd3fpx26nm33m6lbuekszdguue (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_wd3fpx26nm33m6lbuekszdguue rollback deferred: no fence generation: the generation source answered 0
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_x7m4kojfnzefy4jtpk5k27b7h4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_6tm6n36vrovyjckycta2e6cj54 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_uuifxoufajo5knlheljw2adntu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/25 00:11:53 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_kxp3gyp7yn5nw6duekl4nz3qu4 (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_kxp3gyp7yn5nw6duekl4nz3qu4 rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_kxp3gyp7yn5nw6duekl4nz3qu4 is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_55qdqx3ocn4bk35tdfnjqvyinu (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_55qdqx3ocn4bk35tdfnjqvyinu rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_55qdqx3ocn4bk35tdfnjqvyinu is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_yud4kzz3eevfxn5x7j2rgbhlqm (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_yud4kzz3eevfxn5x7j2rgbhlqm rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_yud4kzz3eevfxn5x7j2rgbhlqm is cleaned up and its journal row retired
2026/10/25 00:11:53 provision: a.shop.example.com: swapped for import sd_kqht6yrvuiend6p3aygmygcthe (the original route is journaled)
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_kqht6yrvuiend6p3aygmygcthe: retire its instance key: the env file is a symlink
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_kqht6yrvuiend6p3aygmygcthe rolled back to its original route
2026/10/25 00:11:53 provision: a.shop.example.com: import sd_kqht6yrvuiend6p3aygmygcthe is cleaned up and its journal row retired
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_u6aj7jhtqvpd72obkkm7tcbc5m (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_egyafe3ubetwzlccgxag4emzry (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_2onn2cniecn3cerstrmwv6euaa refused: there is no route at a.shop.example.com to replace
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_c4qxwc7s2j7txairz5frhdsfm4 refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_37exfm6s5eucopqhu4tjvpdybu refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_xy42eravbhqorbz2q3r4eewep4 refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_dwzicp62upctari5dovhfdfqgq refused: the route belongs to app other
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_5vy3kf4jnchigce3zpt26gr4c4 refused: the route is filed under another account
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_xbc4uoirkkjl5sysfjf7rz7dg4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_pj6m5wo62mr2zthuh4owvots5u refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_24svuzbpfyb6qrusutl7gvxs7m refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_dy7pm4acjujxvyxmje7x3rsfxq refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_2axgdmq7arzvh7xc2rekuomxqa refused: the route is not an address route this import can take over (socket)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_v66l4h62whtpuw27ujantkmv2m refused: the route is not an address route this import can take over (no address)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_qmggsc5mywmizspybz66vvjmo4 refused: the route is not an address route this import can take over (provisioned)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_xomjjonq2livo3d774bh2hv344 refused: the route is not an address route this import can take over (kind static)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_impuwyki4ou5fzlzf2ptncnzny refused: the route is not an address route this import can take over (backing)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_uooc5urm3yef47sohbwvho3v6m refused: the route is not an address route this import can take over (tunnel)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_gga47x74bbqfi37luavbpgjphi refused: the route is not an address route this import can take over (caps)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_3et7hranfnng4d2qqymiwdyrhi refused: the route is not an address route this import can take over (platform)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_ze5xs63woye6x7ndpd74u2oova refused: the route is not an address route this import can take over (canary)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_bzp7ynu5td6nqhqnjujgrj4vkm refused: the route is not an address route this import can take over (kind sidecar)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_746e7ifvacpv7mhdu5jwq5ddga refused: the route is not an address route this import can take over (region)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_yaag4phpsaqzanrmqdqrprlmay refused: the route is not an address route this import can take over (fleet_box)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_aqwixi63qakfzl54e2brl3jcgm refused: the route is not an address route this import can take over (hibernate)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_bd3vmcol33hicgzcpaqptkn45q refused: the route is not an address route this import can take over (claim_owner)
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_dq2owenf3fbup7hnsdngi3wioi refused: this box does not run instances nested
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_53pju57q3o3m5hj3dwqe7j2s4a refused: this box does not run instances nested
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_fulxxg2i2hcm2d5iblmd4cbhz4 refused: claim control is on for this box
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_vcadoqv3xy64g7guo7nszz4saa (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_6cw53k5z6xxbemgc4wa5dqj5rm (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/25 00:11:54 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_j3gl6vl5g4mustlwd65mvxkvem: its verify hash is not a sha256
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_mmahdf3vh6525wfaxf3w4bdnqe: its verify hash is not a sha256
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_c6n5lflzvjb3zpjfja3e62moga: its verify hash is not a sha256
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/25 00:11:54 provision: A.shop.example.com/..: not swapping for import sd_nvdcpuse7polzighe6e3jndhpu: its host or seed id is malformed (seeds: not a host)
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_2ggqxkrd3biqn6mgm6wki4t6vq: its record does not describe a nested, hibernating instance
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_merccadcs5uk2jveqew7slpdoe: its record does not describe a nested, hibernating instance
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_2nkrdgb4yj7mekqhwhbhqwzvre: its record does not describe a nested, hibernating instance
2026/10/25 00:11:54 provision: a.shop.example.com: not swapping for import sd_2curg6akxo6ssoraojzpootlam: its record does not describe a nested, hibernating instance
2026/10/25 00:11:54 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_255hsoksottyfv4qlg64ez72lq (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_xolr27zy55r6zy3ldu2bqb2gzu (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_uzdhlfa6pvhdd6opwrua2o7s4i (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/25 00:11:54 provision: dry-run: would consider swapping a.shop.example.com for import sd_wxj7pp7rnp5ptwiecetaqs7j5a
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_3bc3uhfd77y4tmrgzibebaqkj4 rolled back to its original route
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_3bc3uhfd77y4tmrgzibebaqkj4: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_3bc3uhfd77y4tmrgzibebaqkj4 is cleaned up and its journal row retired
2026/10/25 00:11:54 provision: a.shop.example.com: import sd_lq6imktf372rnwa3f23nj72g5m left alone: the import journal holds seed sd_gavocbpsealnho5cl65gtoefdq at swapped
2026/10/25 00:11:54 provision: a.shop.example.com: not minting import sd_gdnvmmyvwtmgal5i2jd7zbugha: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:11:54 provision: a.shop.example.com: not minting import sd_7uisykbi7h4vccjzvzbunylq5u: it is placed but not committed, and only its swap makes its row
2026/10/25 00:11:54 provision: a.shop.example.com: swapped for import sd_tukknv5rqcf6uahwjizebh4d3y (the original route is journaled)
2026/10/25 00:11:54 provision: a.shop.example.com: not minting import sd_tukknv5rqcf6uahwjizebh4d3y: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:11:54 provision: a.shop.example.com: not minting import sd_tukknv5rqcf6uahwjizebh4d3y: it is placed but not committed, and only its swap makes its row
2026/10/25 00:11:54 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:11:54 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:11:54 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:54 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:54 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/25 00:11:54 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:54 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/25 00:11:54 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:54 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/25 00:11:54 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/25 00:11:54 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/25 00:11:54 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/25 00:11:54 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/25 00:11:54 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:11:54 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/25 00:11:54 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/25 00:11:54 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:11:54 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:11:54 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/25 00:11:55 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/25 00:11:55 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/25 00:11:55 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:11:55 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/25 00:11:55 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:11:55 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:11:55 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/25 00:11:55 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:11:55 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:11:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:55 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/25 00:11:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:55 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:11:55 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:11:55 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:11:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:11:55 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:11:55 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:11:55 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:11:55 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:55 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/25 00:11:55 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:55 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:11:55 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:55 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:11:55 provision: an app's records could not be listed: they are skipped
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: record view: change index unusable (get refused): walking
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:11:55 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:11:55 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:11:55 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:11:55 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/25 00:11:55 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:11:55 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:11:55 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:11:55 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:11:55 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:11:55 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:11:55 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:11:55 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:11:55 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:11:55 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:11:55 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/25 00:11:55 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (24.99s)
    plan14_root_reads_test.go:600: root read census: 64 discrepancies
        changed root read cli.go:runShip; review class, task, sites and digest
        changed root read cli.go:runShipAPI; review class, task, sites and digest
        changed root read internal/console/apicli.go:Server.handleAPIShip; review class, task, sites and digest
        changed root read internal/hostops/mutation_boundary_putfrom.go:conditionalRecordStore.PutFrom; review class, task, sites and digest
        changed root read internal/hostops/mutation_boundary_putfrom.go:mutationBoundary.PutFrom; review class, task, sites and digest
        changed root source envelope .
