carlos / platform Public

Sidecar isolation Task 11: the shape's other consumers; status --layout shows the flat-exec policy and the closure check (§3.12, D14, D15)

carlos status --layout: the console door carries each box's flat_exec
report and its workers word and reason from the snapshot unchanged
(additive), and answers for a box with a flat-exec report but no layout
report. The CLI prints, per box, the policy, the layout intent, the
workers word, every allowlist entry flagged unisolated
(host.FlatExecAllowlistedWarning, now exported), dropped entries, the
spawn record beside each host's layout word (a refused worker still in
the inventory reads with activator.FlatExecHeldWord), the inventory
(unknown printed as unknown, never empty), and the closure check, then
names every box whose check does not hold, cannot be read or is stale
(§8.2 step 6). New display strings are placeholders in
status_layout_copy.go for Task 12.

carlos sidecars ls: its door (handleAPISidecarList) answers records and
a running version only; it carries no state word and no per-host
refusal, so the held worker shows in status --layout only. No new
console API.

Consumers: status --instances lists a worker under its own row (test;
the matcher keys on activator.ExecName, no worker prefix needed);
engines arm (simulation only, plan 2 unbuilt) refuses a flat worker row
and admits a nested one (test, doc); hostbox inventory scope admits
either worker path (assert test).

Consumer sweep (IsSidecar()/UnitPrefix/carlos-instance-, non-test,
outside instancectl) against spec §3.12. Not listed there, checked, none
parses unit names, slices or worker paths: cli.go:1519,
status/snapshot.go:1026, activator/wakeidentity.go:38,
activator/activator.go:5131, activator/claim_snapshot.go:50,
edge/edge.go:664, host/edgesfile.go:457, domains/aliases.go:154,
console/domainattach.go:456, console/scandeliver.go:296,
host/fleetbind.go:252,304,367, host/restart.go:72,330,
host/sidecarwake.go:51, host/buildstate.go:358, host/configguard.go:151,
host/agent.go:1084, host/rootmigration_census.go:47,
host/claimfilesseed*.go, host/claimwakeassembly.go:261,
rollout/policy.go:165, rollout/scheduler.go:193,207,
release/adopt.go:1232,1310,2129. Slice walkers, role-agnostic:
host/rootgeneration_services_linux.go:189,
host/rootgeneration_retired_linux.go:232.

Not done, a question: the sampler (internal/host/metrics_probes.go) has
no slice-to-host mapping on main. Nothing scans
carlos.slice/carlos-instances.slice (isolated-exec §6.6's per-host
root), so nested instances and nested workers alike publish no reading.
Adding it changes metered usage for every nested instance.

Census: claim appended for status_instances.go:printStatusLayout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 6 hours ago 6e2904493fc19ef9e770931d4f0e7a1cc106593c parent b9f6256

11 files changed, +649 −18

implementation/census-claims-sidecar-isolation.txt +1 −0
internal/console/apistatusinstances_test.go +34 −0
internal/console/apistatuslayout.go +30 −8
internal/console/apistatuslayout_test.go +68 −0
internal/host/flatexec_copy.go +2 −2
internal/hostbox/inventoryscope_worker_test.go +51 −0
internal/sim/engines/calls_test.go +8 −4
internal/sim/engines/witness_test.go +44 −0
status_instances.go +173 −4
status_layout_copy.go +62 −0
status_layout_flatexec_test.go +176 −0

