carlos / platform Public

WIP claim Plan 14 Part 3 checkpoint 7 (not for merge)

P3-R8 J4 rulings (dead code removed, reclasses, exemption list tested both ways); G2 pre-claim timer adoption; H2 at 67 root tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 week ago 708ff5112beaf64f8e05f5f3da186071f9b469a4 parent 6951b93

67 files changed, +1212 −439

internal/activator/rolelaunch_linux.go +0 −67
internal/activator/rolelaunch_linux_removed_test.go +82 −0
internal/historyreadback/plan14_workflow_test.go +5 −1
internal/host/claimcensus_test.go +1 −1
internal/host/claimhandover_recovery_test.go +1 −1
internal/host/claimjournal_migration.go +0 −6
internal/host/claimjournal_migration_removed_test.go +13 −0
internal/host/claimmoveparks_test.go +1 −1
internal/host/claimparticipation_stale_test.go +1 −1
internal/host/claimretire_transport_test.go +1 −1
internal/host/claimretirerecovery_test.go +1 −1
internal/host/claimstate_linux.go +0 −46
internal/host/claimstate_linux_removed_test.go +51 −0
internal/host/claimstate_other.go +0 −2
internal/host/heldstage_test.go +2 −2
internal/host/legacyinventory_test.go +51 −0
internal/host/movesfloor.go +0 −7
internal/host/movesheldlock_cleanup_test.go +1 −1
internal/host/movesheldrelease_agent_test.go +1 −1
internal/host/movesreport_test.go +2 −2
internal/host/moveswakesource_linux_test.go +1 −1
internal/host/plan12_handover_test.go +1 −1
internal/host/plan12_restore_linux_test.go +1 −1
internal/host/plan14_fix2_live_linux_test.go +1 −1
internal/host/plan14_generation_timer_retirement_test.go +1 −1
internal/host/plan14_history_retirement_test.go +2 −2
internal/host/plan14_launch_verifier_root_linux_test.go +1 −1
internal/host/plan9fix1_journal_linux_test.go +1 −1
internal/host/plan9fix4_claimjournal_migration_linux_test.go +1 −1
internal/host/proofnamed.go +0 −52
internal/host/proofobserve.go +0 −18
internal/host/relocationcensus_test.go +1 −1
internal/host/relocationinstall_linux_test.go +1 −1
internal/host/relocationparticipation_linux_test.go +1 −1
internal/host/rootgeneration_kernel_linux.go +0 −3
internal/host/rootgeneration_kernel_linux_removed_test.go +9 −0
internal/host/rootmigration_historic_linux_test.go +1 −1
internal/host/rootmigration_installed_root_linux_test.go +29 −2
internal/host/rootmigration_production_linux.go +17 −12
internal/host/rootmigration_timers.go +204 −0
internal/host/rootmigration_timers_root_linux_test.go +45 −0
internal/host/rootmigration_timers_test.go +206 −0
internal/host/rootmovesfloor_source.go +0 −3
internal/host/rootrecovery_rebind_test.go +1 −1
internal/host/rootrestart.go +0 −4
internal/host/rootrestart_removed_test.go +11 −0
internal/host/systemparticipation.go +2 −6
internal/hostbox/hold.go +1 −9
internal/hostbox/stopinventory_db.go +0 −23
internal/hostbox/stopinventory_db_removed_test.go +30 −0
internal/hostfloor/participation.go +0 −6
internal/hostfloor/participation_removed_test.go +9 −0
internal/hostguard/root.go +1 −4
internal/hostguard/root_removed_test.go +11 −0
internal/hostguard/rootmigration.go +9 −2
internal/hostguard/rootmigration_test.go +44 −0
internal/provision/plan14_input_inventory_test.go +126 −3
internal/provision/plan14_p3_census_test.go +9 −1
internal/provision/plan14_root_reads_test.go +30 −1
internal/provision/testdata/plan14-root-reads-p3.tsv +65 −18
internal/release/materializeheld.go +0 −71
internal/release/materializeheld_removed_test.go +79 −0
internal/release/roothistory_delivery.go +0 −33
internal/release/roothistory_delivery_removed_test.go +39 −0
internal/rootparticipation/ledger.go +0 −3
internal/rootparticipation/ledger_removed_test.go +7 −0
internal/rootparticipation/production.go +0 −9