        changed root source envelope internal/console
        changed root source envelope internal/hostops
        changed root source envelope internal/release
        changed root source envelope internal/rootfsimage
        unclassified root read cli.go:shipNoteText file:ReadFile@223
        unclassified root read internal/console/apiship_rootfs.go:shipBody.Read file:Read@19,file:Read@398
        unclassified root read internal/console/apiship_rootfs.go:spoolRootfsPart file:OpenFile@114
        unclassified root read internal/release/rootfs.go:type Process file:Command@23
        unclassified root read internal/release/rootfs.go:validateProcess file:Command@242,file:Command@61,file:Command@80
        unclassified root read internal/release/rootfs_ship.go:hashSpooledFile file:Open@70
        unclassified root read internal/release/rootfs_ship.go:putImmutableFrom file:Open@106
        unclassified root read internal/rootfsimage/archive.go:OpenArchive file:Open@226,file:Stat@73
        unclassified root read internal/rootfsimage/dir.go:readDir file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757
        unclassified root read internal/rootfsimage/errors.go:CommandError.Error file:Command@237
        unclassified root read internal/rootfsimage/errors.go:type CommandError file:Command@35
        unclassified root read internal/rootfsimage/flatten.go:boundedReader.Read file:Read@205,file:Read@24
        unclassified root read internal/rootfsimage/framework.go:FillConsole file:Command@897
        unclassified root read internal/rootfsimage/oci.go:OpenLayout file:OpenRoot@66
        unclassified root read internal/rootfsimage/oci.go:layoutStore.has file:Stat@57
        unclassified root read internal/rootfsimage/oci.go:layoutStore.open file:Open@345,file:Stat@116,file:Stat@449
        unclassified root read internal/rootfsimage/oci.go:ociReader.readBlob file:ReadAll@161
        unclassified root read internal/rootfsimage/oci.go:readFile file:ReadAll@279
        unclassified root read internal/rootfsimage/oci.go:verifier.Read file:Read@102,file:Read@19
        unclassified root read internal/rootfsimage/processes.go:ApplyImageConfig file:Command@549,file:Command@574
        unclassified root read internal/rootfsimage/processes.go:ResolveCommands file:Command@171,file:Command@230,file:Command@239
        unclassified root read internal/rootfsimage/processes.go:jitOf file:Command@56
        unclassified root read internal/rootfsimage/processes.go:shebangRuntime file:Open@60
        unclassified root read internal/rootfsimage/progarch.go:Tree.head file:Open@60
        unclassified root read internal/rootfsimage/squashfs.go:treeFS.Lstat file:Lstat@16,file:Stat@65
        unclassified root read internal/rootfsimage/squashfs.go:treeFS.Open file:Open@16,file:ReadFile@204
        unclassified root read internal/rootfsimage/squashfs.go:treeFS.ReadDir file:ReadDir@16
        unclassified root read internal/rootfsimage/squashfs.go:treeFS.ReadFile file:Open@139,file:Read@461,file:ReadFile@16
        unclassified root read internal/rootfsimage/squashfs.go:treeFS.Stat file:Stat@16
        unclassified root read internal/rootfsimage/squashfs.go:treeFile.Read file:Read@19
        unclassified root read internal/rootfsimage/squashfs.go:treeFile.Stat file:Stat@19
        unclassified root read internal/rootfsimage/squashfs.go:writeSquashfs file:Stat@1987
        unclassified root read internal/rootfsimage/tar.go:Tree.copyFile file:Open@67
        unclassified root read internal/rootfsimage/tree.go:Open file:Open@5,file:Stat@154,file:Stat@58
        unclassified root read internal/rootfsimage/tree.go:Tree.Open file:Open@15,file:Open@165
        unclassified root read internal/rootfsimage/tree.go:Tree.writeBlob file:OpenFile@285
        unclassified root read ship_check.go:const#2 data-literal@24
        unclassified root read ship_check.go:rootfsCheck.runArgs file:Command@770,file:Command@854
        unclassified root read ship_check.go:runRootfsCheck file:Read@143
        unclassified root read ship_check_probe.go:cachedCheckProbe file:ReadFile@289
        unclassified root read ship_check_probe.go:checkProbeBinary file:EvalSymlinks@271
        unclassified root read ship_check_probe.go:fileSHA256 file:Open@58
        unclassified root read ship_check_probe.go:listeningPorts file:Open@107
        unclassified root read ship_check_probe.go:staticELF file:Open@46
        unclassified root read ship_check_probe.go:writeFileAtomic file:CreateTemp@86
        unclassified root read ship_rootfs.go:buildRootfs file:Command@1016,file:OpenFile@1379
        unclassified root read ship_rootfs.go:readProcessesFile file:ReadFile@87
        unclassified root read ship_runtime.go:execRunner file:CommandContext@135
        unclassified root read ship_runtime.go:openRootfsSource file:Open@268,file:Stat@146
        changed legacy declaration cli.go:runShip
        changed legacy declaration cli.go:runShipAPI
        changed legacy declaration internal/console/apicli.go:Server.handleAPIShip
        changed legacy declaration internal/hostops/mutation_boundary_putfrom.go:conditionalRecordStore.PutFrom
        changed legacy declaration internal/hostops/mutation_boundary_putfrom.go:mutationBoundary.PutFrom
        
        make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	33.868s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.009s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.598s