CI failed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.022s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (12 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (183 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	4.027s
ok  	github.com/carlosframework/platform/cmd/moveprobe	12.439s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.692s
ok  	github.com/carlosframework/platform/internal/activator	61.402s
ok  	github.com/carlosframework/platform/internal/agentsock	0.044s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.021s
ok  	github.com/carlosframework/platform/internal/appconfig	2.929s
ok  	github.com/carlosframework/platform/internal/apperr	0.116s
ok  	github.com/carlosframework/platform/internal/applog	0.271s
ok  	github.com/carlosframework/platform/internal/awsinv	0.006s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.006s
ok  	github.com/carlosframework/platform/internal/boxid	0.941s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.011s
ok  	github.com/carlosframework/platform/internal/caps	0.023s
ok  	github.com/carlosframework/platform/internal/certwarm	0.006s
ok  	github.com/carlosframework/platform/internal/cgroup	0.761s
ok  	github.com/carlosframework/platform/internal/changelog	0.523s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.436s
ok  	github.com/carlosframework/platform/internal/clamd	0.064s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	7.752s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.012s
ok  	github.com/carlosframework/platform/internal/dbquery	0.011s
ok  	github.com/carlosframework/platform/internal/dbreads	2.130s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.012s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.005s
ok  	github.com/carlosframework/platform/internal/docsite	0.010s
ok  	github.com/carlosframework/platform/internal/domains	2.971s
ok  	github.com/carlosframework/platform/internal/doorkey	0.015s
ok  	github.com/carlosframework/platform/internal/economics	0.011s
ok  	github.com/carlosframework/platform/internal/edge	47.285s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.011s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.166s
ok  	github.com/carlosframework/platform/internal/gate	1.749s
ok  	github.com/carlosframework/platform/internal/genselect	0.038s
ok  	github.com/carlosframework/platform/internal/geo	0.022s
ok  	github.com/carlosframework/platform/internal/geoip	0.033s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.222s
ok  	github.com/carlosframework/platform/internal/host	154.842s
ok  	github.com/carlosframework/platform/internal/hostactors	9.019s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.007s
ok  	github.com/carlosframework/platform/internal/hostbox	5.833s
ok  	github.com/carlosframework/platform/internal/hostclaim	2.082s
ok  	github.com/carlosframework/platform/internal/hostenv	0.009s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.012s
ok  	github.com/carlosframework/platform/internal/hostexec	9.359s
ok  	github.com/carlosframework/platform/internal/hostfence	0.069s
ok  	github.com/carlosframework/platform/internal/hostfiles	11.746s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.028s
ok  	github.com/carlosframework/platform/internal/hostguard	1.303s
ok  	github.com/carlosframework/platform/internal/hostops	3.550s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.003s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.004s
ok  	github.com/carlosframework/platform/internal/hostrelocate	1.420s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.452s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.003s
ok  	github.com/carlosframework/platform/internal/infraview	0.004s
ok  	github.com/carlosframework/platform/internal/instancectl	6.993s
ok  	github.com/carlosframework/platform/internal/instanceexec	3.161s
ok  	github.com/carlosframework/platform/internal/instancefs	0.005s
ok  	github.com/carlosframework/platform/internal/instancekey	0.005s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.008s
ok  	github.com/carlosframework/platform/internal/layout	4.142s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.010s
ok  	github.com/carlosframework/platform/internal/lease	10.450s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	1.134s
ok  	github.com/carlosframework/platform/internal/ledger	0.039s
ok  	github.com/carlosframework/platform/internal/mail	0.660s
ok  	github.com/carlosframework/platform/internal/maintenance	0.122s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	6.634s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.158s
ok  	github.com/carlosframework/platform/internal/metrics	0.007s
ok  	github.com/carlosframework/platform/internal/moves	31.157s
ok  	github.com/carlosframework/platform/internal/moves/archive	2.070s
ok  	github.com/carlosframework/platform/internal/objstore	0.919s
ok  	github.com/carlosframework/platform/internal/ops	0.844s
ok  	github.com/carlosframework/platform/internal/park	0.396s
ok  	github.com/carlosframework/platform/internal/plans	0.008s
ok  	github.com/carlosframework/platform/internal/privatefile	0.006s
2026/10/25 00:45:20 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:20 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:21 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/25 00:45:21 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:21 provision: an app's records could not be listed: they are skipped
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:21 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:45:21 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/25 00:45:21 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:45:21 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:45:21 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:45:21 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:45:21 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:45:21 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:45:21 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:45:21 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:45:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:45:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:21 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/25 00:45:21 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:45:21 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/25 00:45:21 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/25 00:45:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:45:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:22 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:45:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:22 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:22 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:45:22 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/25 00:45:22 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/25 00:45:23 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/25 00:45:23 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:23 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:23 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (1.37s)
    plan9_b8_census_test.go:372: record-write census rejected 4 site(s); update the explicit inventory only after reviewing the source:
          changed site internal/instanceexec/exit.go:RunExit: source differs from the reviewed digest
          changed site internal/layout/plan.go:PlanFor: source differs from the reviewed digest
          changed site internal/ops/litestream.go:FleetDBsWithSkipped: source differs from the reviewed digest
          changed site internal/provision/sidecar_reconcile.go:ReconcileSidecars: source differs from the reviewed digest
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:45:25 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/25 00:45:25 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/25 00:45:25 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/25 00:45:25 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io hibernate false -> true
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged acme.go.tito.io status-named false -> true
2026/10/25 00:45:25 provision: converged acme.go.tito.io status-named true -> false
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:45:25 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:45:25 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:45:25 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/25 00:45:25 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/25 00:45:25 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/25 00:45:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:25 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:45:26 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/25 00:45:26 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/25 00:45:26 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/25 00:45:26 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:26 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/25 00:45:26 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/25 00:45:26 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/25 00:45:26 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:26 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:45:26 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:26 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/25 00:45:26 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:45:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:26 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/25 00:45:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:26 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/25 00:45:26 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:26 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:45:26 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:26 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/25 00:45:26 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/25 00:45:26 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/25 00:45:26 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:26 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:45:26 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/25 00:45:26 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/25 00:45:26 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/25 00:45:26 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:45:26 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/25 00:45:26 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/25 00:45:26 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/25 00:45:26 provision: dry-run: would converge owned.go.tito.io seed
2026/10/25 00:45:26 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/25 00:45:26 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:26 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/25 00:45:26 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/25 00:45:26 provision: converged owned.go.tito.io channel stable -> edge
2026/10/25 00:45:26 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/25 00:45:26 provision: converged owned.go.tito.io hibernate false -> true
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/25 00:45:26 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/25 00:45:26 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/25 00:45:26 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:26 provision: removed retired static route site.go.tito.io (record gone)
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/25 00:45:27 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/25 00:45:27 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:27 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:45:27 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:45:27 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/25 00:45:27 provision: converged acme.go.tito.io channel stable -> edge
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:45:27 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/25 00:45:27 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:45:27 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:45:27 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/25 00:45:27 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:45:27 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/25 00:45:27 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/25 00:45:27 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/25 00:45:27 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/25 00:45:27 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/25 00:45:27 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/25 00:45:28 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/25 00:45:28 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/25 00:45:28 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:28 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:30 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:30 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/25 00:45:30 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:30 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/25 00:45:30 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/25 00:45:30 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/25 00:45:30 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:45:30 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:30 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:30 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:45:30 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/25 00:45:30 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:30 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:30 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/25 00:45:30 provision: a.shop.example.com: swapped for import sd_daghrtlbiizmq6iged6crdtt5u (the original route is journaled)
2026/10/25 00:45:30 provision: a.shop.example.com: import sd_daghrtlbiizmq6iged6crdtt5u committed: its gate is cleared and its journal row dropped
2026/10/25 00:45:30 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_on2h2owi56rxbjctu77hhkh6ze rolled back to its original route
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_on2h2owi56rxbjctu77hhkh6ze: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_on2h2owi56rxbjctu77hhkh6ze is cleaned up and its journal row retired
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_4xxvwx4tpk7cbrd2gryusi5ww4 rolled back to its original route
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_4xxvwx4tpk7cbrd2gryusi5ww4: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_4xxvwx4tpk7cbrd2gryusi5ww4 is cleaned up and its journal row retired
2026/10/25 00:45:31 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_4xp272otvrmpnejaxqwwa5vhee
2026/10/25 00:45:31 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/25 00:45:31 provision: dry-run: would converge a.shop.example.com seed source
2026/10/25 00:45:31 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/25 00:45:31 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/25 00:45:31 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_xs3ivjpqmnyklou63crzmoohje cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_2joie6dnwgkxs2cbem4j6ynsja cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_azn2jpdjlom7vsl3yyt77n2g2q is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_kfta24fxib63o5thushhbobpcy is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_73pvl2rdloamkwkzftfpzgdz7q is journaled, but this box cannot act on imports; its row is left alone
2026/10/25 00:45:31 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/25 00:45:31 provision: b.shop.example.com: import sd_oot7kzr6kda3rrishrw7zy7pne left alone this pass: the import journal could not be read
2026/10/25 00:45:31 provision: c.shop.example.com: import sd_ldsh7hobv5qikpwd3c4rno5nkm left alone this pass: the import journal could not be read
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_in33dy2zttqxf7eta5n67xiiaq committed: its gate is cleared and its journal row dropped
2026/10/25 00:45:31 provision: a.shop.example.com: not converging import sd_o6pyee57bo6bsdvzci3yanud4y: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:45:31 provision: a.shop.example.com: not converging import sd_czyweaulpywmy2lpf5v32ngbly: it is swapped but not committed, and the row on this box has no import gate
2026/10/25 00:45:31 provision: a.shop.example.com: not converging import sd_yxxmgltxurzcs7rw555jrc4tx4: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:45:31 provision: a.shop.example.com: not converging import sd_nx4pu7xqwl4jmjqaiali7d2cja: it is placed but not committed, and the row on this box has no import gate
2026/10/25 00:45:31 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/25 00:45:31 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: a.shop.example.com: import sd_3mfjrlygpy3lg2lpe4vyywfgym committed: its gate is cleared and its journal row dropped
2026/10/25 00:45:31 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:31 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:31 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/25 00:45:31 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_ijxljec4higx3bwjcaqi6m7uzq: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_ijxljec4higx3bwjcaqi6m7uzq rolled back (no box had swapped it)
2026/10/25 00:45:31 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/25 00:45:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:31 provision: removed instance route acme.go.tito.io (its seed sd_aqj3p2zase27oe6yaacm5wfgpe was aborted); the next pass rolls it back
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_aqj3p2zase27oe6yaacm5wfgpe: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_aqj3p2zase27oe6yaacm5wfgpe rolled back (no box had swapped it)
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_akxl3jomg2xp46zq4pim7x7kia has a row this pass may not remove; leaving the seed aborted
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_v7upp5aytrtv2m3ib77xdsgbuu rolled back (no box had swapped it)
2026/10/25 00:45:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:31 provision: removed instance route acme.go.tito.io (its seed sd_uelnp6jxnhvhkz2anppatoynfm was aborted); the next pass rolls it back
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_uelnp6jxnhvhkz2anppatoynfm has no route on this box: its local data is removed
2026/10/25 00:45:31 provision: acme.go.tito.io: aborted seed sd_uelnp6jxnhvhkz2anppatoynfm rolled back (no box had swapped it)
2026/10/25 00:45:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_qa4qplek5bupkk5is2jlqlvuym (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qa4qplek5bupkk5is2jlqlvuym rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qa4qplek5bupkk5is2jlqlvuym is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_lp265nzler5bgo6ijekavqzcqm (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_lp265nzler5bgo6ijekavqzcqm rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_lp265nzler5bgo6ijekavqzcqm is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_6djb2t4t5h3ukt3omwrvrxapa4 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_6djb2t4t5h3ukt3omwrvrxapa4 rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_6djb2t4t5h3ukt3omwrvrxapa4: the host's replica is left alone: its record no longer names this seed
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_6djb2t4t5h3ukt3omwrvrxapa4 is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_leuja2oe6bhgno4at4qxirl46i (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_leuja2oe6bhgno4at4qxirl46i rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_leuja2oe6bhgno4at4qxirl46i rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_leuja2oe6bhgno4at4qxirl46i is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_hopynfz7bm7dioc4dfghiayspq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_hopynfz7bm7dioc4dfghiayspq rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_wjn3rqkqcbticoryblezmzmgna (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_wjn3rqkqcbticoryblezmzmgna is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_tnov764zysdihr3c5meivlyznu (the original route is journaled)
2026/10/25 00:45:32 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_tnov764zysdihr3c5meivlyznu left alone this pass: its record could not be read
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_627nnqb7r7lei44lqttdr7n3he (the original route is journaled)
2026/10/25 00:45:32 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_627nnqb7r7lei44lqttdr7n3he left alone this pass: its record could not be read
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_25nit4zr3ydcnkelaz5pvupxpm (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_25nit4zr3ydcnkelaz5pvupxpm: close the import gate: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_25nit4zr3ydcnkelaz5pvupxpm rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_25nit4zr3ydcnkelaz5pvupxpm is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_4o6aeoz2bf5j5ihyjatqcnv3cq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_4o6aeoz2bf5j5ihyjatqcnv3cq: close the import gate: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_4o6aeoz2bf5j5ihyjatqcnv3cq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_4o6aeoz2bf5j5ihyjatqcnv3cq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_jdgpyupowxq4fyguythsxshdny (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_jdgpyupowxq4fyguythsxshdny rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_jdgpyupowxq4fyguythsxshdny rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_jdgpyupowxq4fyguythsxshdny is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_d5nd2kx3kkrhfc62gqirfceytq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_d5nd2kx3kkrhfc62gqirfceytq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_d5nd2kx3kkrhfc62gqirfceytq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_bjxom3sbbsyk3ksq5spk67weja (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bjxom3sbbsyk3ksq5spk67weja: retire its instance key: injected failure at retire-key
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bjxom3sbbsyk3ksq5spk67weja rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bjxom3sbbsyk3ksq5spk67weja is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_xjughs6qzqk5qp3vypn2uztasq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_xjughs6qzqk5qp3vypn2uztasq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_xjughs6qzqk5qp3vypn2uztasq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_x2vzmabuvw2mspr5jnrf2al76i (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_x2vzmabuvw2mspr5jnrf2al76i: remove its local data: injected failure at remove-local
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_x2vzmabuvw2mspr5jnrf2al76i rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_x2vzmabuvw2mspr5jnrf2al76i is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_sjjfl67yvelmywtx6pcfj4ltzq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_sjjfl67yvelmywtx6pcfj4ltzq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_sjjfl67yvelmywtx6pcfj4ltzq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_ibogzpm5af4yw34rakd2uyacli (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_ibogzpm5af4yw34rakd2uyacli: remove its local data: injected failure at remove-local-done
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_ibogzpm5af4yw34rakd2uyacli rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_ibogzpm5af4yw34rakd2uyacli is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_dmr5kcgfz4b3ofg5bnjvtn7jcq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_dmr5kcgfz4b3ofg5bnjvtn7jcq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_dmr5kcgfz4b3ofg5bnjvtn7jcq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_qpkh4v3ota7oaa2smrhyuwmzt4 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qpkh4v3ota7oaa2smrhyuwmzt4: restore the original route: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qpkh4v3ota7oaa2smrhyuwmzt4 rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qpkh4v3ota7oaa2smrhyuwmzt4 is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_crvfmlwpobr7fiijgiktcbt4zu (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_crvfmlwpobr7fiijgiktcbt4zu: restore the original route: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_crvfmlwpobr7fiijgiktcbt4zu rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_crvfmlwpobr7fiijgiktcbt4zu is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_zitstjw5cog4gy2gg2k5skjcaq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_zitstjw5cog4gy2gg2k5skjcaq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_kjp4bmk7crquju4obneg4n7wam (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_kjp4bmk7crquju4obneg4n7wam rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_kjp4bmk7crquju4obneg4n7wam: delete its snapshot: injected failure at delete-snapshot
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_kjp4bmk7crquju4obneg4n7wam is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_d3womhx2s6p4dw5rfr6hbsydly (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_d3womhx2s6p4dw5rfr6hbsydly rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_d3womhx2s6p4dw5rfr6hbsydly is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_uj2lsenqamlrkclb64nna67e5q (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uj2lsenqamlrkclb64nna67e5q rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uj2lsenqamlrkclb64nna67e5q: delete the host's replica: injected failure at delete-replica
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uj2lsenqamlrkclb64nna67e5q is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_v7kh4rxjq4jilwfjvylzrdnczq (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_v7kh4rxjq4jilwfjvylzrdnczq rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_v7kh4rxjq4jilwfjvylzrdnczq is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_qk2z5i6vsw6zbwhg2mpmpbwp4i (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qk2z5i6vsw6zbwhg2mpmpbwp4i rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qk2z5i6vsw6zbwhg2mpmpbwp4i: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_qk2z5i6vsw6zbwhg2mpmpbwp4i is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_uqahku5yfifsjsduxjkshtltau (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uqahku5yfifsjsduxjkshtltau rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uqahku5yfifsjsduxjkshtltau: retire its journal row: constraint failed: injected (1811)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_uqahku5yfifsjsduxjkshtltau is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_ik4nc4bqckfvhlbwfi7uylskt4 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_ik4nc4bqckfvhlbwfi7uylskt4 rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_ik4nc4bqckfvhlbwfi7uylskt4 is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: mark import sd_ik4nc4bqckfvhlbwfi7uylskt4 rolled back: injected failure at cas
2026/10/25 00:45:32 provision: a.shop.example.com: aborted seed sd_ik4nc4bqckfvhlbwfi7uylskt4 rolled back (no box had swapped it)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_splb4by2vk3peritu6jqkqzdwe (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_splb4by2vk3peritu6jqkqzdwe rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_splb4by2vk3peritu6jqkqzdwe is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: aborted seed sd_splb4by2vk3peritu6jqkqzdwe rolled back (no box had swapped it)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_7iux2blpu4tbq4sl6dkj2lutxi (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_7iux2blpu4tbq4sl6dkj2lutxi rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_7iux2blpu4tbq4sl6dkj2lutxi rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_7iux2blpu4tbq4sl6dkj2lutxi rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_7iux2blpu4tbq4sl6dkj2lutxi is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_bfbciigrxechbsaahgwii5ry3e (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bfbciigrxechbsaahgwii5ry3e rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bfbciigrxechbsaahgwii5ry3e is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_2ff7xcxiz6me2pz73ckidg2qgu (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_2ff7xcxiz6me2pz73ckidg2qgu rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_2ff7xcxiz6me2pz73ckidg2qgu is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_b5hyzynkyxre3e2umt2nhri574 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_b5hyzynkyxre3e2umt2nhri574 rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_b5hyzynkyxre3e2umt2nhri574 is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_lwbsrlrylofkm3zqcoa3nc63wi (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_lwbsrlrylofkm3zqcoa3nc63wi rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_lwbsrlrylofkm3zqcoa3nc63wi is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_kql2kfkukvnc2sc64gxtt6fv5a (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_kql2kfkukvnc2sc64gxtt6fv5a rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_kql2kfkukvnc2sc64gxtt6fv5a is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_bct4q3nutgjrnob6xv65fscc3e (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bct4q3nutgjrnob6xv65fscc3e rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_bct4q3nutgjrnob6xv65fscc3e is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_s35fjlcuwgmryivqsgvd5kticu (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_s35fjlcuwgmryivqsgvd5kticu rolled back to its original route
