amadan
ratelimit: settings, defaults, plan-ceiling resolution, client key (#358)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
4 files changed,
+438
−0
internal/ratelimit/clientkey.go+25 −0internal/ratelimit/clientkey_test.go+27 −0internal/ratelimit/settings.go+208 −0internal/ratelimit/settings_test.go+178 −0
CI failed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (18 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (174 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.751s
ok github.com/carlosframework/platform/cmd/moveprobe 11.812s
ok github.com/carlosframework/platform/cmd/zddprobe 0.739s
ok github.com/carlosframework/platform/internal/activator 60.462s
ok github.com/carlosframework/platform/internal/agentsock 0.040s
ok github.com/carlosframework/platform/internal/alerting 0.005s
ok github.com/carlosframework/platform/internal/analytics 0.038s
ok github.com/carlosframework/platform/internal/appconfig 2.861s
ok github.com/carlosframework/platform/internal/apperr 0.136s
ok github.com/carlosframework/platform/internal/applog 0.256s
ok github.com/carlosframework/platform/internal/awsinv 0.010s
ok github.com/carlosframework/platform/internal/boxchoice 0.006s
ok github.com/carlosframework/platform/internal/boxid 1.327s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.017s
ok github.com/carlosframework/platform/internal/caps 0.025s
ok github.com/carlosframework/platform/internal/certwarm 0.008s
ok github.com/carlosframework/platform/internal/cgroup 0.761s
ok github.com/carlosframework/platform/internal/changelog 0.514s
ok github.com/carlosframework/platform/internal/claimactivation 1.190s
ok github.com/carlosframework/platform/internal/clamd 0.070s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 7.744s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.013s
ok github.com/carlosframework/platform/internal/dbquery 0.016s
ok github.com/carlosframework/platform/internal/dbreads 2.192s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.012s
ok github.com/carlosframework/platform/internal/dnsrec 0.009s
ok github.com/carlosframework/platform/internal/docsite 0.021s
ok github.com/carlosframework/platform/internal/domains 2.927s
ok github.com/carlosframework/platform/internal/doorkey 0.016s
ok github.com/carlosframework/platform/internal/economics 0.009s
ok github.com/carlosframework/platform/internal/edge 46.062s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.135s
ok github.com/carlosframework/platform/internal/gate 1.659s
ok github.com/carlosframework/platform/internal/genselect 0.015s
ok github.com/carlosframework/platform/internal/geo 0.014s
ok github.com/carlosframework/platform/internal/geoip 0.032s
ok github.com/carlosframework/platform/internal/historyreadback 0.160s
ok github.com/carlosframework/platform/internal/host 144.548s
ok github.com/carlosframework/platform/internal/hostactors 7.023s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.007s
ok github.com/carlosframework/platform/internal/hostbox 3.061s
ok github.com/carlosframework/platform/internal/hostclaim 0.891s
ok github.com/carlosframework/platform/internal/hostenv 0.005s
ok github.com/carlosframework/platform/internal/hostevidence 0.012s
ok github.com/carlosframework/platform/internal/hostexec 5.462s
ok github.com/carlosframework/platform/internal/hostfence 0.048s
ok github.com/carlosframework/platform/internal/hostfiles 10.353s
ok github.com/carlosframework/platform/internal/hostfloor 0.029s
ok github.com/carlosframework/platform/internal/hostguard 1.026s
ok github.com/carlosframework/platform/internal/hostops 2.023s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.701s
ok github.com/carlosframework/platform/internal/hostresolve 0.148s
ok github.com/carlosframework/platform/internal/hostwrite 0.005s
ok github.com/carlosframework/platform/internal/infraview 0.004s
ok github.com/carlosframework/platform/internal/instancectl 5.249s
ok github.com/carlosframework/platform/internal/instanceexec 2.776s
ok github.com/carlosframework/platform/internal/instancefs 0.012s
ok github.com/carlosframework/platform/internal/instancekey 0.003s
ok github.com/carlosframework/platform/internal/instanceupdates 0.010s
ok github.com/carlosframework/platform/internal/layout 1.749s
ok github.com/carlosframework/platform/internal/lbhealth 0.005s
ok github.com/carlosframework/platform/internal/lease 10.146s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.610s
ok github.com/carlosframework/platform/internal/ledger 0.026s
ok github.com/carlosframework/platform/internal/mail 0.284s
ok github.com/carlosframework/platform/internal/maintenance 0.099s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.594s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.092s
ok github.com/carlosframework/platform/internal/metrics 0.007s
ok github.com/carlosframework/platform/internal/moves 22.816s
ok github.com/carlosframework/platform/internal/moves/archive 1.103s
ok github.com/carlosframework/platform/internal/objstore 0.352s
ok github.com/carlosframework/platform/internal/ops 0.197s
ok github.com/carlosframework/platform/internal/park 0.258s
ok github.com/carlosframework/platform/internal/plans 0.013s
ok github.com/carlosframework/platform/internal/privatefile 0.006s
2026/10/24 20:40:37 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:37 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:37 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:37 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/24 20:40:37 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:37 provision: an app's records could not be listed: they are skipped
2026/10/24 20:40:37 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:37 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 20:40:37 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 20:40:37 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:40:37 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:40:37 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:40:37 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:40:37 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:40:37 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 20:40:37 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:40:37 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:37 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:40:37 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:40:38 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:40:38 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:40:38 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:40:38 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:40:38 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:40:38 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:40:38 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 20:40:38 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:38 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:38 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:38 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:38 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 20:40:38 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 20:40:38 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/24 20:40:38 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/24 20:40:38 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:38 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:38 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/24 20:40:40 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/24 20:40:40 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/24 20:40:40 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io hibernate false -> true
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged acme.go.tito.io status-named false -> true