ok  	github.com/carlosframework/platform/internal/relay	7.245s
ok  	github.com/carlosframework/platform/internal/release	28.600s
ok  	github.com/carlosframework/platform/internal/rollout	3.801s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.011s
ok  	github.com/carlosframework/platform/internal/rootfsimage	0.252s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.064s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/runs	0.529s
ok  	github.com/carlosframework/platform/internal/s3compat	0.006s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.652s
ok  	github.com/carlosframework/platform/internal/seeds	0.012s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.564s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	11.269s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.451s
ok  	github.com/carlosframework/platform/internal/status	0.071s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.344s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.005s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.059s
ok  	github.com/carlosframework/platform/internal/usage	0.006s
ok  	github.com/carlosframework/platform/internal/version	0.003s
ok  	github.com/carlosframework/platform/internal/vet	1.708s
FAIL
=== internal_console@0 (87 s)
ok  	github.com/carlosframework/platform/internal/console	84.955s
=== internal_console@1 (47 s)
ok  	github.com/carlosframework/platform/internal/console	45.028s
=== internal_console@2 (40 s)
ok  	github.com/carlosframework/platform/internal/console	38.415s
=== internal_console@3 (46 s)
ok  	github.com/carlosframework/platform/internal/console	44.337s
=== internal_console@4 (47 s)
ok  	github.com/carlosframework/platform/internal/console	45.708s
=== internal_console@5 (49 s)
ok  	github.com/carlosframework/platform/internal/console	47.360s
=== internal_console@6 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.739s
=== internal_console@7 (54 s)
ok  	github.com/carlosframework/platform/internal/console	52.591s
=== root@0 (98 s)
ok  	github.com/carlosframework/platform	96.010s
=== root@1 (104 s)
ok  	github.com/carlosframework/platform	102.676s
=== root@2 (96 s)
ok  	github.com/carlosframework/platform	94.602s

FAILED: rest
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/ship_check.go b/ship_check.go
index 064e118b4..35c678ab1 100644
--- a/ship_check.go
+++ b/ship_check.go
@@ -99,8 +99,9 @@ type checkProbeResult struct {
// then web, probed with the binary at probe; then each worker, after a
// healthy web. console is never started (spec §5.10). It writes each line
// of its report to out as it goes. Every container, volume and image it
-// made is removed before it returns, on every path; when ctx ends early the
-// report is failed and says nothing more.
+// made is removed before it returns, on every path, and a removal that
+// fails adds a line after the verdict. When ctx ends early the report is
+// failed and has no verdict, though the cleanup may still add such a line.
func runRootfsCheck(ctx context.Context, rt containerRuntime, b *builtRootfs, probe string, out io.Writer) (r checkReport) {
var raw [4]byte
rand.Read(raw[:]) // never fails (crypto/rand, Go 1.24 on)
@@ -154,7 +155,7 @@ func (c *rootfsCheck) checkArch(ctx context.Context) bool {
if c.rt.name == "podman" {
format = "{{.Host.Arch}}"
}
- out, err := c.rt.run(ctx, nil, nil, "info", "--format", format)
+ out, err := c.rt.run(ctx, nil, "info", "--format", format)
if err != nil {
return c.runtimeFailed(ctx, "info", err)
}
@@ -174,7 +175,7 @@ func (c *rootfsCheck) makeImageAndVolumes(ctx context.Context) bool {
}
for _, v := range []string{c.prefix + "-data", c.prefix + "-run"} {
c.volumes = append(c.volumes, v)
- _, err := c.rt.run(ctx, nil, nil, "volume", "create", "--label", "carlos-check="+c.id, "--driver", "local",
+ _, err := c.rt.run(ctx, nil, "volume", "create", "--label", "carlos-check="+c.id, "--driver", "local",
"--opt", "type=tmpfs", "--opt", "device=tmpfs",
"--opt", fmt.Sprintf("o=uid=%d,gid=%d,mode=0700", checkUID, checkUID), v)
if err != nil {
@@ -200,16 +201,15 @@ func (c *rootfsCheck) processVars(name string) map[string]string {
return vars
}
-// runArgs is the run argv of process name in container ctr, a box's launch
-// contract (spec §5.2) as a local runtime can give it, and the runtime
-// child's environment. Each variable is named on argv as -e KEY and its
-// value travels in the child's environment, which holds nothing else of
-// this process's (runtimeChildEnv): a value is never written to a file, a
-// newline in it stays in it, and a container cannot name a host variable it
-// does not declare. The exception is a variable the runtime CLI itself
-// reads (PATH, HOME, ...; an image's PATH is merged into its processes'
-// env): it goes on argv as -e KEY=VALUE, so the CLI keeps its own.
-func (c *rootfsCheck) runArgs(ctr, name string) (args, env []string) {
+// runArgs is the run argv of process name in container ctr: a box's launch
+// contract (spec §5.2) as a local runtime can give it. Each variable goes on
+// argv whole, as -e KEY=VALUE: one argv element carries a newline intact,
+// nothing is written to a file, and the runtime CLI's own environment gets
+// no release or image variable (an image's LD_PRELOAD or a declared
+// HTTP_PROXY would otherwise be the CLI's too). A process's env is plain
+// values, not secrets (spec §5.2), so showing them on a command line is
+// acceptable.