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_s35fjlcuwgmryivqsgvd5kticu is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_blvsbozaxxr5xol4tba2l576qm (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_blvsbozaxxr5xol4tba2l576qm has no route on this box: its local data is removed and no route is put back
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_blvsbozaxxr5xol4tba2l576qm is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_mp6slxf6zclmluxnvgz7vjjy3i (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_6aj4eyrpcy53no5qt53sckrkae (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_hah7r5ivlobgs55xel2xzybvty (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_hah7r5ivlobgs55xel2xzybvty cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_jocsnznixsso4bkbl6342suse4 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: import sd_jocsnznixsso4bkbl6342suse4 is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/25 00:45:32 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/25 00:45:32 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_ezc3ygk4a2jah2fq5u7uun7oa4 (the original route is journaled)
2026/10/25 00:45:32 provision: a.shop.example.com: swapped for import sd_adhhhgy6rajpxfqlsqrcqlnc3q (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_a7yiz5v6taotuxvsvpx5libtpm (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_ceecdrhtghrtrmww57ebyxa5xq (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_oyunb2se7vnj2e24ejnat2ao7m (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_oyunb2se7vnj2e24ejnat2ao7m rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_yblhvxq52p7qatzelrvryqpvmi (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_yblhvxq52p7qatzelrvryqpvmi has no route on this box: its local data is removed and no route is put back
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_yblhvxq52p7qatzelrvryqpvmi is cleaned up and its journal row retired
2026/10/25 00:45:33 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_rj5jknwvohkmpxzrjj35bfxooq (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_rj5jknwvohkmpxzrjj35bfxooq: remove its local data: injected failure at remove-local
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_rj5jknwvohkmpxzrjj35bfxooq is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_7azfujnzcqf2hsqogvl6cksygu (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_7azfujnzcqf2hsqogvl6cksygu: a route appeared at the host, so its local database is left and the rollback waits
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_rxchigg2do53ny63lxtrwgn76y (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_rxchigg2do53ny63lxtrwgn76y rollback deferred: no fence generation: registry busy
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_dtkn2frib6ozkbd2yz4oxg4phu (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_dtkn2frib6ozkbd2yz4oxg4phu rollback deferred: no fence generation: the generation source answered 0
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_v3ap2d6cuik46mu3ulzi6svsw4 (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_atihywnvmo2ompr5e3mncpbid4 (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_vr7n7b3nownqy4m2mrflj5dla4 (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/25 00:45:33 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_otipg4cw4lp6slo5ugfydzonsy (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_otipg4cw4lp6slo5ugfydzonsy rolled back to its original route
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_otipg4cw4lp6slo5ugfydzonsy is cleaned up and its journal row retired
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_c7c7lca3iaa3sy7htl3jqwg2jy (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_c7c7lca3iaa3sy7htl3jqwg2jy rolled back to its original route
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_c7c7lca3iaa3sy7htl3jqwg2jy is cleaned up and its journal row retired
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_efsbyqxbmtzjnzaeo4rkfnnzbe (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_efsbyqxbmtzjnzaeo4rkfnnzbe rolled back to its original route
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_efsbyqxbmtzjnzaeo4rkfnnzbe is cleaned up and its journal row retired
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_l6yz54scr6y5fjad2soxjwaf2i (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_l6yz54scr6y5fjad2soxjwaf2i: retire its instance key: the env file is a symlink
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_l6yz54scr6y5fjad2soxjwaf2i rolled back to its original route
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_l6yz54scr6y5fjad2soxjwaf2i is cleaned up and its journal row retired
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_xnoqn7wg3x6t3uy4y57tb7jckq (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_wvpegnlu3msk6x6imisdwjyy4y (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_q72hkjvkt3aellozsfqfopk57y refused: there is no route at a.shop.example.com to replace
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_aa3547c37m7va765uiqf5nibqi refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_7elrmxrrtnmmoxifbtes5xpx7y refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_upoxti2uwtl56yzss6tozeex4i refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_s3cb3uxyqy4iclcj62mew7v3ha refused: the route belongs to app other
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_rsotoewky7utoxiogmajiiosqm refused: the route is filed under another account
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_kkxc3msggiwiekj5rimcpjisji refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_3byhkjtzbjbhcnydtwabg5iamm refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_4hzumlusvgfomru5wxi24ef6d4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_lcrffmydcev3oqbedvtzik3b3a refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_xqgoapka4cbagyf7nbqhmu3wrq refused: the route is not an address route this import can take over (socket)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_cxnoryqetu3dwvgaxpxo4ya7cq refused: the route is not an address route this import can take over (no address)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_ihe76iesmg5fc4ulo7tky3cury refused: the route is not an address route this import can take over (provisioned)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_iteq6sqbvfbo4hbyxmb7hy5o3q refused: the route is not an address route this import can take over (kind static)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_aqmekvhugpixmtqty3d6p4i4ty refused: the route is not an address route this import can take over (backing)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_zqflj7ktzhu2gowhdjwwbq42zm refused: the route is not an address route this import can take over (tunnel)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_lcain3shnkorp2rvnkrunv6gvy refused: the route is not an address route this import can take over (caps)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_tr2boqpmozialtf3quf4axlzcu refused: the route is not an address route this import can take over (platform)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_kijhmt7cq2qlsh3be74nx42tn4 refused: the route is not an address route this import can take over (canary)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_jjujczr6x6xjnqfxjskjirf5ne refused: the route is not an address route this import can take over (kind sidecar)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_aup7ucfrewl3dxmw3zqmvjqbry refused: the route is not an address route this import can take over (region)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_mgh5fvdpjzgnuhnmqle5fj7jlu refused: the route is not an address route this import can take over (fleet_box)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_x4jhrqsnheqn5dcjpowqm3fvsy refused: the route is not an address route this import can take over (hibernate)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_jhicszv2yp3rsnplefyvnpuyyy refused: the route is not an address route this import can take over (claim_owner)
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_kxy4t2xnj4roiry3jcbojzir4q refused: this box does not run instances nested
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_v3p6q5qi6r4p2fssru4poyytgm refused: this box does not run instances nested
2026/10/25 00:45:33 provision: a.shop.example.com: import sd_bwm3ujdm45kic476wopggeploa refused: claim control is on for this box
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_uzkpuynqu5asrqx4rviblkitde (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: swapped for import sd_vvpvvviszgpldtydpunjvxb5uu (the original route is journaled)
2026/10/25 00:45:33 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/25 00:45:33 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_bbved6i4tuf3u4m46kekylx6ci: its verify hash is not a sha256
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_ynpmk3q6xsgj44d5hdlwspdnzi: its verify hash is not a sha256
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_qq3xvy5sbl3ezyfmzhe2iq55kq: its verify hash is not a sha256
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/25 00:45:33 provision: A.shop.example.com/..: not swapping for import sd_fitmk6eumjdw6qcnkarsnsbv5u: its host or seed id is malformed (seeds: not a host)
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_sgacc75kgwean6lyp5n3qpsrfa: its record does not describe a nested, hibernating instance
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_nl6qrvh2myyfienyvlrjj6niue: its record does not describe a nested, hibernating instance
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_fapaqnixoquyxouyxa34ic5dje: its record does not describe a nested, hibernating instance
2026/10/25 00:45:33 provision: a.shop.example.com: not swapping for import sd_llcwx75dglunovjy4gfbz3xlom: its record does not describe a nested, hibernating instance
2026/10/25 00:45:34 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/25 00:45:34 provision: a.shop.example.com: swapped for import sd_jrmye6qhbs5qutwwrciogn7vn4 (the original route is journaled)
2026/10/25 00:45:34 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/25 00:45:34 provision: a.shop.example.com: swapped for import sd_kumdgjn2qptlfredn26tsiulva (the original route is journaled)
2026/10/25 00:45:34 provision: a.shop.example.com: swapped for import sd_6y6lk2ntcius2iipskolq656we (the original route is journaled)
2026/10/25 00:45:34 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/25 00:45:34 provision: dry-run: would consider swapping a.shop.example.com for import sd_x2mbaundr4zyet4nmdd3kadvdq
2026/10/25 00:45:34 provision: a.shop.example.com: import sd_5hq4hmd6wly76jmmfpjgdezmfm rolled back to its original route
2026/10/25 00:45:34 provision: a.shop.example.com: import sd_5hq4hmd6wly76jmmfpjgdezmfm: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/25 00:45:34 provision: a.shop.example.com: import sd_5hq4hmd6wly76jmmfpjgdezmfm is cleaned up and its journal row retired
2026/10/25 00:45:34 provision: a.shop.example.com: import sd_336gjussudp4zuuf2siqrh2tbe left alone: the import journal holds seed sd_4gekjtpw6hyssgnqo4ieajddjq at swapped
2026/10/25 00:45:34 provision: a.shop.example.com: not minting import sd_o4qgtceeueoyfqyjdw3fo5gmea: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:45:34 provision: a.shop.example.com: not minting import sd_3cgsf7wnwfdaivu3nbpc43ft2i: it is placed but not committed, and only its swap makes its row
2026/10/25 00:45:34 provision: a.shop.example.com: swapped for import sd_uyyaijzu45nmdbwwkde7vx7eau (the original route is journaled)
2026/10/25 00:45:34 provision: a.shop.example.com: not minting import sd_uyyaijzu45nmdbwwkde7vx7eau: it is swapped but not committed, and only its swap makes its row
2026/10/25 00:45:34 provision: a.shop.example.com: not minting import sd_uyyaijzu45nmdbwwkde7vx7eau: it is placed but not committed, and only its swap makes its row
2026/10/25 00:45:34 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/25 00:45:34 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/25 00:45:34 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/25 00:45:34 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/25 00:45:34 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/25 00:45:34 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/25 00:45:34 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:45:34 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/25 00:45:34 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/25 00:45:34 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/25 00:45:34 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:45:34 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/25 00:45:34 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/25 00:45:34 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/25 00:45:34 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/25 00:45:34 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/25 00:45:34 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: sidecar bot.eleven.bac.sidecar.internal: not minting this pass: the box's layout intent could not be read: store down
2026/10/25 00:45:34 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/25 00:45:34 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/25 00:45:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:34 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/25 00:45:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:34 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:45:34 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:45:34 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:45:34 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/25 00:45:34 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/25 00:45:34 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/25 00:45:34 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/25 00:45:34 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:45:34 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:34 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/25 00:45:34 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:34 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/25 00:45:34 provision: an app's records could not be listed: they are skipped
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:45:34 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:45:34 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:45:34 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:45:34 provision: record view: change index unusable (get refused): walking
2026/10/25 00:45:34 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:34 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/25 00:45:34 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/25 00:45:34 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/25 00:45:34 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:45:34 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/25 00:45:34 provision: removed retired instance route one.example.com (record gone)
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:45:34 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:45:34 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/25 00:45:34 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/25 00:45:34 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:34 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:35 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/25 00:45:35 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/25 00:45:35 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/25 00:45:35 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (25.13s)
    plan14_root_reads_test.go:600: root read census: 128 discrepancies
        changed root read internal/activator/activator.go:Service.doWake; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.respawnWorkerLocked; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.stop; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.sweepOnce; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.spawnInCgroupGated; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom; review class, task, sites and digest
        changed root read internal/activator/backend_unit.go:SplitBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/containment.go:ExecBackend.spawnInCgroupAtTier; review class, task, sites and digest
        changed root read internal/activator/containment.go:Service.legacyRunGone; review class, task, sites and digest
        changed root read internal/activator/layout.go:Classify; review class, task, sites and digest
        changed root read internal/activator/maintenance.go:Service.cleanupFailedWake; review class, task, sites and digest
        changed root read internal/activator/opset.go:Service.reapUnprovenWake; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareAt; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareKeyedAt; review class, task, sites and digest
        changed root read internal/activator/unitproc.go:ExecBackend.observe; review class, task, sites and digest
        changed root read internal/activator/workerswap.go:Service.ReplaceWorker; review class, task, sites and digest
        changed root read internal/appconfig/syncexec.go:nestedRoute; review class, task, sites and digest
        changed root read internal/host/agent.go:fastConvergeLoop; review class, task, sites and digest
        changed root read internal/host/agent.go:runAgent; review class, task, sites and digest
        changed root read internal/host/agent.go:statusLoop; review class, task, sites and digest
        changed root read internal/host/claimunit.go:readClaimUnitSettings; review class, task, sites and digest
        changed root read internal/host/layoutleg.go:layoutStatusReport; review class, task, sites and digest
        changed root read internal/host/layoutleg.go:unmanagedLayoutReport; review class, task, sites and digest
        changed root read internal/host/systemapply.go:layoutReversalIncomplete; review class, task, sites and digest
        changed root read internal/instancectl/server.go:parseRequest; review class, task, sites and digest
        changed root read internal/instancectl/server.go:type Server; review class, task, sites and digest
        changed root read internal/layout/journal.go:Validate; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.Converge; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.convergeHost; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.migrateHost; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.recoverHost; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.restoreHold; review class, task, sites and digest
        changed root read internal/layout/pass.go:Pass.shift; review class, task, sites and digest
        changed root read internal/ops/hibernate_verify.go:HibernatingHosts; review class, task, sites and digest
        changed root read internal/ops/litestream.go:FleetDBsWithSkipped; review class, task, sites and digest
        changed root read internal/ops/ops.go:runLitestream; review class, task, sites and digest
        changed root read internal/provision/sidecar_reconcile.go:ReconcileSidecars; review class, task, sites and digest
        changed root read internal/provision/sidecar_reconcile.go:convergeSidecar; review class, task, sites and digest
        changed root read internal/status/snapshot.go:CollectBox; review class, task, sites and digest
        changed root read status_instances.go:printStatusLayout; review class, task, sites and digest
        changed root source envelope .
        changed root source envelope internal/activator
        changed root source envelope internal/agentsock
        changed root source envelope internal/appconfig
        changed root source envelope internal/console
        changed root source envelope internal/host
        changed root source envelope internal/host/units
        changed root source envelope internal/hostenv
        changed root source envelope internal/instancectl
        changed root source envelope internal/instanceexec
        changed root source envelope internal/layout
        changed root source envelope internal/ops
        changed root source envelope internal/provision
        changed root source envelope internal/release
        changed root source envelope internal/status
        stale root read internal/activator/control.go:systemctlUnitState
        stale root read internal/host/systemapply.go:systemApplier.install
        stale root read internal/host/systemapply.go:systemApplier.layoutReversalReasons
        unclassified root read internal/activator/activator.go:Service.SharedWorkerToken whole:Route@329
        unclassified root read internal/activator/activator.go:Service.agentSocketFor whole:Route@148
        unclassified root read internal/activator/backend_exec.go:ExecBackend.RoleGone registry:Host@192,registry:Host@228,registry:Host@271,registry:Host@562
        unclassified root read internal/activator/backend_exec.go:ExecBackend.startWorkerUnit registry:Host@1137,registry:Host@1299,registry:Host@1647,registry:Host@1775,registry:Host@2094,registry:Host@2193,registry:Host@626,registry:Host@698,whole:Route@1341,whole:Route@2291,whole:Route@328,whole:Route@419
        unclassified root read internal/activator/backend_unit.go:SplitBackend.RoleGone file:Exec@263,registry:Backing@107,registry:Host@217,registry:Host@323,whole:Route@377
        unclassified root read internal/activator/backend_unit.go:SplitBackend.nestedWorkerRow file:Exec@134,registry:Backing@69,whole:Route@193
        unclassified root read internal/activator/backend_unit.go:SplitBackend.perHostAgentSocket file:Exec@154,registry:Backing@82,whole:Route@217
        unclassified root read internal/activator/containment.go:Service.roleGone whole:Route@581
        unclassified root read internal/activator/control.go:systemctlUnitFacts file:CommandContext@105
        unclassified root read internal/activator/flatexec.go:ExecBackend.admitFlatExec whole:Route@126,whole:Route@155
        unclassified root read internal/activator/flatexec.go:FlatExecPolicy.Admit registry:Host@201,registry:Host@278,registry:Host@320,registry:Host@378,registry:Host@97
        unclassified root read internal/activator/layout.go:WorkerManaged registry:Backing@71,registry:Tunnel@91
        unclassified root read internal/activator/opset.go:Service.stopUnitProven registry:Host@309,whole:Route@101,whole:Route@177
        unclassified root read internal/activator/prepare.go:ExecBackend.agentSocketFor whole:Route@102
        unclassified root read internal/activator/prepare.go:ExecBackend.nestedWorkerRow registry:DBPath@112,registry:Host@159,registry:Socket@93,whole:Route@86
        unclassified root read internal/activator/prepare.go:ExecBackend.perHostAgentSocket whole:Route@141,whole:Route@96
        unclassified root read internal/activator/prepare.go:ExecBackend.prepareWorker whole:Route@210
        unclassified root read internal/activator/unitproc.go:ExecBackend.newWorkerUnitProc registry:Host@244,registry:Host@286,whole:Route@167,whole:Route@171
        unclassified root read internal/host/flatexec.go:flatExecInventory registry:Host@288,registry:Host@457,whole:Route@181,whole:Route@223,whole:Route@255,whole:Route@331
        unclassified root read internal/host/flatexec.go:flatExecStatusReport whole:Route@544,whole:Route@548,whole:Route@603,whole:Route@758,whole:Route@796,whole:Route@812
        unclassified root read internal/host/layoutleg.go:layoutRowsReport registry:Hibernate@956,registry:Host@1106,registry:Host@658,registry:Host@812,registry:Host@894,registry:Kind@911,registry:Socket@936,whole:Route@151,whole:Route@313,whole:Route@367,whole:Route@396,whole:Route@434,whole:Route@438
        unclassified root read internal/host/units/carlos-instance-worker@.service:external file:external@0
        unclassified root read internal/layout/pass.go:Pass.managed whole:Route@136,whole:Route@84
        unclassified root read internal/layout/plan.go:WorkerRowAgrees registry:Kind@236,registry:Kind@366
        unclassified root read internal/layout/replicator.go:configFile.unchanged file:Stat@63
        unclassified root read internal/layout/replicator.go:readConfig file:Open@62,file:ReadAll@635,file:Stat@1043,file:Stat@262,file:Stat@783
        unclassified root read internal/layout/replicator.go:systemctlShow file:CommandContext@161
        unclassified root read internal/layout/replicator.go:unitCgroupEmpty file:ReadFile@339
        unclassified root read internal/ops/litestream.go:ActivatorReplicated registry:Backing@59,registry:DBPath@97,registry:Hibernate@117
        unclassified root read internal/ops/litestream.go:ActivatorReplicatedPaths registry:DBPath@257,whole:Route@178,whole:Route@212
        changed legacy declaration internal/activator/activator.go:Service.doWake
        changed legacy declaration internal/activator/activator.go:Service.stop
        changed legacy declaration internal/activator/activator.go:Service.sweepOnce
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.LegacyRunGone
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom
        changed legacy declaration internal/activator/backend_unit.go:SplitBackend.LegacyRunGone
        changed legacy declaration internal/activator/containment.go:Service.legacyRunGone
        changed legacy declaration internal/activator/layout.go:Classify
        changed legacy declaration internal/activator/maintenance.go:Service.cleanupFailedWake
        changed legacy declaration internal/activator/opset.go:Service.reapUnprovenWake
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareAt
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareKeyedAt
        changed legacy declaration internal/activator/unitproc.go:ExecBackend.observe
        changed legacy declaration internal/appconfig/syncexec.go:nestedRoute
        changed legacy declaration internal/host/agent.go:statusLoop
        changed legacy declaration internal/instancectl/server.go:parseRequest
        changed legacy declaration internal/instancectl/server.go:type Server
        changed legacy declaration internal/layout/journal.go:Validate
        changed legacy declaration internal/layout/pass.go:Pass.Converge
        changed legacy declaration internal/layout/pass.go:Pass.convergeHost
        changed legacy declaration internal/layout/pass.go:Pass.migrateHost
        changed legacy declaration internal/layout/pass.go:Pass.recoverHost
        changed legacy declaration internal/layout/pass.go:Pass.restoreHold
        changed legacy declaration internal/layout/pass.go:Pass.shift
        changed legacy declaration internal/ops/hibernate_verify.go:HibernatingHosts
        changed legacy declaration internal/ops/litestream.go:FleetDBsWithSkipped
        changed legacy declaration internal/ops/ops.go:runLitestream
        changed legacy declaration internal/provision/sidecar_reconcile.go:ReconcileSidecars
        changed legacy declaration internal/provision/sidecar_reconcile.go:convergeSidecar
        changed legacy declaration internal/status/snapshot.go:CollectBox
        changed legacy declaration status_instances.go:printStatusLayout
        changed reclassified declaration internal/activator/activator.go:Service.respawnWorkerLocked
        changed reclassified declaration internal/activator/backend_exec.go:ExecBackend.spawnInCgroupGated
        changed reclassified declaration internal/activator/containment.go:ExecBackend.spawnInCgroupAtTier
        changed reclassified declaration internal/activator/workerswap.go:Service.ReplaceWorker
        changed reclassified declaration internal/host/agent.go:fastConvergeLoop
        legacy declaration needs explicit reclassification or removal internal/activator/control.go:systemctlUnitState
        