CI failed — run details

CI log

amadan: log truncated — showing the last 475922 bytes of 572625
ss, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootFloorBinary.supports	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	bounceExecRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:424: J4	internal/rootstate/file_other.go	CheckPublicConfig	A+B3	darwin:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Non-Linux descriptor checks fail closed.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory.go	RootHistory.Blocks	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.Finish	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	history_cli.go	historySync	E1	linux:history_cli.go:historySave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	readProductionGenerationInventory	E2	linux:internal/host/rootgeneration_inventory.go:productionLocalGenerationInventory	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	productionRetireGenerations	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/host/proofask.go	mintAsker.tick	B3	linux:internal/host/agent.go:fastConvergeLoop	route-and-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	RemoveDurable	F	linux:internal/hostfloor/disk.go:Disk.Begin	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_delivery.go	HistoryReconstructionKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	type ClaimLaunchRoot	E1+E2	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	JournalService.read	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-instance-control.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	ReadGenerations	E2	linux:internal/release/pins.go:GenerationPins	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/recoveryrefusals.go	rootRestartChecks.mintRefusals	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.task	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/claimready_other.go	claimProbeSocketReady	B3	darwin:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/coldhandover.go	ColdHandover.retireIntended	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	route-and-input
    plan14_input_inventory_test.go:424: J4	internal/hostrelocate/worker.go	Worker.self	C+D	linux:internal/hostrelocate/worker.go:Worker.ConvertLanding	Worker identity requires current active directory enrollment, home-region match and termination-fence check.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Durable	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesinstall.go	installRun.installAuthority	C+G	linux:internal/host/movesinstall.go:installRun.local_	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/buildstate.go	ReadConsumed	E3	linux:internal/host/updatesreport.go:updatesReader	root-input
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	publish	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_census_other.go	productionGenerationKernelCensus	E2	darwin:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/proofroot.go	proofRoot.mint	B3+E1	linux:internal/host/proofroot.go:proofRoot.mintAndLog	E1 production uses canonical observed programs and complete root refusal inventory; legacy diagnostics do not grant root mint authority.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/image_other.go	Disk.Exec	F	darwin:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	heldStageable	C+E1	linux:internal/release/materializeheld.go:materializeHeldChecked	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_maintenance.go	type rootHistoryMaintenance	E1	linux:internal/host/roothistory.go:openRootHistory	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Disk.withParticipation	D+F	linux:internal/hostfloor/disk.go:Disk.WithParticipation	rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=uses a live root-minted scoped ledger only for its original store; otherwise opens the ordinary census; absent census keeps legacy behavior
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	serveHeldStageRequest	E2	linux:internal/release/materializeheld.go:ServeHeldStageRequestsWithPins	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	rootRestartChecks.runningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Without a census return no running build, so main's cur stays the rollback target and no record is resolved; census-backed retention unchanged.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationRootTask	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/retention.go	retentionPass	E2	linux:internal/host/agent.go:retentionLoop	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckLocal	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception.
    plan14_input_inventory_test.go:424: J4	internal/release/updatetarget.go	NextConsumed	E3	linux:internal/release/adopt.go:settingsTarget	Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.stop	C+E2+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.rebindRecoveryRows	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.installRecoveryInventory	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/guardtransaction.go	legacyGuardEntries	D	linux:internal/host/guardtransaction.go:installFloorHook	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state.go	type Store	A+B3	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:424: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadExactStopInventory	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrollback_resume.go	recoverRootRestarts	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	Recover every attempt independently, skip settled writes and remove leftover capabilities.
    plan14_input_inventory_test.go:424: J4	internal/host/relocatepass.go	RelocationRuntime.finishCompletion	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Completion dispatch requires authoritative completed operation and current executor before discharge.
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction.go	claimInputPolicy	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	routeByHost	E1+E3	linux:internal/host/restartscope.go:restartScopeLeg	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_read.go	readRootExecution	D	linux:internal/host/rootexecution_read.go:rootExecutionRead	Descriptor-checked root opener shared by root Prepare/Check, initial launch authorization and final executable checks; no agent fallback.
    plan14_input_inventory_test.go:424: J4	internal/host/guardarm.go	RunSystemGuardArm	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	readBeneathLine	F	linux:internal/host/movesfloor.go:syncLocalFloor	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.write	A+F+G	linux:internal/rootstate/state_linux.go:directory.Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_available.go	systemApplier.activationFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	type HistoryRecoveryRetirement	E1	linux:history_cli.go:historyCommandWithSave	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	rootFloorAllowsPrev	F	linux:internal/host/movesfloorgate.go:floorGateMain	rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=signed prev identity satisfies local moves and published seeds bounds, relaxed only when no certified build meets bound; caller checks participation separately
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_collect_linux.go	type migrationStopKernel	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloorgate.go	floorGateMain	F	linux:internal/host/movesfloorgate.go:RunSystemFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=dispatches explicit root previous gate; legacy argument shape preserved
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventoryscope.go	ValidateAgentInventory	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdate	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	Guard.readLocked	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	Read-only access takes only the root host lock.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootmigration.go	RootAuthority.CompleteMigrationInventory	G	linux:internal/host/rootmigration_timers.go:rootMigrationTimers.adopt	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=root fence completion binds the migration inventory revision; timer adoption permits only its exact previous revision plus one and recommits visible failed writes
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease.go	newHeldReleaseRequestID	C+E1	linux:internal/host/movesheldrelease.go:heldReleaseVia.request	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_other.go	productionGenerationAbsence	E2	darwin:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: non-Linux production generation retirement refuses. Darwin, Windows and Linux ARM64 compile gates; no non-Linux retirement authority.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journaltrust_linux.go	checkTrustedJournalDir	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatus	E1	linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_parked.go	generationRetirementRecords	E2	linux:internal/host/rootgeneration_parked.go:generationReadRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:424: J4	internal/host/heldstage.go	heldStageRow	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimready_linux.go	claimParentPID	B3	linux:internal/host/claimready_linux.go:claimProbePeer	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closure	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	restartRequestLeg	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Reads the new host-retry log while preserving root-signed grant verification and ordinary restart gates.
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.PrepareState	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.skipRoutes	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	JournalService.journalMigrationMarker	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/relocatepass.go	newCompletionRuntime	C+D	linux:internal/host/relocatepass.go:NewRelocationRuntime	Completion-only runtime treats registry and journal hostnames as discovery and verifies claim and bound identity before discharge.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.afterRecovery	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.applyPointers	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pass	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/healthy_root.go	rootHealthyStore	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	fix1;basis=Normalizes the no-account operator app to the existing ops namespace before opening the root-owned public history.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationowners.go	ClaimAssembly.relocationReleaseHold	C+D	linux:internal/host/relocatepass.go:newCompletionRuntime	Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion.
    plan14_input_inventory_test.go:424: J4	internal/release/rollback.go	writeGroupRefusals	E1	linux:internal/release/adopt.go:adoptHost	E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionImages	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_creation.go	rootHistoryInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	readEffectiveMovesFloor	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader
    plan14_input_inventory_test.go:424: J4	internal/release/consumedfence_linux.go	lockConsumedPublish	E3	linux:internal/release/consumedfence.go:publishConsumed	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.inventory	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	refreshRootSeedsFloor	F	linux:internal/host/seedsfloor.go:systemApplier.armSeedsFloor	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=merges authoritative store floor with denial-only legacy seeds maxima into durable independent root state
    plan14_input_inventory_test.go:424: J4	internal/release/proofgate.go	ProofGate.bindRecording	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/relocatepass.go	RelocationRuntime.once	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.Run	Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy.
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	PinAfterRelease	C	linux:internal/hostrelocate/worker.go:Worker.Step	Pin transition verifies source release authority and exact journal phase before removing execution authority.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.recoverIfNeeded	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary
    plan14_input_inventory_test.go:424: J4	internal/instancectl/claimlaunch_snapshot_linux.go	claimRootDir	C+G	linux:internal/instancectl/claimlaunch_snapshot.go:ClaimUnits.freezeLaunch	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/relocationeffects.go	RelocationEffects.EnsureLocal	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	IsAcquisitionRecovery	E2	linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile.go	Reconciler.installWithWork	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	Install dispatch preserves serving registration and distinguishes hold-only relocation from installation.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_recovery.go	rootRestartChecks.settleHistory	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationIDRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_requirements.go	productionGenerationCreation	E2	linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory	E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_requirements.go	generationRetainedTimers	E2	linux:internal/host/rootgeneration_requirements.go:generationLocalObligations	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.refresh	F	linux:internal/host/rootmovesfloor_refresh.go:rootRefreshAndJudgeMovesPrev	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	checkedUnitRestart	B3+E1	linux:internal/host/rootrestart.go:rootRestartRouteWith	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/host/systemparticipation.go	systemApplier.clearUpdateBegun	D	linux:internal/host/systemparticipation.go:systemApplier.settleUpdateBegun	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/link_linux.go	ReadTrustedLink	A+E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/registryrows.go	RegistryRows.RetireRowsJournal	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/restore.go	ColdRestore.Install	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	productionGenerationInventory	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/completion.go	ReadReconstruction	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	const generationCompletenessKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.persist	F	linux:internal/host/rootmovesfloor.go:rootMovesFloors.refresh	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventoryscope.go	ReconcileAdapter.retirementRoute	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.writeCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.EndUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.EndParticipation	rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	MaterializeHeldUnder	C+E1+E2	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	VerifyHeldLive	C+E1	linux:internal/host/movesstage.go:heldReleasePublished	Held verification wrapper retains selected held lock and delegates root proof validation of live bytes.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBinding.authorizedRecovery	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/recoveryrefusals.go	recoveryResultKey	E1	linux:internal/host/rootrollback.go:settleRollbackAttempt	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RestartSnapshot	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type rootRestartRecord	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	history_cli.go	historySave	E1	linux:history_cli.go:historyCommand	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	enrolled	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.heldTarget	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:424: J4	internal/console/seedfloor.go	Server.seedRegionReady	F	linux:internal/console/apiinstanceimport.go:Server.handleAPIImportStopped	rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness
    plan14_input_inventory_test.go:424: J4	internal/console/apirestartscope.go	environmentNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	runAgent	B+C+D+F	linux:internal/host/agent.go:RunAgent	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
    plan14_input_inventory_test.go:424: J4	internal/host/caps_pass.go	stagedManifestOfLiveVersion	E4	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/heldstage.go	retireEndedHeldRefusals	C+E1	linux:internal/host/heldstage.go:heldStagePass	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/movespass.go	movesWorker.liftFences	C	linux:internal/host/movespass.go:movesPass	root-route;kept=C;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	execBounceable	E1+E3	linux:internal/host/restart.go:bounceExecRoutes	root-route
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	descendSync	A	linux:internal/rootstate/state_linux.go:descend	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_recovery.go	historyRestartAttempt	B3+E1	linux:internal/host/rootrestart.go:checkedUnitRestart	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_parked.go	generationRetirements	E2	linux:internal/host/rootgeneration_parked.go:generationPhysicalPayloads	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/transaction.go	Ledger.WithTransaction	D+F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=takes participation before the effective floor and registry; releases on every return and invalidates the scoped token
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	withRootSeedsFields	F	linux:internal/host/seedsfloor.go:withSeedsFields	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=advertises only checked synced root seeds projection matching deployment and box; no valid projection stays quarantined
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile.go	Reconciler.Install	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/claimowners.go	claimServingOwners.launch	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction.go	declinedClaimGate	C+G	linux:internal/host/claimmoveaccess.go:claimMoveLaunchSource	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/report.go	Disk.Running	F	linux:internal/console/hostreports.go:Server.localHostReport	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	restoreLive	C+E1	linux:internal/release/materializeheld.go:publishHeld	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers_linux.go	agentUnitCgroup	C+G	linux:internal/host/claimstop_kernel_linux.go:newProductionStopKernel	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-restart.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_healthy.go	systemApplier.acceptRootFloorHealthy	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=reads signed installed bytes after the system health gate; writes independent moves and published-seeds root observations
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	journalPrepare	C	linux:internal/hostbox/journalservice.go:journalCall	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/hostguard/record_unix.go	recordDir.openRecord	C	linux:internal/hostguard/record_unix.go:recordDir.read	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/caps_pass.go	buildPlans	E4	linux:internal/host/caps_pass.go:capabilityPass	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Disk.Begin	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/release/heldwake.go	DecideHeldWake	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	materializeHeld	C+E1+E2	linux:internal/release/materializeheld.go:MaterializeHeldUnderWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.publishRelease	C+E1+E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	scanStopCgroupsMode	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.retained	E3	linux:internal/host/buildstate.go:buildStates.heldTarget	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/relocationhandover.go	relocationCompletedHandover.completedPrior	C	linux:internal/host/claimhandover_crossbox.go:wireCompletedHandover	Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer.
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	JournalRelease	C	linux:internal/hostrelocate/participant.go:Participant.Step	Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.replayed	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	recheck	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_parked.go	generationPhysicalPayloads	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: Root rejects unfinished live inventory but accepts intended timer entries only behind exact completed retirement.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootRefreshAndJudgeMovesPrev	F	linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration_linux.go	currentClaimEdgeMaskAt	C+G	linux:internal/host/claimjournal_migration_linux.go:claimEdgeMaskStillOwned	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_execpermit.go	ClaimLaunchRoot.execPermit	D	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_run.go	instanceRegistryHostApp	C+G	linux:internal/host/claimstop_run.go:RunInstanceControl	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/versionsweep.go	settingsPins	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_payload_linux.go	generationPayloadFiles	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_containment_linux.go	generationKernel.containedTask	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/activator/backend_exec.go	ExecBackend.spawnInCgroupGated	E2	linux:internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	rootSeedsFloorDir	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed seeds namespace separate from moves retained floor
    plan14_input_inventory_test.go:424: J4	internal/release/program.go	FileProgram	E1	linux:internal/release/adopt.go:adoptHost	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationMounts	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationpins.go	RootGenerations.Reservations	E2	linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/retirement_timers.go	retirementWithTimers	C+E2	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootFloorDowngradeIdle	D+E2+F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt, guard boot selector and system apply/recover uid 0;basis=uses E network-free retained generation obligations and kernel census under participation before floor; borrowed transaction matches the original root store; no deployment provider read
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakestop.go	ClaimAssembly.localStopIdentity	C+G	linux:internal/host/claimparticipation.go:productionClaimLocal.bind	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	PinFailover	C	linux:internal/hostrelocate/worker.go:Worker.Step	Failover pinning requires recorded source fence and completed acknowledgement barrier.
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	makeRestartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	scopedHosts	E1+E3	linux:internal/host/restartscope.go:bounceScopedRoutes	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/image_linux.go	OpenProtected	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostrelocate/participant.go	Participant.Step	C+D	linux:internal/host/relocatepass.go:RelocationRuntime.once	Participant re-reads claim and installation identity around effects; root stop receipts and fresh participation bound probes, with generic orchestration retained.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory.go	recordRootProgram	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_delivery.go	RootHistory.ReceiveRecoveryRetirements	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/rollout/failures.go	FailureBook.recordLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.reconcileLocked	fix1-merge-review;basis=Marks restriction state dirty and advances its generation before publication.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	RequestKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_recovery_policy.go	RootHistory.recoveryDenials	E1	linux:internal/release/roothistory.go:RootHistory.Blocks	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/caps/render.go	RenderService	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/controller.go	Controller.authority	D	linux:internal/hostexec/controller.go:Open	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/ratchet.go	DigestRatchet.marked	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationVerifyLocal	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	digest	E1	linux:internal/historyreadback/readback.go:RequestKey	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.Observe	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RestartProgress	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.inventoryVersion	C	linux:internal/hostbox/inventory_expected.go:StopInventoryDB.Snapshot	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.Completeness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_timer_mutation.go	ClaimRootHTTP.applyTimerMutation	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.carryRequest	E3	linux:internal/host/buildstate.go:moveCarry	Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	rootGenerationSource.reserve	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.stageRelease	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/claimrelocation.go	openClaimRelocationOwners	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Relocation owner constructor receives existing serving sources and verified identity inside feature gate.
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakestop.go	ClaimAssembly.collectRetirementStop	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	JournalService.CheckLegacyMigration	C	linux:internal/host/claimjournal_migration.go:checkClaimJournalMigration	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	publishHeld	C+E1	linux:internal/release/materializeheld.go:materializeHeld	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Disk.Load	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:424: J4	internal/instancectl/peer_tuple_linux.go	procStart	C+G	linux:internal/instancectl/peer_tuple_linux.go:AuthenticatePeerTuple	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimparticipation_relocation.go	productionClaimLocal.Acknowledged	D	linux:internal/host/relocatepass.go:NewRelocationRuntime	Relocation acknowledgement waits for bound controller readiness; participates in execution admission.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	const RootRestartAbsent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.installRecoveryInventory	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/proofobserve.go	proofObserver.recordSettled	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-5;basis=Ordinary unstamped and derived routes do not resolve deployment records for post-restart health observation.
    plan14_input_inventory_test.go:424: J4	internal/rollout/failures.go	var randRead	E1+E3	linux:internal/rollout/failures.go:newBookID	fix1-merge-review;basis=Names the cryptographic entropy source for failure-book identity; remains retry replay authority.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_startup.go	var openRootMigrationParticipation	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=fixed production participation opener remains rootparticipation.OpenForUpdate; package tests substitute explicit no-census fixtures without accessing the machine store
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.Monitor	D	linux:internal/hostexec/rootbroker.go:RootBroker.Run	Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers_linux.go	installationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:rootInstallationCoverage	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_readback.go	historyReadbackPublisher.publish	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/namedrecovery.go	namedUnitRecovery.checkHistory	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	claimUnitStopKernel.settleUnits	C+E2+G	linux:internal/host/claimlaunch_root.go:claimUnitStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/rolelaunch.go	LaunchJournal.UnitReservation	C	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	type RootHistoryPass	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/hostexec/probe_unix.go	probeExisting	D	linux:internal/hostexec/probe_unix.go:probeLifetime	root-input
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	Respond	E1	linux:internal/host/roothistory_readback.go:historyReadbackPublisher.publish	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-system-recover.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_census_linux.go	generationKernel.census	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationreleases.go	ReleaseObligation.Queue	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Queues exact relocation release retirement obligation and preserves already discharged receipt replay.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_recovery.go	claimInitialSourceRecovery	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.stopCapturedSession	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.prepareRollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	trusted deployment record and root unit binding; durable per-attempt rollback and recovery
    plan14_input_inventory_test.go:424: J4	internal/host/rootrollback_resume.go	resumeRootRestart	B3+E1	linux:internal/host/rootrollback_resume.go:recoverRootRestarts	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/host/movesstage.go	heldReleaseStaged	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchRecord	C+E2+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootview.go	RootAuthority.View	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	Root host lock serializes views; quarantine and pending intent deny admission.
    plan14_input_inventory_test.go:424: J4	internal/host/legacyrestart.go	restartEffectFailed	B3	linux:internal/host/rootrestart.go:restartBoundUnit	E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	readGenerationsSeq	E2	linux:internal/release/pins.go:ReadGenerations	root-input
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	validStatus	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	rootRestartRouteWith	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/generationpayload.go	LaunchJournal.GenerationPayloads	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	rootFloorBinary.forSeeds	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=projects signed SeedsProtocol (zero when absent); comparisons are gated by verified signed publication and available certified builds
    plan14_input_inventory_test.go:424: J4	internal/caps/converge.go	Ops.query	E4	linux:internal/caps/converge.go:Ops.applyUnitState	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrecord_claim.go	rootClaimRecord	C	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	dispatchBoundedWakes	E1+E3	linux:internal/host/restart.go:cycleWorkers	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/typedpark_linux.go	TypedParker.Park	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	RootAuthority.write	C+G	linux:internal/hostguard/record_unix.go:recordDir.write	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	keepsBuildState	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	restartBoundUnit	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
    plan14_input_inventory_test.go:424: J4	internal/host/proofnamed.go	proofBindingSource.findRecord	B3	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Cache index success or failure once per pass; selected records and ETags remain freshly read.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_parked.go	generationReadRetirements	E2	linux:internal/host/rootgeneration_parked.go:productionGenerationRetirements	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_production_linux.go	migrationExecutionEmpty	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	PassFilter	B3+E1+E2+E3	linux:internal/release/adopt.go:Pass	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.layoutReversalReasons	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.gate	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	journalPrune	C	linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimrelocationrelease.go	RelocationReleaseReceipts.Complete	C+G	linux:internal/host/relocationreleases.go:verifyDischargedReceipt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	systemdUnits.JournalTail	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.readCensus	D	linux:internal/rootparticipation/ledger.go:Ledger.Census	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	type generationKernel	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/heldstage.go	heldStageAuthority	C+E1	linux:internal/host/heldstage.go:heldStagePass	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Disk.WithParticipation	D	linux:internal/host/systemapply.go:systemApplier.runWithRelease	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/host/namedrecovery_active.go	namedUnitRecovery.recover	B3+E1	linux:internal/host/namedrecovery_pass.go:namedUnitRecovery.passOption	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.armFloor	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.plan	E1+E3	linux:internal/host/rolloutdeclined.go:honourDeclinedFailures	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_recovery.go	type historyRollbackLink	E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/edgesfile.go	edgesFileWriteClaims	F	linux:internal/host/edgesfile.go:edgesFileLoop	root-route;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/movesstage.go	heldReleaseReady	C+E1	linux:internal/host/movesstage.go:heldReleaseHooksVia	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	MaterializeHeld	E2	linux:internal/host/movesstage.go:var heldMaterialize	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:424: J4	internal/release/refusal.go	ReadRefusal	E1+E3	linux:internal/host/buildstate.go:buildStates.heldWakeInput	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	RootHistoryPass.resolve	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationStart	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.controllerGone	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers_linux.go	rootInstallationCoverage	C+G	linux:internal/host/claimstop_writers_linux.go:verifyNoProcessAt	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.ownedRow	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Extracted row writer retains complete typed inventory and immutable route identity around guarded write.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_requirements.go	type generationRecord	E2	linux:internal/host/rootgeneration_inventory.go:type generationInventory	E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.
    plan14_input_inventory_test.go:424: J4	internal/release/refusal.go	ListRefusals	E1+E3	linux:internal/host/refusalwatch.go:refusalWatch.tick	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrollback.go	settleRollbackAttempt	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.heldBuild	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.report	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostguard/coldhandover.go	Guard.AbandonColdHandover	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	generationRetirement.closed	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootFloorJudge.judge	F	linux:internal/host/systemapply.go:systemApplier.notePrev	rev3=PROPOSED-p3;identity=carlos adopt normal refresh and carlos system apply notePrev, uid 0;basis=observes participation before floor lock; writes identity-bound current/prev verdict even under unknown history without blocking repair executor
    plan14_input_inventory_test.go:424: J4	internal/provision/rootrecord.go	RecordIndex.Find	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Use cached key identity but read and validate current record body and ETag.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_timers.go	rootMigrationTimers.load	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=reads only the root-private saved adoption intention, requiring the same host, incarnation, stamp, session and enrolled box; preserves exact registration IDs on retry
    plan14_input_inventory_test.go:424: J4	internal/hostexec/local_unix.go	localDir.write	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.restoreFiles	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize
    plan14_input_inventory_test.go:424: J4	internal/host/relocationowners.go	relocationAfterAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.idle	D	linux:internal/rootparticipation/ledger.go:Ledger.RecoverAcquisition	D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census.
    plan14_input_inventory_test.go:424: J4	internal/host/namedrecovery.go	type namedUnitRecovery	E1	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.beforeExec	E3	linux:internal/host/buildstate.go:buildStateHook	Consumed request is tenant-bound before execution; unread registry refuses before state merge.
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	withPrevLock	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.holdOf	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.heldBuild	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/bake.go	LoadFirstSeen	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_crossbox.go	relocationAfter	C	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	Admission dispatch preserves landing handover and delegates relocating probing to its typed after-admission owner.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.MintHeldUnder	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	generationKey	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.notePrev	F	linux:internal/host/systemapply.go:systemApplier.decidePrev	rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloorgate_linux.go	readFloorGateFile	F	linux:internal/host/movesfloorgate_linux.go:floorAllowsPrev	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/guardtransaction.go	systemApplier.guardRun	F	linux:internal/host/systemapply.go:systemApplier.onDiskBuild	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.settle	D	linux:internal/hostexec/rootbroker.go:RootBroker.recoverSettlement	On uncertain ETag or delete conflict require both root and remote expiry, then conditionally delete the current ETag.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/migration.go	Ledger.MigrationCensus	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion
    plan14_input_inventory_test.go:424: J4	internal/host/caps_pass.go	stampDBPaths	E4	linux:internal/host/caps_pass.go:capabilityPass	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Verify	C+G	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/proofroot.go	proofRoot.stillLive	B3	linux:internal/host/proofroot.go:proofRoot.mintAndLog	route-and-input
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.heldHost	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipHost	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/typedretire.go	writeJournal	C	linux:internal/hostbox/typedretire.go:TypedRetirement.Run	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesinstall.go	installRun.local_	C+G	linux:internal/host/movesinstall.go:installGeneration	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/restartscope.go	RestartScope.Selects	E1+E3	linux:internal/host/restartscope.go:scopedHosts	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckRootRegisteredRow	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Crash census exception admits only the row named by root pending registration; all other census checks remain required.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/coldhandover.go	LaunchJournal.HasInstallationEffects	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:424: J4	internal/caps/converge.go	readDropIn	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesland.go	landingRun.checking	C	linux:internal/host/movesland.go:landingRun.step	Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	const RootGenerationsDir	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/caps_pass.go	capabilityPass	E4	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/wakepolicy.go	relocationProbe	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	Adoptable	C+E3	linux:internal/host/proofask.go:mintAsker.tick	root-route;kept=C,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	loadRestartMarks	E1+E3	linux:internal/host/restart.go:restartPass	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootroute.go	proofBindingSource.needsRestart	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	readLegacyJournals	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostrelocate/worker.go	Worker.ConvertLanding	C	linux:internal/host/relocatepass.go:convertFencedLanding	Landing conversion requires verified local worker and termination-fence authority before claim conversion.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/participation.go	checkLegacyParticipation	D	linux:internal/hostfloor/disk.go:Disk.Begin	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:424: J4	internal/release/rootbake.go	RootHistory.LoadBake	E1	linux:internal/release/adopt.go:PassFilter	E1 strict root bake and app completeness revisions; backward clocks refuse and visible records are durably recommitted.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RestartBinding	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimretire_transport.go	type ClaimRootHTTP	E1	linux:internal/host/claimstop_run.go:RunInstanceControl	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	openRootMovesFloors	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed moves namespace then delegates checked root store opening
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_production_linux.go	rootMigrationLegacySuspects	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory
    plan14_input_inventory_test.go:424: J4	internal/caps/converge.go	Ops.checkClaimsOnDisk	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchjournal.go	LaunchJournal.mutate	C	linux:internal/hostbox/rolelaunch.go:LaunchJournal.CloseWriters	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/proofgate.go	ProofGate.bind	B3	linux:internal/release/roothistory_pass.go:passConfig.bindProof	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RestartTarget.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	rootJudgePrevWithSource	F	linux:internal/host/movesfloor.go:rootJudgePrev	rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes
    plan14_input_inventory_test.go:424: J4	internal/host/claimcleanup_identity.go	claimCleanupEnrollment.configureSigner	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers_linux.go	emptyContainmentAt	C+G	linux:internal/host/claimstop_writers_linux.go:noProcessGroups	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/stopinventory_db.go	StopInventoryDB.ReadStopInventory	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootview.go	Guard.fenceLocked	C+G	linux:internal/hostguard/recoveryfence.go:Guard.ResumeFence	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records
    plan14_input_inventory_test.go:424: J4	internal/host/relocationwake.go	RelocationWakeInputs.Select	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Relocation wake binds prepared generation, release receipt and install stamp before admission; launch payload selection remains legacy.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_evidence.go	readMigrationStop	G	linux:internal/host/rootmigration_collect_linux.go:recoverMigrationStop	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootmigration.go	RootAuthority.RetainMigrationDeny	C+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority
    plan14_input_inventory_test.go:424: J4	internal/host/proofask.go	mintAsker.stagedSHA	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	systemctlVerb	B3	linux:internal/host/unitsettle.go:systemdUnits.ResetFailed	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rollback.go	upstream	B3	linux:internal/release/rollback.go:processGroup	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootclient.go	requestIdentity	D	linux:internal/hostexec/rootclient.go:RootClient.close	D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	validHistoryRetirement	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/begun.go	ReadBegun	F	linux:internal/host/guardtransaction.go:systemApplier.guardFinished	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	stageHeld	C+E1+E2	linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/guardtransaction.go	systemApplier.guardTransaction	D	linux:internal/host/guardtransaction.go:systemApplier.beginGuard	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	JournalService.Execute	C	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_startup.go	verifyRootMigrationFloors	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks installed and guard signed binaries against both locally retained protocol bounds without remote access
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.heldRoute	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.skipRoutes	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/seedsfloor.go	judgeSeedsPrev	F	linux:internal/host/seedsfloor.go:rootJudgeSeedsPrev	rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) through notePrev, and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root) through rootJudgeSeedsPrev: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	RootHistoryPass.begin	E1	linux:internal/release/adopt.go:adoptHost	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests_source.go	type rootRestartRequestSource	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_reconstruct.go	RootHistory.reconstructionState	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.reconstructionReady	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.Fail	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	rootMovesFloorIdentity	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root-only census reader supplies deployment/box/enrollment; edge mode cannot call it
    plan14_input_inventory_test.go:424: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.rebindRecoveryInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Retain fresh claim and inventory checks and refuse a box listed Lost.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.Certify	E2	linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.binding	B3	linux:internal/host/proofbinding.go:proofBindingSource.forHost	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	Guard.CommitRootInventoryArtifacts	G	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation_probestop.go	RecordProbeStop	C	linux:internal/hostrelocate/participant.go:Participant.Step	Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.refreshAll	E3	linux:internal/host/agent.go:fastConvergeLoop	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	Guard.freshObserved	C	linux:internal/hostguard/guard.go:Guard.fresh	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	rootStartRoute	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Use main systemctl start for legacy non-NotUp recovery while retaining checked rollback when authority binds.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	restartValue	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Observe	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.pass	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.pointerLoop	fix1-merge-review;basis=Saves the failure book before processing pointer retries; preserves signed retry and restriction checks.
    plan14_input_inventory_test.go:424: J4	internal/release/releaseexclusion.go	ReleaseExclusion.With	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	restartGenPass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_linux.go	readHeldRenderHash	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/relocationowners.go	RelocationSource.Open	C+D	linux:internal/host/claimrelocation.go:openClaimRelocationOwners	Relocation owner wiring binds verified actor, C8 provider and identity-checked requests; admission remains typed.
    plan14_input_inventory_test.go:424: J4	internal/host/systemparticipation.go	systemApplier.beginExecutableChange	D	linux:internal/host/systemapply.go:systemApplier.install	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/host/claimrecovery_remote.go	claimCrossBoxHandover.installRecoveryRemote	C	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	type Scope	E1	linux:history_cli.go:historyCommandWithSave	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit_binding_source.go	readClaimUnitShapes	E2		PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/seedsfloor.go	systemApplier.armSeedsFloor	F	linux:internal/host/systemapply.go:systemApplier.armFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStateRegions	E3	linux:internal/host/buildstate.go:newBuildStates	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.member	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostguard/record_unix.go	recordDir.read	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/hostbox/empty_census.go	censusRule.check	C	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/work.go	Serving	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.settleExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:424: J4	internal/host/proofroot.go	proofRoot.around	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Continue minting observations for unaffected routes even when adoption reports a route error.
    plan14_input_inventory_test.go:424: J4	internal/host/claimparticipation.go	productionClaimLocal.participateHost	D	linux:internal/host/claimparticipation.go:productionClaimLocal.participate	Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationowners.go	relocationBeforeAdmission	C	linux:internal/host/relocationowners.go:RelocationSource.Open	Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootview.go	RootAuthority.viewLocked	C+G	linux:internal/hostguard/rootview.go:RootAuthority.Installation	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	historyRetirementKey	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	type stageCheck	E2	linux:internal/release/adopt.go:type passConfig	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:424: J4	internal/release/program.go	ArtifactProgram	E1	linux:internal/release/program.go:ReleaseProgram	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	type Receipt	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/production.go	Ledger.ActivationReady	E2	linux:internal/host/claimstop_run.go:claimActivationReady	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	heldProofAdmit	C+E1	linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	generationHash	E2	linux:internal/release/rootgenerationcompleteness.go:GenerationEvidence.valid	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.RecoverAcquisition	D+F	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=retains acquisition-recovery checks and census commit under the same participation transaction; no new authority from a missing record
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	restartPass	E1+E3	linux:internal/host/agent.go:runAdoptUnderRootRelease	root-route
    plan14_input_inventory_test.go:424: J4	internal/instancectl/server.go	runWithClaim	C+D+G	linux:internal/instancectl/claim.go:RunWithClaim	Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	RootAuthority.read	C+G	linux:internal/hostguard/root.go:Guard.Capture	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.recoverSettlement	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	Recovery serializes settlement with in-flight requests and requires cleanup, exact conditional release and CC9. TestPlan14ExecutionRecoverySettlesWithoutControllerToken and TestPlan14ExecutionRecoveryJoinsRemoteWrite.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/generationinventory.go	RootAuthority.GenerationInstallations	E2	linux:internal/host/rootgeneration_inventory.go:generationInventoryAt	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	judgeRootSeedsPrev	F	linux:internal/host/rootseedsfloor.go:rootRefreshAndJudgeSeedsPrev	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	readRootSeedsBinary	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=carlos adopt seeds judgement and root system apply/recover candidate checks, uid 0;basis=delegates checked signed executable read then selects seeds protocol
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration_linux.go	recoverLegacyClaimEdgeMask	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/stopjournal_reader.go	LaunchJournal.ReadStopKernelJournal	C	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input
    plan14_input_inventory_test.go:424: J4	internal/provision/reconcile.go	mintHeld	C	linux:internal/provision/reconcile.go:Reconcile	Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	rootFloorBootCandidate	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=selects signed prev under unknown history with no known refusal; always retains certified current executor even when bound exceeds every available build
    plan14_input_inventory_test.go:424: J4	internal/instancectl/claimexec_socket_linux.go	claimListenExecSocket	C+G	linux:internal/instancectl/claimexec.go:ClaimUnits.prepareExecGate	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.UpdateID	D	linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_outcomes.go	type historyRecoveryRecord	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit.go	claimUnitContent	E1	linux:internal/host/bootstrap.go:bootstrapWith	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	productionLocalGenerationInventory	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	rootFloorAdvertisementFor	F	linux:internal/host/rootmovesfloor_refresh.go:withRootMovesFields	rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict
    plan14_input_inventory_test.go:424: J4	internal/release/buildstate.go	Consumed.ForeignTo	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	ForeignTo binds consumed decisions to account/app before root release history can be reused.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	relocationInstallAuthority	C	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	systemApplier.seedsActivationRefusal	F	linux:internal/host/systemapply.go:systemApplier.activationRule	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection
    plan14_input_inventory_test.go:424: J4	internal/host/bootstrap.go	const tmpfilesConf	A+C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=A,C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimrecoveryreceipt.go	claimCrossBoxHandover.recoveryStopReceipt	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.recoveryEvidence	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimconstruction.go	refusingRootWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	agentCheckedUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:424: J4	internal/caps/converge.go	scanClaims	E4	linux:internal/caps/converge.go:Ops.checkClaimsOnDisk	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimrecoveryjournal.go	claimRecoveryJournal.successor	C+G	linux:internal/host/claimrecoveryjournal.go:claimCrossBoxHandover.completeRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/image_linux.go	Disk.Exec	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/seedsfloor.go	withSeedsFields	F	linux:internal/host/edgesfile.go:edgesFileLoop	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.Read	A	linux:internal/rootparticipation/production.go:OpenForUpdate	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration.go	rootMigration.write	G	linux:internal/host/rootmigration.go:rootMigration.run	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-system-update.path	external	F	linux:internal/host/bootstrap.go:var unitsFS	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	capabilityPlan	E4	linux:internal/release/adopt.go:adoptHost	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	openGenerationLaunchInventory	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:424: J4	internal/host/claimowners.go	claimServingOwners.serving	C+G	linux:internal/host/claimowners.go:claimServingOwners.Select	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.report	E1+E3	linux:internal/host/rollout.go:rolloutStatusProbe	fix1-merge-review;basis=Reports only durable published restriction epochs and the supported retry protocol; reports do not grant authority.
    plan14_input_inventory_test.go:424: J4	internal/release/rollback.go	rollbackGroup	B3+E1+E3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Retire	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_other.go	Open	A	darwin:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationpins.go	RootGenerationPins.StagedPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	type movesHeldReleaseRoot	E2	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/transaction.go	TransactionLedger	D+F	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=returns only an active root-minted held ledger; stale and cancelled scopes refuse
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor_linux.go	openMovesDir	F	linux:internal/host/movesheldlock.go:withHeldStageLock	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.Names	A	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootview.go	RootAuthority.Installation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	rootFloorJournalPresent	F	linux:internal/host/guardexec.go:RunSystemGuardExec	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=checked authority-file presence selects recovery without opening a deployment store
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootmigration_inventory.go	RootAuthority.MigrationInstallations	C+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0; also root claim startup uid 0;basis=read-only root installation enumeration includes incomplete records and never repairs before preflight
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationInventoryDigest	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/record_unix.go	recordDir.write	C	linux:internal/hostguard/root.go:Guard.AbandonRootInventory	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	readRootFloorProjection	F	linux:internal/host/guardarm.go:RunSystemGuardArm	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=selects moves public root projection for checked advertisement reader
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	rootFloorJudge.permits	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=root guard-exec apply/recover selection and carlos.prev floor-allows-prev, uid 0;basis=signed current, retained prev and fixed staged candidate determine whether a below-bound candidate must be refused; no available qualifying build preserves recovery
    plan14_input_inventory_test.go:424: J4	internal/hostbox/roleintention_linux.go	LaunchJournal.ResolveRoleIntentions	C	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.resolveRoleIntentions	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	makeStartRoute	B3	linux:internal/host/agent.go:adoptLoop	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchLocked	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.CheckHeld	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Hold-only source checks its own row-owned installation inventory rather than the target holder stamp.
    plan14_input_inventory_test.go:424: J4	internal/host/heldstage.go	heldStageCheck	C+E1	linux:internal/host/heldstage.go:heldStageAuthority	route-and-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/park.go	Regional.observe	C	linux:internal/hostbox/regionalworker.go:RegionalWorker.runHost	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	GenerationPins	E2	linux:internal/release/adopt.go:PassFilter	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_app.go	RootHistory.AppRefusals	E1	linux:internal/release/roothistory_app.go:RootHistory.MintRefusals	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationGroupGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	seedRestartMarks	E1+E3	linux:internal/host/restart.go:restartSeed	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/controller.go	ClearStale	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationMaps	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration.go	RunSystemJournalMigrate	G	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration.go	migrateClaimJournalsWith	G	linux:internal/host/claimjournal_migration.go:RunSystemJournalMigrate	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction.go	readProductionRosterRow	C+G	linux:internal/host/movessources.go:productionRosterRegion	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory.go	ClaimRootHTTP.verifyInventoryPath	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_timers.go	type rootMigrationTimers	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=holds root-private migration state, root inventory, root fence authority and isolated registry interface under offline exclusion