+func (c *rootfsCheck) runArgs(ctr, name string) []string {
p := c.b.procs[name]
wd := p.WorkingDir
if wd == "" {
@@ -217,7 +217,7 @@ func (c *rootfsCheck) runArgs(ctr, name string) (args, env []string) {
}
mem := strconv.FormatInt(checkMemory, 10)
user := fmt.Sprintf("%d:%d", checkUID, checkUID)
- args = []string{"run", "-d", "--name", ctr,
+ args := []string{"run", "-d", "--name", ctr,
"--read-only", "--tmpfs", "/tmp",
"--memory", mem, "--memory-swap", mem,
"--cap-drop", "ALL", "--security-opt", "no-new-privileges",
@@ -228,12 +228,7 @@ func (c *rootfsCheck) runArgs(ctr, name string) (args, env []string) {
}
vars := c.processVars(name)
for _, k := range slices.Sorted(maps.Keys(vars)) {
- if slices.Contains(runtimeEnvNames, k) {
- args = append(args, "-e", k+"="+vars[k])
- delete(vars, k)
- } else {
- args = append(args, "-e", k)
- }
+ args = append(args, "-e", k+"="+vars[k])
}
args = append(args,
"-w", wd,
@@ -241,7 +236,7 @@ func (c *rootfsCheck) runArgs(ctr, name string) (args, env []string) {
"--label", "carlos-check="+c.id,
c.image,
)
- return append(args, p.Command[1:]...), runtimeChildEnv(vars)
+ return append(args, p.Command[1:]...)
}
// start runs process name detached and answers its container. A run the
@@ -250,8 +245,7 @@ func (c *rootfsCheck) runArgs(ctr, name string) (args, env []string) {
func (c *rootfsCheck) start(ctx context.Context, name string) (string, bool) {
ctr := c.prefix + "-" + name
c.containers = append(c.containers, ctr)
- args, env := c.runArgs(ctr, name)
- if _, err := c.rt.run(ctx, nil, env, args...); err != nil {
+ if _, err := c.rt.run(ctx, nil, c.runArgs(ctr, name)...); err != nil {
if ctx.Err() == nil && execFormatError(err.Error()) {
return ctr, c.fail(checkNoEmulation)
}
@@ -273,7 +267,7 @@ func (c *rootfsCheck) runRelease(ctx context.Context) bool {
timeout = time.Duration(s) * time.Second
}
wctx, cancel := context.WithTimeout(ctx, timeout)
- out, err := c.rt.run(wctx, nil, nil, "wait", ctr)
+ out, err := c.rt.run(wctx, nil, "wait", ctr)
timedOut := wctx.Err() != nil
cancel()
if err != nil {
@@ -308,7 +302,7 @@ func (c *rootfsCheck) runWeb(ctx context.Context) bool {
// The probe ends itself at its timeout; the margin bounds a runtime
// that never returns.
pctx, cancel := context.WithTimeout(ctx, release.RootfsHealthTimeout+30*time.Second)
- out, perr := c.rt.run(pctx, nil, nil, "exec", ctr, checkProbeMount, "__rootfs-check-probe",
+ out, perr := c.rt.run(pctx, nil, "exec", ctr, checkProbeMount, "__rootfs-check-probe",
"--socket", checkSocket, "--timeout", fmt.Sprintf("%ds", int(release.RootfsHealthTimeout/time.Second)))
cancel()
if ctx.Err() != nil {
@@ -408,7 +402,7 @@ func (c *rootfsCheck) exited(name string, st containerState, logs []string) bool
func (c *rootfsCheck) inspect(ctx context.Context, ctr string) (containerState, error) {
var st containerState
- out, err := c.rt.run(ctx, nil, nil, "inspect", "--format", "{{json .State}}", ctr)
+ out, err := c.rt.run(ctx, nil, "inspect", "--format", "{{json .State}}", ctr)
if err != nil {
return st, err
}
@@ -418,7 +412,7 @@ func (c *rootfsCheck) inspect(ctx context.Context, ctr string) (containerState,
// logs is the container's last checkLogLines lines, both streams (the
// runner joins them for logs), or none when the runtime cannot give them.
func (c *rootfsCheck) logs(ctx context.Context, ctr string) []string {
- out, err := c.rt.run(ctx, nil, nil, "logs", "--tail", strconv.Itoa(checkLogLines), ctr)
+ out, err := c.rt.run(ctx, nil, "logs", "--tail", strconv.Itoa(checkLogLines), ctr)
if err != nil {
return nil
}
@@ -455,18 +449,26 @@ func (c *rootfsCheck) cleanup(ctx context.Context) {
removals = append(removals, []string{"rmi", c.image})
}
for _, args := range removals {
- if _, err := c.rt.run(ctx, nil, nil, args...); err != nil && !notFoundError(err) {
+ if _, err := c.rt.run(ctx, nil, args...); err != nil && !notFoundError(err) {
c.say(fmt.Sprintf("%s %s: %v", c.rt.name, strings.Join(args, " "), err))
}
}
}
-// notFoundError reports whether a runtime's refusal says the object does not
-// exist: docker's "No such container", "no such volume", "No such image",
-// podman's "no such container", "image not known".
+// notFoundError reports whether a runtime's refusal says the object itself
+// does not exist: docker's "No such container", "no such volume", "No such
+// image" and "No such object", podman's "no such container", "no such
+// volume", "no container with name" and "image not known". It names the
+// objects, so a runtime that cannot be reached ("dial unix ...: no such file
+// or directory", "no such host") is still reported.
func notFoundError(err error) bool {
msg := strings.ToLower(err.Error())
- return strings.Contains(msg, "no such ") || strings.Contains(msg, "not known")
+ for _, s := range []string{"no such container", "no such volume", "no such image", "no such object", "no container with name", "image not known"} {
+ if strings.Contains(msg, s) {
+ return true
+ }
+ }
+ return false
}
func (c *rootfsCheck) say(line string) {
diff --git a/ship_check_test.go b/ship_check_test.go
index cbe084b88..fc338d4ba 100644
--- a/ship_check_test.go
+++ b/ship_check_test.go
@@ -52,9 +52,7 @@ type fakeCheck struct {
removeErr map[string]error // a removal's refusal, by object (summary's name)
out *bytes.Buffer
- atImport string // what the report had said when import ran
- env map[string][]string // each process's child environment, at its run
- envNil []string // the calls that ran in this process's environment
+ atImport string // what the report had said when import ran
}
func newFakeCheck(t *testing.T) *fakeCheck {
@@ -63,7 +61,7 @@ func newFakeCheck(t *testing.T) *fakeCheck {
arch: "aarch64", waitOut: "0\n", probeOut: `{"status":200,"after_ms":42}` + "\n",
runErr: map[string]error{}, state: map[string]string{}, logs: map[string]string{},
failAt: -1, cancelAt: -1, out: &bytes.Buffer{},
- removeErr: map[string]error{}, env: map[string][]string{},
+ removeErr: map[string]error{},
}
}
@@ -81,16 +79,13 @@ func flagValue(args []string, flag string) string {
return ""
}
-func (f *fakeCheck) run(ctx context.Context, stdin io.Reader, env []string, args ...string) ([]byte, error) {
+func (f *fakeCheck) run(ctx context.Context, stdin io.Reader, args ...string) ([]byte, error) {
if stdin != nil {
io.Copy(io.Discard, stdin)
}
i := len(f.calls)
f.calls = append(f.calls, slices.Clone(args))
last := args[len(args)-1]
- if env == nil {
- f.envNil = append(f.envNil, args[0])
- }
var removes string
switch {
@@ -132,7 +127,6 @@ func (f *fakeCheck) run(ctx context.Context, stdin io.Reader, env []string, args
case args[0] == "run":
ctr := flagValue(args, "--name")
makes = "container:" + ctr
- f.env[procOf(ctr)] = env
}
if makes != "" {
if name := makes[strings.IndexByte(makes, ':')+1:]; !checkName.MatchString(name) {
@@ -352,7 +346,17 @@ func TestRootfsCheckRunArgs(t *testing.T) {
noSettle(t)
t.Setenv("SHOP_HOST_SECRET", "not the container's")
f := newFakeCheck(t)
- r := runRootfsCheck(context.Background(), f.rt(), shopBuild(t, shopProcs()), "/probe/carlos", f.out)
+ // The image's LD_PRELOAD (Rails 8's jemalloc) reaches the processes as
+ // the build merges it.