        make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	39.102s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.009s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	7.879s
ok  	github.com/carlosframework/platform/internal/relay	7.245s
ok  	github.com/carlosframework/platform/internal/release	33.208s
ok  	github.com/carlosframework/platform/internal/rollout	5.550s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.021s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.061s
ok  	github.com/carlosframework/platform/internal/rootstate	0.036s
ok  	github.com/carlosframework/platform/internal/runs	0.959s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	3.272s
ok  	github.com/carlosframework/platform/internal/seeds	0.079s
ok  	github.com/carlosframework/platform/internal/sim/engines	6.574s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	28.470s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.988s
ok  	github.com/carlosframework/platform/internal/status	0.098s
ok  	github.com/carlosframework/platform/internal/steering	0.015s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.508s
ok  	github.com/carlosframework/platform/internal/svcrole	0.005s
ok  	github.com/carlosframework/platform/internal/telemetry	0.007s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.005s
ok  	github.com/carlosframework/platform/internal/unixdial	0.004s
ok  	github.com/carlosframework/platform/internal/updatewords	0.006s
ok  	github.com/carlosframework/platform/internal/usage	0.020s
ok  	github.com/carlosframework/platform/internal/version	0.003s
ok  	github.com/carlosframework/platform/internal/vet	1.982s
FAIL
=== internal_console@0 (90 s)
ok  	github.com/carlosframework/platform/internal/console	88.446s
=== internal_console@1 (50 s)
ok  	github.com/carlosframework/platform/internal/console	48.537s
=== internal_console@2 (49 s)
ok  	github.com/carlosframework/platform/internal/console	47.587s
=== internal_console@3 (52 s)
ok  	github.com/carlosframework/platform/internal/console	49.795s
=== internal_console@4 (50 s)
ok  	github.com/carlosframework/platform/internal/console	48.009s
=== internal_console@5 (48 s)
ok  	github.com/carlosframework/platform/internal/console	45.892s
=== internal_console@6 (53 s)
ok  	github.com/carlosframework/platform/internal/console	50.815s
=== internal_console@7 (58 s)
ok  	github.com/carlosframework/platform/internal/console	55.766s
=== root@0 (122 s)
using http://127.0.0.1:33971 as a@keymail.dev
--- FAIL: TestRunBuiltCopyIsApplied (0.27s)
    approved_run_copy_test.go:139: RUN-C13: internal/instanceexec/exec.go does not contain the approved text "instance-exec: role <role> is not run, seed, sidecar or cmd"
    approved_run_copy_test.go:139: RUN-C14: internal/instanceexec/exit.go does not contain the approved text "instance-exit: role <role> is not run, seed, sidecar or cmd"
2026/10/25 00:45:37 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:45:37 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A38903": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:37 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:45:41 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:45:41 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A34153": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:41 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:45:47 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:45:47 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:45:47 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:45:47 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:45:47 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:45:47 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:45:49 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:45:49 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=888
2026/10/25 00:45:49 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/25 00:45:49 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
using http://127.0.0.1:43009 as paul@keymail.dev
2026/10/25 00:45:49 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43009": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:49 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
using http://127.0.0.1:43009 as paul@keymail.dev
using http://127.0.0.1:43009 as paul@keymail.dev
Querying a copy of acme.go.tito.io's database, up to transaction 3, written 2026-10-25 00:45:49 UTC. Nothing you run here reaches acme.go.tito.io.
2026/10/25 00:45:49 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:45:49 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:45:49 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:45:50 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:45:50 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:45:50 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:45:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:45:50 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A45287": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:50 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:45:51 console: db read dbr_yxlxbx3jalombr4zvobpnhclny: relayed 1 chunks (99 bytes) in 1.002s, ended done
2026/10/25 00:45:51 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:45:51 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:45:51 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:45:52 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:45:52 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:45:52 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:45:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:45:52 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A38399": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:52 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:45:53 console: db read dbr_y5tecvsapde3j5gdotrl7sem6q: relayed 1 chunks (102 bytes) in 1.002s, ended done
2026/10/25 00:45:53 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:45:53 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/25 00:45:53 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:45:54 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:45:54 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/25 00:45:54 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:45:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:45:54 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A37961": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:45:54 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/25 00:46:56 console: db read dbr_nmmbfk6spu5mqas4iaxk3b63aa: relayed 1 chunks (99 bytes) in 1m2.029s, ended no-result
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:46:56 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:46:56 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:46:56 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 00:46:56 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
fetching a copy of shop.example.com's database from region uk.
2026/10/25 00:46:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:46:56 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A44173": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:46:56 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:46:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:46:56 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A33149": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:46:56 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:46:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:46:57 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A37573": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:46:57 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:46:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:46:57 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A33343": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:46:57 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
using http://127.0.0.1:35445 as paul@keymail.dev
account: ops (bab)
attached tickets.example.com -> default.go.tito.io
DNS: pointing
using http://127.0.0.1:35445 as paul@keymail.dev
account: ops (bab)
attached carloku.example.com -> default.go.tito.io
2026/10/25 00:47:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:47:05 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A38083": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:47:05 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:47:06 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A42357": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/25 00:47:06 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/25 00:47:08 domains: minted platform domain echoapp.bab.oncarlos.test (upstream app.local)
2026/10/25 00:47:08 domains: minted platform domain site.bab.oncarlos.test (upstream site.local)
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:47:10 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:47:10 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:47:10 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 00:47:10 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
FAIL
FAIL	github.com/carlosframework/platform	119.728s
FAIL
=== root@1 (79 s)
ok  	github.com/carlosframework/platform	76.796s
=== root@2 (116 s)
ok  	github.com/carlosframework/platform	113.351s