    plan14_input_inventory_test.go:424: J4	internal/hostbox/rolelaunch.go	strictRoleLaunch	C	linux:internal/hostbox/rolelaunch.go:DecodeRoleLaunchRequest	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_requirements.go	inventoryTimerNames	E2	linux:internal/host/rootgeneration_requirements.go:generationRequiredInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/console/apirestartscope.go	hostNames	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit.go	var readClaimUnitFile	C+G	linux:internal/host/claimunit.go:readClaimUnitSettings	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/roleintention_linux.go	resolveRoleIntention	C	linux:internal/hostbox/roleintention_linux.go:LaunchJournal.ResolveRoleIntentions	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/pending_linux.go	recoverPending	D	linux:internal/hostexec/pending_linux.go:RecoverPending	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Observe	C+G	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	root-input;kept=C,G;scope=protected-decision-only PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/remote.go	CheckRemote	F	linux:internal/hostexec/controller.go:Config.checkRemoteUpdateIdentity	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.Acquire	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	type HistoryHostStatus	E1	linux:internal/release/roothistory_status.go:type HistoryMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	rootRestartRecord.advance	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_census_linux.go	productionGenerationKernelCensus	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	restartScopePass	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Hands historical signed retry entries to the common verifier; unknown selectors do not widen scope.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/production.go	OpenForUpdate	D	linux:internal/host/claimstop_run.go:RunInstanceControl	Unactivated absent census does not block update or recovery; retained census remains authoritative.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	HistoryStatusKey	E1	linux:internal/release/roothistory_status.go:RootHistory.ProjectMigrationStatus	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/generationinventory.go	OpenGenerationLaunchReader	E2	linux:internal/host/rootgeneration_inventory.go:openGenerationLaunchInventory	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/claimparticipation_stale.go	participationCleanupRead.Read	D	linux:internal/host/rootinstallation.go:rootInstallationHostApp	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.activationGuard	D+F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover root units and offline root CLI uid 0;basis=release exclusion then scoped participation transaction then effective moves/seeds floor and registry; signed candidate checks remain inside guard; nested journal close reuses live exclusion
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_recovery_policy.go	RootHistory.RetireD1	E1	linux:internal/release/adopt.go:adoptHost	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/hostexec/local_unix.go	localDir.read	D	linux:internal/hostexec/rootmirror.go:ProjectRootClient	root-input
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	prepareStatus	E1	linux:internal/historyreadback/workflow.go:PrepareOperation	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	type RootGenerations	E2	linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_healthy.go	type rootFloorHealthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.healthy	rev3=PROPOSED-p3;identity=root system apply/adopt health or floor decision uid 0; recovery readers uid 0;basis=binds a root health observation to deployment, box, enrollment and signed binary identity
    plan14_input_inventory_test.go:424: J4	internal/host/claimparticipation.go	productionClaimLocal.prepareLegacyWith	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.prepareWith	Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	GenerationBinding.valid	E2	linux:internal/release/rootgenerations.go:RootGenerations.Read	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests.go	logRestartRequestError	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit_binding.go	claimUnitBindings.check	E2	linux:internal/host/claimunit_placement.go:ClaimLaunchRoot.checkUnitBinding	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_timers.go	rootMigrationTimers.key	G	linux:internal/host/rootmigration_timers.go:rootMigrationTimers.adopt	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=scopes the durable timer adoption intention to the root-observed installation and denied session
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-config-sync.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_requirements.go	ClaimRootHTTP.verifyInventoryTimers	E2	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	JournalService.execute	C+D	linux:internal/hostbox/journalservice.go:JournalService.CompletePendingInventory	Delegates journal transaction with original request hashing; root-generated inventory substitution uses the separate internal entry point.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	type GenerationCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	scanRebootCgroups	C+G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchjournal.go	LaunchJournal.Create	C	linux:internal/hostbox/launchjournal.go:LaunchJournal.Prelaunch	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootread.go	ReadRoot	D	linux:internal/host/rootexecution_read.go:readRootExecution	fix1;basis=Queries broker OFD lock ownership without acquiring a lock; rechecks unchanged durable evidence and monotonic expiry.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RestartBinding.valid	E1	linux:internal/release/rootrestart_history.go:RootRestarts.read	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	MaterializeHeldUnderWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction_linux.go	productionStopControllers.VerifiedController	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_collect_linux.go	migrationStopKernel.RecoverStopped	G	linux:internal/host/claimstop_recovery.go:ClaimStopCoordinator.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakewriters.go	claimWakeAttempt.StopWriters	C+G	linux:internal/host/claimstop_writers.go:ClaimAssembly.writersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	publishVersion	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_creation.go	type rootHistoryAccess	E1	linux:internal/host/claimretire_transport.go:type ClaimRootHTTP	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	type RootInstallation	E2	linux:internal/host/rootinstallation.go:rootInstallationHostApp	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_refresh.go	readRootFloorBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar
    plan14_input_inventory_test.go:424: J4	internal/hostguard/recoveryfence.go	Guard.recordNames	C	linux:internal/hostguard/recoveryfence.go:Guard.PendingFences	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	productionRootGenerations	E2	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/movespass.go	armMovesPass	B+C	linux:internal/host/agent.go:runAgent	Agent moves construction passes registration client and existing guarded publication and park providers.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	RootHistoryPass.recheck	E1	linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationRead	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/claim_evidence_producer.go	ConfigureStopEvidence	C+G	linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/instancectl/peer_tuple_linux.go	AuthenticatePeerTuple	C+G	linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/registry/registry.go	Registry.Upsert	E3	linux:cli.go:runAdd	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged, in the process that holds a remote handle, root passes included: main's body with its insert defaults moved to normalizeRoute and its bind list to routeArgs, and two columns added (seed_source, import_gate); the conflict clause, with the tenant-change rule E3 names, is unchanged; main's E3 authority retained
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_migration.go	ClaimRootHTTP.executionAuthorityWithMigration	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	readRootProtocolBound	F	linux:internal/host/rootmigration_startup.go:verifyRootMigrationFloors	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance
    plan14_input_inventory_test.go:424: J4	internal/hostexec/clock_linux.go	BootID	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/pending_linux.go	controllerProcessStart	D	linux:internal/hostexec/rootprocess_linux.go:ControllerAlive	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/namedrecovery.go	namedUnitRecovery.repair	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.forHost	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	const RootHistoryStatusDir	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.started	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor_linux.go	movesDir.names	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:424: J4	internal/instancectl/legacy_claim_cleanup.go	Server.clearLegacyClaimLaunch	C+G	linux:internal/instancectl/server.go:Server.handleStart	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	WithRunningVersion	B3	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=fix3-Astra-P2;basis=Root-only hook supplies verified current or previous running authority before replacing pointers.
    plan14_input_inventory_test.go:424: J4	internal/host/proofroot.go	type proofRoot	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_launch.go	ClaimLaunchRoot.rootInstalledProgram	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	RootGenerations.Read	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/claimowners.go	claimServingOwners.launchDigest	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchjournal.go	LaunchJournal.SessionLaunches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	ServeHeldStageRequestsWithPins	E2	linux:internal/host/heldstage.go:heldStagePass	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state.go	Sync	A+F+G	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.acceptHealthy	F	linux:internal/host/rootfloor_healthy.go:systemApplier.acceptRootFloorHealthy	rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	JournalService.Replay	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournalDir	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_run.go	claimActivationReady	E2	linux:internal/host/claimstop_run.go:RunInstanceControl	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	settingsApply	E3	linux:internal/host/buildstate.go:buildStates.wakeTarget	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.VerifyDigest	C+G	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authorize	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_stopped_linux.go	verifyMigrationStopped	G	linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery
    plan14_input_inventory_test.go:424: J4	internal/caps/caps.go	Set.UnmarshalJSON	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.write	D	linux:internal/hostexec/rootbroker.go:RootBroker.settle	fix1;basis=Bounds replay to the latest acquisition and preceding settlement, rotates renewal tokens, and holds broker-only OFD liveness.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_production_other.go	migrateRootClaimAuthority	G	darwin:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=non-Linux offline journal-migrate CLI;basis=unsupported-platform stub returns ErrUnsupported without reading or granting migration authority
    plan14_input_inventory_test.go:424: J4	internal/host/rootroute.go	sameProofCandidate	B3	linux:internal/host/proofbinding.go:proofBindingSource.resolve	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	rootGenerationSource.resolve	E2	linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/release/versions.go	PointLive	B3+E2	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	rev3=merge-ruling-5;basis=Compare resolved current and previous paths before retaining the running build; preserve repoint errors and canonical retained pointers.
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	applyRetries	E1+E3	linux:internal/host/restart.go:restartRequestLeg	fix1-merge-review;basis=Verifies the deployment-root signature and account/app/host/book/epoch before lifting a restriction.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	type HistoryMigrationStatus	E1	linux:internal/host/roothistory.go:openRootHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.write	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Finish	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	RootGenerations.Reserve	E2	linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryRefusals	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationTree	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationInstall	B2+C+E2	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstate_linux.go	claimPrivatePathOwner	C+G	linux:internal/host/claimstate_linux.go:prepareClaimStateDirectory	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/rootstate/link_linux.go	directory.readLink	A+E1	linux:internal/rootstate/link_linux.go:ReadTrustedLink	Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/generationpayload.go	type GenerationPayload	E2	linux:internal/host/rootgeneration_inventory.go:type generationInventory	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/instanceexec/claimexec_linux.go	checkClaimExec	E2	linux:internal/instanceexec/claimexec_linux.go:scopedClaimInit	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_authority.go	ClaimRootHTTP.executionAuthority	D	linux:internal/host/rootexecution_migration.go:ClaimRootHTTP.executionAuthorityWithMigration	Fresh claim, deployment binding and root installation authorize participation, including the retained source only.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.recoverAfterReboot	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimretire_transport.go	retirementAcknowledgement	C+G	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.retire	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/registry/registry.go	normalizeRoute	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever Upsert's SQLite arm and the import swap run: the insert defaults from Registry.Upsert's body; E3, the same family as Registry.Upsert, whose body they came from
    plan14_input_inventory_test.go:424: J4	internal/release/rollback.go	processGroup	B3+E1+E3	linux:internal/release/rollback.go:rollbackGroup	root-route;kept=B3,E1,E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/movesfiles.go	relocationPreparedManifest	C	linux:internal/host/movesfiles.go:movesFiles.preparedBinding	Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use.
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.beginExecutionRecoveryFence	D	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetired	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	LinuxStopKernel.readContainedJournal	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakestop.go	ClaimAssembly.stopRetryAttempt	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.bindClaimWakeStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.resolve	B3	linux:internal/host/roothistory.go:openRootHistory	fix1;basis=Binds deployment or root-managed named-unit evidence, trusted unit identity and digest history; registry names are hints only.
    plan14_input_inventory_test.go:424: J4	internal/provision/rootrecord.go	FindRecordByHost	B3+C	linux:internal/host/rootrecord_claim.go:rootClaimRecord	Discovery delegates to the collision-checking index and still reads the selected record afresh.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.RegisterLanding	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation.
    plan14_input_inventory_test.go:424: J4	internal/host/namedrecovery.go	namedUnitRecovery.originalRefusal	E1	linux:internal/host/namedrecovery.go:namedUnitRecovery.checkHistory	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	Guard.locked	C	linux:internal/hostguard/fence.go:Guard.CompleteFence	rev3=merge-ruling-4;basis=Only positively unsafe legacy locks durably quarantine; timeout and I/O errors return without changing root installation state.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	passConfig.recordRefusal	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_parked.go	productionGenerationRetirements	E2	linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventory_expected.go	StopInventoryDB.SnapshotRequest	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.projection	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizeReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller
    plan14_input_inventory_test.go:424: J4	internal/hostbox/writer.go	Writer.Published	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/consumedfence_linux.go	lockConsumedCarry	E3	linux:internal/release/consumedfence.go:FenceCarry	root-input;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationTaskFDs	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	SettingsRefs	E2	linux:internal/release/pins.go:BoxPins	root-route
    plan14_input_inventory_test.go:424: J4	internal/rootstate/file_linux.go	CheckPublicConfig	A+B3	linux:internal/host/proofnamed.go:proofBindingSource.trustedBytes	fix1;basis=Checks root:root ownership, exact 0644 mode and single-link regular-file identity on the already opened operator configuration descriptor.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/workflow.go	Operation.Read	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	fastConvergeLoop	B3	linux:internal/host/agent.go:runAgent	rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	journalIdentity	C	linux:internal/hostbox/generationinventory.go:LaunchJournal.GenerationLaunches	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.BeginUpdateWith	D	linux:internal/hostfloor/disk.go:Disk.Begin	rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/host/movespass.go	armPhase1	B2+C	linux:internal/host/movespass.go:armMovesPass	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the S1 probe hook refusing a row whose import gate is set; main's B2,C authority retained
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.pointerLoop	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Delegates each iteration to pass; retains ownership of the retry/restriction authority path despite no direct read.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/production.go	Ledger.UpdateRequired	D	linux:internal/rootparticipation/production.go:OpenForUpdate	Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.restoreVersion	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	RunSystemApply	D+F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system apply/recover root systemd units uid 0;basis=registers local launch verifier and delegates to the census-gated outer release wrapper while retaining local root floor checks and main no-census path
    plan14_input_inventory_test.go:424: J4	internal/host/claimready_linux.go	claimProbePeer	B3	linux:internal/host/claimready_linux.go:claimProbeSocketReady	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	readLocalFloor	F	linux:internal/host/movesfloor.go:withMovesFields	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationReconciler.reconcile	E2	linux:internal/host/rootgenerationpins.go:productionRootGenerationPins	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/restore.go	readGeneration	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/relocationflush.go	ReleasePositionsFile.Recorded	C	linux:internal/host/relocationeffects.go:RelocationEffects.flushStopped	Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.Write	A+F+G	linux:internal/hostexec/rootbroker.go:RootBroker.deny	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=delegates to shared validated durable-write implementation; production syscall behavior unchanged
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory.go	ClaimRootHTTP.commitRootInventoryPending	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.withRootInventoryHistory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_production.go	WithProductionMovesHeldRelease	B2+C+E1+E2	linux:internal/host/claimstop_run.go:RunInstanceControl	Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_timer_recovery.go	ClaimRootHTTP.settleTimerInventory	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	PROPOSED E46: exact persisted root pending intent only; finish journal after effect matches, preserve denial, no new SQL effect or network claim authority. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_crossbox.go	wireClaimAdmission	C+D	linux:internal/host/claimhandover_crossbox.go:wireProductionAdmission	Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind.
    plan14_input_inventory_test.go:424: J4	internal/hostexec/controller.go	Open	D	linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease.go	decodeHeldReleaseRequest	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.ServeHTTP	root-input;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/guardarm.go	guardArmIdle	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.Run	D+F	linux:internal/host/systemapply.go:systemApplier.runWithRelease	root-input;kept=D,F;scope=protected-decision-only PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchjournal.go	OpenLaunchJournal	C	linux:internal/host/claimjournal_migration.go:var openClaimRootJournal	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	pointerBoundUnit	B3	linux:internal/host/rootrestart.go:restartBoundUnit	rev3=merge-ruling-4;basis=Only PID-zero stopped or restarting states may bind without process identity; inactive units are never woken.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	historyRecoveryDigest	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	RootHistory.recoveryRetirementDigest	E1	linux:internal/release/roothistory_retirement.go:RootHistory.recoveryRetired	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	record.admits	G	linux:internal/hostguard/guard.go:Guard.With	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor_publication.go	type rootSeedsPublication	F	linux:internal/host/rootseedsfloor_publication.go:verifyRootSeedsPublication	rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor_publication.go	verifyRootSeedsPublication	F	linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound	rev3=PROPOSED-p3;identity=root protocol readers uid 0; edge advertisements from public root projection uid carlos;basis=verifies canonical root signature, deployment, purpose, schema and protocol minimum; unsigned source cannot arm seeds
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakeassembly.go	claimSameWriter	C+G	linux:internal/host/claimretire_local.go:claimArtifactRetirement.Recover	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	productionGenerationAbsence	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers.go	ClaimAssembly.WritersStopped	C+G	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	StartRelocation	C		Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy.
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.read	D	linux:internal/hostexec/rootbroker.go:RootBroker.Recover	D1/D2 decode the retained root participation record; missing or malformed state grants nothing.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	const RootRestartsDir	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-adopt.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/renewing.go	RenewingLeases.Acquire	C	linux:internal/host/movespass.go:armPhase1	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.Launch	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/caps/caps.go	ValidCapabilities	E4	linux:cli.go:readCapabilities	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/report.go	ReadEnrollment	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	rootJudgePrev	F	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=normal adopt combines moves and seeds verdict errors; unpublished seeds remain inert; raised bounds never block recording signed prev
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	systemdUnits.StartTime	B3	linux:internal/host/proofobserve.go:proofObserver.observe	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.authority	C+E1	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate.
    plan14_input_inventory_test.go:424: J4	internal/host/moveswakesource.go	movesWakeSources.Open	B2+C	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor.
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_runtime.go	newClaimExecutionRuntime	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationUnescape	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/instanceexec/claim_generation_linux.go	ScopeClaimGeneration	E2	linux:internal/instanceexec/claimexec_linux.go:scopedClaimInit	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/generationinventory.go	RootAuthority.generationInstallation	E2	linux:internal/hostguard/generationinventory.go:RootAuthority.GenerationInstallations	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor_publication.go	readRootSeedsBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh, system apply/recover and guard floor readers, uid 0;basis=unpublished seeds supplies no bound; verified retained publication and root-capped denies determine the bound
    plan14_input_inventory_test.go:424: J4	internal/host/claimready_linux.go	claimProbeSocketReady	B3	linux:internal/host/claimconstruction.go:claimGroupDWiring	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.acquire	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Retry conditional writes and authority reads within original monotonic cutoff; reconcile uncertain writes by exact bytes.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/retirement.go	Guard.WithNoInstallation	C	linux:internal/host/claimproduction.go:claimAdminTokens.With	Use the already-held root host lock for empty-installation authority checks.
    plan14_input_inventory_test.go:424: J4	internal/hostrelocate/worker.go	Worker.Start	C+D		Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy.
    plan14_input_inventory_test.go:424: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.selected	C+G	linux:internal/host/claimmoveaccess.go:claimMoveReadWork.With	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	verifyHeldLive	B2+C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	passConfig.recheckHistory	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	RootGenerations.invalidateCompleteness	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.floorArmed	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority
    plan14_input_inventory_test.go:424: J4	internal/host/claimbackfill.go	newClaimBackfill	C+G	linux:internal/host/agent.go:instancesLoop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostguard/recoveryfence.go	Guard.PendingFences	C	linux:internal/host/claimstop_recovery.go:ClaimStopHTTP.RecoverPending	Root-only read lock avoids an agent-held legacy lock at startup.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retireAll	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_crossbox.go	claimCrossBoxHandover.After	C+G	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	runAdoptUnderRootRelease	B3+E1+E2	linux:internal/host/agent.go:runAdoptWithEnsureSystemUnits	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus. E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:424: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.bind	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationpins.go	generationFileIdentity	E2	linux:internal/release/rootgenerationpins.go:RootGenerationPins.StagedPins	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	type generationReconciler	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/rollout/failures.go	OpenFailureBook	E1+E3	linux:internal/host/updatesroot.go:updatesPassOption	fix1-merge-review;basis=Loads schema-three durable generations and refuses unsafe identity recovery on entropy failure.
    plan14_input_inventory_test.go:424: J4	internal/host/claimconstruction.go	var openClaimRootAuthority	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_outcomes.go	historyRecoveryKey	E1	linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_delivery.go	HistoryRecoveryRetirementKey	E1	linux:internal/historyreadback/workflow.go:Operation.Deliver	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/authorityfile_other.go	OpenAuthorityFile	E2	darwin:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.refresh	F	linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal refresh ratchets accepted history; unknown history persists only observed denies and never advertises accepted
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_transport.go	ClaimRootHTTP.serveJournal	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_install.go	rootLandingIdentity	C	linux:internal/host/rootinventory_install.go:ClaimRootHTTP.rootLandingRoute	Landing target identity binds executor, participants, enrollment and region before first root registration.
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_timer_mutation.go	ClaimRootHTTP.verifyTimerMutation	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	lockJournalMigration	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	GenerationVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	relocationRecord	C+E3	linux:internal/host/relocatepass.go:relocationRelocatable	Canonical relocation record and update policy derive nested installation shape; source account/incarnation is rechecked by root registration.
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Launch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	recoveryControllerAt	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_install.go	landingRegistrationMatches	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session.
    plan14_input_inventory_test.go:424: J4	internal/hostrelocate/participant.go	Participant.sameInstallation	C	linux:internal/hostrelocate/participant.go:Participant.Step	Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session.
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	repairSibling	E2	linux:internal/release/adopt.go:stageFrom	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor_linux.go	movesDir.removedDuringOpen	F	linux:internal/host/movesfloor_linux.go:movesDir.lockNamed	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	Open	A	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationpins.go	type RootGenerationPins	E2	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly.go	ClaimRoleAssembly.PreflightLaunch	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	JournalService.MigrateLegacy	C	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofRouteReady	B3	linux:internal/host/proofobserve.go:productionProofObserver	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_outcomes.go	RootHistory.recoveryOutcomes	E1	linux:internal/release/roothistory.go:RootHistory.Refusals	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/transaction.go	type transactionKey	D+F	linux:internal/rootparticipation/transaction.go:TransactionLedger	rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=unexported key prevents callers from forging the held participation scope
    plan14_input_inventory_test.go:424: J4	internal/host/versionsweep.go	sweepStagedVersions	E2	linux:internal/host/versionsweep.go:sweepStagedVersionsPass	root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.installRemote	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install	Remote install snapshots old source inventory outside host lock and rechecks revision in hold-only path.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/relocationrows.go	RelocationRow	C	linux:internal/hostbox/reconcile.go:Reconciler.rowDecision	Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself.
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_requirements.go	rootInventoryArtifacts	E2	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory.go	RootHistory.read	E1	linux:internal/release/roothistory.go:RootHistory.RecordInstalledProgram	Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_timers.go	rootMigrationTimers.adopt	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration binds the exact observed pre-claim registrations to root retained stop evidence and denies; durable intention precedes conditional registry adoption and root inventory completion
    plan14_input_inventory_test.go:424: J4	internal/console/browserrestart.go	Server.handleBrowserRestart	E1+E3	linux:internal/console/browserrestart.go:Server.handleAppRestart	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimmoveparks.go	refusingClaimMoveWake	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/pending_linux.go	tryExistingPendingLock	D	linux:internal/hostexec/pending_linux.go:recoverPending	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationReceipt	C	linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects	Local-install receipt reader refuses malformed operation materialization; claim receipt digest is checked by its consumers.
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_settle.go	ClaimRootHTTP.cleanupExecution	D	linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime	Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
    plan14_input_inventory_test.go:424: J4	internal/host/movesfloor.go	judgePrevWith	F	linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource	route-and-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	rollbackUnitRestart	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	RootHistory.MigrationStatusWithSources	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/safefile/file_linux.go	writeAtSteps	A+F+G	linux:internal/safefile/file_linux.go:writeAt	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_collect_linux.go	recoverMigrationStop	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakeassembly.go	ClaimWakeAssembly.Build	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	route-and-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/image_linux.go	Disk.Run	F	linux:internal/host/guardtransaction.go:systemApplier.guardRun	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/writerstop.go	operationWriter	C	linux:internal/hostguard/writerstop.go:LandingWriter	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/file_linux.go	Identity	A+B3	linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.Complete	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	readRootProtocolProjection	F	linux:internal/host/rootmovesfloor_source.go:readRootFloorProjection	rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance
    plan14_input_inventory_test.go:424: J4	internal/host/proofobserve.go	proofObserver.observe	B3	linux:internal/host/proofobserve.go:proofObserver.recordSettled	fix1;basis=Observes only the canonically bound unit, executable and readiness, including the installed console guard wrapper.
    plan14_input_inventory_test.go:424: J4	internal/release/proofgate.go	ProofGate.hold	B3	linux:internal/release/proofgate.go:ProofGate.admit	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootroute.go	proofBindingSource.claimIdentity	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/movesinstall.go	recoveryInstallSource	C+G	linux:internal/host/movesrecover.go:recoverRun.install	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/coldhandover.go	ColdHandover.Run	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	route-and-input PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/image_linux.go	ExecutingHash	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/legacyrestart.go	legacySettleOptions	B3	linux:internal/host/legacyrestart.go:legacyRollbackRestart	rev3=merge-ruling-4;basis=Legacy settle uses main readiness inputs and limits; these do not authorize root health history.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.recovered	B3+E1	linux:internal/host/rootrestart.go:productionRootRestartChecks	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	type GenerationReservation	E2	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.controllerGone	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.heldGenerationPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/rootlaunchverifier.go	registerProductionLaunchVerifier	E2	linux:internal/host/claimstop_run.go:RunInstanceControl	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/flock_unix.go	acquire	C	linux:internal/hostguard/guard.go:Guard.locked	rev3=merge-ruling-4;basis=Descriptor checks classify nonregular or foreign-owner locks as unsafe; honest contention waits with bounded exponential backoff.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootrebind.go	Guard.RebindRootInventory	E2	linux:internal/host/rootrecovery_rebind.go:ClaimRootHTTP.rebindRecoveryInventory	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.Prelaunch	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_rows.go	generationRegistryInventory	E2	linux:internal/host/rootgeneration_rows.go:productionGenerationRegistryInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	JournalService.holdsLegacyRows	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	StagedPaths.Refers	E2	linux:internal/release/rootgenerationpins.go:passConfig.generationWriteCheck	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationpins.go	passConfig.generationWriteCheck	E2	linux:internal/release/adopt.go:PassFilter	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	type generationRetirement	E2	linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor_publication.go	acceptRootSeedsPublication	F	linux:internal/host/rootseedsfloor.go:refreshRootSeedsFloor	rev3=PROPOSED-p3;identity=normal carlos adopt and system apply remote floor refresh, uid 0;basis=under stable floor lock, retains only verified nonregressing signed seeds publication; no publisher or activation switch added
    plan14_input_inventory_test.go:424: J4	internal/registry/artifacthosts.go	Registry.ArtifactHosts	E2	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:424: J4	internal/host/claimmoveparks.go	openProductionClaimMoveWake	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationattempts.go	relocationAttemptReader.ReadAttempt	C	linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authoritativeAttempt	Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalpath.go	checkJournalPath	C	linux:internal/hostbox/launchjournal.go:OpenLaunchJournal	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	Disk.VerifyFile	F	linux:internal/hostfloor/image_linux.go:Disk.Exec	root-input
    plan14_input_inventory_test.go:424: J4	internal/rollout/failures.go	FailureBook.markLocked	E1+E3	linux:internal/rollout/failures.go:FailureBook.MarkHoldRan	fix1-merge-review;basis=Advances durable app restriction generations so old grants cannot clear new failures.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/live_linux.go	directory.liveFile	A+D	linux:internal/rootstate/live_linux.go:directory.HoldLive	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	restartCandidates	E1+E3	linux:internal/host/restart.go:restartApps	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostguard/record_unix.go	openDirectory	C	linux:internal/hostguard/flock_unix.go:acquire	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostops/backfill_seeds.go	CollectCensusSeeds	G	linux:internal/host/rootmigration_census.go:rootMigrationCollector.collect	rev3=census-ruling-seeded-instances;basis=no caller in the tree yet; G wires the census collector that will call it: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:424: J4	internal/host/recoveryrefusals.go	rootRestartChecks.copyRecoveryHistory	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	validRootRestart	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.floorAllowsForward	F	linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free forward recovery checks both locally retained protocol release minima
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.Census	D	linux:internal/rootparticipation/production.go:Ledger.ActivationReady	Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.unitBinding	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Reads canonical deployment record, claim, unit file identities and systemd facts without assuming a running PID. Existing running/rollback binding uses the same verifier. Fixtures: TestPlan14SignedNamedRecoveryAuthority and TestPlan14ProofBindingProvenance.
    plan14_input_inventory_test.go:424: J4	internal/release/healthy.go	ReadHealthy	B+B4	linux:internal/host/proofbinding.go:productionProofBindingSource	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrecovery_rebind.go	ClaimRootHTTP.serveRecoveryRebind	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP	root installation and fence authority; recovery rebind and timer identity
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	type generationInventory	E2	linux:internal/host/rootgeneration_inventory.go:productionLocalGenerationInventory	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/file_linux.go	OpenTrustedFile	A+B3	linux:internal/host/rootgenerations_launch.go:productionRootGenerations	kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
    plan14_input_inventory_test.go:424: J4	internal/hostguard/writerstop.go	RecoveryWriterStop	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.beginExecutionRecoveryFence	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers.go	ClaimStopCoordinator.WritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopHTTP.serveWritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootinventory_settle.go	Guard.SettleRootInventory	E2	linux:internal/host/rootinventory_timer_recovery.go:ClaimRootHTTP.settleTimerInventory	PROPOSED E46: exact persisted root pending intent only; finish journal after effect matches, preserve denial, no new SQL effect or network claim authority. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/registry/importjournal.go	Registry.ImportJournalHosts	G	linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote	rev3=census-ruling-seeded-instances;basis=its SQLite arm as carlos, in the agent or the registry child (carlos __registry-child); its remote arm in whichever process holds a remote handle, and a root pass does. No caller in the tree yet, outside the child's dispatch: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.capLegacy	F	linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound	rev3=PROPOSED-p3;identity=root normal adopt/apply refresh and local seeds-bound readers in apply/recover/guard, uid 0;basis=caps service-written protocol and release minima by highest root-observed healthy build; absent observation supplies no bound
    plan14_input_inventory_test.go:424: J4	internal/activator/workerswap.go	Service.ReplaceWorker	E2	linux:internal/rollout/worker.go:scheduler.executeWorker	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_containment.go	validateClaimJournalContainment	C+G	linux:internal/host/claimjournal_transport.go:ClaimRootHTTP.serveJournal	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/proofpolicy.go	LoadProofPolicy	B3	linux:internal/host/proofask.go:mintAsker.tick	root-input;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/sweep.go	SweepStaged	E2	linux:internal/host/versionsweep.go:sweepStagedVersions	root-input
    plan14_input_inventory_test.go:424: J4	internal/activator/workerbuild.go	Service.startWorker	E2	linux:internal/activator/activator.go:Service.doWake	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journaltrust_linux.go	readTrustedJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Recover	root-input
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	validRequest	E1	linux:internal/historyreadback/workflow.go:Operation.checked	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/migration_census_linux.go	CheckMigrationRoots	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=offline scan requires every managed payload to match independent retained inode/type inventory or explicit shared path rules
    plan14_input_inventory_test.go:424: J4	internal/console/apirestartscope.go	routeWithHost	E1+E3	linux:internal/console/apirestartscope.go:resolveRestartScope	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop.go	ClaimStopCoordinator.witnessNoProcess	C+G	linux:internal/host/claimstop.go:ClaimStopCoordinator.FenceAndStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/rootstate/live.go	LiveHeld	A+D	linux:internal/hostexec/rootread.go:ReadRoot	fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.selector	F	linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection	rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	withEffectiveMovesFloorLock	F	linux:internal/host/systemapply.go:systemApplier.activationGuard	rev3=PROPOSED-p3;identity=carlos system apply/recover final activation, uid 0;basis=locks moves then seeds private root stores across final activation; no census uses unchanged legacy lock
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_writers_linux.go	LinuxStopKernel.VerifyNoProcess	C+G	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_runtime.go	var openClaimExecutionAuthority	D	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	Instance-control owns broker, checked store, monitor and bounded cleanup lifetime.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	type generationLaunchPermit	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_source.go	readRootLegacyProtocolJSON	F	linux:internal/host/rootmovesfloor_source.go:rootProtocolLegacy	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration.go	rootMigrationSnapshot.preflight	G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationState	rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refuses active moves, unfinished seeds, incomplete inventories or mismatched migration identity before effects
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_containment_linux.go	inspectClaimContainment	C+G	linux:internal/host/claimjournal_containment_linux.go:var claimContainmentInspect	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	runAdoptWithEnsureSystemUnits	B3+C+D+E1+E2+E3+E4+F	linux:internal/host/agent.go:runAdopt	PROPOSED E45 / R-E45-3: root checks census presence before opening release exclusion; absent census uses main adoption with no release directory or lock. Retained census remains protected with either flag value. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_run.go	RunInstanceControl	C+D+G	linux:main.go:main	Refuse premature claim activation and continue serving recovery after per-host startup failures. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/claimparticipation.go	productionClaimLocal.Prepare	D	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	layoutReversalIncomplete	F	linux:internal/host/systemapply.go:systemApplier.layoutReversalReasons	route-and-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/restore.go	syncDir	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/shared_linux.go	ensurePublicChild	A+B4	linux:internal/rootstate/shared_linux.go:EnsurePublicDir	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:424: J4	internal/registry/registry.go	routeArgs	E3	linux:internal/registry/registry.go:Registry.Upsert	rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever a route is inserted: Upsert, the cold handover restore and the import journal's inserts: the bind list from Registry.Upsert's body (and RestoreClaimRows'), with seed_source and import_gate added; E3, the same family as Registry.Upsert, whose body it came from
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration.go	rootMigration.run	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=offline guarded migration reobserves changed claims, retains union of session tuples, publishes only durable completion and verifies completed replay without rewriting census
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/controllers_linux.go	EnsureControllerDir	F	linux:internal/host/guardarm.go:guardArmControllers	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.CaptureInventory	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.RegisterLanding	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	RootHistory.RecoveryRetired	E1	linux:internal/host/recoveryrefusals.go:checkUnresolvedRecoveries	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	validScope	E1	linux:internal/historyreadback/readback.go:enrolled	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests_source.go	rootRestartRequestSource.target	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	proof_cli.go	runProof	E1	linux:main.go:main	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction.go	ProductionClaimOwnerProvider.OpenClaimOwners	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	Production owner factory wires bounded C8 and relocation providers and closes partial construction on error.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchjournal.go	LaunchJournal.Prelaunch	C	linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Prelaunch	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_startup.go	verifyRootMigrationState	F+G	linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=binds complete root census and durable complete migration record to deployment box enrollment and migration generation
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	proofBindingSource.rollback	B3	linux:internal/host/rootrestart.go:productionRootRestartChecks	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/hostbox/wakepolicy.go	Policy.check	C	linux:internal/hostbox/wakepolicy.go:Policy.Check	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	type GenerationOwner	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-system-update.service	external	F	linux:internal/host/bootstrap.go:var unitsFS	rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
    plan14_input_inventory_test.go:424: J4	internal/hostbox/launchhosts.go	LaunchJournal.HostLaunches	C	linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/inventory_registration.go	ReconcileAdapter.registerRemote	C	linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootmigration.go	migrationDenied	C+G	linux:internal/hostguard/rootmigration.go:RootAuthority.CompleteMigrationInventory	rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_proof.go	legacyJournalProof	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/relocationinstall.go	ClaimAssembly.relocationBuildAuthority	C+D	linux:internal/host/relocationbuild.go:ClaimAssembly.relocationBuild	Relocation build revalidates operation, captured install stamp, prepared pin and execution participation before writes.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart.go	rootRestartChecks.live	B3+E1	linux:internal/host/roothistory_recovery.go:linkRootHistory	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	stageFrom	E2	linux:internal/release/adopt.go:ensureStagedDigest	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_observations.go	claimUnitStopKernel.VerifyWritersStopped	C+G	linux:internal/host/claimstop_writers.go:ClaimStopCoordinator.WritersStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/coldhandover.go	ColdHandover.Recover	C	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	A provably superseded cold admission can abandon its barrier without discarding its receipt.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	type InstallationArtifacts	E2	linux:internal/hostguard/root.go:type RootInstallation	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/claimowners.go	ClaimOwnerDispatch.Select	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	RouteAccount	B3+E3+E4	linux:cli.go:runRoute	root-route;kept=B3,E3,E4;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory.go	ClaimRootHTTP.withRootInventoryHistory	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/root.go	Guard.AbandonRootInventory	C	linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory	Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/authorityfile_linux.go	openAuthorityFile	E2	linux:internal/rootstate/authorityfile_linux.go:OpenAuthorityFile	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit.go	readClaimUnitSettings	C+G	linux:internal/host/bootstrap.go:bootstrapWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.activationRule	F	linux:internal/host/systemapply.go:systemApplier.activationAllowed	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=preliminary activation refuses against both local protocol bounds before existing hold checks
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	retirementEvidence	E1	linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/claimmoveaccess.go	claimMoveReadAccess.Launch	C+G	linux:internal/host/moveswakesource.go:movesReadLaunch	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/local_unix.go	tryAcquireNamed	D	linux:internal/hostexec/local_unix.go:tryAcquire	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/fence.go	StopAuthorityMatches	C	linux:internal/host/claimwakestop.go:ClaimAssembly.collectCapturedStop	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	backfillManifestDigest	E2	linux:internal/release/adopt.go:adoptHost	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/host/claimcensus.go	claimUnitCensus	C+G	linux:internal/host/claimcensus.go:claimGlobalSharedPaths	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/healthy_root.go	addRootHealthy	B+B4	linux:internal/release/healthy_root.go:recordRootHealthy	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/empty_census.go	EmptyInstallationCensus.checkLocal	C+G	linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckLocal	Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery.
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	systemdUnits.Show	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/work.go	WorkSource.Select	C	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	RootGenerations.Started	E2	linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.started	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.wakeTarget	E3	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	scanStopDescriptors	C+G	linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	type passConfig	E2	linux:internal/release/adopt.go:BakeDir	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/rootmigration.go	migrationAdmissionDenied	G	linux:internal/hostguard/root.go:Guard.CommitRootInventoryArtifacts	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RestartTarget	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests.go	rootRestartRequests.run	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_requirements.go	generationLocalObligations	E2	linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_production_linux.go	migrateRootClaimAuthority	G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration adopts pre-claim timers only after verified root stop evidence; resumes its exact saved intention under release and migration exclusion, rechecking kernel absence before completion
    plan14_input_inventory_test.go:424: J4	internal/host/claimconstruction.go	claimConstructionProcessStart	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/buildstate.go	BuildStateCopy.Read	E3	linux:internal/release/heldwake.go:DecideHeldWake	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests.go	restartRequestPass	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/transaction.go	Ledger.lockTransaction	D+F	linux:internal/rootparticipation/ledger.go:Ledger.Acquire	rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=reuses transaction exclusion only for the identical root store; foreign stores refuse
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	settingsTarget	E3	linux:internal/release/adopt.go:adoptHost	Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant.
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	ReadStatus	E1	linux:internal/historyreadback/workflow.go:Operation.Read	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_production.go	claimLaunchFor	D	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	Production root runtime receives the unit-aware kernel wrapper before startup recovery.
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_client.go	productionClaimLocal.prepareWith	D	linux:internal/host/claimparticipation.go:productionClaimLocal.Prepare	Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority.
    plan14_input_inventory_test.go:424: J4	internal/provision/rootrecord.go	IndexRecords	B3+C	linux:internal/provision/rootrecord.go:FindRecordByHost	Discover hosts once, reject duplicate keys, and classify partial discovery as retry rather than permission refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_readback.go	type historyReadbackPublisher	E1	linux:internal/host/roothistory_readback.go:publishRootHistoryReadback	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.Begin	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	StagedPaths.addReal	E2	linux:internal/release/pins.go:BoxPins	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	heldShape	C+E1	linux:internal/release/materializeheld.go:VerifyHeldLive	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_retirement.go	RootHistory.RetireRecovery	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/activator/activator.go	Service.respawnWorkerLocked	E2	linux:internal/activator/activator.go:Service.convergeWorkerLocked	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/floor.go	Read	F	linux:internal/host/hostfencepass.go:hostFenceOnce	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/proofnamed.go	proofBindingSource.record	B3	linux:internal/host/rootroute.go:proofBindingSource.needsRestart	Record key selection uses indexed discovery; local root-managed unit authority is unchanged.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	JournalService.executeWithInventory	C	linux:internal/hostbox/journalservice.go:JournalService.ExecuteRootInventory	Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	RootGenerations.Retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_timers.go	type rootMigrationTimerRecord	G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=retains original stopped inventory, exact observed timer contents and registrations, successor inventory and root revision through interrupted migration
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Install	C	linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Configure	Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_payload_other.go	generationPayloadFiles	E2	darwin:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_production.go	NewProductionClaimStopHandler	C+G	linux:internal/host/claimassembly.go:NewProductionRootClaimStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.retry	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Bound transport retries by original monotonic slack and context; never extend a permit.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RestartIntent	E1	linux:internal/host/rootrestart_requests.go:rootRestartRequests.run	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/console/apirestartscope.go	resolveRestartScope	E1+E3	linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationLinkRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalnamespace_linux.go	prepareJournalDirectory	C+G	linux:internal/hostbox/journalnamespace_linux.go:PrepareRootJournalDirectory	rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains
    plan14_input_inventory_test.go:424: J4	internal/host/rootinventory_install.go	ClaimRootHTTP.rootLandingRoute	C+E3	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	Root derives flat landing row and settings from authoritative record and app policy after target/phase binding.
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_healthy.go	rootMovesFloors.healthy	F	linux:internal/host/rootfloor_healthy.go:rootMovesFloors.capLegacy	rev3=PROPOSED-p3;identity=root health acceptance, normal floor refresh and local seeds-bound readers, uid 0;basis=reads bounded private root health record; missing or malformed record supplies no legacy cap
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootserving.go	RootBroker.servingView	D	linux:internal/hostexec/rootbroker.go:RootBroker.Execute	Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect.
    plan14_input_inventory_test.go:424: J4	internal/release/bake.go	LoadFirstSeenMigrating	E1+E3	linux:internal/release/adopt.go:PassFilter	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration_linux.go	createClaimEdgeMask	C+G	linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	RootHistoryPass.selectRoute	E1	linux:internal/release/adopt.go:PassFilter	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/proofnamed.go	proofExecPath	B3	linux:internal/host/proofobserve.go:proofObserver.observe	fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
    plan14_input_inventory_test.go:424: J4	internal/host/rootlaunchverifier.go	rootLaunchVerifier.verify	E2	linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/rootrollback.go	loadRollback	B3+E1	linux:internal/host/rootrestart.go:rollbackUnitRestart	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop_kernel_linux.go	verifyStopKernelMounts	C+G	linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.retryHost	E1+E3	linux:internal/host/rolloutdeclined.go:rolloutRetryHost	fix1-merge-review;basis=Refuses retry while a failure-book save is owed; verifies the signed current book/epoch grant before clearing.
    plan14_input_inventory_test.go:424: J4	internal/host/claimcleanup_identity.go	verifyClaimCleanupEnrollment	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/hold.go	RegistryHoldPolicy	C	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootrollback.go	readRollbackAttempt	B3	linux:internal/host/rootrollback.go:rootRestartChecks.finish	canonical record/unit/executable authority and one-attempt rollback; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationPayloadBindings	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakeassembly.go	claimSocketReady	C+G	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/agent.go	agentRollbackUnitRestart	B3	linux:internal/host/agent.go:adoptLoop	kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
    plan14_input_inventory_test.go:424: J4	internal/host/rootrestart_requests.go	productionRestartRequestPass	E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
    plan14_input_inventory_test.go:424: J4	internal/host/relocationreleases.go	ReleaseObligation.Complete	C	linux:internal/host/relocationeffects.go:RelocationEffects.Release	Release obligation completion reads fresh claim before verifying and recording root stop receipt.
    plan14_input_inventory_test.go:424: J4	history_cli.go	historyReadFile	E1	linux:history_cli.go:historyCommandWithSave	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction.go	claimServingLaunchSource	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.verifyPointer	F	linux:internal/host/systemapply.go:systemApplier.Run	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists
    plan14_input_inventory_test.go:424: J4	internal/activator/containment.go	ExecBackend.spawnInCgroupAtTier	E2	linux:internal/activator/backend_exec.go:ExecBackend.seedChild	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:424: J4	internal/host/claimretire_transport.go	ClaimRootHTTP.retire	C+G	linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending	PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete.