2026/10/24 20:40:40 provision: converged acme.go.tito.io status-named true -> false
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:40:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:40:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:40:40 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:40:40 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/24 20:40:40 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/24 20:40:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 20:40:40 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 20:40:40 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 20:40:40 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:40 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:40:40 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/24 20:40:40 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/24 20:40:40 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 20:40:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:40 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/24 20:40:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 20:40:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 20:40:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 20:40:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:40 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/24 20:40:40 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 20:40:40 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/24 20:40:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:40:40 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/24 20:40:40 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/24 20:40:40 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/24 20:40:40 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/24 20:40:40 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/24 20:40:40 provision: dry-run: would converge owned.go.tito.io seed
2026/10/24 20:40:40 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/24 20:40:40 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:40 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/24 20:40:40 provision: converged owned.go.tito.io channel stable -> edge
2026/10/24 20:40:40 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/24 20:40:40 provision: converged owned.go.tito.io hibernate false -> true
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:40 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/24 20:40:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/24 20:40:41 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/24 20:40:41 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: removed retired static route site.go.tito.io (record gone)
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/24 20:40:41 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/24 20:40:41 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:41 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 20:40:41 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 20:40:41 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:40:41 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:40:41 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/24 20:40:41 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:40:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:40:41 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:40:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 20:40:41 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/24 20:40:41 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/24 20:40:41 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:40:41 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/24 20:40:41 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/24 20:40:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 20:40:41 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/24 20:40:41 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:40:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:41 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:42 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:42 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:40:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:42 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:40:42 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/24 20:40:42 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/24 20:40:42 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 20:40:42 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 20:40:42 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:42 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:42 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:42 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 20:40:42 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:42 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 20:40:43 provision: a.shop.example.com: swapped for import sd_7jxqihmrukafu56jty3jo7dgqe (the original route is journaled)
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_7jxqihmrukafu56jty3jo7dgqe committed: its gate is cleared and its journal row dropped
2026/10/24 20:40:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_kj4gpj7bjowiywtnxvszonmm7u rolled back to its original route
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_kj4gpj7bjowiywtnxvszonmm7u: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_kj4gpj7bjowiywtnxvszonmm7u is cleaned up and its journal row retired
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_26mmaxuzpqjtbm2o27layrknai rolled back to its original route
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_26mmaxuzpqjtbm2o27layrknai: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_26mmaxuzpqjtbm2o27layrknai is cleaned up and its journal row retired
2026/10/24 20:40:43 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_jpitv7k3ozfipw6qdr3wga27me
2026/10/24 20:40:43 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/24 20:40:43 provision: dry-run: would converge a.shop.example.com seed source
2026/10/24 20:40:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/24 20:40:43 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/24 20:40:43 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_hbfuk57i2s63gf2w6v5igoit5u cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_4fds63tfq4k2fqmxrunvas53vu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_4muhm6iabd5rqbghi7cuvbieke is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_gxoew45gtyibjc5g7y76n5vutm is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_3twt5zoi4rc6yqd4rudxxauzta is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:40:43 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/24 20:40:43 provision: b.shop.example.com: import sd_hqgztsexctqsdjoyteavx43csy left alone this pass: the import journal could not be read
2026/10/24 20:40:43 provision: c.shop.example.com: import sd_p24j2dc3yywrldb5kysxnhavoq left alone this pass: the import journal could not be read
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_u6ceksr2tquw2cro5hqkg4em5e committed: its gate is cleared and its journal row dropped
2026/10/24 20:40:43 provision: a.shop.example.com: not converging import sd_hdg6lhtl6wavoawrncabcotfqq: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 20:40:43 provision: a.shop.example.com: not converging import sd_jchks7pzimshwrzul35ay2hbcu: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 20:40:43 provision: a.shop.example.com: not converging import sd_4qj4lilws7o4bvupungjojsn5m: it is placed but not committed, and the row on this box has no import gate
2026/10/24 20:40:43 provision: a.shop.example.com: not converging import sd_prbrurefal7m5ckmzges2xt5ru: it is placed but not committed, and the row on this box has no import gate