FAILED: rest root@0
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/implementation/census-claims-sidecar-isolation.txt b/implementation/census-claims-sidecar-isolation.txt

index 3c85d07eb..8324838f7 100644

--- a/implementation/census-claims-sidecar-isolation.txt

+++ b/implementation/census-claims-sidecar-isolation.txt

@@ -33,3 +33,4 @@ internal/host/systemapply.go:systemApplier.install beside R9 and before the jour

internal/host/systemapply.go:layoutReversalIncomplete returns the named hosts and the failed reads apart (hosts, problems) so the workers floor can tell a worker host from an error; the same reads, the same hosts named

internal/host/systemapply.go:systemApplier.layoutReversalReasons opens the registry through guardRegistry (the seam it had inline) and joins layoutReversalIncomplete's hosts and problems into the same list as before; no new read

internal/host/claimunit.go:readClaimUnitSettings the line parsing moved verbatim into parseHostEnvKeys (side-effect free, selected keys, same error texts), shared with install's workers floor (nestedWorkersOptedIn); the file read, the missing-file default and prepareRootRetryUnitDirectory stay here; no new read

+status_instances.go:printStatusLayout prints the rows table only when there are rows, and after it each box's flat-exec section and the closure-check summary (printFlatExecSections, D14/D15) from the door's answer; no new read

diff --git a/internal/console/apistatusinstances_test.go b/internal/console/apistatusinstances_test.go

index 489bf37c8..6aa4514d6 100644

--- a/internal/console/apistatusinstances_test.go

+++ b/internal/console/apistatusinstances_test.go

@@ -9,6 +9,7 @@ import (

"github.com/carlosframework/platform/internal/activator"

"github.com/carlosframework/platform/internal/metrics"

+ "github.com/carlosframework/platform/internal/provision"

"github.com/carlosframework/platform/internal/registry"

"github.com/carlosframework/platform/internal/release"

)

@@ -223,3 +224,36 @@ func TestAPIStatusInstancesAccountFilterNarrows(t *testing.T) {

t.Errorf("?account=nosuchacct = %+v, want no rows at all", rows)

}

+// TestAPIStatusInstancesListsAWorker (sidecar isolation §3.12): a native

+// worker's sampled unit is listed under the worker's own row, account and

+// app, not as platform overhead. The sampler publishes a host's reading

+// under activator.ExecName(host) whichever tier runs it (isolated-exec

+// design §6.6), so the matcher needs the worker's row, not a worker unit

+// prefix.

+func TestAPIStatusInstancesListsAWorker(t *testing.T) {

+ fx := newConsoleFixture(t)

+ token := cliToken(t, fx, "paul@keymail.dev", "code-apistatusworker")

+ if err := fx.st.SetOperator("paul@keymail.dev", true); err != nil {

+ t.Fatal(err)

+ }

+ host := "bot.widgets.cdef" + provision.SidecarSuffix

+ fx.addRoute(t, registry.Route{Host: host, Kind: "sidecar", Status: "ready", App: "widgets", Account: "cdef", Channel: "stable"})

+ at := time.Now().UTC().Add(-time.Minute)

+ cpu := 0.5

+ if err := metrics.WriteRaw(context.Background(), fx.rel, metrics.RawChunk{

+ V: 1, Box: "box-worker", Hour: metrics.HourOf(at),

+ Samples: []metrics.Sample{{At: at, Units: map[string]metrics.UnitSample{

+ activator.ExecName(host): {CPUFrac: &cpu},

+ }}},

+ }); err != nil {

+ t.Fatal(err)

+ }

+ rows := statusInstanceRows(t, fx, token, "")

+ if len(rows) != 1 {

+ t.Fatalf("rows = %+v, want the worker's", rows)

+ }

+ if r := rows[0]; r.Host != host || r.App != "widgets" || r.Account != "cdef" || r.Platform || r.Unit != activator.ExecName(host) {

+ t.Errorf("worker row = %+v", r)

+ }

diff --git a/internal/console/apistatuslayout.go b/internal/console/apistatuslayout.go

index 9471f25e4..5421da7e6 100644

--- a/internal/console/apistatuslayout.go

+++ b/internal/console/apistatuslayout.go

@@ -50,6 +50,18 @@ type apiStatusLayoutBox struct {

// not in force on a box whose mode is none (design §8.6). Additive.

Default bool `json:"default,omitempty"`

DefaultBlocked string `json:"default_blocked,omitempty"`

+ // Workers is the box's workers readiness word (sidecar isolation D11,

+ // D14: nested, off, waiting_for_prev or blocked) and WorkersReason the

+ // box's private diagnostic for blocked. FlatExec is the box's

+ // flat-exec report as the snapshot carries it (D14): the policy in

+ // force, the allowlist, the spawn record, the inventory of what refuse

+ // would stop and the closure check (D15), so an operator reads all of

+ // it here without box access. All additive; an old CLI ignores them,

+ // and a box that predates them leaves them absent, which the CLI

+ // renders as not reported, never as closed.

+ Workers string `json:"workers,omitempty"`

+ WorkersReason string `json:"workers_reason,omitempty"`

+ FlatExec *status.FlatExecReport `json:"flat_exec,omitempty"`

}

// layoutMixed is the Mixed rule: a row that runs as the agent's uid with

@@ -103,24 +115,34 @@ func (s *Server) handleAPIStatusLayout(w http.ResponseWriter, r *http.Request) {

now := time.Now()

out := make([]apiStatusLayoutBox, 0, len(boxes))

for _, b := range boxes {

- if b.Metrics == nil || b.Metrics.Layout == nil {

+ if b.Metrics == nil || (b.Metrics.Layout == nil && b.Metrics.FlatExec == nil) {

// A box that predates layout reporting, or has no layout pass

- // armed yet (no activator running): nothing to add.

+ // armed yet (no activator running): nothing to add. A box

+ // with a flat-exec report and no layout report still answers:

+ // the report is read from the registry, not from the pass

+ // (sidecar isolation R4-3).

continue

}

- rows := make([]apiStatusLayoutRow, 0, len(b.Metrics.Layout.Rows))

- for host, rl := range b.Metrics.Layout.Rows {

+ lr := b.Metrics.Layout

+ if lr == nil {

+ lr = &status.LayoutReport{}

+ }

+ rows := make([]apiStatusLayoutRow, 0, len(lr.Rows))

+ for host, rl := range lr.Rows {

rows = append(rows, apiStatusLayoutRow{Host: host, Layout: rl.Layout, Reason: rl.Reason, Note: rl.Note})

}

sort.Slice(rows, func(i, j int) bool { return rows[i].Host < rows[j].Host })

out = append(out, apiStatusLayoutBox{

Box: b.Label,

- Mode: b.Metrics.Layout.Mode,

+ Mode: lr.Mode,

Stale: status.BoxStale(b, now, status.SnapshotPeriod),

Rows: rows,

- Mixed: layoutMixed(b.Metrics.Layout.Mode, rows),

- Default: b.Metrics.Layout.Default,

- DefaultBlocked: b.Metrics.Layout.DefaultBlocked,

+ Mixed: layoutMixed(lr.Mode, rows),

+ Default: lr.Default,

+ DefaultBlocked: lr.DefaultBlocked,

+ Workers: lr.Workers,

+ WorkersReason: lr.WorkersReason,

+ FlatExec: b.Metrics.FlatExec,

})

}

sort.Slice(out, func(i, j int) bool { return out[i].Box < out[j].Box })

diff --git a/internal/console/apistatuslayout_test.go b/internal/console/apistatuslayout_test.go

index c0f81efb9..2397b441b 100644

--- a/internal/console/apistatuslayout_test.go

+++ b/internal/console/apistatuslayout_test.go

@@ -208,3 +208,71 @@ func TestLayoutMixedNeedsANestedAndAFlatRow(t *testing.T) {

}

+// TestAPIStatusLayoutCarriesFlatExecAndWorkers (sidecar isolation D14,

+// D15): the door carries each box's flat-exec report and workers word from

+// the snapshot unchanged, so `carlos status --layout` can show the policy,

+// the allowlist, the inventory and the closure check without box access.

+// An unknown inventory arrives as unknown, never as an empty list.