    plan14_input_inventory_test.go:424: J4	internal/host/systemapply.go	systemApplier.decidePrev	F	linux:internal/host/systemapply.go:systemApplier.install	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationInventoryAt	E2	linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
    plan14_input_inventory_test.go:424: J4	internal/host/guardexec.go	recoverLockHeld	F	linux:internal/host/guardexec.go:RunSystemGuardExec	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalservice.go	NewJournalService	C	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_crossbox.go	relocationBefore	C	linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission	Before-admission dispatch binds relocation executor and probe phase before typed handover.
    plan14_input_inventory_test.go:424: J4	internal/rootstate/shared_linux.go	EnsurePublicDir	A+B4	linux:internal/host/rootrestart.go:productionRootRestartChecks	fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
    plan14_input_inventory_test.go:424: J4	internal/host/buildstate.go	buildStates.write	E3	linux:internal/host/buildstate.go:buildStates.beforeExec	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/seedsfloor.go	readLocalSeedsFloor	F	linux:internal/host/seedsfloor.go:withSeedsFields	rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root); also the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), for its hourly refresh and its edges file: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	passConfig.bindProof	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/host/proofroot.go	proofRoot.mintAndLog	E1	linux:internal/host/proofroot.go:proofRoot.around	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
    plan14_input_inventory_test.go:424: J4	internal/release/proofgate.go	ProofGate.admit	B3	linux:internal/release/adopt.go:adoptHost	root-route;kept=B3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_recovery.go	resumeHistoryRestart	B3+E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/retention.go	buildStatePins	E2	linux:internal/host/agent.go:runAgent	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/sweep.go	LivePins	B3+E2	linux:internal/host/versionsweep.go:sweepStagedVersions	Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping.
    plan14_input_inventory_test.go:424: J4	internal/host/movespass.go	movesWorker.hostBlocked	C	linux:internal/host/movesfinal.go:movesWorker.sweepFinalJournals	root-input;kept=C;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostbox/reconcile.go	Reconciler.holdOnly	C	linux:internal/hostbox/reconcile.go:Reconciler.installWithWork	Hold-only write rechecks claim, record and source inventory under local lock without root RPC there.
    plan14_input_inventory_test.go:424: J4	internal/host/recoveryrefusals.go	checkUnresolvedRecoveries	E1	linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationRetainedFiles	E2	linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	materializeHeldChecked	E2	linux:internal/release/materializeheld.go:serveHeldStageRequest	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:424: J4	internal/hostops/move_fence_release.go	MoveRecoveryGrant.ReleaseFencedTarget	C+D	linux:internal/console/movesrecovery.go:Server.movesRecovery	Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation.
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	rootRestartKey	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerationpins.go	generationPinSource.StagedPins	E2	linux:internal/release/adopt.go:PassFilter	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/host/rootfloor_available.go	rootFloorAvailable	F	linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary	rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available
    plan14_input_inventory_test.go:424: J4	internal/host/claimroleassembly_other.go	ClaimRoleAssembly.PrepareState	C+G	darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	root-route;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/guardtransaction.go	installFloorHook	D	linux:internal/host/systemapply.go:RunSystemApply	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:424: J4	internal/host/seedsfloor.go	rootJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=census-ruling-seeded-instances;basis=the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root): seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
    plan14_input_inventory_test.go:424: J4	internal/release/signedhead.go	StageSignedHead	E1	linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover	Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	rootFloorAllowsPrevIdentity	F	linux:internal/host/rootmovesfloor_boot.go:rootFloorAllowsPrev	rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=checks local signed prev and independent moves/seeds bounds using root census identity; no remote reads
    plan14_input_inventory_test.go:424: J4	internal/host/systemunits.go	ensureSystemUnits	F	linux:internal/host/agent.go:runAdopt	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	nextGenerationsSeq	E2	linux:internal/release/pins.go:WriteGenerations	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.Sync	A+F+G	linux:internal/rootstate/state.go:Sync	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/ledger.go	Ledger.Idle	D+F	linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle	rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=checks settled execution and local launch completeness under participation; nested activation uses only its already-held store
    plan14_input_inventory_test.go:424: J4	internal/release/healthy_root.go	readRootHealthy	B+B4	linux:internal/release/healthy.go:ReadHealthy	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_reconstruct.go	RootHistory.Reconstruct	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	routeReady	B3	linux:internal/host/agent.go:agentCheckedUnitRestart	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_read.go	productionClaimLocal.checkRootParticipation	D	linux:internal/host/rootexecution_client.go:productionClaimLocal.Check	Root observer binds participation to enrolled actor; TestPlan14ExecutionRootLocalIgnoresAgentAbsence.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.boot	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	cycleWorkers	E1+E3	linux:internal/host/restart.go:restartRequestLeg	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostbox/restore.go	loadPinned	C	linux:internal/hostbox/restore.go:ColdRestore.Install	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_boot.go	withRootFloorGuardCandidate	F	linux:internal/host/guardexec.go:RunSystemGuardExec	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=release then previous-binary exclusion; participation check precedes moves and seeds locks; certified current remains executor fallback
    plan14_input_inventory_test.go:424: J4	internal/host/claimretire_local.go	claimArtifactRetirement.Recover	C+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootexecution_recovery.go	recoverRootExecution	D	linux:internal/host/guardtransaction.go:var recoverPendingControllers	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_outcomes.go	RootHistory.RetainRecovery	E1	linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_status.go	RootHistory.ProjectMigrationStatus	E1	linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/guardexec.go	RunSystemGuardExec	F	linux:system.go:runSystem	rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover root units uid 0; edge unit uid carlos; console unit uid carlos-console;basis=root apply/recover selects signed image from local bound; non-root edge bypasses private floor entirely
    plan14_input_inventory_test.go:424: J4	internal/host/legacyrestart.go	rootRestartChecks.allowLegacy	B3+G	linux:internal/host/agent.go:runAdoptUnderRootRelease	rev3=merge-ruling-4;basis=Evaluate the explicit census selector; omitted test selector remains strict.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationPathRef	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationLinkRef	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/proofobserve.go	productionProofObserver	B3+B4	linux:internal/host/agent.go:runAdoptUnderRootRelease	Reuse per-pass record discovery; continue independent observation and root health writes.
    plan14_input_inventory_test.go:424: J4	internal/host/proofbinding.go	productionProofBindingSource	B3	linux:internal/host/namedrecovery.go:productionNamedUnitRecovery	Root-owned current and previous pointers replace health history as executable authority; cache only record discovery.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_creation.go	RootHistory.RecordCreation	E1	linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationKernel.absent	E2	linux:internal/host/rootgeneration_census_linux.go:generationKernel.census	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.reconstruct	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires private root-issued box/generation/nonce token and refuses weakening; no production caller installed
    plan14_input_inventory_test.go:424: J4	internal/host/claimhandover_recovery.go	claimCrossBoxHandover.recoveryEvidence	C+G	linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_inventory.go	generationInstallation	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
    plan14_input_inventory_test.go:424: J4	internal/hostexec/local_unix.go	openDir	D	linux:internal/hostexec/local_unix.go:openLocal	root-input
    plan14_input_inventory_test.go:424: J4	internal/provision/reconcile.go	RouteFor	C+E3	linux:internal/provision/reconcile.go:Reconcile	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos); also root, in the claim root's landing registration (ClaimRootHTTP.rootLandingRoute) and the relocation install (relocationRecord): main's body with one more field: the row's seed column, derived from the record's seed (SeedColumn). Every caller gets it, the two root ones included, so a root-registered row for a seeded record now carries the seed the activator places from; main's C,E3 authority retained
    plan14_input_inventory_test.go:424: J4	internal/host/legacyrestart.go	legacyRootRestart	B3+G	linux:internal/host/roothistory_creation.go:productionCreationHistory	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	generationNames	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/hostguard/record_unix.go	recordDir.writeUsing	C	linux:internal/hostguard/record_unix.go:recordDir.write	root-input
    plan14_input_inventory_test.go:424: J4	internal/rootstate/state_linux.go	directory.Remove	A+B3	linux:internal/host/rootrollback.go:captureRollback	descriptor-checked root rollback capability identity/removal
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_creation.go	rootRestartRequestSource.creation	E1	linux:internal/host/roothistory_creation.go:rootHistoryCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/relocatepass.go	NewRelocationRuntime	C+D	linux:internal/host/relocatepass.go:startRelocationPass	Relocation runtime binds verified enrollment, source, participant and typed stop/fence providers; generic placement stays legacy.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_creation.go	RootHistory.ConsumeCreation	E1	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.start	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	rootSeedsAllowsBinary	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=compares signed seeds protocol to published root bound only while a certified current, prev or staged candidate meets it; no remote reads
    plan14_input_inventory_test.go:424: J4	internal/host/rolloutdeclined.go	failureHolds.refusal	E1+E3	linux:internal/host/rolloutdeclined.go:failureHolds.gate	root-route
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	type RootRestarts	E1	linux:internal/host/rootrestart_requests.go:productionRestartRequestPass	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_creation.go	RootHistory.FreshInstallation	E1	linux:internal/host/rootgeneration_requirements.go:productionGenerationCreation	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration_linux.go	quiesceLegacyClaimJournals	C+G	linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/restart.go	restartSeed	E1+E3	linux:internal/host/agent.go:fastConvergeLoop	fix1-merge-review;basis=Baselines both request logs without applying historical ordinary restarts; signed retry grants remain independently verified.
    plan14_input_inventory_test.go:424: J4	internal/release/adopt.go	CapabilityRoute	E4	linux:internal/host/adopt_advice.go:adviseHostRoleGateMissing	root-route;kept=E4;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	BuildStateKept	E2	linux:internal/release/pins.go:SettingsRefs	root-route
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	requireReceiptOfInstallation	C	linux:internal/hostclaim/relocation.go:RecordLocalInstall	Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/journalmigration_linux.go	legacyJournalFiles	C	linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/store.go	Read	C+D+G	linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease	root-input;kept=C,D,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/historyreadback/readback.go	ResponseKey	E1	linux:internal/historyreadback/readback.go:ReadStatus	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_root.go	ClaimLaunchRoot.startRecorded	E1+E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.start	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	const rootGenerationCompletenessLimit	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	generationRetirement.retire	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retireAll	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
    plan14_input_inventory_test.go:424: J4	internal/release/consumedfence.go	publishGate	E3	linux:internal/release/consumedfence.go:publishConsumed	root-route;kept=E3;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_startup.go	verifyRootMigrationRetained	F+G	linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory
    plan14_input_inventory_test.go:424: J4	internal/release/rootrestart_history.go	RootRestarts.read	E1	linux:internal/release/rootrestart_history.go:RootRestarts.Bindings	E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_kernel_linux.go	type generationMount	E2	linux:internal/host/rootgeneration_kernel_linux.go:generationMounts	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	StageHeldVerifiedWithPins	E2	linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.stageRelease	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/release/releaseexclusion.go	type ReleaseExclusion	E2	linux:internal/host/rootlaunchverifier.go:type rootLaunchVerifier	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_retirement.go	generationRetirement.verify	E2	linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_recovery.go	linkRootHistory	B3+E1	linux:internal/host/agent.go:runAdoptUnderRootRelease	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
    plan14_input_inventory_test.go:424: J4	internal/hostbox/wakepolicy.go	WakePhase	C	linux:internal/hostbox/wakepolicy.go:Policy.check	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostexec/rootbroker.go	RootBroker.deny	D	linux:internal/hostexec/rootbroker.go:RootBroker.Close	D2 compares the current root token before durable loss and live-lock revocation; cleanup is bounded independently of request cancellation.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_creation.go	productionCreationHistory	E1	linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
    plan14_input_inventory_test.go:424: J4	internal/activator/containment.go	ExecBackend.startRole	E2	linux:internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
    plan14_input_inventory_test.go:424: J4	internal/release/claim_identity.go	CheckRouteReleaseIdentity	C+E1	linux:internal/host/claimproduction.go:claimInputPolicy	root-route;kept=C,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimstop.go	ClaimStopCoordinator.FenceAndStop	C+G	linux:internal/host/claimstop_transport.go:ClaimStopHTTP.ServeHTTP	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	Guard.With	C	linux:internal/hostbox/work.go:selectedWork.With	Recheck remote root denial immediately before the protected effect.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_reconstruct.go	RootHistory.resumeReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
    plan14_input_inventory_test.go:424: J4	internal/host/claimproduction_linux.go	readClaimEvidenceKey	C+G	linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	rootRefreshAndJudgeSeedsPrev	F	linux:internal/host/movesfloor.go:rootJudgePrevWithSource	rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path
    plan14_input_inventory_test.go:424: J4	internal/caps/converge.go	Ops.systemctl	E4	linux:internal/caps/converge.go:Converge	root-input
    plan14_input_inventory_test.go:424: J4	internal/host/units/carlos-stage.service	external	B3+C+D+E1	linux:internal/host/bootstrap.go:var unitsFS	root-input;kept=B3,C,D,E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostexec/participation.go	PreinstallationParticipant	D	linux:internal/host/rootexecution_authority.go:ClaimRootHTTP.executionAuthority	D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmigration_startup.go	verifyRootMigrationStartup	F+G	linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks root-owned migration records and typed journal revisions before issuing startup grants; absent census leaves main path intact
    plan14_input_inventory_test.go:424: J4	internal/hostbox/coldhandover.go	writeColdJournal	C	linux:internal/hostbox/coldhandover.go:ColdHandover.Run	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	type GenerationProcess	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
    plan14_input_inventory_test.go:424: J4	internal/host/claimwakestop.go	ClaimAssembly.collectCapturedStop	C+G	linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	GenerationEvidence.valid	E2	linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgeneration_containment_linux.go	generationKernel.containedBinding	E2	linux:internal/host/rootgeneration_containment_linux.go:generationKernel.containedTask	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/host/claimunit_binding.go	claimUnitBindings.read	E2	linux:internal/host/claimunit_placement.go:ClaimLaunchRoot.checkUnitBinding	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	fenceTargetStuck	C	linux:internal/hostclaim/relocation.go:FenceExhaustedTarget	Exhausted-target transition verifies fence and revokes only dead target execution, preserving another live source.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_identity.go	rememberRootFloorSystemIdentity	F	linux:internal/host/systemapply.go:systemApplier.verifyPointer	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=re-fetches and verifies signed pointer equality before retaining its executable identity
    plan14_input_inventory_test.go:424: J4	internal/host/guardroster.go	readGuardRoster	F	linux:internal/host/guardarm.go:RunSystemGuardArm	root-input;kept=F;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_pass.go	RootHistoryPass.complete	E1	linux:internal/release/adopt.go:adoptHost	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerationcompleteness.go	type GenerationEvidence	E2	linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
    plan14_input_inventory_test.go:424: J4	internal/activator/rolelaunch_root_linux.go	RoleLaunch.startIsolated	C	linux:internal/activator/rolelaunch_linux.go:RoleLaunch.Start	root installation and fence authority; registration and recovery; agent RPC lock ordering
    plan14_input_inventory_test.go:424: J4	internal/rootstate/live_linux.go	directory.LiveHeld	A+D	linux:internal/rootstate/live.go:LiveHeld	fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor.go	rootMovesFloors.localBound	F	linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate	rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance
    plan14_input_inventory_test.go:424: J4	internal/registry/remote.go	serveRemote	E2	linux:internal/registry/remote.go:ServeRemote	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
    plan14_input_inventory_test.go:424: J4	internal/safefile/file_linux.go	writeAt	A+F+G	linux:internal/safefile/file_linux.go:Write	rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	StageHeldVerified	C+E1+E2	linux:internal/host/movesstage.go:var heldStageVerified	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
    plan14_input_inventory_test.go:424: J4	internal/hostops/completion_fence.go	ProductionAuthority.completionFence	C	linux:internal/hostops/production_held_start.go:ProductionAuthority.startAppLifecycle	Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion.
    plan14_input_inventory_test.go:424: J4	internal/release/pins.go	BoxPins	E2	linux:internal/release/adopt.go:PassFilter	route-and-input
    plan14_input_inventory_test.go:424: J4	internal/host/movesfinal.go	sourceFinal.parkLocal	C	linux:internal/host/movesfinal.go:sourceFinal.run	root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
    plan14_input_inventory_test.go:424: J4	internal/host/legacyrestart.go	rootRestartChecks.noteLegacy	B3	linux:internal/host/rootrestart.go:rollbackUnitRestart	rev3=merge-ruling-4;basis=Log the no-census legacy restart once through the pass-shared diagnostic latch.
    plan14_input_inventory_test.go:424: J4	internal/host/roothistory_creation.go	rootHistoryCreation	E1	linux:internal/host/roothistory.go:openRootHistory	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
    plan14_input_inventory_test.go:424: J4	internal/release/rootgenerations.go	validGeneration	E2	linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	ReplaceTarget	C	linux:internal/hostrelocate/worker.go:Worker.replace	Replacement verifies target termination fence and allocates a new install stamp, preserving unopened prepared build reuse.
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	ToProbing	C	linux:internal/hostrelocate/participant.go:Participant.Step	Probe transition requires exact local-install receipt at target enrollment and install stamp before admission.
    plan14_input_inventory_test.go:424: J4	internal/release/materializeheld.go	VerifyHeldLiveUnder	C+E1	linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall	Under-lock held verification enforces claim-aware shape and delegates root proof validation.
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_replace.go	replacementReconstruction	E1	linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/rootgenerations_launch.go	generationLaunchPermit.check	E2	linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	readEffectiveSeedsFloor	F	linux:internal/host/rootseedsfloor.go:systemApplier.seedsActivationRefusal	rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census selects verified signed publication plus capped retained deny; unpublished seeds impose no bound; no census retains legacy reader
    plan14_input_inventory_test.go:424: J4	internal/rootparticipation/transaction.go	type heldTransaction	D+F	linux:internal/rootparticipation/transaction.go:TransactionLedger	rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=binds transaction reuse to a root-opened ledger and live callback lifetime
    plan14_input_inventory_test.go:424: J4	internal/host/rootmovesfloor_authorization.go	rootMovesFloors.authorizedReconstruction	F		rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize
    plan14_input_inventory_test.go:424: J4	internal/host/claimjournal_migration_linux.go	var claimSystemctl	C+G	linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/host/claimmovefence.go	claimBoxFenceVerifier	C+G	linux:internal/host/claimassembly.go:ClaimAssembly.Build	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/updatetarget.go	Target	E3	linux:internal/release/adopt.go:settingsTarget	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostguard/guard.go	Guard.Activate	C	linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build	Pending intent and durable quarantine remain denial conditions.
    plan14_input_inventory_test.go:424: J4	internal/host/claimconstruction.go	OpenProductionClaimAssembly	G	linux:internal/host/claimconstruction.go:ensureProductionClaimAssembly	rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path
    plan14_input_inventory_test.go:424: J4	internal/host/restartscope.go	restartScopeLeg	E1+E3	linux:internal/host/restart.go:restartPass	root-route
    plan14_input_inventory_test.go:424: J4	internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.tenant	C+G	linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe	root-input;kept=C,G;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/release/ratchet.go	DigestRatchet.note	E1	linux:internal/release/ratchet.go:DigestRatchet.Admit	root-input;kept=E1;scope=protected-decision-only
    plan14_input_inventory_test.go:424: J4	internal/hostclaim/relocation.go	CompleteRelocation	C	linux:internal/hostrelocate/worker.go:Worker.Step	Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement.
    plan14_input_inventory_test.go:424: J4	internal/host/unitsettle.go	systemdUnits.Exe	B3	linux:internal/host/unitsettle.go:settleUnit	root-input
    plan14_input_inventory_test.go:424: J4	internal/hostfloor/disk.go	UpdateIdle	F	linux:internal/host/claimreport.go:claimReport	root-input
    plan14_input_inventory_test.go:424: J4	internal/release/roothistory_reconstruct.go	RootHistory.ReconstructionStatus	E1	linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
    plan14_input_inventory_test.go:424: J4	internal/host/heldstage.go	heldStagePass	E2	linux:internal/host/agent.go:runAdoptUnderRootRelease	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
    plan14_input_inventory_test.go:424: J4	internal/host/rootseedsfloor.go	systemApplier.rootProtocolAllowsBinary	F	linux:internal/host/systemapply.go:systemApplier.install	rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held
    plan14_input_inventory_test.go:431: family E3 missing erasure fixture 
    plan14_input_inventory_test.go:431: family E3 missing hostile fixture 
    plan14_input_inventory_test.go:431: family E3 missing positive fixture 
    plan14_input_inventory_test.go:431: family E3 missing rename fixture 
    plan14_input_inventory_test.go:431: family E3 missing retry fixture 
    plan14_input_inventory_test.go:431: family E4 missing erasure fixture 
    plan14_input_inventory_test.go:431: family E4 missing hostile fixture 
    plan14_input_inventory_test.go:431: family E4 missing positive fixture 
    plan14_input_inventory_test.go:431: family E4 missing rename fixture 
    plan14_input_inventory_test.go:431: family E4 missing retry fixture 
    plan14_input_inventory_test.go:435: authority coverage: 16486 reachable declarations; 540 failures
2026/10/15 21:43:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:39 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:39 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/15 21:43:40 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/15 21:43:40 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/15 21:43:40 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io hibernate false -> true
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged acme.go.tito.io status-named false -> true
2026/10/15 21:43:40 provision: converged acme.go.tito.io status-named true -> false
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 21:43:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 21:43:40 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 21:43:40 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 21:43:40 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/15 21:43:40 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/15 21:43:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 21:43:40 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 21:43:40 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 21:43:40 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:40 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 21:43:40 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/15 21:43:40 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/15 21:43:40 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 21:43:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 21:43:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 21:43:40 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/15 21:43:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 21:43:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 21:43:40 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 21:43:40 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 21:43:40 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 21:43:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 21:43:40 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 21:43:40 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/15 21:43:40 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 21:43:40 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/15 21:43:40 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 21:43:40 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 21:43:40 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/15 21:43:40 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/15 21:43:40 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/15 21:43:40 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/15 21:43:40 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/15 21:43:40 provision: dry-run: would converge owned.go.tito.io seed
2026/10/15 21:43:40 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/15 21:43:40 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 21:43:40 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/15 21:43:40 provision: converged owned.go.tito.io channel stable -> edge
2026/10/15 21:43:40 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/15 21:43:40 provision: converged owned.go.tito.io hibernate false -> true
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/15 21:43:40 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/15 21:43:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: removed retired static route site.go.tito.io (record gone)
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:40 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/15 21:43:41 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/15 21:43:41 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:41 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 21:43:41 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 21:43:41 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 21:43:41 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 21:43:41 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/15 21:43:41 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 21:43:41 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 21:43:41 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 21:43:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 21:43:41 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/15 21:43:41 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/15 21:43:41 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 21:43:41 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/15 21:43:41 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/15 21:43:41 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 21:43:41 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/15 21:43:41 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 21:43:41 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:41 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/15 21:43:41 provision: a.shop.example.com: swapped for import sd_4rw5j5jincmniwzbhnxxutibju (the original route is journaled)
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_4rw5j5jincmniwzbhnxxutibju committed: its gate is cleared and its journal row dropped
2026/10/15 21:43:41 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_ymlkbgpgnjx7mhvdl3o3oibhiu rolled back to its original route
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_ymlkbgpgnjx7mhvdl3o3oibhiu: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_ymlkbgpgnjx7mhvdl3o3oibhiu is cleaned up and its journal row retired
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_hwweexg5uefvyyhgw7indfhx6y rolled back to its original route
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_hwweexg5uefvyyhgw7indfhx6y: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_hwweexg5uefvyyhgw7indfhx6y is cleaned up and its journal row retired
2026/10/15 21:43:41 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_4aznjnadx3tvyjjsaavuljp5ai
2026/10/15 21:43:41 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/15 21:43:41 provision: dry-run: would converge a.shop.example.com seed source
2026/10/15 21:43:41 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:41 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/15 21:43:41 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/15 21:43:41 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_iwy3m2vallzib43e2qrjggky64 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_4fgfyd2yvugyei5rjocpgw3lw4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_szoqyebl257vdzyo4vgzdnuhsq is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_z3byqpovujwfeaxrhnbl2gn6fa is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_e3idbcu5z3godfxmzabytlyigm is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 21:43:41 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/15 21:43:41 provision: b.shop.example.com: import sd_dzze7arvydqdya43q6ttscgvo4 left alone this pass: the import journal could not be read
2026/10/15 21:43:41 provision: c.shop.example.com: import sd_uordztgj5vjwj7yels4k7eq4fe left alone this pass: the import journal could not be read
2026/10/15 21:43:41 provision: a.shop.example.com: import sd_czeo6i3jrgquioasmthicah4mm committed: its gate is cleared and its journal row dropped
2026/10/15 21:43:41 provision: a.shop.example.com: not converging import sd_5aag6guyl6v322vc7clqhphms4: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 21:43:41 provision: a.shop.example.com: not converging import sd_n4j6dwgkpvyne5flf7x5cale3u: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 21:43:41 provision: a.shop.example.com: not converging import sd_gh7dbgxiuzzrc5gffheme5jwv4: it is placed but not committed, and the row on this box has no import gate
2026/10/15 21:43:41 provision: a.shop.example.com: not converging import sd_n7zsxdlh45moxdk262exgbx5za: it is placed but not committed, and the row on this box has no import gate
2026/10/15 21:43:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:42 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/15 21:43:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_yxb3sjzwe4p5ee7oaxvoemxkim committed: its gate is cleared and its journal row dropped
2026/10/15 21:43:42 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:42 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:42 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/15 21:43:42 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_rjmtwa45eblxtfcic4mf77sqza: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_rjmtwa45eblxtfcic4mf77sqza rolled back (no box had swapped it)
2026/10/15 21:43:42 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/15 21:43:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:42 provision: removed instance route acme.go.tito.io (its seed sd_o3ghjppyvh2rndbd22ejytaojq was aborted); the next pass rolls it back
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_o3ghjppyvh2rndbd22ejytaojq: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_o3ghjppyvh2rndbd22ejytaojq rolled back (no box had swapped it)
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_ejss73b5lpddziifvbwb522ki4 has a row this pass may not remove; leaving the seed aborted
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_yvju54d5s3u3rpq3yylreyjtwe rolled back (no box had swapped it)
2026/10/15 21:43:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:42 provision: removed instance route acme.go.tito.io (its seed sd_ymdids4y45da3hrwlolbc7afiu was aborted); the next pass rolls it back
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_ymdids4y45da3hrwlolbc7afiu has no route on this box: its local data is removed
2026/10/15 21:43:42 provision: acme.go.tito.io: aborted seed sd_ymdids4y45da3hrwlolbc7afiu rolled back (no box had swapped it)
2026/10/15 21:43:42 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_zrg3kqz3mkjl5xfutgnastqahe (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zrg3kqz3mkjl5xfutgnastqahe rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zrg3kqz3mkjl5xfutgnastqahe is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_foqhcnajnt2s6sbjf7yfcfj4b4 (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_foqhcnajnt2s6sbjf7yfcfj4b4 rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_foqhcnajnt2s6sbjf7yfcfj4b4 is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_e66g365toxqutnfxrt2sundhza (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_e66g365toxqutnfxrt2sundhza rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_e66g365toxqutnfxrt2sundhza: the host's replica is left alone: its record no longer names this seed
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_e66g365toxqutnfxrt2sundhza is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_hsrn3snkz5j4kyit2dm4oajrsq (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_hsrn3snkz5j4kyit2dm4oajrsq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_hsrn3snkz5j4kyit2dm4oajrsq rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_hsrn3snkz5j4kyit2dm4oajrsq is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_6lw7xbtjn62kk7s4f7w4nspxte (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_6lw7xbtjn62kk7s4f7w4nspxte rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_bbzhc2o3jlsjczz3iwlx7bgtyy (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_bbzhc2o3jlsjczz3iwlx7bgtyy is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_43fdi54bckucjvc4a4tzpgjjom (the original route is journaled)
2026/10/15 21:43:42 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_43fdi54bckucjvc4a4tzpgjjom left alone this pass: its record could not be read
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_kizlbyz7kl5c3mpb3zon2ej3yq (the original route is journaled)
2026/10/15 21:43:42 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_kizlbyz7kl5c3mpb3zon2ej3yq left alone this pass: its record could not be read
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_2jusycq7fudq7fik4wdykjwdle (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2jusycq7fudq7fik4wdykjwdle: close the import gate: constraint failed: injected (1811)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2jusycq7fudq7fik4wdykjwdle rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2jusycq7fudq7fik4wdykjwdle is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_s3ekmio2mvvn3amnhvmjms76bq (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_s3ekmio2mvvn3amnhvmjms76bq: close the import gate: constraint failed: injected (1811)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_s3ekmio2mvvn3amnhvmjms76bq rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_s3ekmio2mvvn3amnhvmjms76bq is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_2l2r5bon2qnhvv6c7bwtaoo344 (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2l2r5bon2qnhvv6c7bwtaoo344 rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2l2r5bon2qnhvv6c7bwtaoo344 rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2l2r5bon2qnhvv6c7bwtaoo344 is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_zifausq4m4ha7663miq4i45kiq (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zifausq4m4ha7663miq4i45kiq rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zifausq4m4ha7663miq4i45kiq is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_cykyy2rhlpjywh2bmnfhjub6uy (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_cykyy2rhlpjywh2bmnfhjub6uy: retire its instance key: injected failure at retire-key
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_cykyy2rhlpjywh2bmnfhjub6uy rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_cykyy2rhlpjywh2bmnfhjub6uy is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_35xran2dibtu5f4jk3zvc5knpe (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_35xran2dibtu5f4jk3zvc5knpe rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_35xran2dibtu5f4jk3zvc5knpe is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_ir7gbphlgvdijcot4hyhgvjwci (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ir7gbphlgvdijcot4hyhgvjwci: remove its local data: injected failure at remove-local
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ir7gbphlgvdijcot4hyhgvjwci rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ir7gbphlgvdijcot4hyhgvjwci is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_fceldefsiqzk3spgjbzldazoti (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_fceldefsiqzk3spgjbzldazoti rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_fceldefsiqzk3spgjbzldazoti is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_zb4wohdbrt2vcqspxexdgugnrm (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zb4wohdbrt2vcqspxexdgugnrm: remove its local data: injected failure at remove-local-done
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zb4wohdbrt2vcqspxexdgugnrm rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_zb4wohdbrt2vcqspxexdgugnrm is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_bw6hkwvxlv3w5m7z2sizngirnm (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_bw6hkwvxlv3w5m7z2sizngirnm rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_bw6hkwvxlv3w5m7z2sizngirnm is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_u3mvtjr5eu73rfe3qhnh6bypqe (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_u3mvtjr5eu73rfe3qhnh6bypqe: restore the original route: constraint failed: injected (1811)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_u3mvtjr5eu73rfe3qhnh6bypqe rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_u3mvtjr5eu73rfe3qhnh6bypqe is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_ni4t4qwny6cnvdgzzroqinmpkm (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ni4t4qwny6cnvdgzzroqinmpkm: restore the original route: constraint failed: injected (1811)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ni4t4qwny6cnvdgzzroqinmpkm rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ni4t4qwny6cnvdgzzroqinmpkm is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_vuqztn6bhcojx2qkh4gacxjzz4 (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_vuqztn6bhcojx2qkh4gacxjzz4 is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_2tcosoldfr7ssc3w7vzzflogam (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2tcosoldfr7ssc3w7vzzflogam rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2tcosoldfr7ssc3w7vzzflogam: delete its snapshot: injected failure at delete-snapshot
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_2tcosoldfr7ssc3w7vzzflogam is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_mo5fmawq55iopxxddveefpufty (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_mo5fmawq55iopxxddveefpufty rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_mo5fmawq55iopxxddveefpufty is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_ncfy6ctud52kujz3sliqzwnvpq (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ncfy6ctud52kujz3sliqzwnvpq rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ncfy6ctud52kujz3sliqzwnvpq: delete the host's replica: injected failure at delete-replica
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_ncfy6ctud52kujz3sliqzwnvpq is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_dishviufldz7l34ns54j4enzju (the original route is journaled)
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_dishviufldz7l34ns54j4enzju rolled back to its original route
2026/10/15 21:43:42 provision: a.shop.example.com: import sd_dishviufldz7l34ns54j4enzju is cleaned up and its journal row retired
2026/10/15 21:43:42 provision: a.shop.example.com: swapped for import sd_vh2ea5wbxfvwlqqo4xblzfo4bu (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_vh2ea5wbxfvwlqqo4xblzfo4bu rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_vh2ea5wbxfvwlqqo4xblzfo4bu: retire its journal row: constraint failed: injected (1811)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_vh2ea5wbxfvwlqqo4xblzfo4bu is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_prld7shaxhck75nt6u7lloqoxe (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_prld7shaxhck75nt6u7lloqoxe rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_prld7shaxhck75nt6u7lloqoxe: retire its journal row: constraint failed: injected (1811)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_prld7shaxhck75nt6u7lloqoxe is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_jgpthrfyjoe33uifum5jmcoj6e (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_jgpthrfyjoe33uifum5jmcoj6e rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_jgpthrfyjoe33uifum5jmcoj6e is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: mark import sd_jgpthrfyjoe33uifum5jmcoj6e rolled back: injected failure at cas
2026/10/15 21:43:43 provision: a.shop.example.com: aborted seed sd_jgpthrfyjoe33uifum5jmcoj6e rolled back (no box had swapped it)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_5xbxuzjs3wwl2nyvuztdfaspby (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5xbxuzjs3wwl2nyvuztdfaspby rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5xbxuzjs3wwl2nyvuztdfaspby is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: aborted seed sd_5xbxuzjs3wwl2nyvuztdfaspby rolled back (no box had swapped it)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_4v3nt5dw7cxuoyyrjcal2gceya (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4v3nt5dw7cxuoyyrjcal2gceya rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4v3nt5dw7cxuoyyrjcal2gceya rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4v3nt5dw7cxuoyyrjcal2gceya rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4v3nt5dw7cxuoyyrjcal2gceya is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_abgx4heux3z5llbswximxz6vvm (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_abgx4heux3z5llbswximxz6vvm rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_abgx4heux3z5llbswximxz6vvm is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_undoncytxs3mz7oh5hperfg3nm (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_undoncytxs3mz7oh5hperfg3nm rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_undoncytxs3mz7oh5hperfg3nm is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_r3mo6fs5hhjprr4qvnevaglcna (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_r3mo6fs5hhjprr4qvnevaglcna rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_r3mo6fs5hhjprr4qvnevaglcna is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_mcaybkng7rp4ztrkghi7yolx3m (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_mcaybkng7rp4ztrkghi7yolx3m rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_mcaybkng7rp4ztrkghi7yolx3m is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_bn4b5aokzrvsraoqehrz5axtgi (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_bn4b5aokzrvsraoqehrz5axtgi rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_bn4b5aokzrvsraoqehrz5axtgi is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_hyxwcmblfp3qhaf3uuw5n3ds2y (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_hyxwcmblfp3qhaf3uuw5n3ds2y rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_hyxwcmblfp3qhaf3uuw5n3ds2y is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_r3voo3p5wnjsm6jxew5g2ii6py (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_r3voo3p5wnjsm6jxew5g2ii6py rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_r3voo3p5wnjsm6jxew5g2ii6py is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_ltuhobgjspktsepmfjrjy5wpdu (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_ltuhobgjspktsepmfjrjy5wpdu has no route on this box: its local data is removed and no route is put back
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_ltuhobgjspktsepmfjrjy5wpdu is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_uk3sq7u644waxqm3qzt3bfwdji (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_mekk2nosgxkpyukt7bsm6skpsy (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_nzoqdjulwz7qkdhnpsuqvmhgdy (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_nzoqdjulwz7qkdhnpsuqvmhgdy cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_rzlbylwa7aaukna3kzi6kbof3q (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_rzlbylwa7aaukna3kzi6kbof3q is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/15 21:43:43 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/15 21:43:43 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_sy5bf34jtc2citt7mfcgs5hcpy (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_b25y4g3vflqh6g3jdyeiukf2vm (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_qdltjqpbt7efcfyxmpq7uhzzoa (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_n34ii2vhjoz3fl7j3y3gagaipi (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_ryvcr6u4bvh5y6ywwqy7kzeubq (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_ryvcr6u4bvh5y6ywwqy7kzeubq rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_uhgh6krjcw5i3dzgnos6qxzoga (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_uhgh6krjcw5i3dzgnos6qxzoga has no route on this box: its local data is removed and no route is put back
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_uhgh6krjcw5i3dzgnos6qxzoga is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_jxtyroim5kvjelefyuflogpgwe (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_jxtyroim5kvjelefyuflogpgwe: remove its local data: injected failure at remove-local
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_jxtyroim5kvjelefyuflogpgwe is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_m443g6vcpxfbnbcaazllgsvaeu (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_m443g6vcpxfbnbcaazllgsvaeu: a route appeared at the host, so its local database is left and the rollback waits
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_6hcjeku6u36uqfkeegdwybcfla (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_6hcjeku6u36uqfkeegdwybcfla rollback deferred: no fence generation: registry busy
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_ubmi6jsspp7ovjs7iu62eii5re (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_ubmi6jsspp7ovjs7iu62eii5re rollback deferred: no fence generation: the generation source answered 0
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_h6nolbojqipaagw4yjsxz24xju (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_teszvyqtxpacgcr2ma4xqvu3s4 (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_hig3qssuhxtl5dle2lfzsrlspu (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/15 21:43:43 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_5d2rdwe7ud5rmu6f6cj5uclpoe (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5d2rdwe7ud5rmu6f6cj5uclpoe rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5d2rdwe7ud5rmu6f6cj5uclpoe is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_c335ovyd2gjg6rla7nqzqoterq (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_c335ovyd2gjg6rla7nqzqoterq rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_c335ovyd2gjg6rla7nqzqoterq is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_5yqxqj4ebylpz3w7vgwml3ie7a (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5yqxqj4ebylpz3w7vgwml3ie7a rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5yqxqj4ebylpz3w7vgwml3ie7a is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_asff5wzcrkjmlemkyzjdb7ini4 (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_asff5wzcrkjmlemkyzjdb7ini4: retire its instance key: the env file is a symlink
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_asff5wzcrkjmlemkyzjdb7ini4 rolled back to its original route
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_asff5wzcrkjmlemkyzjdb7ini4 is cleaned up and its journal row retired
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_pljvors67hgde6fas2xmzlogvm (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 21:43:43 provision: a.shop.example.com: swapped for import sd_kap5jjqdklucvmu5t567yildpi (the original route is journaled)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_vtz2uqpfchpq3mut5slsrtwmxm refused: there is no route at a.shop.example.com to replace
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_cmpjjn7rs6ohuzorwkxkufilcm refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_5wl7zb46lyph4wq3rialk3z7se refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_owf7tnjzge5grxlxrwj4gbybzm refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_k3ocrdp6sbngbxwdrik32htn7m refused: the route belongs to app other
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_w6yneqhkx3uqzpzdwgcoty5neq refused: the route is filed under another account
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_3xztfbootbormsys3ihzwu53xy refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4aeuxh6772oanyruc2xudavszi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_qdyah4pf2plea4nrxu343nglfy refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_34ronueteazdqer3j247l7bcxi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_njflzuqynhggzuhva3wb66q6zm refused: the route is not an address route this import can take over (socket)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_oyjcnfqrs2wjgjgcoycyge733i refused: the route is not an address route this import can take over (no address)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_uyhzw2ktdeuwhppg5beq2cojue refused: the route is not an address route this import can take over (provisioned)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_4kmwotjj2nf3koswcmdo6yqxxa refused: the route is not an address route this import can take over (kind static)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_6yukkbicbc5rhmqngajq3svxeq refused: the route is not an address route this import can take over (backing)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_wsz4pyn36cetdfgaxa3fbcq3lm refused: the route is not an address route this import can take over (tunnel)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_hsncevwug2klqmftahiuxgycby refused: the route is not an address route this import can take over (caps)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_ziednljjm765ak7eh7rhy7ddhe refused: the route is not an address route this import can take over (platform)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_agrcxw7k25kiy4cgzotz5ihwra refused: the route is not an address route this import can take over (canary)
2026/10/15 21:43:43 provision: a.shop.example.com: import sd_h43h2z7iubtf3nf7xieb6p3exa refused: the route is not an address route this import can take over (kind sidecar)
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_3idzpb6g72f4xpd2mwcb6ylmza refused: the route is not an address route this import can take over (region)
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_tokaeuftvuo4nttjg6gdoqn3cm refused: the route is not an address route this import can take over (fleet_box)
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_xwahc6wbaoevlandr5uy22kgqq refused: the route is not an address route this import can take over (hibernate)
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_zlk26rgfslcrq7razueoz235a4 refused: the route is not an address route this import can take over (claim_owner)
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_tkpls7jyk2kq5ybqq7fhuywypa refused: this box does not run instances nested
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_stlqaeu3j56cw3sude6ukxycye refused: this box does not run instances nested
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_vo23ct6etvebchbwfk5zmz66wu refused: claim control is on for this box
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_bg2t4t3yu7cd7og3o5ysgtyiiu (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_istwda3ldxxz5itstvf4236yd4 (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/15 21:43:44 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_bvg3ty3l7zhiikmveulcij776m: its verify hash is not a sha256
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_sfifozzhkwknlld2aucxr5cnga: its verify hash is not a sha256
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_sb7t7qheyf4fzu6z52yndtjm5y: its verify hash is not a sha256
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/15 21:43:44 provision: A.shop.example.com/..: not swapping for import sd_mxqjg5punx4gjfuiuimysa46eq: its host or seed id is malformed (seeds: not a host)
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_aed44sacxubtiomdbhuyvkcobe: its record does not describe a nested, hibernating instance
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_7mrpcqswkpzlvtn2r424mhdqfa: its record does not describe a nested, hibernating instance
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_wgoyw565jwwb7nuzn7hkcm2boq: its record does not describe a nested, hibernating instance
2026/10/15 21:43:44 provision: a.shop.example.com: not swapping for import sd_kqihalkk6jvoqluc44nzjlrcx4: its record does not describe a nested, hibernating instance
2026/10/15 21:43:44 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_go6i4ymn4xzylxgeunr4jtvjm4 (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_coajvjcklq2543dsfw6m7y7yaa (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_juyvvn6tp7ey2ah3oud5pbfsxe (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/15 21:43:44 provision: dry-run: would consider swapping a.shop.example.com for import sd_o4vwqhimsc3snway2gap66krce
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_q5kcfjye5gzf6swn5bfgvov6we rolled back to its original route
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_q5kcfjye5gzf6swn5bfgvov6we: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_q5kcfjye5gzf6swn5bfgvov6we is cleaned up and its journal row retired
2026/10/15 21:43:44 provision: a.shop.example.com: import sd_uk25as5z6fkroshdvthh5gmtky left alone: the import journal holds seed sd_oejubyezgr4v6yruj62bthcr6m at swapped
2026/10/15 21:43:44 provision: a.shop.example.com: not minting import sd_yiqxiyihrjstubmff4wl56ke74: it is swapped but not committed, and only its swap makes its row
2026/10/15 21:43:44 provision: a.shop.example.com: not minting import sd_fatya63dumywhcxns47tyegnxq: it is placed but not committed, and only its swap makes its row
2026/10/15 21:43:44 provision: a.shop.example.com: swapped for import sd_kph2lympll7tgfg6qbpstjwsum (the original route is journaled)
2026/10/15 21:43:44 provision: a.shop.example.com: not minting import sd_kph2lympll7tgfg6qbpstjwsum: it is swapped but not committed, and only its swap makes its row
2026/10/15 21:43:44 provision: a.shop.example.com: not minting import sd_kph2lympll7tgfg6qbpstjwsum: it is placed but not committed, and only its swap makes its row
2026/10/15 21:43:44 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 21:43:44 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/15 21:43:44 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/15 21:43:44 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/15 21:43:44 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/15 21:43:44 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/15 21:43:44 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 21:43:44 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/15 21:43:44 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/15 21:43:44 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 21:43:44 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/15 21:43:44 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/15 21:43:44 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/15 21:43:44 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/15 21:43:44 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 21:43:44 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/15 21:43:44 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 21:43:44 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 21:43:44 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/15 21:43:44 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 21:43:44 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 21:43:44 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:44 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/15 21:43:44 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:44 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:44 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 21:43:44 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 21:43:44 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 21:43:44 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 21:43:44 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 21:43:44 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 21:43:44 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	34.491s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.517s
ok  	github.com/carlosframework/platform/internal/relay	7.233s
ok  	github.com/carlosframework/platform/internal/release	21.488s
ok  	github.com/carlosframework/platform/internal/rollout	3.741s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.006s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.058s
ok  	github.com/carlosframework/platform/internal/rootstate	0.028s
ok  	github.com/carlosframework/platform/internal/runs	0.567s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.503s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.408s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.470s
ok  	github.com/carlosframework/platform/internal/status	0.039s
ok  	github.com/carlosframework/platform/internal/steering	0.005s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.216s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.004s
ok  	github.com/carlosframework/platform/internal/vet	1.537s
FAIL
make: *** [Makefile:18: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/internal/activator/rolelaunch_linux.go b/internal/activator/rolelaunch_linux.go