+ procs := shopProcs()
+ webEnv := procs[release.ProcessWeb].Env
+ webEnv["HTTP_PROXY"] = "http://proxy.example.com:3128"
+ webEnv["docker_host"] = "tcp://example.com:2375"
+ procs, err := rootfsimage.ApplyImageConfig(procs, rootfsimage.ImageConfig{Env: []string{"LD_PRELOAD=/usr/local/lib/libjemalloc.so"}})
+ if err != nil {
+ t.Fatal(err)
+ }
+ r := runRootfsCheck(context.Background(), f.rt(), shopBuild(t, procs), "/probe/carlos", f.out)
if r.failed {
t.Fatalf("report = %q", r.lines)
}
@@ -408,54 +412,40 @@ func TestRootfsCheckRunArgs(t *testing.T) {
t.Errorf("argv ends %q, want the image then the command's arguments", tail)
}
- // Each variable is named on argv; the values travel in the child's
- // environment, never in a file. A runtime's own name (PATH, from the
- // image) goes on argv whole, so the CLI keeps its own PATH.
- var named []string
+ // Each variable goes on argv whole, a multi-line value as one element.
+ // Names the runtime CLI or its loader would read (an image's LD_PRELOAD,
+ // a declared HTTP_PROXY or docker_host) are only ever container values:
+ // the runner has no way to give the CLI any environment of theirs.
+ var vars []string
for i, a := range web {
if a == "-e" {
- named = append(named, web[i+1])
+ vars = append(vars, web[i+1])
}
}
- wantNamed := []string{"A_FIRST", "CARLOS_DB", "CARLOS_HOST", "CARLOS_REGION", "CARLOS_SOCKET", "PATH=/srv/bin:/usr/bin", "SHOP_CERT", "SHOP_MODE"}
- if !slices.Equal(named, wantNamed) {
- t.Errorf("-e %q, want %q", named, wantNamed)
+ wantVars := []string{
+ "A_FIRST=1",
+ "CARLOS_DB=/data/instances/check/shop.example.com.db",
+ "CARLOS_HOST=shop.example.com",
+ "CARLOS_REGION=local",
+ "CARLOS_SOCKET=/run/carlos/instances/check/app.sock",
+ "HTTP_PROXY=http://proxy.example.com:3128",
+ "LD_PRELOAD=/usr/local/lib/libjemalloc.so",
+ "PATH=/srv/bin:/usr/bin",
+ "SHOP_CERT=" + shopCert,
+ "SHOP_MODE=production",
+ "docker_host=tcp://example.com:2375",
+ }
+ if !slices.Equal(vars, wantVars) {
+ t.Errorf("-e %q\nwant %q", vars, wantVars)
}
if slices.Contains(web, "--env-file") {
t.Error("the run still takes an env file")
}
- env := f.env["web"]
- for _, kv := range []string{
- "A_FIRST=1", "SHOP_MODE=production", "SHOP_CERT=" + shopCert,
- "CARLOS_SOCKET=/run/carlos/instances/check/app.sock",
- "CARLOS_DB=/data/instances/check/shop.example.com.db",
- "CARLOS_HOST=shop.example.com", "CARLOS_REGION=local",
- "PATH=" + os.Getenv("PATH"),
- } {
- if !slices.Contains(env, kv) {
- t.Errorf("the child's environment lacks %q: %q", kv, env)
- }
- }
- for _, kv := range env {
- name, _, _ := strings.Cut(kv, "=")
- if !slices.Contains(runtimeEnvNames, name) && !slices.Contains(wantNamed, name) {
- t.Errorf("the child's environment carries %s, which the process does not declare", name)
- }
- if name == "PATH" && kv != "PATH="+os.Getenv("PATH") {
- t.Errorf("the runtime CLI got the image's %s", kv)
- }
- }
for _, unwanted := range []string{"SHOP_HOST_SECRET", "CARLOS_CONTROL_SOCKET", "CARLOS_PURGE"} {
- for _, kv := range env {
- if strings.HasPrefix(kv, unwanted+"=") {
- t.Errorf("the child's environment sets %s", unwanted)
- }
+ if slices.ContainsFunc(vars, func(kv string) bool { return strings.HasPrefix(kv, unwanted+"=") }) {
+ t.Errorf("the container gets %s", unwanted)
}
}
- // The calls that pass no variables run in this process's environment.
- if want := []string{"info", "import", "volume", "volume", "wait", "exec", "inspect", "rm", "rm", "rm", "volume", "volume", "rmi"}; !slices.Equal(f.envNil, want) {
- t.Errorf("calls in this process's environment: %q, want %q", f.envNil, want)
- }
// The probe runs inside web, from the mounted binary.