+func TestAPIStatusLayoutCarriesFlatExecAndWorkers(t *testing.T) {

+ fx := newConsoleFixture(t)

+ token := cliToken(t, fx, "paul@keymail.dev", "code-apistatuslayoutflatexec")

+ if err := fx.st.SetOperator("paul@keymail.dev", true); err != nil {

+ t.Fatal(err)

+ }

+ now := time.Now().UTC().Truncate(time.Second)

+ seed := func(label string, layout *status.LayoutReport, fe *status.FlatExecReport) {

+ b := status.CollectBox(nil, status.Probes{Release: "v1", Layout: layout, FlatExec: fe}, now)

+ b.Label = label

+ if err := status.WriteBox(context.Background(), fx.rel, b); err != nil {

+ t.Fatal(err)

+ }

+ seed("open-box", &status.LayoutReport{

+ Mode: "nested", Workers: "blocked", WorkersReason: "claim mode is on",

+ Rows: map[string]status.RowLayout{"bot.shop.abc.sidecar.internal": {Layout: "flat"}},

+ }, &status.FlatExecReport{

+ Mode: "refuse", Allow: []string{"tools.example.com"}, Dropped: []string{"not a host"}, Intent: "nested",

+ Refusals: []status.FlatExecRefusal{{Host: "bot.shop.abc.sidecar.internal", Reason: "flat_refused", Since: now, Last: now, Count: 2}},

+ Inventory: []status.FlatExecRow{{Host: "bot.shop.abc.sidecar.internal", Layout: "flat", Worker: true}},

+ FlatWorkers: 1,

+ })

+ seed("unknown-box", &status.LayoutReport{Mode: "flat", Rows: map[string]status.RowLayout{}},

+ &status.FlatExecReport{Mode: "report", Intent: "unknown", InventoryUnknown: "no layout pass is armed on this box, so its rows cannot be classified"})

+ // A box with a flat-exec report and no layout report still answers:

+ // the report is computed from the registry, not from the pass.

+ seed("no-layout-box", nil, &status.FlatExecReport{Mode: "refuse", Intent: "nested", Closed: true})

+ code, body := getBearer(t, fx.ts.URL+"/api/cli/status/layout", token)

+ if code != http.StatusOK {

+ t.Fatalf("GET = %d %q", code, body)

+ }

+ var out struct {

+ Boxes []apiStatusLayoutBox `json:"boxes"`

+ }

+ if err := json.Unmarshal(body, &out); err != nil {

+ t.Fatalf("unreadable: %v: %s", err, body)

+ }

+ byLabel := map[string]apiStatusLayoutBox{}

+ for _, b := range out.Boxes {

+ byLabel[b.Box] = b

+ }

+ open := byLabel["open-box"]

+ if open.Workers != "blocked" || open.WorkersReason != "claim mode is on" {

+ t.Errorf("open-box workers = %q %q", open.Workers, open.WorkersReason)

+ }

+ fe := open.FlatExec

+ if fe == nil || fe.Mode != "refuse" || fe.Intent != "nested" || len(fe.Allow) != 1 || fe.Allow[0] != "tools.example.com" ||

+ len(fe.Dropped) != 1 || len(fe.Refusals) != 1 || fe.Refusals[0].Reason != "flat_refused" || fe.Refusals[0].Count != 2 ||

+ len(fe.Inventory) != 1 || !fe.Inventory[0].Worker || fe.FlatWorkers != 1 || fe.Closed {

+ t.Errorf("open-box flat exec = %+v", fe)

+ }

+ unknown := byLabel["unknown-box"].FlatExec

+ if unknown == nil || unknown.InventoryUnknown == "" || unknown.Closed {

+ t.Errorf("unknown-box flat exec = %+v, want the unknown inventory carried", unknown)

+ }

+ nl, ok := byLabel["no-layout-box"]

+ if !ok || nl.FlatExec == nil || !nl.FlatExec.Closed {

+ t.Errorf("no-layout-box = %+v (present %v), want its flat-exec report", nl, ok)

+ }

diff --git a/internal/host/flatexec_copy.go b/internal/host/flatexec_copy.go

index 04de6e379..e618bd8b0 100644

--- a/internal/host/flatexec_copy.go

+++ b/internal/host/flatexec_copy.go

@@ -3,7 +3,7 @@ package host

// Copy for the flat-exec policy's operator surfaces (sidecar isolation spec

// D12, D14), collected and reviewed in Task 12. A placeholder until then.

-// flatExecAllowlistedWarning is what `carlos status --layout` says beside

+// FlatExecAllowlistedWarning is what `carlos status --layout` says beside

// every allowlisted host: it runs as the agent in the host namespace and

// is not isolated from its neighbours.

-const flatExecAllowlistedWarning = "unisolated: allowlisted in CARLOS_FLAT_EXEC_ALLOW, this host runs as the agent in the host namespace and can read every tenant on the box" // copy: placeholder, Task 12

+const FlatExecAllowlistedWarning = "unisolated: allowlisted in CARLOS_FLAT_EXEC_ALLOW, this host runs as the agent in the host namespace and can read every tenant on the box" // copy: placeholder, Task 12

diff --git a/internal/hostbox/inventoryscope_worker_test.go b/internal/hostbox/inventoryscope_worker_test.go

new file mode 100644

index 000000000..2db503eaa

--- /dev/null

+++ b/internal/hostbox/inventoryscope_worker_test.go

@@ -0,0 +1,51 @@

+package hostbox

+import (

+ "path/filepath"

+ "testing"

+ "github.com/carlosframework/platform/internal/provision"

+ "github.com/carlosframework/platform/internal/registry"

+// TestInventoryScopeAcceptsEitherWorkerPath (sidecar isolation §3.12): a

+// worker row's database is at NestedDBPath once it is nested and at

+// DefaultDBPath while it is flat (D2), and ValidateAgentInventory's path

+// check already admits both, for a worker host as for an instance host.

+// Claims stay dormant and keep refusing workers (§10); this pins only that

+// the scope check does not need a worker branch.

+func TestInventoryScopeAcceptsEitherWorkerPath(t *testing.T) {

+ data := t.TempDir()

+ host := "bot.shop.cdef" + provision.SidecarSuffix

+ own := registry.ClaimOwnership{ClaimIncarnation: "inc", ClaimStamp: 1, ClaimOwner: "owner", ClaimRowID: "row"}

+ in := StopInventory{Host: host, Incarnation: "inc", InstallationStamp: 1, Complete: true}

+ entry := func(rel string) []StopInventoryEntry {

+ return []StopInventoryEntry{{Kind: "path", ManagedRoot: "data", RelativePath: rel, Ownership: "owner", Materialization: "materialized"}}

+ }

+ nested := registry.Route{Host: host, Kind: "sidecar", DBPath: provision.NestedDBPath(data, host), ClaimOwnership: own}

+ parent, err := filepath.Rel(data, filepath.Dir(nested.DBPath))

+ if err != nil {

+ t.Fatal(err)

+ }

+ for _, rel := range []string{parent, filepath.Join(parent, host+".db")} {

+ in.Entries = entry(rel)

+ if err := ValidateAgentInventory(in, &nested, data); err != nil {

+ t.Errorf("nested worker %s: %v", rel, err)

+ }

+ flat := registry.Route{Host: host, Kind: "sidecar", DBPath: provision.DefaultDBPath(data, host), ClaimOwnership: own}

+ for _, rel := range []string{host + ".db", host + ".db-wal"} {

+ in.Entries = entry(rel)

+ if err := ValidateAgentInventory(in, &flat, data); err != nil {

+ t.Errorf("flat worker %s: %v", rel, err)

+ }

+ other := registry.Route{Host: host, Kind: "sidecar", DBPath: filepath.Join(data, "elsewhere", host+".db"), ClaimOwnership: own}

+ in.Entries = entry(filepath.Join("elsewhere", host+".db"))

+ if err := ValidateAgentInventory(in, &other, data); err == nil {

+ t.Error("a worker row at neither path was accepted")

+ }

diff --git a/internal/sim/engines/calls_test.go b/internal/sim/engines/calls_test.go

index c38bdbb59..c0fac5dfa 100644

--- a/internal/sim/engines/calls_test.go

+++ b/internal/sim/engines/calls_test.go

@@ -492,13 +492,17 @@ func (w *world) engineAdmit(home, from *box, mark caller, hostname, path, via, r

// ---------- armed boxes (spec §6.2) ----------

// unisolatedKinds are the launch paths that run tenant code outside an

-// instance slice: a flat instance, a foreign one, and an app's worker.

+// instance slice: a flat instance, a foreign one, and an app's worker row

+// that classifies flat or foreign (sidecar isolation §3.12: a nested

+// worker runs in its own host's instance slice, carlos-instance-worker@,

+// and is launched like any nested group).

var unisolatedKinds = []string{"flat", "foreign", "worker"}

// arm is `carlos engines arm`: refused unless every exec-backed instance

// route is nested (unit-backed routes are judged by backing and admitted),

-// no route spawns workers, and every carlos-exec@ cgroup is empty

-// (arm-checks-box). Then the box records the armed state and the edge opens

+// no worker row classifies flat or foreign (sidecar isolation §3.12; it

+// was "no route spawns workers" while every worker ran in carlos-exec@),

+// and every carlos-exec@ cgroup is empty (arm-checks-box). Then the box records the armed state and the edge opens

// the engine sockets.

func (w *world) arm(b *box) bool {

if b.Armed {

@@ -538,7 +542,7 @@ func (w *world) disarm(b *box) {

// launchUnisolated starts tenant code outside an instance slice: kind flat

// or foreign (an instance of that layout, through the exec-child path) or

-// worker (an app's worker in carlos-exec@). While armed it is refused before

+// worker (an app's flat or foreign worker row, in carlos-exec@). While armed it is refused before

// any process starts (armed-refuses-unisolated). The model's unisolated

// tenants are one route per kind, acct/<kind>.

func (w *world) launchUnisolated(b *box, kind string) bool {

diff --git a/internal/sim/engines/witness_test.go b/internal/sim/engines/witness_test.go

index cbc759729..7cb260410 100644

--- a/internal/sim/engines/witness_test.go

+++ b/internal/sim/engines/witness_test.go

@@ -2103,3 +2103,47 @@ func TestEveryRuleHasWitness(t *testing.T) {

}

+// TestArmJudgesWorkerRowsByLayout (sidecar isolation §3.12, engines design

+// §6.2): arming refuses a box whose worker row classifies flat (its process

+// in carlos-exec@, and the row itself once that process stops) and admits

+// one whose worker row is nested, running in its own instance slice; an

+// armed box starts the nested worker, since it is not an unisolated launch.

+func TestArmJudgesWorkerRowsByLayout(t *testing.T) {

+ w := newWitness()

+ b := w.boxes[1]

+ b.Live["worker"], b.Good["worker"] = vPlain, vPlain

+ if !w.launchUnisolated(b, "worker") {

+ t.Fatalf("a flat worker on an unarmed box refused")

+ }

+ if w.arm(b) {

+ t.Errorf("arming succeeded with a flat worker running")

+ }

+ w.stopGroup(b, "worker")

+ if w.arm(b) {

+ t.Errorf("arming succeeded with a flat worker row on the box")

+ }

+ w.moveToNested(b, "worker")

+ if !w.launch(b, "worker", vPlain, "seed") {

+ t.Fatalf("the nested worker did not start")

+ }

+ if !w.arm(b) {

+ t.Errorf("arming refused with the worker row nested: %s", w.boxesState())

+ }

+ w.stopGroup(b, "worker")

+ if !w.launch(b, "worker", vPlain, "seed") {

+ t.Errorf("an armed box refused the nested worker's start")

+ }

+ for _, p := range b.Procs {

+ if p.Group == "worker" && p.Unisolated {

+ t.Errorf("the nested worker runs unisolated: %+v", p)

+ }

+ w.check()

+ if len(w.violations) > 0 {

+ t.Errorf("violations: %v", w.violations)

+ }

+ if t.Failed() {

+ dump(t, w)

+ }

diff --git a/status_instances.go b/status_instances.go

index 2eb8b11bc..ede62e7d6 100644

--- a/status_instances.go

+++ b/status_instances.go

@@ -24,6 +24,10 @@ import (

"net/url"

"sort"

"strings"

+ "time"

+ "github.com/carlosframework/platform/internal/activator"

+ "github.com/carlosframework/platform/internal/host"

)

// statusInstanceRow is one awake instance, as the console answers it

@@ -157,6 +161,44 @@ type statusLayoutBox struct {

// DefaultBlocked: why the default is not in force on this box.