index 528c3ed40..8f7ad67b2 100644

--- a/internal/activator/rolelaunch_linux.go

+++ b/internal/activator/rolelaunch_linux.go

@@ -4,11 +4,8 @@ package activator

import (

"context"

- "crypto/sha256"

- "encoding/hex"

"os"

"os/exec"

- "path"

"path/filepath"

"strconv"

"strings"

@@ -30,70 +27,6 @@ func (l RoleLaunch) Start(ctx context.Context, role string, attempt hostclaim.Wa

return l.startIsolated(ctx, role, attempt, build, before)

}

-// prepareRoleReservation preserves the recoverable reservation primitive for

-// the future root integration. It grants no execution capability and Start

-// never calls it while the isolated root protocol is unavailable.

-func (l RoleLaunch) prepareRoleReservation(ctx context.Context, role string, attempt hostclaim.WakeRetryAttempt, build func() *exec.Cmd) (*exec.Cmd, *cgroup.Prepared, hostbox.LaunchReservation, error) {

- if l.Journal.Remote() || l.Parent == nil || l.ParentPath == "" || l.Work == nil || l.Journal == nil || l.Executable == nil || build == nil || attempt.ID == "" || attempt.InvocationID == "" || attempt.LaunchInputs == "" || attempt.Session != l.Target.Session || attempt.Box != l.Target.Box || attempt.Enrollment != l.Target.Enrollment || attempt.BootID != l.Target.BootID || attempt.ControllerID != l.Target.ControllerID {

- return nil, nil, hostbox.LaunchReservation{}, hostwrite.ErrUnavailable

- }

- var cmd *exec.Cmd

- var executable *os.File

- defer func() {

- if executable != nil {

- executable.Close()

- }

- }()

- var child *cgroup.Prepared

- var reservation hostbox.LaunchReservation

- err := l.Work.With(ctx, l.Identity, func() error {

- if l.Initialize != nil {

- if err := l.Initialize(ctx); err != nil {

- return err

- }

- var err error

- cmd = build()

- if cmd == nil {

- return hostwrite.ErrUnavailable

- }

- executable, err = l.Executable(ctx, cmd)

- if err != nil {

- return err

- }

- if executable == nil {

- return hostwrite.ErrUnavailable

- }

- var stat unix.Stat_t

- if err = unix.Fstat(int(executable.Fd()), &stat); err != nil {

- return err

- }

- if stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Mode&0111 == 0 {

- return hostwrite.ErrUnavailable

- }

- digest := sha256.Sum256([]byte(role + "\x00" + attempt.ID))

- name := hex.EncodeToString(digest[:16])

- reservation = hostbox.LaunchReservation{ID: attempt.ID + ":" + role, Role: role, InvocationID: attempt.InvocationID, Inputs: attempt.LaunchInputs, Target: l.Target, Group: hostbox.LaunchGroup{RelativePath: path.Join(l.ParentPath, "role-"+name), InvocationID: attempt.InvocationID}, Executable: hostbox.LaunchFile{Device: uint64(stat.Dev), Inode: stat.Ino}}

- child, err = l.Parent.PrepareRoleChildWithIntent(name, func(parent cgroup.ContainmentIdentity) error {

- reservation.Parent = hostbox.LaunchGroup{RelativePath: l.ParentPath, Device: parent.Device, Inode: parent.Inode}

- return l.Journal.IntendRole(ctx, reservation)

- })

- if err != nil {

- return err

- }

- id, err := child.Identity()

- if err != nil {

- return err

- }

- reservation.Group.Device, reservation.Group.Inode = id.Device, id.Inode

- if err = l.Journal.Reserve(ctx, reservation); err != nil {

- return err

- }

- return nil

- })

- return cmd, child, reservation, err

func roleProcessStart(pid int) (string, error) {

raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")

if err != nil {

diff --git a/internal/activator/rolelaunch_linux_removed_test.go b/internal/activator/rolelaunch_linux_removed_test.go

new file mode 100644

index 000000000..bbd95a7c9

--- /dev/null

+++ b/internal/activator/rolelaunch_linux_removed_test.go

@@ -0,0 +1,82 @@

+//go:build linux

+package activator

+import (

+ "context"

+ "crypto/sha256"

+ "encoding/hex"

+ "os"

+ "os/exec"

+ "path"

+ "github.com/carlosframework/platform/internal/cgroup"

+ "github.com/carlosframework/platform/internal/hostbox"

+ "github.com/carlosframework/platform/internal/hostclaim"

+ "github.com/carlosframework/platform/internal/hostwrite"

+ "golang.org/x/sys/unix"

+// prepareRoleReservation preserves the recoverable reservation primitive for

+// the future root integration. It grants no execution capability and Start

+// never calls it while the isolated root protocol is unavailable.

+func (l RoleLaunch) prepareRoleReservation(ctx context.Context, role string, attempt hostclaim.WakeRetryAttempt, build func() *exec.Cmd) (*exec.Cmd, *cgroup.Prepared, hostbox.LaunchReservation, error) {

+ if l.Journal.Remote() || l.Parent == nil || l.ParentPath == "" || l.Work == nil || l.Journal == nil || l.Executable == nil || build == nil || attempt.ID == "" || attempt.InvocationID == "" || attempt.LaunchInputs == "" || attempt.Session != l.Target.Session || attempt.Box != l.Target.Box || attempt.Enrollment != l.Target.Enrollment || attempt.BootID != l.Target.BootID || attempt.ControllerID != l.Target.ControllerID {

+ return nil, nil, hostbox.LaunchReservation{}, hostwrite.ErrUnavailable

+ }

+ var cmd *exec.Cmd

+ var executable *os.File

+ defer func() {

+ if executable != nil {

+ executable.Close()

+ }

+ }()

+ var child *cgroup.Prepared

+ var reservation hostbox.LaunchReservation

+ err := l.Work.With(ctx, l.Identity, func() error {

+ if l.Initialize != nil {

+ if err := l.Initialize(ctx); err != nil {

+ return err

+ }

+ var err error

+ cmd = build()

+ if cmd == nil {

+ return hostwrite.ErrUnavailable

+ }

+ executable, err = l.Executable(ctx, cmd)

+ if err != nil {

+ return err

+ }

+ if executable == nil {

+ return hostwrite.ErrUnavailable

+ }

+ var stat unix.Stat_t

+ if err = unix.Fstat(int(executable.Fd()), &stat); err != nil {

+ return err

+ }

+ if stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Mode&0111 == 0 {

+ return hostwrite.ErrUnavailable

+ }

+ digest := sha256.Sum256([]byte(role + "\x00" + attempt.ID))

+ name := hex.EncodeToString(digest[:16])

+ reservation = hostbox.LaunchReservation{ID: attempt.ID + ":" + role, Role: role, InvocationID: attempt.InvocationID, Inputs: attempt.LaunchInputs, Target: l.Target, Group: hostbox.LaunchGroup{RelativePath: path.Join(l.ParentPath, "role-"+name), InvocationID: attempt.InvocationID}, Executable: hostbox.LaunchFile{Device: uint64(stat.Dev), Inode: stat.Ino}}

+ child, err = l.Parent.PrepareRoleChildWithIntent(name, func(parent cgroup.ContainmentIdentity) error {

+ reservation.Parent = hostbox.LaunchGroup{RelativePath: l.ParentPath, Device: parent.Device, Inode: parent.Inode}

+ return l.Journal.IntendRole(ctx, reservation)

+ })

+ if err != nil {

+ return err

+ }

+ id, err := child.Identity()

+ if err != nil {

+ return err

+ }

+ reservation.Group.Device, reservation.Group.Inode = id.Device, id.Inode

+ if err = l.Journal.Reserve(ctx, reservation); err != nil {

+ return err

+ }

+ return nil

+ })

+ return cmd, child, reservation, err

diff --git a/internal/historyreadback/plan14_workflow_test.go b/internal/historyreadback/plan14_workflow_test.go

index ca366b7e3..a9a32efa3 100644

--- a/internal/historyreadback/plan14_workflow_test.go

+++ b/internal/historyreadback/plan14_workflow_test.go

@@ -101,7 +101,11 @@ func TestPlan14HistoryOperatorConflicts(t *testing.T) {

case "expired":

f.now = f.now.Add(25 * 60 * 60 * 1e9)

case "delivery conflict", "replacement", "wrong replacement":

- if err := release.PublishHistoryReconstruction(t.Context(), f.directory.Store, f.signer, old); err != nil {

+ wire, err := release.SignRootEnvelope(f.signer, old)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if _, err := f.directory.Store.Put(t.Context(), release.HistoryReconstructionKey(old.Account, old.App, old.Identity, old.Revision), wire, ""); err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimcensus_test.go b/internal/host/claimcensus_test.go

index 41fbd8940..d276e0943 100644

--- a/internal/host/claimcensus_test.go

+++ b/internal/host/claimcensus_test.go

@@ -368,7 +368,7 @@ func testClaimProductionCensusInstallation(t *testing.T, fenced bool) {

}

defer reg.Close()

r.Registry = reg

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(r.DataDir, ".hostclaims", "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(r.DataDir, ".hostclaims", "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimhandover_recovery_test.go b/internal/host/claimhandover_recovery_test.go

index f1959faca..1cda3f915 100644

--- a/internal/host/claimhandover_recovery_test.go

+++ b/internal/host/claimhandover_recovery_test.go

@@ -119,7 +119,7 @@ func TestClaimColdHandoverAfterControllerRecoveryReachesNextWake(t *testing.T) {

t.Fatalf("recovered tuple was rewritten: %+v", receipt.Target)

}

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimjournal_migration.go b/internal/host/claimjournal_migration.go

index 117e1df11..d0cfdaa44 100644

--- a/internal/host/claimjournal_migration.go

+++ b/internal/host/claimjournal_migration.go

@@ -61,12 +61,6 @@ func RunSystemJournalMigrate(args []string) {

}

-// migrateClaimJournals opens only what the import needs: the verified actor,

-// root's journal and the retirement directory for the legacy stop proofs.

-func migrateClaimJournals(ctx context.Context, store release.Store, r ClaimRuntimeResources, provider ClaimOwnerProvider) (resultErr error) {

- return migrateClaimJournalsWith(ctx, store, r, provider, false)

func migrateClaimJournalsWith(ctx context.Context, store release.Store, r ClaimRuntimeResources, provider ClaimOwnerProvider, census bool) (resultErr error) {

if store == nil || provider == nil || r.Mode != "instance-control" || !filepath.IsAbs(r.DataDir) {

return hostwrite.ErrUnavailable

diff --git a/internal/host/claimjournal_migration_removed_test.go b/internal/host/claimjournal_migration_removed_test.go

new file mode 100644

index 000000000..e052e016c

--- /dev/null

+++ b/internal/host/claimjournal_migration_removed_test.go

@@ -0,0 +1,13 @@

+package host

+import (

+ "context"

+ "github.com/carlosframework/platform/internal/release"

+// migrateClaimJournals opens only what the import needs: the verified actor,

+// root's journal and the retirement directory for the legacy stop proofs.

+func migrateClaimJournals(ctx context.Context, store release.Store, r ClaimRuntimeResources, provider ClaimOwnerProvider) (resultErr error) {

+ return migrateClaimJournalsWith(ctx, store, r, provider, false)

diff --git a/internal/host/claimmoveparks_test.go b/internal/host/claimmoveparks_test.go

index 729657ca4..f3800c30b 100644

--- a/internal/host/claimmoveparks_test.go

+++ b/internal/host/claimmoveparks_test.go

@@ -153,7 +153,7 @@ func TestMoveParksBuildWithFailedWakeUsesRegionalEngine(t *testing.T) {

t.Fatal(err)

}

defer reg.Close()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimparticipation_stale_test.go b/internal/host/claimparticipation_stale_test.go

index fffeb622a..b136161f0 100644

--- a/internal/host/claimparticipation_stale_test.go

+++ b/internal/host/claimparticipation_stale_test.go

@@ -76,7 +76,7 @@ func TestPlan9PreviousAgentRetiredParticipation(t *testing.T) {

}

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(t.TempDir(), "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimretire_transport_test.go b/internal/host/claimretire_transport_test.go

index d161a506b..514b2c319 100644

--- a/internal/host/claimretire_transport_test.go

+++ b/internal/host/claimretire_transport_test.go

@@ -17,7 +17,7 @@ func TestRootRetirementJournalsBeforeAcknowledgementAndPreservesSuccessor(t *tes

t.Fatal(err)

}

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimretirerecovery_test.go b/internal/host/claimretirerecovery_test.go

index 081b76e29..4372042b9 100644

--- a/internal/host/claimretirerecovery_test.go

+++ b/internal/host/claimretirerecovery_test.go

@@ -183,7 +183,7 @@ func TestClaimRetirementRecoversPersistedLaunchOwner(t *testing.T) {

}

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/claimstate_linux.go b/internal/host/claimstate_linux.go

index 66473afcf..d244d1e60 100644

--- a/internal/host/claimstate_linux.go

+++ b/internal/host/claimstate_linux.go

@@ -95,49 +95,3 @@ func claimStateDatabaseOwner(path string) error {

}

return nil

}

-func prepareClaimStateDatabase(path string) error {

- uid, gid, err := claimStateOwner()

- if err != nil {

- return err

- }

- return prepareClaimDatabaseOwner(path, uid, gid)

-func prepareClaimDatabaseOwner(path string, uid, gid int) error {

- for _, suffix := range []string{"", "-wal", "-shm"} {

- name := path + suffix

- f, err := safefile.OpenFile(name, os.O_RDWR, 0)

- created := false

- if errors.Is(err, unix.ENOENT) {

- if suffix != "" {

- continue

- }

- f, err = safefile.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0600)

- created = err == nil

- }

- if err != nil {

- return err

- }

- err = func() error {

- defer f.Close()

- fd := int(f.Fd())

- var stat unix.Stat_t

- if err := unix.Fstat(fd, &stat); err != nil {

- return err

- }

- if stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Nlink != 1 || (!created && int(stat.Uid) != uid) {

- return hostwrite.ErrUnavailable

- }

- if created && os.Geteuid() == 0 {

- if err := unix.Fchown(fd, uid, gid); err != nil {

- return err

- }

- return unix.Fchmod(fd, 0600)

- }()

- if err != nil {

- return err

- }

- return nil

diff --git a/internal/host/claimstate_linux_removed_test.go b/internal/host/claimstate_linux_removed_test.go

new file mode 100644

index 000000000..45acbb151

--- /dev/null

+++ b/internal/host/claimstate_linux_removed_test.go

@@ -0,0 +1,51 @@

+//go:build linux

+package host

+import (

+ "errors"

+ "os"

+ "github.com/carlosframework/platform/internal/hostwrite"

+ "github.com/carlosframework/platform/internal/safefile"

+ "golang.org/x/sys/unix"

+func prepareClaimDatabaseOwner(path string, uid, gid int) error {

+ for _, suffix := range []string{"", "-wal", "-shm"} {

+ name := path + suffix

+ f, err := safefile.OpenFile(name, os.O_RDWR, 0)

+ created := false

+ if errors.Is(err, unix.ENOENT) {

+ if suffix != "" {

+ continue

+ }

+ f, err = safefile.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0600)

+ created = err == nil

+ }

+ if err != nil {

+ return err

+ }

+ err = func() error {

+ defer f.Close()

+ fd := int(f.Fd())

+ var stat unix.Stat_t

+ if err := unix.Fstat(fd, &stat); err != nil {

+ return err

+ }

+ if stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Nlink != 1 || (!created && int(stat.Uid) != uid) {

+ return hostwrite.ErrUnavailable

+ }

+ if created && os.Geteuid() == 0 {

+ if err := unix.Fchown(fd, uid, gid); err != nil {

+ return err

+ }

+ return unix.Fchmod(fd, 0600)

+ }()

+ if err != nil {

+ return err

+ }

+ return nil

diff --git a/internal/host/claimstate_other.go b/internal/host/claimstate_other.go

index b6c6780ba..fdf78b973 100644

--- a/internal/host/claimstate_other.go

+++ b/internal/host/claimstate_other.go

@@ -6,5 +6,3 @@ import "github.com/carlosframework/platform/internal/hostwrite"

func prepareClaimStateDirectory(string) error { return hostwrite.ErrUnavailable }

func claimStateDatabaseOwner(string) error { return hostwrite.ErrUnavailable }

-func prepareClaimStateDatabase(string) error { return hostwrite.ErrUnavailable }

diff --git a/internal/host/heldstage_test.go b/internal/host/heldstage_test.go

index 7dc1d46ab..e5e2e0b51 100644

--- a/internal/host/heldstage_test.go

+++ b/internal/host/heldstage_test.go

@@ -379,11 +379,11 @@ func TestHeldPublicationIsGuardedByTheAuthority(t *testing.T) {

t.Fatalf("authority before staging: %v", err)

}

rt := registry.Route{Host: req.Host, Account: req.Account, App: req.App, HoldOp: req.Op}

- if _, err := release.StageHeld(ctx, s, hsPub, hsRatchet(t), opt, rt, req.Version); err != nil {

+ if _, err := release.StageHeldVerified(ctx, s, hsPub, hsRatchet(t), opt, rt, req.Version, offProofGate(t)); err != nil {

t.Fatalf("StageHeld: %v", err)

}

tc.during(t, reg, s)

- err := release.PublishHeld(ctx, s, opt, rt, req.Version, offProofGate(t), func(publish func() error) error { return auth(req, publish) })

+ _, err := release.MaterializeHeld(ctx, s, hsPub, hsRatchet(t), opt, rt, req.Version, offProofGate(t), func(publish func() error) error { return auth(req, publish) })

got, _ := release.LiveVersion(opt, hsHost)

if tc.stale {

if !errors.Is(err, release.ErrStaleHeldStage) || got != "" {

diff --git a/internal/host/legacyinventory_test.go b/internal/host/legacyinventory_test.go

new file mode 100644

index 000000000..cb2d17446

--- /dev/null

+++ b/internal/host/legacyinventory_test.go

@@ -0,0 +1,51 @@

+package host

+import (

+ "context"

+ "database/sql"

+ "github.com/carlosframework/platform/internal/hostbox"

+ "github.com/carlosframework/platform/internal/release"

+ "github.com/carlosframework/platform/internal/rootparticipation"

+ "testing"

+func openLegacyInventory(t *testing.T, path string) (*hostbox.StopInventoryDB, error) {

+ t.Helper()

+ j, err := hostbox.OpenLaunchJournal(path)

+ if err != nil {

+ return nil, err

+ }

+ t.Cleanup(func() { j.Close() })

+ service, err := hostbox.NewJournalService(j)

+ if err != nil {

+ return nil, err

+ }

+ db, err := sql.Open("sqlite", path)

+ if err != nil {

+ return nil, err

+ }

+ defer db.Close()

+ for _, name := range []string{"launches", "journal_requests", "journal_receipt_retention"} {

+ if _, err := db.Exec("DROP TABLE " + name); err != nil {

+ return nil, err

+ }

+ return service.Inventory, nil

+func legacyActivationReady(ctx context.Context) error {

+ l, err := rootparticipation.Open()

+ if err != nil {

+ return err

+ }

+ defer l.State.Close()

+ return l.ActivationReady(ctx)

+func publishHistoryFixture(ctx context.Context, store release.Store, signer release.Signer, key string, grant any) error {

+ raw, err := release.SignRootEnvelope(signer, grant)

+ if err != nil {

+ return err

+ }

+ _, err = store.Put(ctx, key, raw, "")

+ return err

diff --git a/internal/host/movesfloor.go b/internal/host/movesfloor.go

index 7d402d598..41f8c38ae 100644

--- a/internal/host/movesfloor.go

+++ b/internal/host/movesfloor.go

@@ -457,13 +457,6 @@ func rootJudgePrevWithSource(reg *registry.Registry, source rootFloorIdentitySou

return errors.Join(rootJudgeMovesPrevWithSource(reg, source), rootJudgeSeedsPrev())

}

-// rootJudgeMovesPrev is the moves half: the same judge decidePrev runs,

-// under the same lock, learning carlos.prev's version by running it when

-// the sidecar is missing (a box whose carlos.prev was installed by a build

-// before the floor existed).

-func rootJudgeMovesPrev(reg *registry.Registry) error {

- return rootJudgeMovesPrevWithSource(reg, rootMovesFloorIdentity)

func rootJudgeMovesPrevWithSource(reg *registry.Registry, source rootFloorIdentitySource) error {

if id, required, err := source.read(); err != nil {

return err

diff --git a/internal/host/movesheldlock_cleanup_test.go b/internal/host/movesheldlock_cleanup_test.go

index 1ab34302d..4f2d5b291 100644

--- a/internal/host/movesheldlock_cleanup_test.go

+++ b/internal/host/movesheldlock_cleanup_test.go

@@ -29,7 +29,7 @@ import (

func heldLockCensus(t *testing.T, data, host string, extra ...string) error {

t.Helper()

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/movesheldrelease_agent_test.go b/internal/host/movesheldrelease_agent_test.go

index 77519b2db..1d65f9e0f 100644

--- a/internal/host/movesheldrelease_agent_test.go

+++ b/internal/host/movesheldrelease_agent_test.go

@@ -250,7 +250,7 @@ func TestHeldReleaseOldConsumers(t *testing.T) {

}

t.Setenv("CARLOS_HOST_CLAIM", "")

authorized := false

- if err := release.ServeHeldStageRequests(ctx, h.s, hsPub, hsRatchet(t), opt, data, offProofGate(t), func(release.HeldStageRequest, func() error) error {

+ if err := release.ServeHeldStageRequestsWithPins(ctx, h.s, hsPub, hsRatchet(t), opt, data, offProofGate(t), func(release.HeldStageRequest, func() error) error {

authorized = true

return nil

}); err != nil {

diff --git a/internal/host/movesreport_test.go b/internal/host/movesreport_test.go

index 5abd3a460..7e3fe08e0 100644

--- a/internal/host/movesreport_test.go

+++ b/internal/host/movesreport_test.go

@@ -289,7 +289,7 @@ func TestPreparingRelaysHeldStageOnAHardenedBox(t *testing.T) {

// The root pass, with the relay's own authority, materializes it.

heldMaterialize = prev

- if err := release.ServeHeldStageRequests(ctx, h.s, hsPub, hsRatchet(t), targetOpt, targetData, offProofGate(t), heldStageAuthority(reg, h.s, "uk-box", targetData)); err != nil {

+ if err := release.ServeHeldStageRequestsWithPins(ctx, h.s, hsPub, hsRatchet(t), targetOpt, targetData, offProofGate(t), heldStageAuthority(reg, h.s, "uk-box", targetData)); err != nil {

t.Fatal(err)

}

if v, err := release.LiveVersion(targetOpt, p1Host); err != nil || v != "v7" {

@@ -309,7 +309,7 @@ func TestPreparingRelaysHeldStageOnAHardenedBox(t *testing.T) {

if err := writeHeldStageRequest(targetData, bad); err != nil {

t.Fatal(err)

}

- if err := release.ServeHeldStageRequests(ctx, h.s, hsPub, hsRatchet(t), opt, targetData, offProofGate(t), heldStageAuthority(reg, h.s, "uk-box", targetData)); err != nil {

+ if err := release.ServeHeldStageRequestsWithPins(ctx, h.s, hsPub, hsRatchet(t), opt, targetData, offProofGate(t), heldStageAuthority(reg, h.s, "uk-box", targetData)); err != nil {

t.Fatal(err)

}

if v, _ := release.LiveVersion(opt, p1Host); v != "" {

diff --git a/internal/host/moveswakesource_linux_test.go b/internal/host/moveswakesource_linux_test.go

index 32da58921..9ddfc1234 100644

--- a/internal/host/moveswakesource_linux_test.go

+++ b/internal/host/moveswakesource_linux_test.go

@@ -345,7 +345,7 @@ func (w *mwWorld) sourceInstallationRow(rowStamp uint64) mwSourceInstallation {

if err := local.RecordInventory(ctx, poHost, hostguard.Captured{Incarnation: h.Incarnation, Stamp: rcS}, "flat", []string{dbRel, dbRel + ".gen"}, func(*hostclaim.Claim) error { return nil }); err != nil {

t.Fatal(err)

}

- inv, err := hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "inventory.db"))

+ inv, err := openLegacyInventory(t, filepath.Join(t.TempDir(), "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/plan12_handover_test.go b/internal/host/plan12_handover_test.go

index 6f222c1d9..a7cab583d 100644

--- a/internal/host/plan12_handover_test.go

+++ b/internal/host/plan12_handover_test.go

@@ -108,7 +108,7 @@ func plan12Handover(t *testing.T, kind, mode string) (*recoveryFixture, hostclai

}

h.Identity = handoverRecoveryIdentity(t, hostbox.Actor{Box: "box-1", Enrollment: "enrollment-1", Revision: 7, Region: "ie"})

- h.Inventory, err = hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "inventory.db"))

+ h.Inventory, err = openLegacyInventory(t, filepath.Join(t.TempDir(), "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/plan12_restore_linux_test.go b/internal/host/plan12_restore_linux_test.go

index ef479bea6..b4b5120c4 100644

--- a/internal/host/plan12_restore_linux_test.go

+++ b/internal/host/plan12_restore_linux_test.go

@@ -157,7 +157,7 @@ func TestPlan12RecoveryRestoreSourceDatabase(t *testing.T) {

}

c.wake.Prelaunch, c.wake.PrepareState = roles.Prelaunch, roles.PrepareState

if name == "missing-inventory" {

- replacement, e := hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "empty.db"))

+ replacement, e := openLegacyInventory(t, filepath.Join(t.TempDir(), "empty.db"))

if e != nil {

t.Fatal(e)

}

diff --git a/internal/host/plan14_fix2_live_linux_test.go b/internal/host/plan14_fix2_live_linux_test.go

index 5dd70b0d2..b12833dd1 100644

--- a/internal/host/plan14_fix2_live_linux_test.go

+++ b/internal/host/plan14_fix2_live_linux_test.go

@@ -175,7 +175,7 @@ func TestPlan14Fix2PlatformUpdateClaimsOffNoCensus(t *testing.T) {

if err != nil || required {

t.Fatalf("unactivated census blocked update: %v %v", required, err)

}

- if rootparticipation.ActivationReady(t.Context()) == nil {

+ if legacyActivationReady(t.Context()) == nil {

t.Fatal("claims activated without census and verifier")

}

guard := hostfloor.Disk{Dir: t.TempDir()}

diff --git a/internal/host/plan14_generation_timer_retirement_test.go b/internal/host/plan14_generation_timer_retirement_test.go

index b85e6a551..fef8320ff 100644

--- a/internal/host/plan14_generation_timer_retirement_test.go

+++ b/internal/host/plan14_generation_timer_retirement_test.go

@@ -21,7 +21,7 @@ func TestPlan14GenerationTimerRetirement(t *testing.T) {

t.Fatal(err)

}

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/plan14_history_retirement_test.go b/internal/host/plan14_history_retirement_test.go

index b1ea6f3c8..fdf70ec36 100644

--- a/internal/host/plan14_history_retirement_test.go

+++ b/internal/host/plan14_history_retirement_test.go

@@ -120,7 +120,7 @@ func TestPlan14RecoveryRetirementProductionCallback(t *testing.T) {

}

grant.Replaces = pending.PendingDigest

}

- if err := release.PublishHistoryReconstruction(t.Context(), e.store, release.RootSigner(key), grant); err != nil {

+ if err := publishHistoryFixture(t.Context(), e.store, release.RootSigner(key), release.HistoryReconstructionKey(grant.Account, grant.App, grant.Identity, grant.Revision), grant); err != nil {

t.Fatal(err)