2026/10/24 20:40:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/24 20:40:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: a.shop.example.com: import sd_n2s6iihoa6tsrvlrrciy42d7c4 committed: its gate is cleared and its journal row dropped
2026/10/24 20:40:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:43 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:43 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/24 20:40:43 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_gvfcgcvemehjb3jdvcgmxaxkqe: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_gvfcgcvemehjb3jdvcgmxaxkqe rolled back (no box had swapped it)
2026/10/24 20:40:43 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/24 20:40:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:43 provision: removed instance route acme.go.tito.io (its seed sd_6dcgyeu7co64zo73msfcbdviqy was aborted); the next pass rolls it back
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_6dcgyeu7co64zo73msfcbdviqy: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_6dcgyeu7co64zo73msfcbdviqy rolled back (no box had swapped it)
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_6aysrevrbuzyhr6uld4ctk3xeq has a row this pass may not remove; leaving the seed aborted
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_qvdfxjeo24npuiuigotkwxizsu rolled back (no box had swapped it)
2026/10/24 20:40:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:43 provision: removed instance route acme.go.tito.io (its seed sd_hdh6vzzg5ycic5mm6rju6lo4aa was aborted); the next pass rolls it back
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_hdh6vzzg5ycic5mm6rju6lo4aa has no route on this box: its local data is removed
2026/10/24 20:40:43 provision: acme.go.tito.io: aborted seed sd_hdh6vzzg5ycic5mm6rju6lo4aa rolled back (no box had swapped it)
2026/10/24 20:40:43 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_k5ibcyypq7vbshpozwjv2vmb64 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_k5ibcyypq7vbshpozwjv2vmb64 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_k5ibcyypq7vbshpozwjv2vmb64 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_6m7cfis65f3k2nptt7bmnbb7ha (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_6m7cfis65f3k2nptt7bmnbb7ha rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_6m7cfis65f3k2nptt7bmnbb7ha is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_c5ksbyij3ng55tjt22n6qklc2q (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_c5ksbyij3ng55tjt22n6qklc2q rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_c5ksbyij3ng55tjt22n6qklc2q: the host's replica is left alone: its record no longer names this seed
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_c5ksbyij3ng55tjt22n6qklc2q is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_fwunl3vmdw2baxv4kbi4xb3irm (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_fwunl3vmdw2baxv4kbi4xb3irm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_fwunl3vmdw2baxv4kbi4xb3irm rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_fwunl3vmdw2baxv4kbi4xb3irm is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_2ptslasied6v4uxmawrx2yriqq (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_2ptslasied6v4uxmawrx2yriqq rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_pbkk5ofylwknykn4a2kn5v3jnm (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_pbkk5ofylwknykn4a2kn5v3jnm is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_djhiyuz75p7dorg6ojdwpo6rfq (the original route is journaled)
2026/10/24 20:40:44 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_djhiyuz75p7dorg6ojdwpo6rfq left alone this pass: its record could not be read
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_rznhlxjn2dduikczdzm523w7am (the original route is journaled)
2026/10/24 20:40:44 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rznhlxjn2dduikczdzm523w7am left alone this pass: its record could not be read
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_uvzc5e4vilkrzcdvh2nj7h3u7m (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uvzc5e4vilkrzcdvh2nj7h3u7m: close the import gate: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uvzc5e4vilkrzcdvh2nj7h3u7m rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uvzc5e4vilkrzcdvh2nj7h3u7m is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_3xuf2jsnzwfw6dcwqhfnd7pik4 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_3xuf2jsnzwfw6dcwqhfnd7pik4: close the import gate: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_3xuf2jsnzwfw6dcwqhfnd7pik4 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_3xuf2jsnzwfw6dcwqhfnd7pik4 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_dfdymzlxs5snkmfomqhjbptpdy (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_dfdymzlxs5snkmfomqhjbptpdy rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_dfdymzlxs5snkmfomqhjbptpdy rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_dfdymzlxs5snkmfomqhjbptpdy is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_y5ioyoxnknwq37rzqauxn2ycci (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_y5ioyoxnknwq37rzqauxn2ycci rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_y5ioyoxnknwq37rzqauxn2ycci is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_rsm72yiygl4yrk2lc5c46zdxca (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rsm72yiygl4yrk2lc5c46zdxca: retire its instance key: injected failure at retire-key
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rsm72yiygl4yrk2lc5c46zdxca rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rsm72yiygl4yrk2lc5c46zdxca is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_2a2p4h4wwgj3jk25coqtmjqnde (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_2a2p4h4wwgj3jk25coqtmjqnde rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_2a2p4h4wwgj3jk25coqtmjqnde is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_oldjipizyuyrsvbftws6nycy34 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_oldjipizyuyrsvbftws6nycy34: remove its local data: injected failure at remove-local
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_oldjipizyuyrsvbftws6nycy34 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_oldjipizyuyrsvbftws6nycy34 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_rvn7rvw4llglt7pec6cxlmytm4 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rvn7rvw4llglt7pec6cxlmytm4 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rvn7rvw4llglt7pec6cxlmytm4 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_nmzsnujyewhpshredqrbrvg3je (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_nmzsnujyewhpshredqrbrvg3je: remove its local data: injected failure at remove-local-done
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_nmzsnujyewhpshredqrbrvg3je rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_nmzsnujyewhpshredqrbrvg3je is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_rpanpn7xafzuzlktacky7uhgwi (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rpanpn7xafzuzlktacky7uhgwi rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_rpanpn7xafzuzlktacky7uhgwi is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_uqnx6dpyo33p4hmr6dybbeyvue (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uqnx6dpyo33p4hmr6dybbeyvue: restore the original route: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uqnx6dpyo33p4hmr6dybbeyvue rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_uqnx6dpyo33p4hmr6dybbeyvue is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_edew47pr3t5hkv474u6iljtml4 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_edew47pr3t5hkv474u6iljtml4: restore the original route: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_edew47pr3t5hkv474u6iljtml4 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_edew47pr3t5hkv474u6iljtml4 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_ev2evybh7crhxb5vi2eytr3t7m (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_ev2evybh7crhxb5vi2eytr3t7m is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_eezprud7fu4gyibklgkljxaphy (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_eezprud7fu4gyibklgkljxaphy rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_eezprud7fu4gyibklgkljxaphy: delete its snapshot: injected failure at delete-snapshot