Default bool `json:"default"`

DefaultBlocked string `json:"default_blocked"`

+ // Workers is the box's workers readiness word (nested, off,

+ // waiting_for_prev, blocked) and WorkersReason why it is blocked;

+ // FlatExec the box's flat-exec report (sidecar isolation D14), nil

+ // from a box or console that predates it.

+ Workers string `json:"workers"`

+ WorkersReason string `json:"workers_reason"`

+ FlatExec *statusLayoutFlatExec `json:"flat_exec"`

+// statusLayoutFlatExec is one box's flat-exec report as the door carries

+// it (status.FlatExecReport on the box). Declared here, as the other wire

+// structs in this file are.

+type statusLayoutFlatExec struct {

+ Mode string `json:"mode"`

+ Allow []string `json:"allow"`

+ Dropped []string `json:"dropped"`

+ Intent string `json:"intent"`

+ Refusals []statusFlatExecRefusal `json:"refusals"`

+ Inventory []statusFlatExecRow `json:"inventory"`

+ InventoryUnknown string `json:"inventory_unknown"`

+ FlatWorkers int `json:"flat_workers"`

+ Closed bool `json:"closed"`

+// statusFlatExecRefusal is one host's last refusal or would-be refusal.

+type statusFlatExecRefusal struct {

+ Host string `json:"host"`

+ Reason string `json:"reason"`

+ Since time.Time `json:"since"`

+ Last time.Time `json:"last"`

+ Count int `json:"count"`

+// statusFlatExecRow is one inventory row: a host refuse would stop.

+type statusFlatExecRow struct {

+ Host string `json:"host"`

+ Layout string `json:"layout"`

+ Worker bool `json:"worker"`

}

func (s *apiSession) statusLayoutList(ctx context.Context) ([]statusLayoutBox, error) {

@@ -236,7 +278,13 @@ func printStatusLayout(w io.Writer, boxes []statusLayoutBox) {

lines = append(lines, line{name, r.Host, r.Layout, reason})

}

- if len(lines) == 0 {

+ reported := false

+ for _, b := range boxes {

+ if b.FlatExec != nil {

+ reported = true

+ }

+ if len(lines) == 0 && !reported {

mutedf(w, "no boxes have reported a layout yet")

return

}

@@ -246,10 +294,13 @@ func printStatusLayout(w io.Writer, boxes []statusLayoutBox) {

}

return lines[i].host < lines[j].host

})

- fmt.Fprintln(w, "BOX HOST LAYOUT REASON")

- for _, l := range lines {

- fmt.Fprintf(w, "%s %s %s %s\n", l.box, l.host, l.layout, dashIfEmpty(l.reason))

+ if len(lines) > 0 {

+ fmt.Fprintln(w, "BOX HOST LAYOUT REASON")

+ for _, l := range lines {

+ fmt.Fprintf(w, "%s %s %s %s\n", l.box, l.host, l.layout, dashIfEmpty(l.reason))

+ }

}

+ printFlatExecSections(w, boxes)

// A box with flat, foreign or external rows beside nested ones, or

// under a nested intent, is the loud case: each of those still shares

// the agent's uid and mount namespace, so the nested rows on that box

@@ -277,6 +328,124 @@ func printStatusLayout(w io.Writer, boxes []statusLayoutBox) {

}

+// printFlatExecSections renders, box by box, the flat-exec policy

+// (sidecar isolation D14) and D15's closure check, then names every box

+// whose check does not hold, cannot be read or is stale (§8.2 step 6).

+// Sorted by box, like the table. An unknown inventory is printed as

+// unknown and never as empty, and its check never holds.

+func printFlatExecSections(w io.Writer, boxes []statusLayoutBox) {

+ sorted := append([]statusLayoutBox(nil), boxes...)

+ sort.Slice(sorted, func(i, j int) bool { return sorted[i].Box < sorted[j].Box })

+ var open []string

+ for _, b := range sorted {

+ name := b.Box

+ if b.Stale {

+ name += " (stale)"

+ }

+ fmt.Fprintln(w)

+ if !printFlatExecSection(w, name, b) || b.Stale {

+ open = append(open, name)

+ }

+ if len(open) > 0 {

+ fmt.Fprintf(w, layoutFlatExecClosureSummary+"\n", strings.Join(open, ", "))

+ }

+// printFlatExecSection is one box's section; it reports whether the box's

+// closure check holds.

+func printFlatExecSection(w io.Writer, name string, b statusLayoutBox) bool {

+ fe := b.FlatExec

+ if fe == nil {

+ fmt.Fprintf(w, layoutFlatExecNotReported+"\n", name)

+ return false

+ }

+ workers := dashIfEmpty(b.Workers)

+ if b.WorkersReason != "" {

+ workers += " (" + b.WorkersReason + ")"

+ }

+ fmt.Fprintf(w, layoutFlatExecLine+"\n", name, dashIfEmpty(fe.Mode), dashIfEmpty(fe.Intent), workers)

+ // The layout word beside each host: the pass's row, else the

+ // inventory's (computed from the registry, so it can name a host

+ // the pass reported nothing for).

+ word := map[string]string{}

+ for _, r := range fe.Inventory {

+ word[r.Host] = r.Layout

+ }

+ for _, r := range b.Rows {

+ word[r.Host] = r.Layout

+ }

+ heldWorker := map[string]bool{}

+ for _, r := range fe.Inventory {

+ if r.Worker {

+ heldWorker[r.Host] = true

+ }

+ for _, h := range fe.Allow {

+ fmt.Fprintf(w, layoutFlatExecAllowed+"\n", h, dashIfEmpty(word[h]), host.FlatExecAllowlistedWarning)

+ }

+ for _, d := range fe.Dropped {

+ fmt.Fprintf(w, layoutFlatExecDropped+"\n", d)

+ }

+ refusals := append([]statusFlatExecRefusal(nil), fe.Refusals...)

+ sort.Slice(refusals, func(i, j int) bool { return refusals[i].Host < refusals[j].Host })

+ for _, r := range refusals {

+ fmt.Fprintf(w, layoutFlatExecRefusal, r.Reason, r.Host, dashIfEmpty(word[r.Host]), r.Count,

+ r.Since.UTC().Format(time.RFC3339), r.Last.UTC().Format(time.RFC3339))

+ // Held: a worker the policy refused whose row is still flat or

+ // foreign (still in the inventory), so it is not running.

+ refused := r.Reason == activator.FlatExecFlatRefused || r.Reason == activator.FlatExecForeignRefused

+ if refused && heldWorker[r.Host] {

+ fmt.Fprintf(w, layoutFlatExecHeldSuffix, activator.FlatExecHeldWord)

+ }

+ fmt.Fprintln(w)

+ }

+ inventoryWorkers := 0

+ switch {

+ case fe.InventoryUnknown != "":

+ fmt.Fprintf(w, layoutFlatExecInventoryUnknown+"\n", fe.InventoryUnknown)

+ case len(fe.Inventory) == 0:

+ fmt.Fprintln(w, layoutFlatExecInventoryNone)

+ default:

+ inv := append([]statusFlatExecRow(nil), fe.Inventory...)

+ sort.Slice(inv, func(i, j int) bool { return inv[i].Host < inv[j].Host })

+ for _, r := range inv {

+ if r.Worker {

+ inventoryWorkers++

+ fmt.Fprintf(w, layoutFlatExecWouldRefuseWorker+"\n", r.Host, r.Layout)

+ continue

+ }

+ fmt.Fprintf(w, layoutFlatExecWouldRefuse+"\n", r.Host, r.Layout)

+ }

+ // The box's own verdict, never read as holding with an unknown

+ // inventory. The reasons are restated from the same report so an

+ // operator sees what to resolve.

+ if fe.Closed && fe.InventoryUnknown == "" {

+ fmt.Fprintln(w, layoutFlatExecClosureHolds)

+ return true

+ }

+ var why []string

+ if fe.Mode != "refuse" {

+ why = append(why, fmt.Sprintf(layoutFlatExecWhyPolicy, dashIfEmpty(fe.Mode)))

+ }

+ if len(fe.Allow) > 0 {

+ why = append(why, fmt.Sprintf(layoutFlatExecWhyAllow, len(fe.Allow)))

+ }

+ if fe.InventoryUnknown != "" {

+ why = append(why, layoutFlatExecWhyUnknown)

+ }

+ if inventoryWorkers > 0 {

+ why = append(why, fmt.Sprintf(layoutFlatExecWhyWorkers, inventoryWorkers))

+ }

+ if len(why) == 0 {

+ fmt.Fprintln(w, layoutFlatExecClosureFailsBare)

+ } else {

+ fmt.Fprintf(w, layoutFlatExecClosureFails+"\n", strings.Join(why, "; "))

+ }

+ return false

// layoutModeSplit sorts the boxes by mode: nested, and anything else

// (flat, none, unreadable). Stale boxes are left out: their mode is what

// they last said, not what they are.

diff --git a/status_layout_copy.go b/status_layout_copy.go

new file mode 100644

index 000000000..250ca0b0d

--- /dev/null

+++ b/status_layout_copy.go

@@ -0,0 +1,62 @@

+package main

+// Copy for `carlos status --layout`'s flat-exec section (sidecar isolation

+// spec D14, D15, §8.2 step 6), collected and reviewed in Task 12. Each is a

+// placeholder until then. The closed words they carry (refuse, report, the

+// intent sources, the workers word and the refusal reasons) are status

+// words, not copy, and are printed as the box reports them.

+// layoutFlatExecLine opens a box's section: the box, the policy in force,

+// the effective layout intent and the workers readiness word.

+const layoutFlatExecLine = "%s flat exec: %s, layout intent %s, workers %s" // copy: placeholder, Task 12

+// layoutFlatExecNotReported is a box whose snapshot has no flat-exec

+// report: one that predates the policy, or runs no agent.

+const layoutFlatExecNotReported = "%s flat exec: not reported (this box predates the flat-exec policy or runs no agent); closure check unknown" // copy: placeholder, Task 12

+// layoutFlatExecAllowed is one allowlist entry, its layout word and the

+// unisolated warning (host.FlatExecAllowlistedWarning).

+const layoutFlatExecAllowed = " allowlisted %s (%s): %s" // copy: placeholder, Task 12

+// layoutFlatExecDropped is an allowlist entry the box dropped because it is

+// not a host name.

+const layoutFlatExecDropped = " allowlist entry dropped, not a host name: %q" // copy: placeholder, Task 12

+// layoutFlatExecRefusal is one host's spawn record: the reason word, the

+// host, its layout word, the count, and the first and last time.

+const layoutFlatExecRefusal = " %s %s (%s): %d times since %s, last %s" // copy: placeholder, Task 12

+// layoutFlatExecHeldSuffix follows a refused worker's record while the

+// worker is still flat or foreign: the held word (activator.FlatExecHeldWord).

+const layoutFlatExecHeldSuffix = "; %s" // copy: placeholder, Task 12

+// layoutFlatExecWouldRefuse and layoutFlatExecWouldRefuseWorker are one

+// inventory row: what refuse would stop, by host and layout word.

+const (

+ layoutFlatExecWouldRefuse = " would refuse %s (%s)" // copy: placeholder, Task 12

+ layoutFlatExecWouldRefuseWorker = " would refuse %s (%s, worker)" // copy: placeholder, Task 12

+// layoutFlatExecInventoryNone is a known, empty inventory;

+// layoutFlatExecInventoryUnknown one the box could not compute, with its

+// reason. An unknown inventory is never rendered as empty.

+const (

+ layoutFlatExecInventoryNone = " would refuse: nothing" // copy: placeholder, Task 12

+ layoutFlatExecInventoryUnknown = " would refuse: unknown (%s)" // copy: placeholder, Task 12

+// The closure check (D15): holds, or does not with the reasons joined by

+// "; ".