}

if err := deps.Reconstruct(t.Context(), b); err == nil {

@@ -139,7 +139,7 @@ func TestPlan14RecoveryRetirementProductionCallback(t *testing.T) {

t.Fatal("different authorization reported complete")

}

retirement := release.HistoryRecoveryRetirement{Schema: 1, Kind: "carlos-release-recovery-retirement", Identity: view.Identity, Operation: "retire-exact-ambiguity", IssuedAt: now, Binding: b, Source: view.Hosts[0].Source, AttemptID: old.ID, OutcomeDigest: view.Hosts[0].RecoveryDigests[old.ID], VerifiedID: good.ID, VerifiedDigest: view.Hosts[0].RecoveryDigests[good.ID]}

- if err := release.PublishHistoryRecoveryRetirement(t.Context(), e.store, release.RootSigner(key), retirement); err != nil {

+ if err := publishHistoryFixture(t.Context(), e.store, release.RootSigner(key), release.HistoryRecoveryRetirementKey(retirement.Binding, retirement.Identity, retirement.OutcomeDigest), retirement); err != nil {

t.Fatal(err)

}

q = challenge()

diff --git a/internal/host/plan14_launch_verifier_root_linux_test.go b/internal/host/plan14_launch_verifier_root_linux_test.go

index d155e89ee..1be05b7be 100644

--- a/internal/host/plan14_launch_verifier_root_linux_test.go

+++ b/internal/host/plan14_launch_verifier_root_linux_test.go

@@ -90,7 +90,7 @@ func TestPlan14LaunchVerifierRootRunner(t *testing.T) {

case "begin":

return l.BeginUpdate(ctx, "update")

case "end":

- return l.EndUpdate(ctx, "update")

+ return l.EndUpdateWith(ctx, "update", nil)

case "recover":

return l.RecoverAcquisition(ctx)

default:

diff --git a/internal/host/plan9fix1_journal_linux_test.go b/internal/host/plan9fix1_journal_linux_test.go

index fb44a4c23..642ef8bbe 100644

--- a/internal/host/plan9fix1_journal_linux_test.go

+++ b/internal/host/plan9fix1_journal_linux_test.go

@@ -34,7 +34,7 @@ func plan9Fix1RootRetire(t *testing.T) (ClaimRootHTTP, hostguard.FenceTarget, *r

t.Fatal(err)

}

base := t.TempDir()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(base, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(base, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/plan9fix4_claimjournal_migration_linux_test.go b/internal/host/plan9fix4_claimjournal_migration_linux_test.go

index 1b3a2832b..81d0e24fd 100644

--- a/internal/host/plan9fix4_claimjournal_migration_linux_test.go

+++ b/internal/host/plan9fix4_claimjournal_migration_linux_test.go

@@ -185,7 +185,7 @@ func TestPlan9Fix4MigrationRetryAfterCommitRecoversOwnedMask(t *testing.T) {

if err = launch.Close(); err != nil {

t.Fatal(err)

}

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(legacy, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(legacy, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/proofnamed.go b/internal/host/proofnamed.go

index 487c43940..a6e03eb99 100644

--- a/internal/host/proofnamed.go

+++ b/internal/host/proofnamed.go

@@ -11,7 +11,6 @@ import (

"os"

"path/filepath"

"strings"

- "time"

"github.com/carlosframework/platform/internal/controlname"

"github.com/carlosframework/platform/internal/hostfloor"

@@ -142,23 +141,6 @@ func (s *proofBindingSource) record(ctx context.Context, host string) (proofReco

return proofRecord{record: rec, key: s.namedPath, revision: hex.EncodeToString(hash.Sum(nil)), execPath: execPath, local: true, files: evidence}, nil

}

-func (s *proofBindingSource) capturedVersion(host, source, exe, digest string) bool {

- if s.attempts == nil {

- return false

- }

- store, err := s.attempts()

- if err != nil {

- return false

- }

- defer store.Close()

- now := time.Now()

- if s.now != nil {

- now = s.now()

- }

- attempt, binding, err := loadRollback(store, host, now)

- return err == nil && binding.Source == source && attempt.Target == exe && attempt.TargetDigest == digest && !attempt.Failed && !attempt.Recovering

func proofExecPath(b proofBinding, opt string) string {

if b.ExecPath != "" {

return b.ExecPath

@@ -166,40 +148,6 @@ func proofExecPath(b proofBinding, opt string) string {

return release.LiveLink(opt, b.Route.Host)

}

-func (s *proofBindingSource) installedConsoleVersion(version, digest string) bool {

- pub, err := release.ParsePublicKey(os.Getenv("CARLOS_RELEASE_PUBKEY"), "CARLOS_RELEASE_PUBKEY")

- if err != nil {

- return false

- }

- dir, err := rootstate.Open(filepath.Join(s.optDir, "system", "guard", "identities"), false, true)

- if err != nil {

- return false

- }

- defer dir.Close()

- names, err := dir.Names()

- if err != nil {

- return false

- }

- for _, name := range names {

- if !strings.HasSuffix(name, ".json") {

- continue

- }

- raw, err := dir.Read(name)

- if err != nil {

- return false

- }

- p, err := release.VerifySystemIdentity(pub, raw)

- if err != nil {

- return false

- }

- artifact, ok := p.Current.ConsoleArtifacts[release.AdoptPlatform()]

- if ok && p.Current.Version == version && artifact.SHA256 == digest && name == p.Current.ReleaseTag+".json" {

- return true

- }

- return false

func (s *proofBindingSource) findRecord(ctx context.Context, host string) (*provision.Record, string, error) {

if !s.cacheIndex {

return provision.FindRecordByHost(ctx, s.store, host)

diff --git a/internal/host/proofobserve.go b/internal/host/proofobserve.go

index 0b7db3339..9fcc8d5f5 100644

--- a/internal/host/proofobserve.go

+++ b/internal/host/proofobserve.go

@@ -130,24 +130,6 @@ func (o proofObserver) observe(rt registry.Route, after time.Duration) (liveBuil

invocation: before.InvocationID, pid: before.MainPID, start: start, binding: binding}, nil

}

-// recordSettled is checkedUnitRestart's settled hook on the root pass: hash

-// the executable that just passed the settle check and add it to the app's

-// healthy history. Every failure is a log line; a missed record costs only a

-// proof wait later.

-//

-// It holds the process to observe's two equalities (Ruling 8): the unit's

-// ExecPath is the route's live link, and the bytes of /proc/<MainPID>/exe

-// are the live link's. This Show is a second look after the settle, and in

-// that moment the unit can have restarted, or its new process not yet exec'd

-// the binary; without both checks such a process's bytes could enter the

-// history. A build missed here is recorded later by the root pass's "live for

-// after" rule.

-func recordSettled(sys unitSystem, procExe func(pid int) string, optDir, bakeDir string, now func() time.Time) func(rt registry.Route) error {

- o := productionProofObserver(optDir)

- o.sys, o.procExe, o.now = sys, procExe, now

- return o.recordSettled(bakeDir)

func (o proofObserver) recordSettled(history string) func(registry.Route) error {

return func(rt registry.Route) error {

if rt.Unit == "" || rt.Unit == activator.UnitName(rt.Host) {

diff --git a/internal/host/relocationcensus_test.go b/internal/host/relocationcensus_test.go

index 174c73b6a..f6aefef34 100644

--- a/internal/host/relocationcensus_test.go

+++ b/internal/host/relocationcensus_test.go

@@ -42,7 +42,7 @@ func censusWithSharedFiles(t *testing.T, classified string, files map[string]str

t.Fatal(err)

}

defer reg.Close()

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(r.DataDir, ".hostclaims", "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(r.DataDir, ".hostclaims", "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/relocationinstall_linux_test.go b/internal/host/relocationinstall_linux_test.go

index 31601027a..f4df9b38e 100644

--- a/internal/host/relocationinstall_linux_test.go

+++ b/internal/host/relocationinstall_linux_test.go

@@ -137,7 +137,7 @@ func (f *installFixture) onBox(r ClaimRuntimeResources, actor hostbox.Actor) {

}

reg := f.reg

t.Cleanup(func() { reg.Close() })

- if f.inv, err = hostbox.OpenStopInventoryDB(filepath.Join(r.DataDir, ".hostclaims", "inventory.db")); err != nil {

+ if f.inv, err = openLegacyInventory(t, filepath.Join(r.DataDir, ".hostclaims", "inventory.db")); err != nil {

t.Fatal(err)

}

inv := f.inv

diff --git a/internal/host/relocationparticipation_linux_test.go b/internal/host/relocationparticipation_linux_test.go

index 92c49c07b..16a8b7529 100644

--- a/internal/host/relocationparticipation_linux_test.go

+++ b/internal/host/relocationparticipation_linux_test.go

@@ -99,7 +99,7 @@ func newParticipationBox(t *testing.T) *participationBox {

}

b.guard = hostguard.Guard{DataDir: b.data, LockDir: filepath.Join(locks, "hostguard"), Claims: hostguard.StoreReader{Store: b.store}}

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(t.TempDir(), "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/rootgeneration_kernel_linux.go b/internal/host/rootgeneration_kernel_linux.go

index cfb22640a..50a229a1c 100644

--- a/internal/host/rootgeneration_kernel_linux.go

+++ b/internal/host/rootgeneration_kernel_linux.go

@@ -30,9 +30,6 @@ type generationKernel struct {

contained []release.GenerationReservation

}

-func generationMajor(dev uint64) uint32 { return unix.Major(dev) }

-func generationMinor(dev uint64) uint32 { return unix.Minor(dev) }

func generationRead(path string) ([]byte, error) {

f, err := os.Open(path)

if err != nil {

diff --git a/internal/host/rootgeneration_kernel_linux_removed_test.go b/internal/host/rootgeneration_kernel_linux_removed_test.go

new file mode 100644

index 000000000..5b476fa41

--- /dev/null

+++ b/internal/host/rootgeneration_kernel_linux_removed_test.go

@@ -0,0 +1,9 @@

+//go:build linux

+package host

+import "golang.org/x/sys/unix"

+func generationMajor(dev uint64) uint32 { return unix.Major(dev) }

+func generationMinor(dev uint64) uint32 { return unix.Minor(dev) }

diff --git a/internal/host/rootmigration_historic_linux_test.go b/internal/host/rootmigration_historic_linux_test.go

index 5259aabd0..e5b47a1e4 100644

--- a/internal/host/rootmigration_historic_linux_test.go

+++ b/internal/host/rootmigration_historic_linux_test.go

@@ -77,7 +77,7 @@ func migrationHistoricFixture(t *testing.T, store release.Store, r ClaimRuntimeR

t.Fatal(err)

}

in := hostbox.StopInventory{Complete: true, Host: rec.Host, Incarnation: inc, InstallationStamp: 1, Box: actor.Box, Enrollment: actor.Enrollment, DirectoryRevision: "1", Entries: []hostbox.StopInventoryEntry{{Kind: "path", ArtifactID: "historic-data", ManagedRoot: "data", RelativePath: "historic-data", Ownership: "historic-owner", Materialization: "materialized", Device: uint64(st.Dev), Inode: st.Ino, Type: st.Mode & unix.S_IFMT}, {Kind: "timer", ArtifactID: "timer", ManagedRoot: "timers", RelativePath: rec.Host + "/refresh", Ownership: "historic-owner", Materialization: "materialized"}}}

- inventory, err := hostbox.OpenStopInventoryDB(filepath.Join(legacy, "inventory.db"))

+ inventory, err := openLegacyInventory(t, filepath.Join(legacy, "inventory.db"))

if err != nil {

t.Fatal(err)

}

diff --git a/internal/host/rootmigration_installed_root_linux_test.go b/internal/host/rootmigration_installed_root_linux_test.go

index 082c10e84..b5478399d 100644

--- a/internal/host/rootmigration_installed_root_linux_test.go

+++ b/internal/host/rootmigration_installed_root_linux_test.go

@@ -24,6 +24,8 @@ const migrationInstalledDir = "/var/lib/plan14-p3-migration-installed"

const migrationInstalledUnit = "plan14-p3-migration-installed.service"

type migrationInstalledFixture struct {

+ Timer registry.Timer

+ Registry, TimerRegistration string

Data, Opt, Units, Scratch, PublicKey, Boot string

Target hostguard.FenceTarget

Receipt []byte

@@ -52,7 +54,22 @@ func saveMigrationInstalled(t *testing.T, store release.Store, r ClaimRuntimeRes

if err != nil {

t.Fatal(err)

}

- f := migrationInstalledFixture{r.DataDir, r.OptDir, r.UnitsDir, scratch, os.Getenv("CARLOS_RELEASE_PUBKEY"), string(boot), target, receipt}

+ timer, err := r.Registry.GetTimer(target.Host, "refresh")

+ if err != nil || timer == nil || !timer.ClaimOwnership.Valid() {

+ t.Fatal("unadopted reboot timer", timer, err)

+ }

+ f := migrationInstalledFixture{Data: r.DataDir, Opt: r.OptDir, Units: r.UnitsDir, Scratch: scratch, PublicKey: os.Getenv("CARLOS_RELEASE_PUBKEY"), Boot: string(boot), Registry: r.Registry.Path(), TimerRegistration: timer.Registration, Timer: *timer, Target: target, Receipt: receipt}

+ if err := r.Registry.Close(); err != nil {

+ t.Fatal(err)

+ }

+ registryBytes, err := os.ReadFile(f.Registry)

+ if err != nil {

+ t.Fatal(err)

+ }

+ f.Registry = filepath.Join(migrationInstalledDir, "registry.db")

+ if err := writeFileDurable(f.Registry, registryBytes, 0600); err != nil {

+ t.Fatal(err)

+ }

raw, err := json.Marshal(f)

if err != nil {

t.Fatal(err)

@@ -190,7 +207,7 @@ func TestPlan14MigrationInstalledStartupPayload(t *testing.T) {

t.Fatal(err)

}

owners.RetirementAuthority.Directory.PublicKey = pub

- reg, err := registry.Open(filepath.Join(migrationInstalledDir, "registry.db"))

+ reg, err := registry.Open(f.Registry)

if err != nil {

t.Fatal(err)

}

@@ -206,6 +223,16 @@ func TestPlan14MigrationInstalledStartupPayload(t *testing.T) {

t.Fatal("reboot changed receipt", err)

}

captured := hostguard.Captured{Incarnation: f.Target.Incarnation, Stamp: f.Target.Stamp}

+ timer, err := reg.GetTimer(f.Target.Host, "refresh")

+ expectedTimer := f.Timer

+ expectedTimer.Registration = f.TimerRegistration

+ if err != nil || *timer != expectedTimer || timer.ClaimRowID != f.TimerRegistration || timer.ClaimIncarnation != f.Target.Incarnation || timer.ClaimStamp != f.Target.Stamp {

+ t.Fatal("reboot timer identity", timer, err)

+ }

+ view, err := assembly.Guard.Root.Installation(t.Context(), f.Target.Host, captured)

+ if err != nil || view.Artifacts.Timers != "refresh" || view.InventoryRevision != 2 {

+ t.Fatal("reboot root timer inventory", view, err)

+ }

launches := 0

launch := func() error { launches++; return exec.Command("/usr/bin/true").Run() }

allow := func(*hostclaim.Claim) error { return nil }

diff --git a/internal/host/rootmigration_production_linux.go b/internal/host/rootmigration_production_linux.go

index 848f754f3..445eed004 100644

--- a/internal/host/rootmigration_production_linux.go

+++ b/internal/host/rootmigration_production_linux.go

@@ -61,11 +61,8 @@ func migrateRootClaimAuthority(ctx context.Context, store release.Store, r Claim

_, inventory := hostbox.RemoteJournals(func(ctx context.Context, q hostbox.JournalRequest) (hostbox.JournalResponse, error) {

return journals.Execute(ctx, "root-migration", q)

})

+ timers := rootMigrationTimers{state: state, registry: r.Registry, inventory: inventory, guard: guard}

completeInventory := func(ctx context.Context, item rootMigrationItem, target hostguard.FenceTarget) error {

- in, revision, err := inventory.Snapshot(ctx, item.Installation.Host, hostguard.Captured{Incarnation: item.Installation.Incarnation, Stamp: item.Installation.Stamp})

- if err != nil {

- return err

- }

observed, err := (hostguard.StoreReader{Store: store}).Read(ctx, item.Installation.Host)

if err != nil || observed.Claim == nil {

return errRootMigrationBusy

@@ -74,14 +71,7 @@ func migrateRootClaimAuthority(ctx context.Context, store release.Store, r Claim

if err != nil {

return err

}

- prior := item.Installation

- // The signed complete inventory plus the offline physical census establishes this history.

- prior.Artifacts.Schema = 1

- artifacts, err := rootInventoryArtifacts(prior, canonical, in, revision)

- if err != nil {

- return err

- }

- return root.CompleteMigrationInventory(ctx, target, revision, artifacts)

+ return timers.adopt(ctx, item, target, canonical)

}

coordinator := ClaimStopCoordinator{Guard: guard, Claims: hostguard.StoreReader{Store: store}, Inventory: inventory, Kernel: newProductionStopKernel(launches, roots), Evidence: store, EvidenceSigner: owners.EvidenceKey, RequestLimit: hostbox.RequestLimit, Now: time.Now, NewID: func() string { return "migration-" + randomMigrationID() }}

m := rootMigration{guardReady: func(context.Context) error {

@@ -103,6 +93,14 @@ func migrateRootClaimAuthority(ctx context.Context, store release.Store, r Claim

if target.Host != in.Host || target.Incarnation != in.Incarnation || target.Stamp != in.Stamp || target.Session != item.Session {

continue

}

+ if pending, exists, err := timers.load(item); err != nil {

+ return err

+ } else if exists {

+ if err := verifyMigrationStopped(ctx, launches, inventory, l, roots); err != nil {

+ return err

+ }

+ return completeInventory(ctx, item, pending.Target)

+ }

result, err := recoverMigrationStop(ctx, coordinator, store, owners.RetirementAuthority.Directory, launches, inventory, l, item.ClaimETag, roots)

if err != nil {

return err

@@ -135,6 +133,13 @@ func migrateRootClaimAuthority(ctx context.Context, store release.Store, r Claim

if err := (ClaimRootHTTP{Reconcile: hostbox.ReconcileAdapter{Registry: r.Registry}}).verifyInventoryTimers(in); err != nil {

return err

}

+ for _, e := range in.Entries {

+ if e.Kind == "timer" {

+ if err := (ClaimRootHTTP{Reconcile: hostbox.ReconcileAdapter{Registry: r.Registry}}).verifyInventoryTimer(in.Host, timers.owner(item, e.RowIdentity), e); err != nil {

+ return err

+ }

all = append(all, in)

}

if err := hostbox.CheckMigrationRoots(ctx, roots, claimGlobalSharedPaths(r), all); err != nil {

diff --git a/internal/host/rootmigration_timers.go b/internal/host/rootmigration_timers.go

new file mode 100644

index 000000000..43b6d0717

--- /dev/null

+++ b/internal/host/rootmigration_timers.go

@@ -0,0 +1,204 @@

+package host

+import (

+ "context"

+ "crypto/sha256"

+ "encoding/hex"

+ "encoding/json"

+ "errors"

+ "fmt"

+ "os"

+ "reflect"

+ "strings"

+ "github.com/carlosframework/platform/internal/hostbox"

+ "github.com/carlosframework/platform/internal/hostguard"

+ "github.com/carlosframework/platform/internal/registry"

+ "github.com/carlosframework/platform/internal/rootparticipation"

+ "github.com/carlosframework/platform/internal/rootstate"

+type rootMigrationTimerRecord struct {

+ Schema int

+ Target hostguard.FenceTarget

+ Before, Next hostbox.StopInventory

+ Revision uint64

+ Rows []registry.Timer

+ Registrations []string

+ Artifacts hostguard.InstallationArtifacts

+type rootMigrationTimers struct {

+ state rootstate.Store

+ registry *registry.Registry

+ inventory *hostbox.StopInventoryDB

+ guard hostguard.Guard

+func (m rootMigrationTimers) key(item rootMigrationItem) string {

+ in := item.Installation

+ return "timers-" + generationInventoryDigest([]any{in.Host, in.Incarnation, in.Stamp, item.Session}) + ".json"

+func (m rootMigrationTimers) owner(item rootMigrationItem, registration string) registry.ClaimOwnership {

+ in := item.Installation

+ sum := sha256.Sum256([]byte(fmt.Sprintf("%s\x00%s\x00%d\x00%s", in.Host, in.Incarnation, in.Stamp, in.Box)))

+ return registry.ClaimOwnership{ClaimIncarnation: in.Incarnation, ClaimStamp: in.Stamp, ClaimOwner: hex.EncodeToString(sum[:]), ClaimRowID: registration}

+func (m rootMigrationTimers) load(item rootMigrationItem) (rootMigrationTimerRecord, bool, error) {

+ var r rootMigrationTimerRecord

+ raw, err := m.state.Read(m.key(item))

+ if errors.Is(err, os.ErrNotExist) {

+ return r, false, nil

+ }

+ if err != nil {

+ return r, false, err

+ }

+ in := item.Installation

+ if rootparticipation.Decode(raw, &r) != nil || r.Schema != 1 || r.Revision == 0 || r.Revision == ^uint64(0) || r.Target.Host != in.Host || r.Target.Incarnation != in.Incarnation || r.Target.Stamp != in.Stamp || r.Target.Session != item.Session || r.Target.Box != in.Box || r.Target.Enrollment != in.Enrollment {

+ return r, false, errRootMigrationBusy

+ }

+ if len(r.Rows) != len(r.Registrations) {

+ return r, false, errRootMigrationBusy

+ }

+ for i, id := range r.Registrations {

+ if id == "" {

+ return r, false, errRootMigrationBusy

+ }

+ r.Rows[i].Registration = id

+ }

+ return r, true, nil

+func (m rootMigrationTimers) adopt(ctx context.Context, item rootMigrationItem, target hostguard.FenceTarget, canonical registry.Route) error {

+ if m.state == nil || m.registry == nil || m.inventory == nil || m.guard.Root == nil {

+ return errRootMigrationBusy

+ }

+ r, exists, err := m.load(item)

+ if err != nil {

+ return err

+ }

+ if exists {

+ if r.Target != target {

+ return errRootMigrationBusy

+ }

+ } else {

+ in, rev, err := m.inventory.Snapshot(ctx, target.Host, hostguard.Captured{Incarnation: target.Incarnation, Stamp: target.Stamp})

+ if err != nil {

+ return err

+ }

+ if !in.Complete || rev == 0 || rev == ^uint64(0) || in.Host != item.Installation.Host || in.Incarnation != item.Installation.Incarnation || in.InstallationStamp != item.Installation.Stamp || in.Box != item.Installation.Box || in.Enrollment != item.Installation.Enrollment {

+ return errRootMigrationBusy

+ }

+ rows, err := m.registry.TimersFor(in.Host)

+ if err != nil {

+ return err

+ }

+ r = rootMigrationTimerRecord{Schema: 1, Target: target, Before: in, Next: in, Revision: rev, Rows: rows}

+ for _, row := range rows {

+ r.Registrations = append(r.Registrations, row.Registration)

+ }

+ r.Next.Entries = append([]hostbox.StopInventoryEntry(nil), in.Entries...)

+ matched := map[string]bool{}

+ for i, e := range r.Next.Entries {

+ if e.Kind != "timer" {

+ continue

+ }

+ name := strings.TrimPrefix(e.RelativePath, in.Host+"/")

+ if name == e.RelativePath || name == "" || strings.ContainsAny(name, "/\\\r\n\x00") || matched[name] || e.TimerRetired || e.Materialization != "materialized" {

+ return errRootMigrationBusy

+ }

+ found := false

+ for _, row := range rows {

+ if row.Name != name {

+ continue

+ }

+ found = true

+ matched[name] = true

+ owner := m.owner(item, row.Registration)

+ if row.Registration == "" || row.Host != in.Host || (row.ClaimOwnership != (registry.ClaimOwnership{}) && (row.ClaimOwnership != owner || e.RowIdentity != row.Registration || e.Ownership != owner.ClaimOwner)) {

+ return errRootMigrationBusy

+ }

+ e.ManagedRoot, e.RowIdentity, e.Ownership = "registry", row.Registration, owner.ClaimOwner

+ e.Device, e.Inode, e.Type = 0, 0, 0

+ r.Next.Entries[i] = e

+ }

+ if !found {

+ return errRootMigrationBusy

+ }

+ if len(matched) != len(rows) {

+ return errRootMigrationBusy

+ }

+ prior := item.Installation

+ prior.Artifacts.Schema = 1

+ r.Artifacts, err = rootInventoryArtifacts(prior, canonical, r.Next, rev)

+ if err != nil {

+ return err

+ }

+ // The original inventory remains bound to root's completed receipt. Registry

+ // observations cannot replace the stop proof or the retained session denial.

+ receipt, err := m.guard.FenceReceiptFor(ctx, r.Target)

+ if err != nil {

+ return err

+ }

+ var proof StopReceipt

+ if json.Unmarshal(receipt.Bytes, &proof) != nil || proof.InventorySHA256 != digestStop(r.Before) {

+ return errRootMigrationBusy

+ }

+ view, err := m.guard.Root.View(ctx, target.Host, hostguard.Captured{Incarnation: target.Incarnation, Stamp: target.Stamp})

+ if err != nil {

+ return err

+ }

+ denied := false

+ for _, d := range view.MigrationDenies {

+ if d.Incarnation == target.Incarnation && d.Stamp >= target.Stamp && d.Session >= target.Session {

+ denied = true

+ }

+ if !denied {

+ return errRootMigrationBusy

+ }

+ raw, err := json.Marshal(r)

+ if err != nil {

+ return err

+ }

+ if err := m.state.Write(m.key(item), raw); err != nil {

+ return err

+ }

+ current, rev, err := m.inventory.Snapshot(ctx, target.Host, hostguard.Captured{Incarnation: target.Incarnation, Stamp: target.Stamp})

+ if err != nil {

+ return err

+ }

+ before := rev == r.Revision && reflect.DeepEqual(current, r.Before)

+ after := rev == r.Revision+1 && reflect.DeepEqual(current, r.Next)

+ if !before && !after {

+ return errRootMigrationBusy

+ }

+ rows, err := m.registry.TimersFor(target.Host)

+ if err != nil {

+ return err

+ }

+ if len(rows) != len(r.Rows) {

+ return errRootMigrationBusy

+ }

+ for _, observed := range r.Rows {

+ owned := observed

+ owned.ClaimOwnership = m.owner(item, observed.Registration)

+ current, err := m.registry.GetTimer(observed.Host, observed.Name)

+ if err != nil {

+ return err

+ }

+ if *current == observed && observed.ClaimOwnership == (registry.ClaimOwnership{}) {

+ if err := m.registry.AdoptClaimTimer(ctx, observed, owned.ClaimOwnership); err != nil {

+ return err

+ }

+ } else if *current != owned {

+ return errRootMigrationBusy

+ }

+ if before {

+ if err := m.inventory.WriteStopInventory(ctx, r.Next); err != nil {

+ return err

+ }

+ return m.guard.Root.CompleteMigrationInventory(ctx, target, r.Revision+1, r.Artifacts, r.Revision)

diff --git a/internal/host/rootmigration_timers_root_linux_test.go b/internal/host/rootmigration_timers_root_linux_test.go

new file mode 100644

index 000000000..b5f5ef668

--- /dev/null

+++ b/internal/host/rootmigration_timers_root_linux_test.go

@@ -0,0 +1,45 @@

+//go:build linux && rootrunner

+package host

+import (

+ "github.com/carlosframework/platform/internal/rootstate"

+ "os"

+ "path/filepath"

+ "testing"

+func TestPlan14RootMigrationTimerAdoptionRootRunner(t *testing.T) {

+ testRootMigrationTimerAdoption(t, func(t *testing.T) rootstate.Store {

+ state, err := rootstate.Open(filepath.Join(generationRootRunnerDir(t), "authority"), true, false)

+ if err != nil {

+ t.Fatal(err)

+ }

+ return state

+ }, func(t *testing.T, r *ClaimRuntimeResources) {

+ uid, gid := generationRunnerRegistryUser(t)

+ path := r.Registry.Path()

+ if err := r.Registry.Close(); err != nil {

+ t.Fatal(err)

+ }

+ for dir := filepath.Dir(path); dir != "/tmp" && dir != "/var/lib" && dir != "/"; dir = filepath.Dir(dir) {

+ if err := os.Chmod(dir, 0755); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.Chown(filepath.Dir(path), uid, gid); err != nil {

+ t.Fatal(err)

+ }

+ for _, suffix := range []string{"", "-wal", "-shm"} {

+ if err := os.Chown(path+suffix, uid, gid); err != nil && !os.IsNotExist(err) {

+ t.Fatal(err)

+ }

+ reg, err := openRegistryChild(path, uid, gid)

+ if err != nil {

+ t.Fatal(err)

+ }

+ r.Registry = reg

+ t.Cleanup(func() { reg.Close() })

+ })

diff --git a/internal/host/rootmigration_timers_test.go b/internal/host/rootmigration_timers_test.go

new file mode 100644

index 000000000..c5d1a1e37

--- /dev/null

+++ b/internal/host/rootmigration_timers_test.go

@@ -0,0 +1,206 @@

+//go:build linux

+package host

+import (

+ "context"

+ "encoding/json"

+ "errors"

+ "os"

+ "path/filepath"

+ "testing"

+ "time"

+ "github.com/carlosframework/platform/internal/hostbox"

+ "github.com/carlosframework/platform/internal/hostclaim"

+ "github.com/carlosframework/platform/internal/hostguard"

+ "github.com/carlosframework/platform/internal/hostops"

+ "github.com/carlosframework/platform/internal/registry"

+ "github.com/carlosframework/platform/internal/rootstate"

+type migrationTimerFault struct {

+ rootstate.Store

+ fail bool

+func (s *migrationTimerFault) Write(n string, b []byte) error {

+ if err := s.Store.Write(n, b); err != nil {

+ return err

+ }

+ if s.fail {

+ s.fail = false

+ return os.ErrInvalid

+ }

+ return nil

+func TestPlan14RootMigrationTimerAdoption(t *testing.T) {

+ testRootMigrationTimerAdoption(t, func(t *testing.T) rootstate.Store { return &rollbackDisk{dir: t.TempDir()} }, nil)

+func testRootMigrationTimerAdoption(t *testing.T, open func(*testing.T) rootstate.Store, prepareRegistry func(*testing.T, *ClaimRuntimeResources)) {

+ for _, attack := range []string{"none", "intent-sync", "after-row", "after-inventory", "after-root", "registration", "contents", "foreign-owner", "erased-row", "extra-row", "missing-receipt", "missing-deny"} {

+ t.Run(attack, func(t *testing.T) {

+ store, r, owners, _ := fix4JournalFixture(t)

+ if prepareRegistry != nil {

+ prepareRegistry(t, &r)

+ }

+ actor, err := owners.Identity.Verify(t.Context())

+ if err != nil {

+ t.Fatal(err)

+ }

+ target, receipt := migrationHistoricFixture(t, store, r, owners.ClaimOwnerBindings, actor, &hostops.BackfillPlan{Hosts: map[string]hostops.BackfillHost{}})

+ j, err := hostbox.OpenLaunchJournal(filepath.Join(t.TempDir(), "root.db"))

+ if err != nil {

+ t.Fatal(err)

+ }

+ defer j.Close()

+ svc, err := hostbox.NewJournalService(j)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if err := svc.MigrateLegacy(t.Context(), filepath.Join(r.DataDir, ".hostclaims"), actor.Box, actor.Enrollment, func(context.Context) (func(), error) { return func() {}, nil }, legacyJournalProof(store, owners.RetirementAuthority.Directory)); err != nil {

+ t.Fatal(err)

+ }

+ fstate := &migrationTimerFault{Store: open(t)}

+ defer fstate.Close()

+ root := hostguard.NewRootAuthority(fstate)

+ guard := hostguard.Guard{Root: root, LockDir: t.TempDir(), DataDir: r.DataDir, Claims: hostguard.StoreReader{Store: store}}