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_eezprud7fu4gyibklgkljxaphy is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_qcduvwvb5iaporz2lylecwlwje (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_qcduvwvb5iaporz2lylecwlwje rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_qcduvwvb5iaporz2lylecwlwje is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_lwygakmitpzbywjjd2j63c4rsy (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_lwygakmitpzbywjjd2j63c4rsy rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_lwygakmitpzbywjjd2j63c4rsy: delete the host's replica: injected failure at delete-replica
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_lwygakmitpzbywjjd2j63c4rsy is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_ugqovjtdkytz6e5foos5hjanke (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_ugqovjtdkytz6e5foos5hjanke rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_ugqovjtdkytz6e5foos5hjanke is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_x57bf7xlf7jakcuepvs2mud6oa (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_x57bf7xlf7jakcuepvs2mud6oa rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_x57bf7xlf7jakcuepvs2mud6oa: retire its journal row: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_x57bf7xlf7jakcuepvs2mud6oa is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_gbdarc23tvk4n7yngshbw5m2tu (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_gbdarc23tvk4n7yngshbw5m2tu rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_gbdarc23tvk4n7yngshbw5m2tu: retire its journal row: constraint failed: injected (1811)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_gbdarc23tvk4n7yngshbw5m2tu is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_vqsqflmte4y7wrgy2ref2zhgpi (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_vqsqflmte4y7wrgy2ref2zhgpi rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_vqsqflmte4y7wrgy2ref2zhgpi is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: mark import sd_vqsqflmte4y7wrgy2ref2zhgpi rolled back: injected failure at cas
2026/10/24 20:40:44 provision: a.shop.example.com: aborted seed sd_vqsqflmte4y7wrgy2ref2zhgpi rolled back (no box had swapped it)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_egao6bvfctevboxwej4nxu6tze (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_egao6bvfctevboxwej4nxu6tze rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_egao6bvfctevboxwej4nxu6tze is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: aborted seed sd_egao6bvfctevboxwej4nxu6tze rolled back (no box had swapped it)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_36bp2jf7bskxqg3p53dfajpufa (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_36bp2jf7bskxqg3p53dfajpufa rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_36bp2jf7bskxqg3p53dfajpufa rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_36bp2jf7bskxqg3p53dfajpufa rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_36bp2jf7bskxqg3p53dfajpufa is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_msub7k3eyzx6fhmn4a64cjx234 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_msub7k3eyzx6fhmn4a64cjx234 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_msub7k3eyzx6fhmn4a64cjx234 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_hktkzbeiiysrel3sogn7ophj4y (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_hktkzbeiiysrel3sogn7ophj4y rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_hktkzbeiiysrel3sogn7ophj4y is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_krc33phbr6wadkqzthf4e34mni (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_krc33phbr6wadkqzthf4e34mni rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_krc33phbr6wadkqzthf4e34mni is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_6x5ktl5fekrbk6s4ff34tkprli (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_6x5ktl5fekrbk6s4ff34tkprli rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_6x5ktl5fekrbk6s4ff34tkprli is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_omyypvqpp4ayc4mnvflarcc32i (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_omyypvqpp4ayc4mnvflarcc32i rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_omyypvqpp4ayc4mnvflarcc32i is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_5eakytglltyhej4hmkywcnm724 (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_5eakytglltyhej4hmkywcnm724 rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_5eakytglltyhej4hmkywcnm724 is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_upv7qojvuihvnbzb3fgeupljoy (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_upv7qojvuihvnbzb3fgeupljoy rolled back to its original route
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_upv7qojvuihvnbzb3fgeupljoy is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_qfmbtf7h3y2qo66oo6cjaagsra (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_qfmbtf7h3y2qo66oo6cjaagsra has no route on this box: its local data is removed and no route is put back
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_qfmbtf7h3y2qo66oo6cjaagsra is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_qs6mmuesg7rxpesdcxhbwgkjve (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_xe6wghdocwok4g5c73reknfmfq (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_svbvvzrm26da26waj32zwgmhlu (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_svbvvzrm26da26waj32zwgmhlu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_gvjbr7qeftkxx2d3b2bq4sm74m (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: import sd_gvjbr7qeftkxx2d3b2bq4sm74m is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/24 20:40:44 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/24 20:40:44 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_hc7ngwtfcmbg55nibwxcde5aea (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_obtzy6nbmnekejupysntwyh2ae (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_qnok5rja2bcsdbwjypui7tz33i (the original route is journaled)
2026/10/24 20:40:44 provision: a.shop.example.com: swapped for import sd_aty6rwmwyhkkvlyzqfgykeknve (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_oh3dnptiofokq2opcjnr6uuooa (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_oh3dnptiofokq2opcjnr6uuooa rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_gifu6nkrrtjh5t3umoyhesptmu (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_gifu6nkrrtjh5t3umoyhesptmu has no route on this box: its local data is removed and no route is put back
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_gifu6nkrrtjh5t3umoyhesptmu is cleaned up and its journal row retired
2026/10/24 20:40:45 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_akvarbhcl7x3fyg6ezqgokjrae (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_akvarbhcl7x3fyg6ezqgokjrae: remove its local data: injected failure at remove-local
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_akvarbhcl7x3fyg6ezqgokjrae is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_yjp4qhbqvu6tlywhk7qm6oe56u (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_yjp4qhbqvu6tlywhk7qm6oe56u: a route appeared at the host, so its local database is left and the rollback waits
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_xm4jmip3tpniudwtqqsxawx74m (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_xm4jmip3tpniudwtqqsxawx74m rollback deferred: no fence generation: registry busy