var exec []string
@@ -602,9 +592,6 @@ func TestRootfsCheckNeverStartsConsole(t *testing.T) {
t.Errorf("the check called %q", s)
}
}
- if _, ok := f.env["console"]; ok {
- t.Error("console was given an environment")
- }
}
func TestRootfsCheckWarnsAboutAJITWithoutTheFlag(t *testing.T) {
@@ -660,6 +647,7 @@ func TestRootfsCheckReportsAFailedRemoval(t *testing.T) {
f.removeErr["jobs"] = errors.New(`Error: no container with name or ID "x" found: no such container`)
f.removeErr["data"] = errors.New("Error response from daemon: get x: no such volume")
f.removeErr["image"] = errors.New("Error: x: image not known")
+ f.removeErr["run"] = errors.New("Cannot connect to the Docker daemon at unix:///var/run/docker.sock: dial unix /var/run/docker.sock: connect: no such file or directory")
r := runRootfsCheck(context.Background(), f.rt(), shopBuild(t, shopProcs()), "/probe/carlos", f.out)
var web string
for _, c := range f.calls {
@@ -667,14 +655,24 @@ func TestRootfsCheckReportsAFailedRemoval(t *testing.T) {
web = c[len(c)-1]
}
}
- want := []string{checkC74, "docker rm -f " + web + ": Error response from daemon: cannot remove container: permission denied"}
- if got := r.lines[len(r.lines)-2:]; !slices.Equal(got, want) {
+ var runVol string
+ for _, c := range f.calls {
+ if c[0] == "volume" && c[1] == "rm" && strings.HasSuffix(c[2], "-run") {
+ runVol = c[2]
+ }
+ }
+ want := []string{
+ checkC74,
+ "docker rm -f " + web + ": Error response from daemon: cannot remove container: permission denied",
+ "docker volume rm " + runVol + ": Cannot connect to the Docker daemon at unix:///var/run/docker.sock: dial unix /var/run/docker.sock: connect: no such file or directory",
+ }
+ if got := r.lines[len(r.lines)-3:]; !slices.Equal(got, want) {
t.Errorf("report ends %q, want %q", got, want)
}
if r.failed {
t.Error("a leftover container failed the image's check")
}
- if !strings.HasSuffix(f.out.String(), want[1]+"\n") {
+ if !strings.HasSuffix(f.out.String(), want[1]+"\n"+want[2]+"\n") {
t.Errorf("out = %q, want the removal failure last", f.out)
}
}
@@ -737,14 +735,13 @@ func TestRootfsCheckCleansUpOnEveryPath(t *testing.T) {
})
}
-// The production runner keeps a failed command's stdout, gives logs both
-// of the container's streams, and gives a child the env it is handed.
+// The production runner keeps a failed command's stdout, and gives logs both
+// of the container's streams.
func TestExecRunnerKeepsStdoutAndJoinsLogs(t *testing.T) {
bin := t.TempDir()
stubRuntime(t, bin, "docker", `case "$1" in
exec) echo '{"status":0,"ports":[3000]}'; echo 'probe gave up' >&2; exit 1 ;;
logs) echo out-1; echo err-1 >&2; echo out-2 ;;
-run) printf '%s|%s' "$SHOP_CERT" "${SHOP_HOST_SECRET-unset}" ;;
esac
`)
onlyPath(t, bin)
@@ -752,24 +749,20 @@ esac
if err != nil {
t.Fatal(err)
}
- out, err := rt.run(context.Background(), nil, nil, "exec", "x")
+ out, err := rt.run(context.Background(), nil, "exec", "x")
if err == nil || err.Error() != "probe gave up" || string(out) != `{"status":0,"ports":[3000]}`+"\n" {
t.Errorf("exec: %q, %v", out, err)
}
- out, err = rt.run(context.Background(), nil, nil, "logs", "x")
+ out, err = rt.run(context.Background(), nil, "logs", "x")
if err != nil || string(out) != "out-1\nerr-1\nout-2\n" {
t.Errorf("logs: %q, %v", out, err)
}
- // Given an env, the child has that env and nothing else of ours.
- t.Setenv("SHOP_HOST_SECRET", "not the container's")
- out, err = rt.run(context.Background(), nil, runtimeChildEnv(map[string]string{"SHOP_CERT": shopCert}), "run", "x")
- if want := shopCert + "|unset"; err != nil || string(out) != want {
- t.Errorf("run: %q, %v; want %q", out, err, want)
- }
}
// Through the binary: carlos ship --rootfs --check with a stub docker, from
-// the flag rules to the exit status, and nothing left in the temp dir.
+// the flag rules to the exit status, and nothing left in the temp dir. The
+// stub keeps its environment at info and at run: a process's variables reach
+// it only as -e argv, so the two must be the same.
func TestShipRootfsCheckThroughTheBinary(t *testing.T) {
if testing.Short() {
t.Skip("runs the carlos binary")
@@ -777,18 +770,21 @@ func TestShipRootfsCheckThroughTheBinary(t *testing.T) {
run, bucket := versioningCLI(t)
dir, _ := rootfsRailsDir(t)
bin, work := t.TempDir(), t.TempDir()
- // A run's child has only the runtime's variables and the process's, so
- // the stub's paths are in the script, not its environment. At web's run
- // it keeps what the container would get and looks for an env file.
logPath := filepath.Join(work, "log")
stubRuntime(t, bin, "docker", fmt.Sprintf(`log='%s'
work='%s'
echo "$@" >> "$log"
case "$1" in
-info) echo aarch64 ;;
+info) env | LC_ALL=C sort > "$work/env-info"; echo aarch64 ;;
import) cat > /dev/null ;;
-run) printf '%%s' "$SHOP_CERT" > "$work/cert"
- echo "host secret: ${SHOP_HOST_SECRET-unset}" >> "$log"
+run) env | LC_ALL=C sort > "$work/env-run"
+ prev=
+ for a in "$@"; do
+ if [ "$prev" = -e ]; then
+ case "$a" in SHOP_CERT=*) printf '%%s' "${a#SHOP_CERT=}" > "$work/cert" ;; esac
+ fi
+ prev=$a
+ done
find "$TMPDIR" -name '*.env' >> "$log" ;;
exec) echo "$FAKE_PROBE"; exit "$FAKE_PROBE_EXIT" ;;
inspect) echo '{"Running":true}' ;;
@@ -796,7 +792,8 @@ esac
exit 0
`, logPath, work))
procs := filepath.Join(work, "processes.json")
- if err := os.WriteFile(procs, []byte(`{"web": {"command": ["bin/rails", "server"], "working_dir": "/rails", "env": {"SHOP_CERT": `+strconv.Quote(shopCert)+`}}}`), 0o644); err != nil {
+ declared := `"SHOP_CERT": ` + strconv.Quote(shopCert) + `, "HTTP_PROXY": "http://proxy.example.com:3128", "docker_host": "tcp://example.com:2375"`
+ if err := os.WriteFile(procs, []byte(`{"web": {"command": ["bin/rails", "server"], "working_dir": "/rails", "env": {`+declared+`}}}`), 0o644); err != nil {
t.Fatal(err)
}
probe := filepath.Join(work, "probe")
@@ -807,8 +804,21 @@ exit 0
t.Setenv("PATH", bin)
t.Setenv("CARLOS_CONTAINER_RUNTIME", "")
t.Setenv("CARLOS_CHECK_PROBE", probe)
- t.Setenv("SHOP_HOST_SECRET", "not the container's")
t.Setenv("TMPDIR", tmp)
+ // The run's environment is the info's: no process variable in it.