+ item := rootMigrationItem{Installation: hostguard.RootInstallation{Host: target.Host, Incarnation: target.Incarnation, Stamp: target.Stamp, Account: "bab", App: "app", Record: "apps/bab/app/instances/" + target.Host + ".json", Box: target.Box, Enrollment: target.Enrollment, Migration: 1}, Session: target.Session, ClaimETag: target.ClaimETag}

+ if attack != "missing-deny" {

+ if err := root.RetainMigrationDeny(t.Context(), item.Installation, item.Session); err != nil {

+ t.Fatal(err)

+ }

+ if attack == "missing-deny" {

+ if err := guard.EstablishRoot(t.Context(), item.Installation, func(*hostclaim.Claim) error { return nil }); err != nil {

+ t.Fatal(err)

+ }

+ if attack != "missing-receipt" {

+ if _, err := guard.BeginFence(t.Context(), target); err != nil {

+ t.Fatal(err)

+ }

+ if err := guard.CompleteFence(t.Context(), target, receipt, time.Now(), func(context.Context, hostguard.FenceTarget, []byte, time.Time) error { return nil }); err != nil {

+ t.Fatal(err)

+ }

+ state := &migrationTimerFault{Store: open(t), fail: attack == "intent-sync"}

+ defer state.Close()

+ m := rootMigrationTimers{state: state, registry: r.Registry, inventory: svc.Inventory, guard: guard}

+ original, err := r.Registry.GetTimer(target.Host, "refresh")

+ if err != nil {

+ t.Fatal(err)

+ }

+ canonical := registry.Route{Host: target.Host, Account: "bab", App: "app"}

+ if attack == "missing-receipt" || attack == "missing-deny" {

+ if m.adopt(t.Context(), item, target, canonical) == nil {

+ t.Fatal("adoption without stopped root authority")

+ }

+ got, err := r.Registry.GetTimer(target.Host, "refresh")

+ if err != nil || *got != *original {

+ t.Fatal("row changed before root authority", got, err)

+ }

+ if _, exists, err := m.load(item); err != nil || exists {

+ t.Fatal("intent written before root authority", exists, err)

+ }

+ return

+ }

+ if attack != "none" {

+ state.fail = true

+ if m.adopt(t.Context(), item, target, canonical) == nil {

+ t.Fatal("intent sync acknowledged")

+ }

+ got, _ := r.Registry.GetTimer(target.Host, "refresh")

+ if *got != *original {

+ t.Fatal("row changed before durable intent")

+ }

+ rec, ok, err := m.load(item)

+ if err != nil || !ok {

+ t.Fatal(ok, err)

+ }

+ owned := rec.Rows[0]

+ owned.ClaimOwnership = m.owner(item, owned.Registration)

+ switch attack {

+ case "after-row", "after-inventory", "after-root":

+ if err := r.Registry.AdoptClaimTimer(t.Context(), rec.Rows[0], owned.ClaimOwnership); err != nil {

+ t.Fatal(err)

+ }

+ if attack != "after-row" {

+ if err := svc.Inventory.WriteStopInventory(t.Context(), rec.Next); err != nil {

+ t.Fatal(err)

+ }

+ if attack == "after-root" {

+ fstate.fail = true

+ if err := root.CompleteMigrationInventory(t.Context(), target, rec.Revision+1, rec.Artifacts, rec.Revision); err == nil {

+ t.Fatal("root sync acknowledged")

+ }

+ case "foreign-owner":

+ if err := r.Registry.AdoptClaimTimer(t.Context(), *original, registry.ClaimOwnership{ClaimIncarnation: "foreign", ClaimStamp: 2, ClaimOwner: "foreign", ClaimRowID: original.Registration}); err != nil {

+ t.Fatal(err)

+ }

+ case "registration", "contents":

+ changed := *original

+ if attack == "registration" {

+ changed.Registration = "replacement"

+ }

+ if attack == "contents" {

+ changed.Path = "/changed"

+ }

+ if err := r.Registry.ReplaceTimers(target.Host, []registry.Timer{changed}); err != nil {

+ t.Fatal(err)

+ }

+ case "erased-row":

+ if err := r.Registry.DeleteTimer(target.Host, "refresh"); err != nil {

+ t.Fatal(err)

+ }

+ case "extra-row":

+ if err := r.Registry.UpsertTimer(registry.Timer{Host: target.Host, Name: "extra", Kind: "cron", Spec: "0 0 * * *", Path: "/extra"}); err != nil {

+ t.Fatal(err)

+ }

+ err = m.adopt(t.Context(), item, target, canonical)

+ refused := attack == "registration" || attack == "contents" || attack == "foreign-owner" || attack == "erased-row" || attack == "extra-row"

+ if (err != nil) != refused {

+ t.Fatalf("refused=%v: %v", refused, err)

+ }

+ if refused {

+ return

+ }

+ if err = m.adopt(t.Context(), item, target, canonical); err != nil {

+ t.Fatal("replay", err)

+ }

+ got, err := r.Registry.GetTimer(target.Host, "refresh")

+ want := *original

+ want.ClaimOwnership = m.owner(item, original.Registration)

+ if err != nil || *got != want {

+ t.Fatal("identity or bookkeeping changed", got, err)

+ }

+ in, rev, err := svc.Inventory.Snapshot(t.Context(), target.Host, hostguard.Captured{Incarnation: target.Incarnation, Stamp: target.Stamp})

+ if err != nil || rev != 2 {

+ t.Fatal("inventory revision", rev, err)

+ }

+ e := in.Entries[1]

+ if e.ManagedRoot != "registry" || e.RowIdentity != original.Registration || e.Ownership != want.ClaimOwner {

+ t.Fatal("timer not inventoried", e)

+ }

+ retained, err := root.Installation(t.Context(), target.Host, hostguard.Captured{Incarnation: target.Incarnation, Stamp: target.Stamp})

+ if err != nil || retained.InventoryRevision != rev {

+ t.Fatal("root revision", retained, err)

+ }

+ var decoded StopReceipt

+ if json.Unmarshal(receipt, &decoded) != nil {

+ t.Fatal("receipt")

+ }

+ saved, err := guard.FenceReceiptFor(t.Context(), target)

+ if err != nil || string(saved.Bytes) != string(receipt) {

+ t.Fatal("receipt changed", err)

+ }

+ if _, err := state.Read("absent"); !errors.Is(err, os.ErrNotExist) {

+ t.Fatal(err)

+ }

+ })

+ }

diff --git a/internal/host/rootmovesfloor_source.go b/internal/host/rootmovesfloor_source.go

index 06386d6e3..2fcff9fd1 100644

--- a/internal/host/rootmovesfloor_source.go

+++ b/internal/host/rootmovesfloor_source.go

@@ -183,9 +183,6 @@ func readRootProtocolProjection(dir string) (rootFloorProjection, error) {

return p, nil

}

-func readRootLegacyFloorJSON(dd string) (*moves.Floor, error) {

- return readRootLegacyProtocolJSON(dd, moves.FloorFile)

func readRootLegacyProtocolJSON(dd, name string) (*moves.Floor, error) {

file, err := openBeneath(dd, strings.Split(filepath.ToSlash(name), "/")...)

if errors.Is(err, os.ErrNotExist) {

diff --git a/internal/host/rootrecovery_rebind_test.go b/internal/host/rootrecovery_rebind_test.go

index b252fc944..cc1d07c84 100644

--- a/internal/host/rootrecovery_rebind_test.go

+++ b/internal/host/rootrecovery_rebind_test.go

@@ -83,7 +83,7 @@ func TestPlan14RecoveryRebindAuthority(t *testing.T) {

t.Fatal(err)

}

case "missing inventory":

- root.Reconcile.Inventory, _ = hostbox.OpenStopInventoryDB(filepath.Join(t.TempDir(), "missing.db"))

+ root.Reconcile.Inventory, _ = openLegacyInventory(t, filepath.Join(t.TempDir(), "missing.db"))

t.Cleanup(func() { root.Reconcile.Inventory.Close() })

case "plain stopped report":

o := f.read()

diff --git a/internal/host/rootrestart.go b/internal/host/rootrestart.go

index 41db59b68..9730bc3de 100644

--- a/internal/host/rootrestart.go

+++ b/internal/host/rootrestart.go

@@ -519,10 +519,6 @@ func rootStartRoute(reg *registry.Registry, optDir string, checks rootRestartChe

return rollbackUnitRestart(reg, systemdUnits{}, optDir, os.Getenv, checks)

}

-func rootRestartRoute(reg *registry.Registry, optDir string, settled func(registry.Route) error) func(string) error {

- return rootRestartRouteWith(reg, systemdUnits{}, optDir, os.Getenv, settled, productionRootRestartChecks(systemdUnits{}, optDir))

func rootSelectedRestart(reg *registry.Registry, sys unitSystem, optDir string, getenv func(string) string, settled func(registry.Route) error, checks rootRestartChecks, rollback bool) hostwrite.Callback {

return func(ctx context.Context, selected hostwrite.Selection) error {

if selected.Work == nil {

diff --git a/internal/host/rootrestart_removed_test.go b/internal/host/rootrestart_removed_test.go

new file mode 100644

index 000000000..67c43a852

--- /dev/null

+++ b/internal/host/rootrestart_removed_test.go

@@ -0,0 +1,11 @@

+package host

+import (

+ "os"

+ "github.com/carlosframework/platform/internal/registry"

+func rootRestartRoute(reg *registry.Registry, optDir string, settled func(registry.Route) error) func(string) error {

+ return rootRestartRouteWith(reg, systemdUnits{}, optDir, os.Getenv, settled, productionRootRestartChecks(systemdUnits{}, optDir))

diff --git a/internal/host/systemparticipation.go b/internal/host/systemparticipation.go

index 740f9721c..cbf244a95 100644

--- a/internal/host/systemparticipation.go

+++ b/internal/host/systemparticipation.go

@@ -5,11 +5,12 @@ import (

"encoding/json"

"errors"

"fmt"

- "github.com/carlosframework/platform/internal/rootparticipation"

"os"

"path/filepath"

"time"

+ "github.com/carlosframework/platform/internal/rootparticipation"

"github.com/carlosframework/platform/internal/hostfloor"

)

@@ -35,11 +36,6 @@ type updateBegun struct {

At time.Time `json:"at"`

}

-// hostexecParticipation preserves the legacy region-HA check until root owns a census.

-func hostexecParticipation(ctx context.Context, dataDir string) error {

- return hostfloor.CheckParticipation(ctx, dataDir, false)

// beginExecutableChange is §5.10's root side, run under the apply lock

// just before the first box-changing step: write the marker durably, then

// look for participation. On a refusal the marker is removed again and the

diff --git a/internal/hostbox/hold.go b/internal/hostbox/hold.go

index f7d8ae24a..73f28813f 100644

--- a/internal/hostbox/hold.go

+++ b/internal/hostbox/hold.go

@@ -2,6 +2,7 @@ package hostbox

import (

"context"

"github.com/carlosframework/platform/internal/hostwrite"

"github.com/carlosframework/platform/internal/registry"

)

@@ -25,15 +26,6 @@ func RegistryHoldPolicy(reg *registry.Registry) func(context.Context, string) (s

}

-// ChangeHold requires a previously selected phase-authorized action. The

-// registry condition retains the observed operation through a guard wait.

-func ChangeHold(ctx context.Context, work hostwrite.Work, reg *registry.Registry, rt registry.Route, expected, next string) error {

- if work == nil || reg == nil {

- return ErrUnsupported

- }

- return work.With(ctx, hostwrite.Identity{}, func() error { return reg.SetClaimHold(ctx, rt.Host, rt.ClaimOwnership, expected, next) })

func Selected(work hostwrite.Work) (Selection, error) {

w, ok := work.(selectedWork)

if !ok {

diff --git a/internal/hostbox/stopinventory_db.go b/internal/hostbox/stopinventory_db.go

index 131ad3f60..6e234632d 100644

--- a/internal/hostbox/stopinventory_db.go

+++ b/internal/hostbox/stopinventory_db.go

@@ -5,7 +5,6 @@ import (

"database/sql"

"encoding/json"

"errors"

- "net/url"

"path/filepath"

"github.com/carlosframework/platform/internal/hostguard"

@@ -17,28 +16,6 @@ type StopInventoryDB struct {

shared bool

}

-func OpenStopInventoryDB(path string) (*StopInventoryDB, error) {

- if !filepath.IsAbs(path) {

- return nil, ErrTypedInventory

- }

- if err := checkJournalPath(path); err != nil {

- return nil, err

- }

- // busy_timeout is a connection DSN pragma, in force before the first

- // statement and on any replacement connection.

- db, err := sql.Open("sqlite", "file:"+url.PathEscape(path)+"?_pragma=busy_timeout(5000)")

- if err != nil {

- return nil, err

- }

- db.SetMaxOpenConns(1)

- for _, q := range []string{"PRAGMA busy_timeout=5000", "PRAGMA journal_mode=WAL", inventoryVersionsSQL, "PRAGMA synchronous=FULL", "CREATE TABLE IF NOT EXISTS stop_inventory(host TEXT NOT NULL,incarnation TEXT NOT NULL,stamp INTEGER NOT NULL,body BLOB NOT NULL,PRIMARY KEY(host,incarnation,stamp))"} {

- if _, err := db.Exec(q); err != nil {

- db.Close()

- return nil, err

- }

- return &StopInventoryDB{db: db}, nil

func (d *StopInventoryDB) Close() error {

if d == nil {

return nil

diff --git a/internal/hostbox/stopinventory_db_removed_test.go b/internal/hostbox/stopinventory_db_removed_test.go

new file mode 100644

index 000000000..b2f813b6d

--- /dev/null

+++ b/internal/hostbox/stopinventory_db_removed_test.go

@@ -0,0 +1,30 @@

+package hostbox

+import (

+ "database/sql"

+ "net/url"

+ "path/filepath"

+func OpenStopInventoryDB(path string) (*StopInventoryDB, error) {

+ if !filepath.IsAbs(path) {

+ return nil, ErrTypedInventory

+ }

+ if err := checkJournalPath(path); err != nil {

+ return nil, err

+ }

+ // busy_timeout is a connection DSN pragma, in force before the first

+ // statement and on any replacement connection.

+ db, err := sql.Open("sqlite", "file:"+url.PathEscape(path)+"?_pragma=busy_timeout(5000)")

+ if err != nil {

+ return nil, err

+ }

+ db.SetMaxOpenConns(1)

+ for _, q := range []string{"PRAGMA busy_timeout=5000", "PRAGMA journal_mode=WAL", inventoryVersionsSQL, "PRAGMA synchronous=FULL", "CREATE TABLE IF NOT EXISTS stop_inventory(host TEXT NOT NULL,incarnation TEXT NOT NULL,stamp INTEGER NOT NULL,body BLOB NOT NULL,PRIMARY KEY(host,incarnation,stamp))"} {

+ if _, err := db.Exec(q); err != nil {

+ db.Close()

+ return nil, err

+ }

+ return &StopInventoryDB{db: db}, nil

diff --git a/internal/hostfloor/participation.go b/internal/hostfloor/participation.go

index c4f6d40d3..cb924100a 100644

--- a/internal/hostfloor/participation.go

+++ b/internal/hostfloor/participation.go

@@ -13,12 +13,6 @@ import (

"github.com/carlosframework/platform/internal/safefile"

)

-// CheckParticipation reads only directory entries. Floor-armed boxes require

-// the controller directory; legacy region HA boxes may not have one yet.

-func CheckParticipation(ctx context.Context, dataDir string, requireDirectory bool) error {

- return (Disk{}).CheckParticipation(ctx, dataDir, requireDirectory)

func (d Disk) CheckParticipation(ctx context.Context, dataDir string, requireDirectory bool) error {

return d.WithParticipation(ctx, func(ctx context.Context, l rootparticipation.Ledger) error {

if err := l.Idle(ctx); err != nil {

diff --git a/internal/hostfloor/participation_removed_test.go b/internal/hostfloor/participation_removed_test.go

new file mode 100644

index 000000000..94ee2ce49

--- /dev/null

+++ b/internal/hostfloor/participation_removed_test.go

@@ -0,0 +1,9 @@

+package hostfloor

+import "context"

+// CheckParticipation reads only directory entries. Floor-armed boxes require

+// the controller directory; legacy region HA boxes may not have one yet.

+func CheckParticipation(ctx context.Context, dataDir string, requireDirectory bool) error {

+ return (Disk{}).CheckParticipation(ctx, dataDir, requireDirectory)

diff --git a/internal/hostguard/root.go b/internal/hostguard/root.go

index 57d634dfd..116049f71 100644

--- a/internal/hostguard/root.go

+++ b/internal/hostguard/root.go

@@ -120,10 +120,7 @@ func (g Guard) CommitRootInstallation(ctx context.Context, in RootInstallation,

if commit == nil {

return ErrInvalidInput

}

- return g.CommitRootInventory(ctx, in, nil, check, nil, func(RootInstallation) error { return commit() })

-func (g Guard) CommitRootInventory(ctx context.Context, in RootInstallation, intent []byte, check func(*hostclaim.Claim) error, validate func(RootInstallation) error, commit func(RootInstallation) error) error {

- return g.CommitRootInventoryArtifacts(ctx, in, intent, check, validate, commit, nil)

+ return g.CommitRootInventoryArtifacts(ctx, in, nil, check, nil, func(RootInstallation) error { return commit() }, nil)

}

func (g Guard) CommitRootInventoryArtifacts(ctx context.Context, in RootInstallation, intent []byte, check func(*hostclaim.Claim) error, validate func(RootInstallation) error, commit func(RootInstallation) error, artifacts func(RootInstallation) (InstallationArtifacts, error)) error {

diff --git a/internal/hostguard/root_removed_test.go b/internal/hostguard/root_removed_test.go

new file mode 100644

index 000000000..3f1f585dd

--- /dev/null

+++ b/internal/hostguard/root_removed_test.go

@@ -0,0 +1,11 @@

+package hostguard

+import (

+ "context"

+ "github.com/carlosframework/platform/internal/hostclaim"

+func (g Guard) CommitRootInventory(ctx context.Context, in RootInstallation, intent []byte, check func(*hostclaim.Claim) error, validate func(RootInstallation) error, commit func(RootInstallation) error) error {

+ return g.CommitRootInventoryArtifacts(ctx, in, intent, check, validate, commit, nil)

diff --git a/internal/hostguard/rootmigration.go b/internal/hostguard/rootmigration.go

index 8ffdaa692..838b775e1 100644

--- a/internal/hostguard/rootmigration.go

+++ b/internal/hostguard/rootmigration.go

@@ -53,7 +53,7 @@ func (a *RootAuthority) RetainMigrationDeny(ctx context.Context, in RootInstalla

// CompleteMigrationInventory binds the checked inventory only after root has

// retained its own completed stop receipt for this denied session.

-func (a *RootAuthority) CompleteMigrationInventory(ctx context.Context, target FenceTarget, revision uint64, artifacts InstallationArtifacts) error {

+func (a *RootAuthority) CompleteMigrationInventory(ctx context.Context, target FenceTarget, revision uint64, artifacts InstallationArtifacts, previous ...uint64) error {

if target.validate(target.Host) != nil || revision == 0 || artifacts.Schema != 1 {

return ErrInvalidInput

}

@@ -76,7 +76,14 @@ func (a *RootAuthority) CompleteMigrationInventory(ctx context.Context, target F

completed = true

}

- if !completed || r.installation.InventoryRevision != 0 && r.installation.InventoryRevision != revision {

+ prior := revision

+ if len(previous) > 1 || len(previous) == 1 && (previous[0] == 0 || previous[0] == ^uint64(0) || previous[0]+1 != revision) {

+ return ErrInvalidInput

+ }

+ if len(previous) == 1 {

+ prior = previous[0]

+ }

+ if !completed || r.installation.InventoryRevision != 0 && r.installation.InventoryRevision != revision && r.installation.InventoryRevision != prior {

return ErrFenceTarget

}

r.installation.InventoryRevision = revision

diff --git a/internal/hostguard/rootmigration_test.go b/internal/hostguard/rootmigration_test.go

index c63b13353..19cae28eb 100644

--- a/internal/hostguard/rootmigration_test.go

+++ b/internal/hostguard/rootmigration_test.go

@@ -95,3 +95,47 @@ func TestPlan14MigrationReadmissionRequiresCompletedPredecessor(t *testing.T) {

t.Fatal("deny lost")

}

+func TestPlan14MigrationInventoryRevisionAdvance(t *testing.T) {

+ f, target, captured := fenceFixture(t)

+ root := NewRootAuthority(&rootTestStore{dir: t.TempDir()})

+ f.g.Root = root

+ f.obs.Claim.Holder.Account, f.obs.Claim.Holder.App = "bab", "app"

+ in := RootInstallation{Host: target.Host, Incarnation: captured.Incarnation, Stamp: captured.Stamp, Account: "bab", App: "app", Record: "record", Box: target.Box, Enrollment: target.Enrollment, Migration: 1}

+ if err := root.RetainMigrationDeny(t.Context(), in, target.Session); err != nil {

+ t.Fatal(err)

+ }

+ artifacts := InstallationArtifacts{Schema: 1, Timers: "refresh"}

+ if root.CompleteMigrationInventory(t.Context(), target, 4, artifacts) == nil {

+ t.Fatal("revision without stopped receipt")

+ }

+ var err error

+ target, err = f.g.BeginFence(t.Context(), target)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if err := f.g.CompleteFence(t.Context(), target, []byte("verified predecessor"), time.Now(), func(context.Context, FenceTarget, []byte, time.Time) error { return nil }); err != nil {

+ t.Fatal(err)

+ }

+ if err := root.CompleteMigrationInventory(t.Context(), target, 4, artifacts); err != nil {

+ t.Fatal(err)

+ }

+ for _, change := range [][2]uint64{{0, 1}, {3, 5}, {4, 6}, {5, 6}, {^uint64(0), 0}} {

+ if root.CompleteMigrationInventory(t.Context(), target, change[1], artifacts, change[0]) == nil {

+ t.Fatal("unbound revision advance", change)

+ }

+ if err := root.CompleteMigrationInventory(t.Context(), target, 5, artifacts, 4); err != nil {

+ t.Fatal("exact successor", err)

+ }

+ if err := root.CompleteMigrationInventory(t.Context(), target, 5, artifacts, 4); err != nil {

+ t.Fatal("retry", err)

+ }

+ if root.CompleteMigrationInventory(t.Context(), target, 4, artifacts) == nil {

+ t.Fatal("revision regressed")

+ }

+ view, err := root.View(t.Context(), target.Host, captured)

+ if err != nil || view.Installation.InventoryRevision != 5 || len(view.MigrationDenies) != 1 || view.MigrationDenies[0].Session != target.Session {

+ t.Fatal(view, err)

+ }

diff --git a/internal/provision/plan14_input_inventory_test.go b/internal/provision/plan14_input_inventory_test.go

index d345fb084..5b76cb765 100644

--- a/internal/provision/plan14_input_inventory_test.go

+++ b/internal/provision/plan14_input_inventory_test.go

@@ -339,6 +339,45 @@ func inputJSONMethods(typ types.Type, seen map[types.Type]bool) []types.Object {

return out

}

+type inputExemption struct {

+ Ruling string

+ Pending string

+var inputExemptions = map[string]inputExemption{

+ "internal/host/rootmovesfloor.go:rootMovesFloors.reconstruct": {Ruling: "P3-R4.6"},

+ "internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizeReconstruction": {Ruling: "P3-R4.6"},

+ "internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizedReconstruction": {Ruling: "P3-R4.6"},

+ "internal/hostclaim/relocation.go:StartRelocation": {Ruling: "R-E2a"},

+ "internal/hostrelocate/participant.go:Participant.Sweep": {Ruling: "R-E2a"},

+ "internal/hostrelocate/worker.go:Worker.Start": {Ruling: "R-E2a"},

+ "internal/host/claimunit_binding_source.go:readClaimUnitShapes": {Ruling: "pending track E item 4a", Pending: "4a"},

+// Update this checkpoint status when merging E's completion report. The 4a

+// exemption must be removed before either Part 2 or Part 3 lands.

+var inputTrackEComplete = map[string]bool{"4a": false}

+func checkInputExemptions(inv rootReadInventory, callers map[string]string, exemptions map[string]inputExemption, completed map[string]bool) []string {

+ var failures []string

+ for key, ex := range exemptions {

+ e, exists := inv.Entries[key]

+ if !exists || e.Class != "authority" || inv.Removed[key] != "" {

+ failures = append(failures, key+": exemption has no authority declaration")

+ }

+ if ex.Ruling == "" {

+ failures = append(failures, key+": exemption has no ruling")

+ }

+ if callers[key] != "" {

+ failures = append(failures, key+": exempt unit now has a production caller; remove exemption and supply coverage")

+ }

+ if ex.Pending != "" && completed[ex.Pending] {

+ failures = append(failures, key+": temporary exemption survived completed track E item "+ex.Pending)

+ }

+ return failures

func checkInputRow(e classifiedRootRead, callers map[string]string, tests map[string]bool) []string {

if e.Class != "authority" {

return nil

@@ -349,7 +388,7 @@ func checkInputRow(e classifiedRootRead, callers map[string]string, tests map[st

return []string{key + ": " + err.Error()}

}

var failures []string

- if callers[key] == "" {

+ if callers[key] == "" && inputExemptions[key].Ruling == "" {

failures = append(failures, key+": no production caller reachable from root entrypoint")

}

for _, name := range families {

@@ -374,8 +413,11 @@ func TestPlan14RootInputInventoryCoverage(t *testing.T) {

if err != nil {

t.Fatal(err)

}

- var failures []string

- for _, e := range inv.Entries {

+ failures := checkInputExemptions(inv, callers, inputExemptions, inputTrackEComplete)

+ for key, e := range inv.Entries {

+ if inv.Removed[key] != "" {

+ continue

+ }

failures = append(failures, checkInputRow(e, callers, tests)...)

if e.Class == "authority" {

family, _ := inputFamilyFor(e)

@@ -424,3 +466,84 @@ func TestPlan14RootInputInventoryCoverageMutations(t *testing.T) {

t.Fatal("legacy entered J4")

}

+func TestPlan14RootInputExemptions(t *testing.T) {

+ inv := rootReadInventory{Entries: map[string]classifiedRootRead{}}

+ for key := range inputExemptions {

+ inv.Entries[key] = classifiedRootRead{Class: "authority"}

+ }

+ tests := map[string]bool{}

+ for _, name := range []string{inputFamilies["A"].Hostile, inputFamilies["A"].Rename, inputFamilies["A"].Erasure, inputFamilies["A"].Retry, inputFamilies["A"].Positive} {

+ tests[name] = true

+ }

+ for key := range inputExemptions {

+ parts := strings.SplitN(key, ":", 2)

+ row := classifiedRootRead{rootReadEntry: rootReadEntry{File: parts[0], Unit: parts[1]}, Class: "authority", Task: "A"}

+ if errs := checkInputRow(row, nil, tests); len(errs) != 0 {

+ t.Fatal("callerless exemption refused", errs)

+ }

+ if len(checkInputRow(row, nil, nil)) == 0 {

+ t.Fatal("exemption waived family fixtures")

+ }

+ callers := map[string]string{}

+ if errs := checkInputExemptions(inv, callers, inputExemptions, nil); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ for key := range inputExemptions {

+ t.Run(key, func(t *testing.T) {

+ callers[key] = "main.go:main"

+ if len(checkInputExemptions(inv, callers, inputExemptions, nil)) == 0 {

+ t.Fatal("production wiring escaped exemption guard")

+ }

+ delete(callers, key)

+ e := inv.Entries[key]

+ delete(inv.Entries, key)

+ if len(checkInputExemptions(inv, callers, inputExemptions, nil)) == 0 {

+ t.Fatal("stale exemption accepted")

+ }

+ inv.Entries[key] = e

+ })

+ }

+ if len(checkInputExemptions(inv, callers, inputExemptions, map[string]bool{"4a": true})) == 0 {

+ t.Fatal("completed E4a accepted temporary exemption")

+ }

+ if len(checkInputExemptions(inv, callers, map[string]inputExemption{"unknown": {}}, nil)) == 0 {

+ t.Fatal("unruled exemption accepted")

+ }

+func TestPlan14RootInputExemptionGraphMutation(t *testing.T) {

+ root := t.TempDir()

+ write := func(name, body string) {

+ t.Helper()

+ path := filepath.Join(root, name)

+ if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.WriteFile(path, []byte(body), 0600); err != nil {

+ t.Fatal(err)

+ }

+ write("go.mod", "module fixture/root\n\ngo 1.24\n")

+ write("main.go", "package main\nfunc main(){}\n")

+ write("internal/hostclaim/relocation.go", "package hostclaim\nfunc StartRelocation(){}\n")

+ key := "internal/hostclaim/relocation.go:StartRelocation"

+ inv := rootReadInventory{Entries: map[string]classifiedRootRead{key: {Class: "authority"}}}

+ exemptions := map[string]inputExemption{key: inputExemptions[key]}

+ callers, err := inputCallers(root)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if errs := checkInputExemptions(inv, callers, exemptions, nil); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ write("main.go", "package main\nimport \"fixture/root/internal/hostclaim\"\nfunc main(){hostclaim.StartRelocation()}\n")

+ callers, err = inputCallers(root)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if callers[key] == "" || len(checkInputExemptions(inv, callers, exemptions, nil)) == 0 {

+ t.Fatal("production relocation wiring escaped the exemption")

+ }

diff --git a/internal/provision/plan14_p3_census_test.go b/internal/provision/plan14_p3_census_test.go

index e9b05da29..88e314b34 100644

--- a/internal/provision/plan14_p3_census_test.go

+++ b/internal/provision/plan14_p3_census_test.go

@@ -20,7 +20,15 @@ func TestPlan14P3OverlayPreservesLegacySeal(t *testing.T) {

// The conservative write scanner recognizes the local helper's name as a

// record-key site. These calls write root floor files, never instance records.

func plan14P3WriteCensusInventory() []censusEntry {

- return append(plan14EWriteCensusInventory(),

+ entries := plan14EWriteCensusInventory()

+ kept := make([]censusEntry, 0, len(entries))

+ for _, e := range entries {

+ if e.File == "internal/release/roothistory_delivery.go" && (e.Unit == "PublishHistoryReconstruction" || e.Unit == "PublishHistoryRecoveryRetirement") {

+ continue

+ }

+ kept = append(kept, e)

+ }

+ return append(kept,

censusEntry{"internal/host/rootmovesfloor.go", "rootMovesFloors.refresh", "key-site", "key:writeRecord", "cb70a1eefbb4f8f243090270f23141c9c9a773ee278af002c79a6c3ef6b7c3b7"},

censusEntry{"internal/host/rootmovesfloor.go", "rootMovesFloors.persist", "key-site", "key:writeRecord", "2c1e0843c5865a31c0fab011d7d4825963bbb5a301727f37f3b1b6c3519eba5e"},

censusEntry{"internal/host/rootmovesfloor.go", "rootMovesFloors.writeRecord", "key-site", "key:writeRecord", "a8a51bdd73f8ab1447edf2241d19a41ba1bcb0084ef045d370e5282aca7e9e66"},

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index c067af307..f3a703102 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -948,7 +948,13 @@ func checkRootReadDeclarations(scan rootReadScan, inv rootReadInventory) []strin

errs = append(errs, "changed reclassified declaration "+key)

}

- for key := range inv.Removed {

+ for key, removal := range inv.Removed {

+ if strings.HasSuffix(removal, ";census-ruling-J4") {

+ if _, exists := scan.Declarations[key]; exists || inv.Entries[key].Class != "" {

+ errs = append(errs, "removed J4 declaration still present "+key)

+ }

+ continue

+ }

if _, ok := inv.Frozen[key]; !ok {

errs = append(errs, "removal of unfrozen declaration "+key)

}

@@ -966,3 +972,26 @@ func rootReadScanned(scan rootReadScan, key string) bool {

}

return false

}

+func TestPlan14J4RemovalRequiresAbsentDeclaration(t *testing.T) {

+ key := "root.go:dead"

+ scan := rootReadScan{Declarations: map[string]string{}}

+ inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Removed: map[string]string{key: "E2;census-ruling-J4"}}