+const (

+ layoutFlatExecClosureHolds = " closure check: holds" // copy: placeholder, Task 12

+ layoutFlatExecClosureFails = " closure check: does not hold: %s" // copy: placeholder, Task 12

+ layoutFlatExecClosureFailsBare = " closure check: does not hold" // copy: placeholder, Task 12

+ layoutFlatExecWhyPolicy = "the policy is %s, not refuse" // copy: placeholder, Task 12

+ layoutFlatExecWhyAllow = "the allowlist names %d hosts" // copy: placeholder, Task 12

+ layoutFlatExecWhyUnknown = "the inventory is unknown" // copy: placeholder, Task 12

+ layoutFlatExecWhyWorkers = "%d worker rows are flat or foreign" // copy: placeholder, Task 12

+// layoutFlatExecClosureSummary names, after every box's section, each box

+// whose closure check does not hold, is unknown, or is stale (§8.2 step 6).

+const layoutFlatExecClosureSummary = "\nclosure check does not hold, or cannot be read, on: %s" // copy: placeholder, Task 12

diff --git a/status_layout_flatexec_test.go b/status_layout_flatexec_test.go

new file mode 100644

index 000000000..f4654882f

--- /dev/null

+++ b/status_layout_flatexec_test.go

@@ -0,0 +1,176 @@

+package main

+import (

+ "bytes"

+ "context"

+ "fmt"

+ "net/http"

+ "net/http/httptest"

+ "strings"

+ "testing"

+ "time"

+ "github.com/carlosframework/platform/internal/activator"

+ "github.com/carlosframework/platform/internal/host"

+// TestPrintStatusLayoutShowsTheFlatExecPolicy (sidecar isolation D14,

+// D15, §8.2 step 6): per box, without box access, an operator reads the

+// policy in force, every allowlist entry flagged unisolated, every refused

+// and would-be-refused host beside its layout word, the inventory, the

+// workers word and whether the closure check holds. A worker the policy

+// refused and that is still flat reads as held.

+func TestPrintStatusLayoutShowsTheFlatExecPolicy(t *testing.T) {

+ at := time.Date(2026, 10, 25, 9, 0, 0, 0, time.UTC)

+ worker := "bot.shop.cdef.sidecar.internal"

+ boxes := []statusLayoutBox{

+ {Box: "kass-1", Mode: "nested", Workers: "blocked", WorkersReason: "claim mode is on",

+ Rows: []statusLayoutRow{

+ {Host: "a.example.com", Layout: "nested"},

+ {Host: "tools.example.com", Layout: "flat"},

+ {Host: worker, Layout: "flat"},

+ {Host: "old.example.com", Layout: "foreign", Reason: "db and socket are neither default"},

+ },

+ FlatExec: &statusLayoutFlatExec{

+ Mode: "refuse", Intent: "nested",

+ Allow: []string{"tools.example.com"}, Dropped: []string{"Not_A_Host"},

+ Refusals: []statusFlatExecRefusal{

+ {Host: worker, Reason: activator.FlatExecFlatRefused, Since: at, Last: at.Add(time.Hour), Count: 3},

+ {Host: "old.example.com", Reason: activator.FlatExecForeignReported, Since: at, Last: at, Count: 1},

+ },

+ Inventory: []statusFlatExecRow{

+ {Host: worker, Layout: "flat", Worker: true},

+ {Host: "old.example.com", Layout: "foreign"},

+ },

+ FlatWorkers: 1,

+ }},

+ {Box: "kass-2", Mode: "nested", Workers: "nested",

+ Rows: []statusLayoutRow{{Host: "c.example.com", Layout: "nested"}},

+ FlatExec: &statusLayoutFlatExec{Mode: "refuse", Intent: "nested", Closed: true}},

+ }

+ var buf bytes.Buffer

+ printStatusLayout(&buf, boxes)

+ out := buf.String()

+ for _, want := range []string{

+ "BOX HOST LAYOUT REASON",

+ fmt.Sprintf(layoutFlatExecLine, "kass-1", "refuse", "nested", "blocked (claim mode is on)"),

+ fmt.Sprintf(layoutFlatExecAllowed, "tools.example.com", "flat", host.FlatExecAllowlistedWarning),

+ fmt.Sprintf(layoutFlatExecDropped, "Not_A_Host"),

+ fmt.Sprintf(layoutFlatExecRefusal, activator.FlatExecFlatRefused, worker, "flat", 3, "2026-10-25T09:00:00Z", "2026-10-25T10:00:00Z") +

+ fmt.Sprintf(layoutFlatExecHeldSuffix, activator.FlatExecHeldWord),

+ fmt.Sprintf(layoutFlatExecRefusal, activator.FlatExecForeignReported, "old.example.com", "foreign", 1, "2026-10-25T09:00:00Z", "2026-10-25T09:00:00Z") + "\n",

+ fmt.Sprintf(layoutFlatExecWouldRefuseWorker, worker, "flat"),

+ fmt.Sprintf(layoutFlatExecWouldRefuse, "old.example.com", "foreign"),

+ fmt.Sprintf(layoutFlatExecClosureFails, strings.Join([]string{fmt.Sprintf(layoutFlatExecWhyAllow, 1), fmt.Sprintf(layoutFlatExecWhyWorkers, 1)}, "; ")),

+ fmt.Sprintf(layoutFlatExecLine, "kass-2", "refuse", "nested", "nested"),

+ layoutFlatExecInventoryNone,

+ layoutFlatExecClosureHolds,

+ fmt.Sprintf(layoutFlatExecClosureSummary, "kass-1"),

+ } {

+ if !strings.Contains(out, want) {

+ t.Errorf("missing %q in:\n%s", want, out)

+ }

+ // kass-2's section says the closure check holds; kass-1's does not.

+ k2 := out[strings.Index(out, fmt.Sprintf(layoutFlatExecLine, "kass-2", "refuse", "nested", "nested")):]

+ if !strings.Contains(k2, layoutFlatExecClosureHolds) {

+ t.Errorf("kass-2's closure check does not read as holding:\n%s", k2)

+ }

+ if strings.Contains(out[:strings.Index(out, k2)], layoutFlatExecClosureHolds) {

+ t.Errorf("kass-1's closure check reads as holding:\n%s", out)

+ }

+// An inventory the box could not compute renders as unknown with the box's

+// reason, never as empty, and its closure check never holds, even if the

+// box's own Closed were set. A box that reports no flat-exec block at all

+// (one that predates it) says so, and its closure check is unknown too.

+func TestPrintStatusLayoutUnknownInventoryIsNeverEmpty(t *testing.T) {

+ boxes := []statusLayoutBox{

+ {Box: "kass-1", Mode: "flat", Rows: []statusLayoutRow{{Host: "a.example.com", Layout: "flat"}},

+ FlatExec: &statusLayoutFlatExec{Mode: "refuse", Intent: "unknown", Closed: true,

+ InventoryUnknown: "no layout pass is armed on this box, so its rows cannot be classified"}},

+ {Box: "kass-old", Mode: "flat", Rows: []statusLayoutRow{{Host: "b.example.com", Layout: "flat"}}},

+ }

+ var buf bytes.Buffer

+ printStatusLayout(&buf, boxes)

+ out := buf.String()

+ for _, want := range []string{

+ fmt.Sprintf(layoutFlatExecInventoryUnknown, "no layout pass is armed on this box, so its rows cannot be classified"),

+ fmt.Sprintf(layoutFlatExecClosureFails, layoutFlatExecWhyUnknown),

+ fmt.Sprintf(layoutFlatExecNotReported, "kass-old"),

+ fmt.Sprintf(layoutFlatExecClosureSummary, "kass-1, kass-old"),

+ } {

+ if !strings.Contains(out, want) {

+ t.Errorf("missing %q in:\n%s", want, out)

+ }

+ for _, bad := range []string{layoutFlatExecInventoryNone, layoutFlatExecClosureHolds} {

+ if strings.Contains(out, bad) {

+ t.Errorf("an unknown inventory rendered %q:\n%s", bad, out)

+ }

+// A report-mode box with an empty allowlist and no inventory still does

+// not close: the policy is not refuse. A stale box is never verified.

+func TestPrintStatusLayoutClosureNeedsRefuseAndAFreshBox(t *testing.T) {

+ boxes := []statusLayoutBox{

+ {Box: "kass-1", Mode: "nested", Rows: []statusLayoutRow{{Host: "a.example.com", Layout: "nested"}},

+ FlatExec: &statusLayoutFlatExec{Mode: "report", Intent: "nested"}},

+ {Box: "kass-2", Mode: "nested", Stale: true, Rows: []statusLayoutRow{{Host: "b.example.com", Layout: "nested"}},

+ FlatExec: &statusLayoutFlatExec{Mode: "refuse", Intent: "nested", Closed: true}},

+ }

+ var buf bytes.Buffer

+ printStatusLayout(&buf, boxes)

+ out := buf.String()

+ for _, want := range []string{

+ fmt.Sprintf(layoutFlatExecClosureFails, fmt.Sprintf(layoutFlatExecWhyPolicy, "report")),

+ fmt.Sprintf(layoutFlatExecClosureSummary, "kass-1, kass-2 (stale)"),

+ } {

+ if !strings.Contains(out, want) {

+ t.Errorf("missing %q in:\n%s", want, out)

+ }

+// A box with a flat-exec report and no layout rows still gets its section

+// rather than the "no boxes have reported a layout yet" line.

+func TestPrintStatusLayoutFlatExecWithoutRows(t *testing.T) {

+ boxes := []statusLayoutBox{{Box: "kass-1", FlatExec: &statusLayoutFlatExec{Mode: "refuse", Intent: "nested", Closed: true}}}

+ var buf bytes.Buffer

+ printStatusLayout(&buf, boxes)

+ out := buf.String()

+ if strings.Contains(out, "no boxes have reported a layout yet") || !strings.Contains(out, layoutFlatExecClosureHolds) {

+ t.Errorf("out:\n%s", out)

+ }

+// The fetch half: the door's flat_exec block, workers word and reason

+// decode into the CLI's own wire structs.

+func TestStatusLayoutListDecodesFlatExec(t *testing.T) {

+ ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

+ w.Header().Set("Content-Type", "application/json")

+ fmt.Fprint(w, `{"boxes":[{"box":"ie","mode":"nested","stale":false,"rows":[],"workers":"blocked","workers_reason":"claim mode is on",`+

+ `"flat_exec":{"mode":"refuse","allow":["t.example.com"],"dropped":["x"],"intent":"nested",`+

+ `"refusals":[{"host":"h.example.com","reason":"flat_refused","since":"2026-10-25T09:00:00Z","last":"2026-10-25T10:00:00Z","count":2}],`+

+ `"inventory":[{"host":"h.example.com","layout":"flat","worker":true}],"inventory_unknown":"","flat_workers":1,"closed":false}}]}`)

+ }))

+ defer ts.Close()

+ boxes, err := newTestSession(ts.URL).statusLayoutList(context.Background())

+ if err != nil {

+ t.Fatal(err)

+ }

+ if len(boxes) != 1 {

+ t.Fatalf("boxes = %+v", boxes)

+ }

+ b := boxes[0]

+ fe := b.FlatExec

+ if b.Workers != "blocked" || b.WorkersReason != "claim mode is on" || fe == nil || fe.Mode != "refuse" || fe.Intent != "nested" ||

+ len(fe.Allow) != 1 || len(fe.Dropped) != 1 || len(fe.Refusals) != 1 || fe.Refusals[0].Count != 2 ||

+ !fe.Refusals[0].Last.Equal(time.Date(2026, 10, 25, 10, 0, 0, 0, time.UTC)) ||

+ len(fe.Inventory) != 1 || !fe.Inventory[0].Worker || fe.FlatWorkers != 1 || fe.Closed {

+ t.Fatalf("box = %+v flat exec %+v", b, fe)

+ }