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_fbtesbd4clkkpci74ep7bp4ada (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_fbtesbd4clkkpci74ep7bp4ada rollback deferred: no fence generation: the generation source answered 0
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_y74ygq6q5cr2gpzzorzwxe5yue (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_c4gml5kqzoesjwtxidxeshp5n4 (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_5v3bblael3x7mt7atqk2bz2cn4 (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_m656zrs2qeq42ug3mikciurloa (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_m656zrs2qeq42ug3mikciurloa rolled back to its original route
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_m656zrs2qeq42ug3mikciurloa is cleaned up and its journal row retired
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_itzjqd7gk77u7jcavftng3dvyy (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_itzjqd7gk77u7jcavftng3dvyy rolled back to its original route
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_itzjqd7gk77u7jcavftng3dvyy is cleaned up and its journal row retired
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_vrzpe3bo3xcun36xuzbwfyxto4 (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_vrzpe3bo3xcun36xuzbwfyxto4 rolled back to its original route
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_vrzpe3bo3xcun36xuzbwfyxto4 is cleaned up and its journal row retired
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_nxwbo5rru4vz6qg6zgcoipg2tu (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_nxwbo5rru4vz6qg6zgcoipg2tu: retire its instance key: the env file is a symlink
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_nxwbo5rru4vz6qg6zgcoipg2tu rolled back to its original route
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_nxwbo5rru4vz6qg6zgcoipg2tu is cleaned up and its journal row retired
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_aghty6vxom7y37dbzqvh2vsxkm (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_3lca32i5omulfzshowvhexgeey (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_pigrgi6qtyyan3awbwazqf7ibi refused: there is no route at a.shop.example.com to replace
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_7zytee45mx7h2peyxjs3r6jwmi refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_u5jeicen3jib6tvd53ia5d5d54 refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_c6ioytik2qxn5ynd5homjy35ga refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_knnqpopqjnqq52acicfaphbgqa refused: the route belongs to app other
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_richybz7twd77cg7uw6e3ej7ti refused: the route is filed under another account
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_znddlawt53muljpr672h3jfndi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_u627mxrgb3463etsnl24oroig4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_7geyk67i6vvtmoknyxsoisiu4i refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_7hj2w42fy3lebpd3nvw2e3hg24 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_yugbuemq3iubj5oocjxlluhxpm refused: the route is not an address route this import can take over (socket)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_47dz4meduuuyvruv3ykcy7dkge refused: the route is not an address route this import can take over (no address)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_t7rqudepwbdz6oodgeb5ueon4q refused: the route is not an address route this import can take over (provisioned)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_3jgw4e2736tmvbqqj75k6u2nwy refused: the route is not an address route this import can take over (kind static)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_abbdahibgotusqivlh2enoqrqi refused: the route is not an address route this import can take over (backing)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_sxifi3f3ftd3kwfzrizocjozxe refused: the route is not an address route this import can take over (tunnel)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_jp3625gww3j3nrfsmhajjpaqii refused: the route is not an address route this import can take over (caps)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_ggwcore4bncpcivmqayv46zto4 refused: the route is not an address route this import can take over (platform)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_sj43f654um4ksklz24lopahu54 refused: the route is not an address route this import can take over (canary)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_b3r76gs23iwiz7nz5d7z2jlegu refused: the route is not an address route this import can take over (kind sidecar)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_vcru4n3yrezp5rldnpss2gusay refused: the route is not an address route this import can take over (region)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_owhb6atlyy4ofley2exadieuo4 refused: the route is not an address route this import can take over (fleet_box)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_b3wexmlioqkclm7ago4yaxg5ku refused: the route is not an address route this import can take over (hibernate)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_pqpdk77wzq76j7spubp4vdijta refused: the route is not an address route this import can take over (claim_owner)
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_2zix2ewhlhmstrjagg5j3o56ti refused: this box does not run instances nested
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_nfmlmwq4ibfj7mlskqbrognqiy refused: this box does not run instances nested
2026/10/24 20:40:45 provision: a.shop.example.com: import sd_42qcbntouqj7g6fjc5qyufzoea refused: claim control is on for this box
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_mijjdtlh7krdynrbushvmjyzd4 (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_prznzpj34oikrtaor5m2lj4spm (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_fmhlkprwvovxhmb4e6z6iy7sla: its verify hash is not a sha256
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_i7c275maegjt3fle6rtfigrtzu: its verify hash is not a sha256
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_p5cwuywilpzl5kmhqewogr42qy: its verify hash is not a sha256
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/24 20:40:45 provision: A.shop.example.com/..: not swapping for import sd_6dexzmbjps62xdpj5lbq4cfyku: its host or seed id is malformed (seeds: not a host)
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_ctq5s3xl52q2zxp4z7guugslpe: its record does not describe a nested, hibernating instance
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_rzhmuy3flbbizquk6z3l4wj5hq: its record does not describe a nested, hibernating instance
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_dqiwamztkqh5uolhnxo35ejkli: its record does not describe a nested, hibernating instance
2026/10/24 20:40:45 provision: a.shop.example.com: not swapping for import sd_nioospfpaafo2vwy6jgo6pgvpi: its record does not describe a nested, hibernating instance
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_aw3sriaxwy354lt4kezcjbrfey (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_nlzhm7pubtu5tyiurcpebg3zka (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: swapped for import sd_pwgug3ztcq6tkafsjyowz2kiee (the original route is journaled)
2026/10/24 20:40:45 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/24 20:40:45 provision: dry-run: would consider swapping a.shop.example.com for import sd_nkohwnvlnworfsu53sidcauifi
2026/10/24 20:40:46 provision: a.shop.example.com: import sd_rhjwpbbldlfwqmbv6756g63zkm rolled back to its original route
2026/10/24 20:40:46 provision: a.shop.example.com: import sd_rhjwpbbldlfwqmbv6756g63zkm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:40:46 provision: a.shop.example.com: import sd_rhjwpbbldlfwqmbv6756g63zkm is cleaned up and its journal row retired