+ sameEnv := func(t *testing.T, names ...string) {
+ t.Helper()
+ info, err1 := os.ReadFile(filepath.Join(work, "env-info"))
+ runEnv, err2 := os.ReadFile(filepath.Join(work, "env-run"))
+ if err1 != nil || err2 != nil || !bytes.Equal(info, runEnv) {
+ t.Errorf("the runtime ran web in another environment (%v, %v):\ninfo:\n%s\nrun:\n%s", err1, err2, info, runEnv)
+ }
+ for _, name := range names {
+ if bytes.Contains(runEnv, []byte("\n"+name+"=")) || bytes.HasPrefix(runEnv, []byte(name+"=")) {
+ t.Errorf("the runtime's own environment has %s", name)
+ }
+ }
+ }
t.Setenv("FAKE_PROBE", `{"status":200,"after_ms":7}`)
t.Setenv("FAKE_PROBE_EXIT", "0")
@@ -822,17 +832,19 @@ exit 0
}
}
log, _ := os.ReadFile(logPath)
- for _, verb := range []string{"rm -f carlos-check-", "volume rm carlos-check-", "rmi carlos-check-", "host secret: unset\n"} {
- if !strings.Contains(string(log), verb) {
- t.Errorf("the runtime never saw %q:\n%s", verb, log)
+ for _, want := range []string{"rm -f carlos-check-", "volume rm carlos-check-", "rmi carlos-check-",
+ " -e HTTP_PROXY=http://proxy.example.com:3128 ", " -e docker_host=tcp://example.com:2375 "} {
+ if !strings.Contains(string(log), want) {
+ t.Errorf("the runtime never saw %q:\n%s", want, log)
}
}
if strings.Contains(string(log), ".env") {
t.Errorf("an env file was written:\n%s", log)
}
if cert, err := os.ReadFile(filepath.Join(work, "cert")); err != nil || string(cert) != shopCert {
- t.Errorf("web's SHOP_CERT reached the runtime as %q (%v), want %q", cert, err, shopCert)
+ t.Errorf("web's SHOP_CERT reached the runtime as %q (%v), want %q as one argument", cert, err, shopCert)
}
+ sameEnv(t, "SHOP_CERT", "HTTP_PROXY", "docker_host", "CARLOS_SOCKET")
if strings.Contains(string(log), "-console") {
t.Errorf("the filled-in console was started:\n%s", log)
}
@@ -850,6 +862,27 @@ exit 0
}
}
+ // An image whose config sets LD_PRELOAD, as Rails 8's does for jemalloc:
+ // the container gets it, the runtime never does.
+ archive := filepath.Join(work, "shop.tar")
+ legacyArchiveWith(t, archive, []legacyFile{{"srv/server", "x", 0o755}}, []string{"LD_PRELOAD=/usr/local/lib/libjemalloc.so"})
+ imageProcs := filepath.Join(work, "image-processes.json")
+ if err := os.WriteFile(imageProcs, []byte(`{"web": {"command": ["/srv/server"]}}`), 0o644); err != nil {
+ t.Fatal(err)
+ }
+ t.Setenv("FAKE_PROBE", `{"status":200,"after_ms":7}`)
+ t.Setenv("FAKE_PROBE_EXIT", "0")
+ if err := os.WriteFile(logPath, nil, 0o644); err != nil {
+ t.Fatal(err)
+ }
+ if out, err := run("ship", "--rootfs", archive, "--processes", imageProcs, "--check"); err != nil {
+ t.Fatalf("ship --check of an image: %v\n%s", err, out)
+ }
+ if log, _ := os.ReadFile(logPath); !strings.Contains(string(log), " -e LD_PRELOAD=/usr/local/lib/libjemalloc.so ") {
+ t.Errorf("the image's LD_PRELOAD is not a container variable:\n%s", log)
+ }
+ sameEnv(t, "LD_PRELOAD")
+
for _, flag := range [][]string{{"--app", "shop"}, {"-a", "shop"}, {"--version", "0.1.0-1"}, {"--console", "https://console.example.com"}, {"--message", "x"}} {
out, err := run(append([]string{"ship", "--rootfs", dir, "--processes", procs, "--check"}, flag...)...)
name := strings.TrimLeft(flag[0], "-")
diff --git a/ship_runtime.go b/ship_runtime.go
index a620557db..07f042dae 100644
--- a/ship_runtime.go
+++ b/ship_runtime.go
@@ -6,12 +6,10 @@ import (
"errors"
"fmt"
"io"
- "maps"
"os"
"os/exec"
"path/filepath"
"regexp"
- "slices"
"strings"
"github.com/carlosframework/platform/internal/rootfsimage"
@@ -31,11 +29,10 @@ var errNoRuntime = errors.New("--check runs the image with Docker or Podman, and
// none), and answers its stdout, also when it fails (--check's probe exits 1
// with its findings on stdout). A failure carries the runtime's stderr. For
// logs, whose stdout and stderr are the container's two streams, the answer
-// is both streams in one. env nil runs the binary in this process's
-// environment; otherwise env is the child's whole environment (--check's
-// run passes a container's variables there, named on argv as -e KEY, so no
-// value is written to a file or shown on a command line).
-type runnerFunc func(ctx context.Context, stdin io.Reader, env []string, args ...string) ([]byte, error)
+// is both streams in one. The binary always runs in this process's own
+// environment: no release or image variable is ever put there (--check
+// passes a container's variables on argv).
+type runnerFunc func(ctx context.Context, stdin io.Reader, args ...string) ([]byte, error)
// containerRuntime is the runtime found: name is "docker" or "podman", and
// run runs its binary.
@@ -66,10 +63,9 @@ func findContainerRuntime() (containerRuntime, error) {
// execRunner runs the binary at bin. Its error is the runtime's own
// message, the last of its stderr, so a caller can show why it failed.
func execRunner(bin string) runnerFunc {
- return func(ctx context.Context, stdin io.Reader, env []string, args ...string) ([]byte, error) {
+ return func(ctx context.Context, stdin io.Reader, args ...string) ([]byte, error) {
cmd := exec.CommandContext(ctx, bin, args...)
cmd.Stdin = stdin
- cmd.Env = env
var stdout, stderr bytes.Buffer
cmd.Stdout, cmd.Stderr = &stdout, &stderr
if len(args) > 0 && args[0] == "logs" {
@@ -87,36 +83,6 @@ func execRunner(bin string) runnerFunc {
}
}
-// runtimeEnvNames are the variables the docker and podman CLIs read to
-// find their binaries, their config and their daemon or socket: the only
-// part of this process's environment a runtime child given its own env
-// keeps.