2026/10/24 20:40:46 provision: a.shop.example.com: import sd_rax7djhjsmfugualtak2xrufue left alone: the import journal holds seed sd_gvkwcogbun4647pkuazsmpb65m at swapped
2026/10/24 20:40:46 provision: a.shop.example.com: not minting import sd_yx3y6w3umxxzobhxg6jgmq7t3m: it is swapped but not committed, and only its swap makes its row
2026/10/24 20:40:46 provision: a.shop.example.com: not minting import sd_ajyzbjbxgoebfpp2wzvqy2varu: it is placed but not committed, and only its swap makes its row
2026/10/24 20:40:46 provision: a.shop.example.com: swapped for import sd_h5rqcreuefxv7a7b744fpv3xiu (the original route is journaled)
2026/10/24 20:40:46 provision: a.shop.example.com: not minting import sd_h5rqcreuefxv7a7b744fpv3xiu: it is swapped but not committed, and only its swap makes its row
2026/10/24 20:40:46 provision: a.shop.example.com: not minting import sd_h5rqcreuefxv7a7b744fpv3xiu: it is placed but not committed, and only its swap makes its row
2026/10/24 20:40:46 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:40:46 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/24 20:40:46 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/24 20:40:46 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/24 20:40:46 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/24 20:40:46 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/24 20:40:46 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 20:40:46 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/24 20:40:46 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/24 20:40:46 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 20:40:46 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:40:46 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/24 20:40:46 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/24 20:40:46 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:40:46 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/24 20:40:46 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:40:46 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:40:46 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/24 20:40:46 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:40:46 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:40:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:46 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/24 20:40:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:46 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:40:46 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:40:46 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 20:40:46 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:40:46 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:40:46 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 20:40:46 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:40:46 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:46 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/24 20:40:46 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:46 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:46 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:46 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:40:46 provision: an app's records could not be listed: they are skipped
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: record view: change index unusable (get refused): walking
2026/10/24 20:40:46 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 20:40:46 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/24 20:40:46 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:40:46 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:40:46 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:40:46 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/24 20:40:46 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:40:46 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 20:40:46 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 20:40:46 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 20:40:46 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 20:40:46 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:40:46 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:40:46 provision: removed retired instance route one.example.com (record gone)
2026/10/24 20:40:46 provision: removed retired instance route one.example.com (record gone)
2026/10/24 20:40:46 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:40:46 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/24 20:40:46 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (15.51s)
plan14_root_reads_test.go:600: root read census: 1 discrepancies
changed root source envelope internal/ratelimit
make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL github.com/carlosframework/platform/internal/provision 24.365s
ok github.com/carlosframework/platform/internal/publicrelease 0.011s
ok github.com/carlosframework/platform/internal/ratelimit 0.006s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.663s
ok github.com/carlosframework/platform/internal/relay 7.237s
ok github.com/carlosframework/platform/internal/release 26.672s
ok github.com/carlosframework/platform/internal/rollout 3.840s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.009s
ok github.com/carlosframework/platform/internal/rootparticipation 0.062s
ok github.com/carlosframework/platform/internal/rootstate 0.036s
ok github.com/carlosframework/platform/internal/runs 0.522s
ok github.com/carlosframework/platform/internal/s3compat 0.009s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.734s
ok github.com/carlosframework/platform/internal/seeds 0.013s
ok github.com/carlosframework/platform/internal/sim/engines 2.627s
ok github.com/carlosframework/platform/internal/sim/hostlife 11.883s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.593s
ok github.com/carlosframework/platform/internal/status 0.071s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.284s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.005s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.005s
ok github.com/carlosframework/platform/internal/usage 0.006s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.686s
FAIL
=== internal_console@0 (80 s)
ok github.com/carlosframework/platform/internal/console 78.181s
=== internal_console@1 (44 s)
ok github.com/carlosframework/platform/internal/console 42.596s
=== internal_console@2 (41 s)
ok github.com/carlosframework/platform/internal/console 39.812s
=== internal_console@3 (42 s)
ok github.com/carlosframework/platform/internal/console 40.233s
=== internal_console@4 (43 s)
ok github.com/carlosframework/platform/internal/console 41.290s
=== internal_console@5 (41 s)
ok github.com/carlosframework/platform/internal/console 39.415s
=== internal_console@6 (38 s)
ok github.com/carlosframework/platform/internal/console 36.439s
=== internal_console@7 (47 s)
ok github.com/carlosframework/platform/internal/console 45.262s
=== root@0 (110 s)
ok github.com/carlosframework/platform 108.476s
=== root@1 (85 s)
ok github.com/carlosframework/platform 83.067s
=== root@2 (93 s)
ok github.com/carlosframework/platform 91.430s
FAILED: rest
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/internal/ratelimit/clientkey.go b/internal/ratelimit/clientkey.go| new file mode 100644 |
| index 000000000..bdb324a79 |
| --- /dev/null |
| +++ b/internal/ratelimit/clientkey.go |
| @@ -0,0 +1,25 @@ |
| +package ratelimit |
| + |
| +import "net/netip" |
| + |
| +// ClientKey maps a client address to the key the limiter counts it under: the |
| +// address itself for IPv4 (an IPv4-mapped IPv6 address counts as IPv4), and |
| +// the /64 for IPv6, since one subscriber normally holds a whole /64 and could |
| +// otherwise take a fresh address per request. It reports false when ip does |
| +// not parse. |
| +func ClientKey(ip string) (netip.Prefix, bool) { |