-var runtimeEnvNames = []string{
- "PATH", "HOME", "USER", "LOGNAME", "TMPDIR", "LANG",
- "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "DBUS_SESSION_BUS_ADDRESS",
- "DOCKER_HOST", "DOCKER_CONTEXT", "DOCKER_CONFIG", "DOCKER_CERT_PATH", "DOCKER_TLS_VERIFY", "DOCKER_API_VERSION",
- "CONTAINER_HOST", "CONTAINER_CONNECTION", "CONTAINER_SSHKEY",
- "CONTAINERS_CONF", "CONTAINERS_STORAGE_CONF", "CONTAINERS_REGISTRIES_CONF",
- "SystemRoot", "SYSTEMROOT", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "ProgramData",
-}
-
-// runtimeChildEnv is a runtime child's whole environment: the
-// runtimeEnvNames this process has, then vars, sorted by name. Nothing else
-// of this process's environment reaches it, so a container that names a
-// variable it does not declare gets nothing from the host.
-func runtimeChildEnv(vars map[string]string) []string {
- var env []string
- for _, name := range runtimeEnvNames {
- if v, ok := os.LookupEnv(name); ok {
- env = append(env, name+"="+v)
- }
- }
- for _, k := range slices.Sorted(maps.Keys(vars)) {
- env = append(env, k+"="+vars[k])
- }
- return env
-}
-
// saveImage exports the local image ref to the archive file out: docker
// save writes the archive Docker makes, podman save an OCI archive.
// Failure is RFS-1-C59.
@@ -125,7 +91,7 @@ func (rt containerRuntime) saveImage(ctx context.Context, ref, out string) error
if rt.name == "podman" {
args = []string{"save", "--format", "oci-archive", "-o", out, ref}
}
- if _, err := rt.run(ctx, nil, nil, args...); err != nil {
+ if _, err := rt.run(ctx, nil, args...); err != nil {
return fmt.Errorf("could not export %s with %s: %s", ref, rt.name, err)
}
return nil
@@ -146,7 +112,7 @@ func (rt containerRuntime) importTree(ctx context.Context, t *rootfsimage.Tree,
pw.CloseWithError(err) // nil closes it as EOF
done <- err
}()
- _, err := rt.run(ctx, pr, nil, args...)
+ _, err := rt.run(ctx, pr, args...)
// A runtime that stopped reading must not leave the writer blocked.
pr.CloseWithError(io.ErrClosedPipe)
if werr := <-done; err == nil && werr != nil && !errors.Is(werr, io.ErrClosedPipe) {
diff --git a/ship_runtime_test.go b/ship_runtime_test.go
index 43e6fd7c6..673ce8a46 100644
--- a/ship_runtime_test.go
+++ b/ship_runtime_test.go
@@ -108,27 +108,48 @@ func TestLooksLikeImageRef(t *testing.T) {
// app/hello (the minimal builder of rootfsimage's tests, which this package
// cannot import: preflight 1.23).
func legacyArchive(t *testing.T, path string) {
+ t.Helper()
+ legacyArchiveWith(t, path, []legacyFile{{"app/hello", "hi\n", 0o644}}, nil)
+}
+
+// legacyFile is one regular file of legacyArchiveWith's layer.
+type legacyFile struct {
+ name, body string
+ mode int64
+}
+
+// legacyArchiveWith writes the legacy form for arm64 with one layer holding
+// files (and their parent directories) and env as the image config's Env.
+func legacyArchiveWith(t *testing.T, path string, files []legacyFile, env []string) {
t.Helper()
var layer bytes.Buffer
lw := tar.NewWriter(&layer)
mt := time.Unix(1_700_000_000, 0)
- for _, h := range []*tar.Header{
- {Name: "app/", Typeflag: tar.TypeDir, Mode: 0o755, ModTime: mt},
- {Name: "app/hello", Typeflag: tar.TypeReg, Mode: 0o644, Size: 3, ModTime: mt},
- } {
- if err := lw.WriteHeader(h); err != nil {
+ dirs := map[string]bool{}
+ for _, f := range files {
+ for d := filepath.Dir(f.name); d != "."; d = filepath.Dir(d) {
+ if !dirs[d] {
+ dirs[d] = true
+ if err := lw.WriteHeader(&tar.Header{Name: d + "/", Typeflag: tar.TypeDir, Mode: 0o755, ModTime: mt}); err != nil {
+ t.Fatal(err)
+ }
+ }
+ }
+ if err := lw.WriteHeader(&tar.Header{Name: f.name, Typeflag: tar.TypeReg, Mode: f.mode, Size: int64(len(f.body)), ModTime: mt}); err != nil {
t.Fatal(err)
}
- if h.Typeflag == tar.TypeReg {
- if _, err := lw.Write([]byte("hi\n")); err != nil {
- t.Fatal(err)
- }
+ if _, err := lw.Write([]byte(f.body)); err != nil {
+ t.Fatal(err)
}
}
if err := lw.Close(); err != nil {
t.Fatal(err)
}
- cfg, err := json.Marshal(map[string]any{"architecture": "arm64", "os": "linux", "config": map[string]any{}})
+ config := map[string]any{}
+ if env != nil {
+ config["Env"] = env
+ }
+ cfg, err := json.Marshal(map[string]any{"architecture": "arm64", "os": "linux", "config": config})
if err != nil {
t.Fatal(err)
}
@@ -308,7 +329,7 @@ func TestImportTreeArgs(t *testing.T) {
}
var gotArgs []string
var names []string
- rt := containerRuntime{name: c.name, run: func(ctx context.Context, stdin io.Reader, _ []string, args ...string) ([]byte, error) {
+ rt := containerRuntime{name: c.name, run: func(ctx context.Context, stdin io.Reader, args ...string) ([]byte, error) {
gotArgs = args
tr := tar.NewReader(stdin)
for {
@@ -343,7 +364,7 @@ func TestImportTreeRuntimeFailsEarly(t *testing.T) {
t.Fatal(err)
}
boom := errors.New("boom")
- rt := containerRuntime{name: "docker", run: func(context.Context, io.Reader, []string, ...string) ([]byte, error) { return nil, boom }}
+ rt := containerRuntime{name: "docker", run: func(context.Context, io.Reader, ...string) ([]byte, error) { return nil, boom }}
done := make(chan error, 1)
go func() { done <- rt.importTree(context.Background(), tree, "x") }()
select {