| + a, err := netip.ParseAddr(ip) |
| + if err != nil { |
| + return netip.Prefix{}, false |
| + } |
| + a = a.Unmap().WithZone("") |
| + bits := 64 |
| + if a.Is4() { |
| + bits = 32 |
| + } |
| + p, err := a.Prefix(bits) |
| + if err != nil { |
| + return netip.Prefix{}, false |
| + } |
| + return p, true |
| +} |
diff --git a/internal/ratelimit/clientkey_test.go b/internal/ratelimit/clientkey_test.go| new file mode 100644 |
| index 000000000..a82c929a8 |
| --- /dev/null |
| +++ b/internal/ratelimit/clientkey_test.go |
| @@ -0,0 +1,27 @@ |
| +package ratelimit |
| + |
| +import "testing" |
| + |
| +func TestClientKey(t *testing.T) { |
| + for _, c := range []struct { |
| + in string |
| + want string |
| + ok bool |
| + }{ |
| + {"203.0.113.9", "203.0.113.9/32", true}, |
| + {"::ffff:203.0.113.9", "203.0.113.9/32", true}, |
| + {"2001:db8:1:2:3:4:5:6", "2001:db8:1:2::/64", true}, |
| + {"fe80::1%eth0", "fe80::/64", true}, |
| + {"not-an-ip", "", false}, |
| + {"", "", false}, |
| + } { |
| + p, ok := ClientKey(c.in) |
| + if ok != c.ok { |
| + t.Errorf("ClientKey(%q) ok = %v, want %v", c.in, ok, c.ok) |
| + continue |
| + } |
| + if ok && p.String() != c.want { |
| + t.Errorf("ClientKey(%q) = %s, want %s", c.in, p, c.want) |
| + } |
| + } |
| +} |
diff --git a/internal/ratelimit/settings.go b/internal/ratelimit/settings.go| new file mode 100644 |
| index 000000000..acd970f07 |
| --- /dev/null |
| +++ b/internal/ratelimit/settings.go |
| @@ -0,0 +1,208 @@ |
| +// Package ratelimit holds the per-instance rate-limit settings the edge |
| +// enforces: the owner-facing shape, the defaults, and the resolution of |
| +// owner settings against a plan ceiling into the values the edge acts on. |
| +// |
| +// It is a leaf package. It imports nothing from this repository so the plan |
| +// catalog, the provisioner and the edge can all depend on it. |
| +package ratelimit |
| + |
| +import ( |
| + "encoding/json" |
| + "fmt" |
| + "sort" |
| + "strings" |
| +) |
| + |
| +// Rule is one set of limits. A zero field means "not set": in Settings it |
| +// inherits the default (or, for a path rule, the base rule); in a Ceiling it |
| +// means no ceiling. |
| +type Rule struct { |
| + ClientShare int `json:"client_share,omitempty"` // in-flight per client while busy |
| + Rate int `json:"rate,omitempty"` // backstop, requests per second |
| + Burst int `json:"burst,omitempty"` // backstop bucket size |
| +} |
| + |
| +// PathRule overrides the base rule for requests whose path starts with Prefix. |
| +type PathRule struct { |
| + Prefix string `json:"prefix"` |
| + Rule |
| +} |
| + |
| +// Settings is what an instance owner sets. The zero Settings means "use the |
| +// defaults", and is stored as an empty string. |
| +type Settings struct { |
| + BusyAt int `json:"busy_at,omitempty"` // in-flight count at which per-client shares start to apply |
| + Rule |
| + Paths []PathRule `json:"paths,omitempty"` |
| +} |
| + |
| +const ( |
| + // MaxPaths bounds the per-path rules so the edge's lookup stays a short scan. |
| + MaxPaths = 8 |
| + // MaxValue bounds every numeric field. It is far above anything a real |
| + // instance needs and keeps products and sums well inside int range. |
| + MaxValue = 1_000_000 |
| +) |
| + |
| +// Defaults is what an instance gets for every field its owner leaves unset. |
| +var Defaults = Settings{BusyAt: 64, Rule: Rule{ClientShare: 16, Rate: 300, Burst: 1000}} |
| + |
| +// Validate reports the first problem in s. Messages name the offending field |
| +// as it appears in the settings JSON, under a "rate_limit." prefix. |
| +func (s Settings) Validate() error { |
| + if err := checkValue("rate_limit.busy_at", s.BusyAt); err != nil { |
| + return err |
| + } |
| + if err := s.Rule.validate("rate_limit"); err != nil { |
| + return err |
| + } |
| + if len(s.Paths) > MaxPaths { |
| + return fmt.Errorf("rate_limit.paths: %d rules, at most %d", len(s.Paths), MaxPaths) |
| + } |
| + seen := make(map[string]int, len(s.Paths)) |
| + for i, p := range s.Paths { |
| + at := fmt.Sprintf("rate_limit.paths[%d]", i) |
| + switch { |
| + case p.Prefix == "": |
| + return fmt.Errorf("%s.prefix: empty", at) |
| + case !strings.HasPrefix(p.Prefix, "/"): |
| + return fmt.Errorf("%s.prefix: must start with /", at) |
| + } |
| + if j, dup := seen[p.Prefix]; dup { |
| + return fmt.Errorf("%s.prefix: same as paths[%d]", at, j) |
| + } |
| + seen[p.Prefix] = i |
| + if err := p.Rule.validate(at); err != nil { |
| + return err |
| + } |
| + } |
| + return nil |
| +} |
| + |
| +func (r Rule) validate(at string) error { |
| + if err := checkValue(at+".client_share", r.ClientShare); err != nil { |
| + return err |
| + } |
| + if err := checkValue(at+".rate", r.Rate); err != nil { |
| + return err |
| + } |
| + return checkValue(at+".burst", r.Burst) |
| +} |
| + |
| +func checkValue(field string, v int) error { |
| + if v < 0 || v > MaxValue { |
| + return fmt.Errorf("%s: %d is outside 0 to %d", field, v, MaxValue) |
| + } |
| + return nil |
| +} |
| + |
| +// Canonical is the stored form of s: "" for the zero Settings, otherwise its |
| +// JSON with Paths sorted by Prefix, so equal settings compare equal as |
| +// strings whatever order the owner wrote the paths in. It does not change s. |
| +func (s Settings) Canonical() string { |
| + if s.BusyAt == 0 && s.Rule == (Rule{}) && len(s.Paths) == 0 { |
| + return "" |
| + } |
| + c := s |
| + if len(s.Paths) > 0 { |
| + c.Paths = append([]PathRule(nil), s.Paths...) |
| + sort.Slice(c.Paths, func(i, j int) bool { return c.Paths[i].Prefix < c.Paths[j].Prefix }) |
| + } |
| + b, err := json.Marshal(c) |
| + if err != nil { |
| + // Settings is plain ints and strings; Marshal cannot fail on it. |
| + panic("ratelimit: marshal settings: " + err.Error()) |
| + } |
| + return string(b) |
| +} |
| + |
| +// Parse reads the stored form back. The empty string is the zero Settings. |
| +// It decodes only; call Validate to check the values. |
| +func Parse(col string) (Settings, error) { |
| + var s Settings |
| + if col == "" { |
| + return s, nil |
| + } |
| + if err := json.Unmarshal([]byte(col), &s); err != nil { |
| + return Settings{}, fmt.Errorf("rate_limit: %w", err) |
| + } |
| + return s, nil |
| +} |
| + |
| +// Ceiling is the most a plan allows an instance. A zero field is no ceiling. |
| +// BusyAt has none: it only moves the point where fair-sharing starts, and |
| +// raising it never lets one client take more than the backstop allows. |
| +type Ceiling struct{ ClientShare, Rate, Burst int } |
| + |
| +// Effective is Settings resolved against defaults and a Ceiling: every field |
| +// is filled and nothing exceeds the ceiling. This is what the edge enforces. |
| +type Effective struct { |
| + BusyAt int `json:"busy_at"` |
| + Base Rule `json:"base"` |
| + Paths []PathRule `json:"paths,omitempty"` // longest prefix first |
| +} |
| + |
| +// Resolve starts from Defaults, overlays the owner's non-zero fields, lets |
| +// each path rule inherit any field it left zero from the resolved base, and |
| +// then clamps ClientShare, Rate and Burst to the ceiling's non-zero values. |
| +func Resolve(s Settings, c Ceiling) Effective { |
| + e := Effective{BusyAt: Defaults.BusyAt, Base: Defaults.Rule} |
| + if s.BusyAt != 0 { |
| + e.BusyAt = s.BusyAt |
| + } |
| + e.Base = overlay(e.Base, s.Rule) |
| + for _, p := range s.Paths { |
| + e.Paths = append(e.Paths, PathRule{Prefix: p.Prefix, Rule: clamp(overlay(e.Base, p.Rule), c)}) |
| + } |
| + e.Base = clamp(e.Base, c) |
| + // Longest first so RuleFor can take the first match. Equal lengths are |
| + // ordered by prefix to keep the result deterministic. |
| + sort.SliceStable(e.Paths, func(i, j int) bool { |
| + a, b := e.Paths[i].Prefix, e.Paths[j].Prefix |
| + if len(a) != len(b) { |
| + return len(a) > len(b) |
| + } |
| + return a < b |
| + }) |
| + return e |
| +} |
| + |
| +// overlay returns base with each non-zero field of over written on top. |
| +func overlay(base, over Rule) Rule { |
| + if over.ClientShare != 0 { |
| + base.ClientShare = over.ClientShare |
| + } |
| + if over.Rate != 0 { |
| + base.Rate = over.Rate |
| + } |
| + if over.Burst != 0 { |
| + base.Burst = over.Burst |
| + } |
| + return base |
| +} |
| + |
| +func clamp(r Rule, c Ceiling) Rule { |
| + r.ClientShare = capAt(r.ClientShare, c.ClientShare) |
| + r.Rate = capAt(r.Rate, c.Rate) |
| + r.Burst = capAt(r.Burst, c.Burst) |
| + return r |
| +} |
| + |
| +func capAt(v, ceiling int) int { |
| + if ceiling != 0 && v > ceiling { |
| + return ceiling |
| + } |
| + return v |
| +} |
| + |
| +// RuleFor returns the rule for a request path: the path rule with the longest |
| +// matching prefix, and its index in e.Paths, or the base rule and -1. Matching |
| +// is a case-sensitive prefix test on the path as given. |
| +func (e Effective) RuleFor(path string) (idx int, r Rule) { |
| + for i, p := range e.Paths { |
| + if strings.HasPrefix(path, p.Prefix) { |
| + return i, p.Rule |
| + } |
| + } |
| + return -1, e.Base |
| +} |
diff --git a/internal/ratelimit/settings_test.go b/internal/ratelimit/settings_test.go| new file mode 100644 |
| index 000000000..97dd467d6 |
| --- /dev/null |
| +++ b/internal/ratelimit/settings_test.go |
| @@ -0,0 +1,178 @@ |
| +package ratelimit |
| + |
| +import ( |
| + "reflect" |
| + "strings" |
| + "testing" |
| +) |
| + |
| +func TestValidateRefuses(t *testing.T) { |
| + nine := make([]PathRule, 9) |
| + for i := range nine { |
| + nine[i] = PathRule{Prefix: "/p" + string(rune('a'+i)) + "/"} |
| + } |
| + cases := []struct { |
| + name string |
| + s Settings |
| + want string // the field the error names |
| + }{ |
| + {"negative busy_at", Settings{BusyAt: -1}, "rate_limit.busy_at"}, |
| + {"negative client_share", Settings{Rule: Rule{ClientShare: -1}}, "rate_limit.client_share"}, |
| + {"negative rate", Settings{Rule: Rule{Rate: -1}}, "rate_limit.rate"}, |
| + {"negative burst", Settings{Rule: Rule{Burst: -1}}, "rate_limit.burst"}, |
| + {"busy_at too big", Settings{BusyAt: MaxValue + 1}, "rate_limit.busy_at"}, |
| + {"rate too big", Settings{Rule: Rule{Rate: MaxValue + 1}}, "rate_limit.rate"}, |
| + {"path field negative", Settings{Paths: []PathRule{{Prefix: "/a/"}, {Prefix: "/b/", Rule: Rule{Burst: -5}}}}, "rate_limit.paths[1].burst"}, |
| + {"path field too big", Settings{Paths: []PathRule{{Prefix: "/a/", Rule: Rule{ClientShare: MaxValue + 1}}}}, "rate_limit.paths[0].client_share"}, |
| + {"nine paths", Settings{Paths: nine}, "rate_limit.paths"}, |
| + {"no leading slash", Settings{Paths: []PathRule{{Prefix: "/ok/"}, {Prefix: "/x/"}, {Prefix: "api/"}}}, "rate_limit.paths[2].prefix"}, |
| + {"duplicate prefix", Settings{Paths: []PathRule{{Prefix: "/api/"}, {Prefix: "/api/"}}}, "rate_limit.paths[1].prefix"}, |
| + {"empty prefix", Settings{Paths: []PathRule{{Prefix: ""}}}, "rate_limit.paths[0].prefix"}, |
| + } |
| + for _, c := range cases { |
| + t.Run(c.name, func(t *testing.T) { |
| + err := c.s.Validate() |
| + if err == nil { |
| + t.Fatal("Validate accepted it") |
| + } |
| + if !strings.Contains(err.Error(), c.want) { |
| + t.Fatalf("error %q does not name %q", err, c.want) |
| + } |
| + }) |
| + } |
| +} |
| + |
| +func TestValidateAccepts(t *testing.T) { |
| + eight := make([]PathRule, MaxPaths) |
| + for i := range eight { |
| + eight[i] = PathRule{Prefix: "/p" + string(rune('a'+i)) + "/"} |
| + } |
| + for name, s := range map[string]Settings{ |
| + "zero": {}, |
| + "defaults": Defaults, |
| + "max": {BusyAt: MaxValue, Rule: Rule{ClientShare: MaxValue, Rate: MaxValue, Burst: MaxValue}}, |
| + "eight": {Paths: eight}, |
| + } { |
| + if err := s.Validate(); err != nil { |
| + t.Errorf("%s: %v", name, err) |
| + } |
| + } |
| +} |
| + |
| +func TestCanonicalRoundTrip(t *testing.T) { |
| + s := Settings{ |
| + BusyAt: 10, |
| + Rule: Rule{Rate: 50}, |
| + Paths: []PathRule{ |
| + {Prefix: "/b/", Rule: Rule{Burst: 7}}, |
| + {Prefix: "/a/", Rule: Rule{ClientShare: 3}}, |
| + }, |
| + } |
| + orig := append([]PathRule(nil), s.Paths...) |
| + got, err := Parse(s.Canonical()) |
| + if err != nil { |
| + t.Fatal(err) |
| + } |
| + want := s |
| + want.Paths = []PathRule{orig[1], orig[0]} |
| + if !reflect.DeepEqual(got, want) { |
| + t.Fatalf("round trip = %+v, want %+v", got, want) |
| + } |
| + if !reflect.DeepEqual(s.Paths, orig) { |
| + t.Fatal("Canonical reordered the caller's Paths") |
| + } |
| + // Two spellings of the same settings share one canonical form. |
| + flipped := s |
| + flipped.Paths = []PathRule{orig[1], orig[0]} |
| + if s.Canonical() != flipped.Canonical() { |
| + t.Fatalf("canonical forms differ: %q vs %q", s.Canonical(), flipped.Canonical()) |
| + } |
| + |
| + if c := (Settings{}).Canonical(); c != "" { |
| + t.Fatalf("zero Canonical = %q, want empty", c) |
| + } |
| + z, err := Parse("") |
| + if err != nil || !reflect.DeepEqual(z, Settings{}) { |
| + t.Fatalf("Parse(\"\") = %+v, %v", z, err) |
| + } |
| + if _, err := Parse("{bad"); err == nil { |
| + t.Fatal("Parse accepted malformed JSON") |
| + } |
| +} |
| + |
| +func TestResolveFillsDefaults(t *testing.T) { |
| + got := Resolve(Settings{}, Ceiling{}) |
| + want := Effective{BusyAt: 64, Base: Rule{ClientShare: 16, Rate: 300, Burst: 1000}} |
| + if !reflect.DeepEqual(got, want) { |
| + t.Fatalf("Resolve = %+v, want %+v", got, want) |
| + } |
| +} |
| + |
| +func TestResolvePathInheritsBase(t *testing.T) { |
| + s := Settings{ |
| + Rule: Rule{Rate: 500}, |
| + Paths: []PathRule{{Prefix: "/api/", Rule: Rule{ClientShare: 32}}}, |
| + } |
| + e := Resolve(s, Ceiling{}) |
| + if len(e.Paths) != 1 { |
| + t.Fatalf("paths = %+v", e.Paths) |
| + } |
| + want := Rule{ClientShare: 32, Rate: 500, Burst: 1000} |
| + if e.Paths[0].Rule != want { |
| + t.Fatalf("/api/ = %+v, want %+v", e.Paths[0].Rule, want) |
| + } |
| +} |
| + |
| +func TestResolveClampsToCeiling(t *testing.T) { |
| + s := Settings{ |
| + BusyAt: 5000, |
| + Rule: Rule{Rate: 5000, Burst: 9000}, |
| + Paths: []PathRule{{Prefix: "/api/", Rule: Rule{Rate: 8000}}}, |
| + } |
| + e := Resolve(s, Ceiling{Rate: 2000}) |
| + if e.Base.Rate != 2000 || e.Paths[0].Rate != 2000 { |
| + t.Fatalf("rates = %d, %d, want 2000", e.Base.Rate, e.Paths[0].Rate) |
| + } |
| + if e.Base.Burst != 9000 || e.Paths[0].Burst != 9000 { |
| + t.Fatalf("bursts = %d, %d, want 9000", e.Base.Burst, e.Paths[0].Burst) |
| + } |
| + if e.BusyAt != 5000 { |
| + t.Fatalf("BusyAt = %d, want it left alone", e.BusyAt) |
| + } |
| + |
| + // A ceiling also catches the defaults, and clamps the other two fields. |
| + e = Resolve(Settings{}, Ceiling{ClientShare: 4, Burst: 100}) |
| + if e.Base.ClientShare != 4 || e.Base.Burst != 100 || e.Base.Rate != 300 { |
| + t.Fatalf("base = %+v", e.Base) |
| + } |
| +} |
| + |
| +func TestRuleForLongestPrefix(t *testing.T) { |
| + s := Settings{Paths: []PathRule{ |
| + {Prefix: "/api/", Rule: Rule{Rate: 10}}, |
| + {Prefix: "/api/v2/", Rule: Rule{Rate: 20}}, |
| + }} |
| + e := Resolve(s, Ceiling{}) |
| + for _, c := range []struct { |
| + path string |
| + rate int |
| + neg bool // expect Base |
| + }{ |
| + {"/api/v2/x", 20, false}, |
| + {"/api/x", 10, false}, |
| + {"/api", 300, true}, |
| + {"/API/x", 300, true}, |
| + {"/", 300, true}, |
| + } { |
| + idx, r := e.RuleFor(c.path) |
| + if r.Rate != c.rate { |
| + t.Errorf("%s: rate %d, want %d", c.path, r.Rate, c.rate) |
| + } |
| + if (idx == -1) != c.neg { |
| + t.Errorf("%s: idx %d, base expected %v", c.path, idx, c.neg) |
| + } |
| + if idx >= 0 && e.Paths[idx].Rule != r { |
| + t.Errorf("%s: idx %d does not index the returned rule", c.path, idx) |
| + } |
| + } |
| +} |