+ if errs := checkRootReadDeclarations(scan, inv); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ scan.Declarations[key] = "digest"

+ if len(checkRootReadDeclarations(scan, inv)) == 0 {

+ t.Fatal("live removed declaration accepted")

+ }

+ delete(scan.Declarations, key)

+ inv.Entries[key] = classifiedRootRead{Class: "authority"}

+ if len(checkRootReadDeclarations(scan, inv)) == 0 {

+ t.Fatal("retained removed row accepted")

+ }

+ delete(inv.Entries, key)

+ inv.Removed[key] = "E2;unruled"

+ if len(checkRootReadDeclarations(scan, inv)) == 0 {

+ t.Fatal("unruled removal accepted")

+ }

diff --git a/internal/provision/testdata/plan14-root-reads-p3.tsv b/internal/provision/testdata/plan14-root-reads-p3.tsv

index 77f9c177a..ff8133c7e 100644

--- a/internal/provision/testdata/plan14-root-reads-p3.tsv

+++ b/internal/provision/testdata/plan14-root-reads-p3.tsv

@@ -4,12 +4,10 @@ internal/console/boxselect.go Server.selectMoveBoxes authority F,J4 rev3=PROPOSE

internal/console/seedfloor.go Server.seedRegionReady authority F,J4 rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness d116ff2f72a1386a3a4120c69fea671cd3d43af264a20a1b8e98b5c61f11efb2

internal/host/claimconstruction.go OpenProductionClaimAssembly authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path file:Read@4278,file:Read@9540,file:ReadFile@3822,registry:Host@9567,whole:Route@9655 9c00a440613c5fdc402ef9fd038d6e193ac88dace1a0430d3fe59557efbce90c

internal/host/claimjournal_migration.go RunSystemJournalMigrate authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup 4f204d8a97620bfb22430a94e236d6c5b14a5265b35f68e21fb2ad34903ae0f3

-internal/host/claimjournal_migration.go migrateClaimJournals authority G,J4 rev3=PROPOSED-p3;identity=test-only wrapper; production offline uid 0 CLI calls migrateClaimJournalsWith with full=true;basis=retains legacy import/mask behavior for tests; no production caller e21da6b220796cc799dcd6dcbfe5b566b7bb6753394c786f44ac66cfcc07c6e3

internal/host/claimjournal_migration.go migrateClaimJournalsWith authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import e9b719120521b324163865a620812115a126cafc21b62ffa41282cf4e8093c34

internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main file:OpenFile@565,file:ReadFile@1142,file:ReadFile@1756,file:ReadFile@5797,file:ReadFile@865,file:Stat@3448 3eb11b09adc3b122f555513cc35aac8124f89149e72db995351cde384b2cf809

internal/host/guardexec.go RunSystemGuardExec authority F,J4 rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover root units uid 0; edge unit uid carlos; console unit uid carlos-console;basis=root apply/recover selects signed image from local bound; non-root edge bypasses private floor entirely file:Exec@1960,file:Exec@2113,file:Stat@976 6f47b37437a4072284e0965d13a60c9cb9a7a9b048be140238dc1e6b57b44675

internal/host/guardtransaction.go systemApplier.guardRun authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request c0a0ea8fe6a524d95b3a579ecf296c8075e435478c6daae2b0fa06518e88314f

-internal/host/movesfloor.go rootJudgeMovesPrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt-only wrapper delegates to root-aware moves judge; no direct input reads 0c9aa7c7df1ddd5b21798bc0158c5496dad16d400a69e8ace2dd61e8e16f0d58

internal/host/movesfloor.go rootJudgeMovesPrevWithSource authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged file:Stat@289,file:Stat@490 fa942c1c4b8af2d2930be427e303f3b9838c0fce33f1b3f8e63e17093b638269

internal/host/movesfloor.go rootJudgePrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=normal adopt combines moves and seeds verdict errors; unpublished seeds remain inert; raised bounds never block recording signed prev 8b5ecf5a0f33ee58d603f308302bcc8e68678da6b1e6ee7ed03845c35747f8c6

internal/host/movesfloor.go rootJudgePrevWithSource authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes 8d25e75b26a43b93f4c635b5d3a9d25bf41f60a02face307dc11034c706dd916

@@ -60,7 +58,6 @@ internal/host/rootmovesfloor_refresh.go rootRefreshAndJudgeMovesPrev authority F

internal/host/rootmovesfloor_refresh.go withRootMovesFields authority F,J4 rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state file:Open@405 29fb652e22df888f18c691b91db6b83b9781d89d005a2fae431d8102e77b2f88

internal/host/rootmovesfloor_source.go readEffectiveMovesFloor authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader a6420f9074a459fa5107cbd60ca18828f0dec132eb53add849152db2a9b0f62a

internal/host/rootmovesfloor_source.go readRootFloorProjection authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=selects moves public root projection for checked advertisement reader 572e2d0d6a783e823c3c76ca08c38fd86abc5265486c246bb1b123d834fea485

-internal/host/rootmovesfloor_source.go readRootLegacyFloorJSON authority F,J4 rev3=PROPOSED-p3;identity=test-only compatibility wrapper; production uses readRootLegacyProtocolJSON from adopt/apply uid 0;basis=selects moves JSON for bounded denial-only reader; no recovery or boot call 41475b13c77395562264e21faad32b142b053fc199919c39e1eeba28f0f17155

internal/host/rootmovesfloor_source.go readRootLegacyProtocolJSON authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance file:ReadAll@441,file:Stat@278 835f913509edbe65d72986bb23e7af580aaf2d4cc222e87064e29d0d16e61103

internal/host/rootmovesfloor_source.go readRootProtocolBound authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance file:Open@187 2e35ae8bdee1433877d928f22b4a3315dfd2027378a71124ca361284323c22b2

internal/host/rootmovesfloor_source.go readRootProtocolProjection authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance file:Open@86,file:Read@232 36f45f87d3cabebaaf759e2cd2b3c4397a5247247e329a0fd71de291ad1a2bf0

@@ -98,12 +95,10 @@ internal/host/systemapply.go systemApplier.verifyPointer authority F,J4 rev3=PRO

internal/host/units/carlos-system-recover.service external authority F,J4 rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor file:external@0 f16b260868c4b258c804b3a4720e17f02f6c020eda9dcc2a67d2ca032a077b45

internal/host/units/carlos-system-update.service external authority F,J4 rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor file:external@0 cfcaeea6308021ce5a7cb088464e8df3abc6b03ffaa0c7a0153c6d91bf1e3fd6

internal/hostbox/migration_census_linux.go CheckMigrationRoots authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=offline scan requires every managed payload to match independent retained inode/type inventory or explicit shared path rules file:Lstat@1678,file:Lstat@932,file:WalkDir@1202 3eb5e56f13b0932364b68c7d80ad18135b262614b105c41bfcc3477d6f558e79

-internal/hostbox/migration_census_other.go CheckMigrationRoots authority G,J4 rev3=PROPOSED-p3;identity=non-Linux unsupported stub; no production caller on this checkpoint;basis=returns ErrUnsupported without scanning or granting migration authority 594ecda260fcf80baf5a2709c9cc5a04e91c655c8bd2f7ac307eef44216eb9c8

internal/hostguard/guard.go record.admits authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt 5864d1fa79a66ca6f69057416079b46524ed4bfdf1ce1de88124b5a24a428418

internal/hostguard/root.go Guard.CommitRootInventoryArtifacts authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied 08e42f8810e2645a875b5177fc9e104ed4b307c7d80dc77d204e2516b1bd66de

internal/hostguard/root.go RootAuthority.read authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials file:Read@175 7ff862f573a05a17951546a56ff791d42962d693331a69e8338bd8eb4f283d6b

internal/hostguard/root.go RootAuthority.write authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record 678156528bb5d3e92f8c07835ff7a7d05afb5d498ff604966d2b6d9293867c0c

-internal/hostguard/rootmigration.go RootAuthority.CompleteMigrationInventory authority C,G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root completed fence receipt and retained session deny required before installing recovered inventory revision a548470f72eb9f5f9a457c292e06a303f4a7dca2068f10eda5fcbb4e118ab783

internal/hostguard/rootmigration.go RootAuthority.RetainMigrationDeny authority C,G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority fb821d19b6ca6e1454d025013d27ef8a856a684262421d3ee76804723e875c37

internal/hostguard/rootmigration.go migrationAdmissionDenied authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor c7312f5e0e67b2b69bbea1b8f432dd48ba06f0b4a26ebf349b6724769651631e

internal/hostguard/rootmigration.go migrationDenied authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission 6ccf5c00e33d880aa50ea15d2bce22a3cce14455d5cc7f05197e42f789da8805

@@ -120,21 +115,10 @@ internal/rootstate/state_linux.go directory.write authority A,F,G rev3=PROPOSED-

internal/safefile/fault_rootrunner_linux.go WriteAtFault diagnostic A,F rev3=PROPOSED-p3;identity=rootrunner test binary uid 0 only;basis=rootrunner-only seam runs actual safefile operations before/after chosen interruption dff2fd53a3561df3aa04b6f7462ab62c4cc32c826d152464989b6a399d83056c

internal/safefile/file_linux.go writeAt authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation eadb1d4dd961ebc7dc7ba8a469669003695d618d6c0dc13794763c7fa881d22c

internal/safefile/file_linux.go writeAtSteps authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement file:Fstat@1116,file:Fstat@700,file:Openat@522,file:Openat@875,file:Read@277 865b847b97df6753e1abd16a00d018d27cdabdd23c96d42a97b381103d088d21

-@coverage internal/console 6f4998c39e6d66cd73ea98500000cbecac251dd21dafd58f51a85c2291e0c533

-@coverage internal/edgesfile 7b48368150a427e4620f1c9ded49942b688c9e6c9cd983b7da43d3f2c0810b72

-@coverage internal/host/units bf6ae516012701e0ca41908167e4efd60dd3c2c24e9af1555dec077e8be44461

-@coverage internal/hostguard fd42f4f47ed3439bb906fa4224961f8bd3555b2cfc2a1a2e62b9415594551cd1

-@coverage internal/release 82bb0c3894d5dd0334efb8689977c980c03fbbe80306229d19f0753eb99b94ac

-@coverage internal/rootstate 8415892a08d6c9c1b2d71aa25b0952cbcaa53e533213b7fac56dd0666ee787cf

-@coverage internal/safefile 7030f312f7a60487381f0dbae2cdecaaa83625b639b6af15104f912592550816

internal/host/rootmigration_collect_linux.go migrationStopKernel.RecoverStopped authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream file:Read@327 75895f820e1bc7ad3ce1c6dd501655617967ab06631e0e4962e23c54a54ae8d8

internal/host/rootmigration_collect_linux.go recoverMigrationStop authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation 4649b2f1a9ee44d7509e57a9fad03e880c19075dbc34141a9a5ce3ad17c6414e

internal/host/rootmigration_collect_linux.go type migrationStopKernel authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority 09680751d01d45098f9f98b672ec8db92ef0fc55bee36fae45dfd79981456f70

-internal/host/rootmigration_production_linux.go migrateRootClaimAuthority authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=under offline exclusion dispatches signed import or fresh root-journal collection before publishing retained completion; legacy importer remains signature-gated file:Open@1538,file:Open@302,file:Open@384,file:Open@508,file:Open@6676,file:Read@2593,file:ReadFile@1340,whole:Route@3070 0f9faac07bac06613b70e2e04ed84e2b1dbfc5daf2b1ab4d5f1e3ca0f391e236

internal/hostbox/journalnamespace_linux.go prepareJournalDirectory authority C,G,J4 rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains file:Fstat@1026,file:Fstat@436,file:Fstatat@1357,file:Open@177,file:Openat@585,file:Openat@843,file:ReadDir@1242 11d159f47531654c958c62f4f54a22866605dc4bda6ff80c0ef77c02d97255be

-@coverage . 0353e3570e8e4af5a08a273f8c4e4df9f6b3bc440b24365a78b0531b3f8a57a9

-@coverage internal/host f5a61729de25655339fdbb500308538622d36fe5a38e30dbfa4b1bc750cec88f

-@coverage internal/hostbox 36002cdef72e2ee4de60b1da551a5d57ef077c8d95099677731be441edc766c0

internal/host/rootfloor_available.go rootFloorAvailable authority F,J4 rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available ebd8e7e71f9b8fd6ae3fdffc069f33edcc8495a9b07f50e599ec909d708a1af2

internal/host/rootfloor_available.go systemApplier.activationFloor authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound 63bcfdafa93a5091ee4316949a370998684c4e50903453f44436e6cd42a8ac37

internal/host/rootfloor_healthy.go rootMovesFloors.acceptHealthy authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it 3acf2e05253de53bccc1065ded12cdd58be324147ec3f3e21ad99eb145a121d5

@@ -149,7 +133,6 @@ internal/host/rootseedsfloor_publication.go readRootSeedsBound authority F,J4 re

internal/host/rootseedsfloor_publication.go type rootSeedsPublication authority F,J4 rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose a69c991db71defd5ca0f512c07327df6bfc25ada992b8f7affd5b560cb930de8

internal/host/rootseedsfloor_publication.go verifyRootSeedsPublication authority F,J4 rev3=PROPOSED-p3;identity=root protocol readers uid 0; edge advertisements from public root projection uid carlos;basis=verifies canonical root signature, deployment, purpose, schema and protocol minimum; unsigned source cannot arm seeds 7c992d8e3374bb183942c3fc6ff666b342b0506319e6989258d365857099ec74

internal/rootparticipation/migration.go Ledger.MigrationCensus authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion file:Read@207 6a572bf17012a7ff51b4e70401e40abeca593fcc760f76a5354e60a3e06c6b41

-@coverage internal/rootparticipation 677ed247e166f86046677c00774feb1055ff5bb390383ff5de6b5f8c79034361

internal/rootparticipation/ledger.go Ledger.Acquire authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion. file:Read@330 9737daf352e7e7e850c7dea8b1176d689624093cc91c2d869bf9052ca8782773

internal/rootparticipation/ledger.go Ledger.BeginUpdateWith authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@299 93d58cd04c1a44bf0941ae67b79d802824b4b4c18bca7670efa8ec38e5ffe2b1

internal/rootparticipation/ledger.go Ledger.EndUpdateWith authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@232 617e3c537aa3d14e2bdca861e2fc4383440d480039d0f9a5d71f0df55ecff959

@@ -158,8 +141,72 @@ internal/rootparticipation/transaction.go Ledger.lockTransaction authority D,F,J

internal/rootparticipation/transaction.go TransactionLedger authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=returns only an active root-minted held ledger; stale and cancelled scopes refuse 2046fbd7b7ec9455794dbaf614ea4cb50b9147929004434a172a67656fb7ff63

internal/rootparticipation/transaction.go type heldTransaction authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=binds transaction reuse to a root-opened ledger and live callback lifetime 4769022372ba86be2255c15a53c5d7acd88bc9e50652391e84284a436ae615c7

internal/rootparticipation/transaction.go type transactionKey authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=unexported key prevents callers from forging the held participation scope c309e812e20a85927d3cc93c8048d811c7187137797ad76646cc12f892d82a63

-@coverage internal/hostfloor 5d69c9c333f1c6f8a6e1409ffd5b20e6762f74fae744ac57714af463f9b694b9

internal/host/systemapply.go systemApplier.runWithRelease authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=root CLI carries E release exclusion through apply and recovery; nested guards reuse its token; absent census runs the exact legacy body 462d91eb211467885431108bc352b1913ea430fca5602434fc9fd7ef39713efa

internal/hostfloor/disk.go Disk.withParticipation authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=uses a live root-minted scoped ledger only for its original store; otherwise opens the ordinary census; absent census keeps legacy behavior 3bf4a54d1ab3621eee974a797ffa63a988369b9f245ceddde1cb99cc6386ec82

internal/rootparticipation/ledger.go Ledger.Idle authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=checks settled execution and local launch completeness under participation; nested activation uses only its already-held store e50d8f839d39f771ad4b6018f315cd7002a6e470424df0a46482906c31ef575e

internal/rootparticipation/ledger.go Ledger.RecoverAcquisition authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=retains acquisition-recovery checks and census commit under the same participation transaction; no new authority from a missing record d1f44274ba0a53aae7e39ce016da787748123665bda0cdf7a40339a4fc52e9fc

+@remove internal/activator/rolelaunch_linux.go RoleLaunch.prepareRoleReservation

+@removed internal/activator/rolelaunch_linux.go RoleLaunch.prepareRoleReservation C,J1 census-ruling-J4

+@removed internal/host/claimjournal_migration.go migrateClaimJournals G,J4 census-ruling-J4

+@remove internal/host/claimstate_linux.go prepareClaimDatabaseOwner

+@removed internal/host/claimstate_linux.go prepareClaimDatabaseOwner C,G,J4 census-ruling-J4

+@remove internal/host/movesfloor.go rootJudgeMovesPrev

+@removed internal/host/movesfloor.go rootJudgeMovesPrev F,J4 census-ruling-J4

+@remove internal/host/proofnamed.go proofBindingSource.capturedVersion

+@removed internal/host/proofnamed.go proofBindingSource.capturedVersion B3,J1 census-ruling-J4

+@remove internal/host/proofnamed.go proofBindingSource.installedConsoleVersion

+@removed internal/host/proofnamed.go proofBindingSource.installedConsoleVersion B3,J1 census-ruling-J4

+@remove internal/host/proofobserve.go recordSettled

+@removed internal/host/proofobserve.go recordSettled B3,J1,J4 census-ruling-J4

+@remove internal/host/rootgeneration_kernel_linux.go generationMajor

+@removed internal/host/rootgeneration_kernel_linux.go generationMajor E2 census-ruling-J4

+@remove internal/host/rootgeneration_kernel_linux.go generationMinor

+@removed internal/host/rootgeneration_kernel_linux.go generationMinor E2 census-ruling-J4

+@removed internal/host/rootmovesfloor_source.go readRootLegacyFloorJSON F,J4 census-ruling-J4

+@remove internal/host/rootrestart.go rootRestartRoute

+@removed internal/host/rootrestart.go rootRestartRoute B3,J1 census-ruling-J4

+@remove internal/hostbox/hold.go ChangeHold

+@removed internal/hostbox/hold.go ChangeHold C,J2,J4 census-ruling-J4

+@remove internal/hostbox/stopinventory_db.go OpenStopInventoryDB

+@removed internal/hostbox/stopinventory_db.go OpenStopInventoryDB C,J2,J4 census-ruling-J4

+@remove internal/hostfloor/participation.go CheckParticipation

+@removed internal/hostfloor/participation.go CheckParticipation D census-ruling-J4

+@remove internal/hostguard/root.go Guard.CommitRootInventory

+@removed internal/hostguard/root.go Guard.CommitRootInventory E2 census-ruling-J4

+@remove internal/release/materializeheld.go PublishHeld

+@removed internal/release/materializeheld.go PublishHeld C,E1,J1 census-ruling-J4

+@remove internal/release/materializeheld.go ServeHeldStageRequests

+@removed internal/release/materializeheld.go ServeHeldStageRequests E2 census-ruling-J4

+@remove internal/release/materializeheld.go StageHeld

+@removed internal/release/materializeheld.go StageHeld C,E1,J1 census-ruling-J4

+@remove internal/release/roothistory_delivery.go PublishHistoryReconstruction

+@removed internal/release/roothistory_delivery.go PublishHistoryReconstruction E1 census-ruling-J4

+@remove internal/release/roothistory_delivery.go PublishHistoryRecoveryRetirement

+@removed internal/release/roothistory_delivery.go PublishHistoryRecoveryRetirement E1 census-ruling-J4

+@remove internal/rootparticipation/ledger.go Ledger.EndUpdate

+@removed internal/rootparticipation/ledger.go Ledger.EndUpdate D census-ruling-J4

+@remove internal/rootparticipation/production.go ActivationReady

+@removed internal/rootparticipation/production.go ActivationReady D,G census-ruling-J4

+internal/historyreadback/readback.go RequestStatus diagnostic E1 rev3=PROPOSED-p3;identity=diagnostic request library, no production caller;basis=P3-R8 #2; signed readback request only; no reconstruction or retirement d89052b0cdd12c8c8dcbc353e9ae995005caeb88d8e4c70974cb9e6f4bfd46d7

+internal/hostbox/migration_census_other.go CheckMigrationRoots hint G,J4 rev3=PROPOSED-p3;identity=non-Linux offline migration caller;basis=P3-R8 #17; unsupported platform refusal only 594ecda260fcf80baf5a2709c9cc5a04e91c655c8bd2f7ac307eef44216eb9c8

+internal/host/rootmigration_production_linux.go migrateRootClaimAuthority authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration adopts pre-claim timers only after verified root stop evidence; resumes its exact saved intention under release and migration exclusion, rechecking kernel absence before completion file:Open@1538,file:Open@302,file:Open@384,file:Open@508,file:Open@6832,file:Read@2490,file:ReadFile@1340,whole:Route@2803 896026523dd3c7a01e41664aa1b233c3de67b093efe8d8f3b778d6dd3c11397a

+internal/host/rootmigration_timers.go rootMigrationTimers.adopt authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration binds the exact observed pre-claim registrations to root retained stop evidence and denies; durable intention precedes conditional registry adoption and root inventory completion registry:ClaimOwner@1997,registry:ClaimOwner@2135,registry:ClaimOwnership@1860,registry:ClaimOwnership@1914,registry:ClaimOwnership@4009,registry:ClaimOwnership@4202,registry:ClaimOwnership@4314,registry:Host@1836,registry:Host@4107,registry:Name@1677,registry:Name@4122,registry:Registration@1153,registry:Registration@1785,registry:Registration@1810,registry:Registration@1962,registry:Registration@2117,registry:Registration@4046,whole:ClaimOwnership@1864,whole:ClaimOwnership@1918,whole:ClaimOwnership@1936,whole:ClaimOwnership@4015,whole:ClaimOwnership@4211,whole:ClaimOwnership@4320,whole:Route@2456,whole:Timer@1067,whole:Timer@1073,whole:Timer@1101,whole:Timer@1663,whole:Timer@2304,whole:Timer@3896,whole:Timer@3911,whole:Timer@3980,whole:Timer@3998,whole:Timer@4179,whole:Timer@4190,whole:Timer@4304,whole:Timer@4383,whole:Timer@4394 35914f3267326de830fb7c149bf330638cb49794a3e8c6f41445078a92669a04

+internal/host/rootmigration_timers.go rootMigrationTimers.load authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=reads only the root-private saved adoption intention, requiring the same host, incarnation, stamp, session and enrolled box; preserves exact registration IDs on retry file:Read@145,registry:Registration@844,whole:Timer@668,whole:Timer@846 f58c918185b3c382e5c1545f441cb589157b0c6cf60bb54322ca7edf40f1c1c9

+internal/host/rootmigration_timers.go rootMigrationTimers.key authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=scopes the durable timer adoption intention to the root-observed installation and denied session 76a349236e49d55a5b9866b86ea60aa56a7a5b179b7b77b82d87535f0a305f0c

+internal/host/rootmigration_timers.go rootMigrationTimers.owner authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=derives installation ownership from root-observed host, incarnation, stamp and box, never a service row owner a9dda27d00a9505d75099c75964643d20219dc8b1a0bfa64d3f1060ef85c111f

+internal/host/rootmigration_timers.go type rootMigrationTimerRecord authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=retains original stopped inventory, exact observed timer contents and registrations, successor inventory and root revision through interrupted migration 653d1a8f608c1bb1965881928b652dffe419db0697bd2b3ce09ac40c7f59af34

+internal/host/rootmigration_timers.go type rootMigrationTimers authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=holds root-private migration state, root inventory, root fence authority and isolated registry interface under offline exclusion dc83f25eaae718327601d7d19c2c93f56e589cc176405c6249e9ea4e3c864c34

+internal/hostguard/rootmigration.go RootAuthority.CompleteMigrationInventory authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=root fence completion binds the migration inventory revision; timer adoption permits only its exact previous revision plus one and recommits visible failed writes 2cae20b131f8095abb56be863ed457b0cb22c42d28d486488edc83ba9d519986

+@coverage . 0353e3570e8e4af5a08a273f8c4e4df9f6b3bc440b24365a78b0531b3f8a57a9

+@coverage internal/activator 95ea5c811cee8a679170f708c30b4446021740977474551c1d22bf8afaacf9be

+@coverage internal/console 6f4998c39e6d66cd73ea98500000cbecac251dd21dafd58f51a85c2291e0c533

+@coverage internal/edgesfile 7b48368150a427e4620f1c9ded49942b688c9e6c9cd983b7da43d3f2c0810b72

+@coverage internal/host c2b410276372d64cbd7fe7d45f2f94db5f322a256fa400d6861d9ccf16b70275

+@coverage internal/host/units bf6ae516012701e0ca41908167e4efd60dd3c2c24e9af1555dec077e8be44461

+@coverage internal/hostbox 37e91e5b73a48538a69e2a25286e76f740917b29c0fb5f26e32d5f59e3da6e1d

+@coverage internal/hostfloor 696e5ea4fa37b924b68e8e262235b99298ee19342d875213ba8209e5287dd3c6

+@coverage internal/hostguard 9aa80c14419e017785500e225fef7746ed9af37936ced9c238b9dd3aa5d485c9

+@coverage internal/release 775ec9f26a2d04f1674ce7adfa80472886064b452134ba5dab165d565d90262f

+@coverage internal/rootparticipation ffa18f535e706793976bb235426fa5852e65baba211be5077666c1dc738e7f0b

+@coverage internal/rootstate 8415892a08d6c9c1b2d71aa25b0952cbcaa53e533213b7fac56dd0666ee787cf

+@coverage internal/safefile 7030f312f7a60487381f0dbae2cdecaaa83625b639b6af15104f912592550816

diff --git a/internal/release/materializeheld.go b/internal/release/materializeheld.go

index b389e3c97..db06623a5 100644

--- a/internal/release/materializeheld.go

+++ b/internal/release/materializeheld.go

@@ -336,22 +336,6 @@ func materializeHeld(ctx context.Context, s Store, pub ed25519.PublicKey, r *Dig

return m, nil

}

-// StageHeld is a held row's staging step, ensureStaged, with nothing

-// published: the version lands in the version store and live/<host> is

-// left alone. It refuses while CARLOS_HOST_CLAIM is on, and a refused write

-// is ErrStageBlocked wrapping the cause.

-//

-// It stages only a build §4.1 authorizes (settings spec rev 11 §4.3a):

-// HeldAuthorized, under pub and the box's ratchet r, answers first, and the

-// staging binds the digest it returns. A build nothing authorizes is

-// ErrHeldNotAuthorized, and nothing is downloaded.

-func StageHeld(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRatchet, optDir string, rt registry.Route, version string) (*Manifest, error) {

- if err := heldStageable(rt, version); err != nil {

- return nil, err

- }

- return stageHeld(ctx, s, pub, r, optDir, rt, version)

// StageHeldVerified is T7 under the host claim (moves design §7.3 and §9.2

// as amended on 2026-10-12, Paul's T7 ruling): the pinned version is staged

// into the shared version store and verified, and live/<host> is never

@@ -440,35 +424,6 @@ func stageHeld(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRat

return m, nil

}

-// PublishHeld points live/<host> at a staged version, and does it inside

-// guard: guard re-checks whatever authorised the stage (for the root relay,

-// the registry hold frozen and the host claim re-read) and calls publish

-// only if that still holds, as its last step. Staging can take minutes, so

-// an authority checked only before it could be stale by now: a move aborted

-// or replaced meanwhile must never have live/<host> repointed for it. A nil

-// guard is refused: nothing is published on a request's word alone.

-//

-// Before guard it runs D3 as adoption does (admit, then bind on the staged

-// bytes), so a release the box's proof policy does not admit is

-// ErrHeldNotProven and live/<host> is untouched. A nil proof is refused.

-func PublishHeld(ctx context.Context, s Store, optDir string, rt registry.Route, version string, proof *ProofGate, guard func(publish func() error) error) error {

- if err := heldStageable(rt, version); err != nil {

- return err

- }

- if guard == nil {

- return errHeldNoGuard

- }

- if proof == nil {

- return errHeldNoProofGate

- }

- proof.BeginPass()

- ptr, v, err := heldProofAdmit(ctx, s, optDir, rt, version, proof)

- if err != nil {

- return err

- }

- return publishHeld(optDir, rt, version, proof, ptr, v, guard)

// publishHeld is PublishHeld after admit. Everything runs inside guard,

// after the authority's re-check and under whatever it holds (for the root

// relay, the registry's holds frozen): bind hashes the staged bytes, the

@@ -698,32 +653,6 @@ func HeldStagedDir(dataDir string) string { return filepath.Join(dataDir, "moves

// agent's uid, flat tenants included.

const heldStageRequestMax = 4096

-// ServeHeldStageRequests is the root side of the held-stage relay, run by

-// `carlos adopt` after its release adoption. For each <name>.json in

-// HeldStageDir it validates every field before any filesystem effect (Host

-// equal to name and a valid host shape, valid account, app and version, a

-// non-empty op and box), asks authorize, stages, asks authorize again with

-// the publication as its then, writes the HeldStaged ack and removes the

-// request. A request that fails validation, that authorize refuses at

-// either point with ErrStaleHeldStage, that D3 refuses (proof, as

-// MaterializeHeld applies it: ErrHeldNotProven), or that §4.1 does not

-// authorize (ErrHeldNotAuthorized, or a build that does not hash to its

-// authorizing digest: ErrManifestDigest) is removed with a log line,

-// and live/<host> is never repointed for it. A request whose staging, ack or

-// publication fails any other way is kept for the next pass. With no

-// request directory it reads nothing and creates nothing.

-//

-// authorize(req, then) checks req and, if it passes, runs then (when

-// non-nil) under whatever guard keeps the check true until then returns.

-// Before staging it is called with a nil then.

-//

-// The directory is agent-owned and this runs as root, so every read, write

-// and removal goes through safefile: no symlink is followed at any

-// component, and only a regular file with one link is read.

-func ServeHeldStageRequests(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRatchet, optDir, dataDir string, proof *ProofGate, authorize func(req HeldStageRequest, then func() error) error) error {

- return ServeHeldStageRequestsWithPins(ctx, s, pub, r, optDir, dataDir, proof, authorize)

// ServeHeldStageRequestsWithPins protects the old relay on census boxes, including

// after claims are disabled. The caller holds release exclusion through the pass.

func ServeHeldStageRequestsWithPins(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRatchet, optDir, dataDir string, proof *ProofGate, authorize func(req HeldStageRequest, then func() error) error, pins ...PinSource) error {

diff --git a/internal/release/materializeheld_removed_test.go b/internal/release/materializeheld_removed_test.go

new file mode 100644

index 000000000..d36e7a38c

--- /dev/null

+++ b/internal/release/materializeheld_removed_test.go

@@ -0,0 +1,79 @@

+package release

+import (

+ "context"

+ "crypto/ed25519"

+ "github.com/carlosframework/platform/internal/registry"

+// StageHeld is a held row's staging step, ensureStaged, with nothing

+// published: the version lands in the version store and live/<host> is

+// left alone. It refuses while CARLOS_HOST_CLAIM is on, and a refused write

+// is ErrStageBlocked wrapping the cause.

+//

+// It stages only a build §4.1 authorizes (settings spec rev 11 §4.3a):

+// HeldAuthorized, under pub and the box's ratchet r, answers first, and the

+// staging binds the digest it returns. A build nothing authorizes is

+// ErrHeldNotAuthorized, and nothing is downloaded.

+func StageHeld(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRatchet, optDir string, rt registry.Route, version string) (*Manifest, error) {

+ if err := heldStageable(rt, version); err != nil {

+ return nil, err

+ }

+ return stageHeld(ctx, s, pub, r, optDir, rt, version)

+// PublishHeld points live/<host> at a staged version, and does it inside

+// guard: guard re-checks whatever authorised the stage (for the root relay,

+// the registry hold frozen and the host claim re-read) and calls publish

+// only if that still holds, as its last step. Staging can take minutes, so

+// an authority checked only before it could be stale by now: a move aborted

+// or replaced meanwhile must never have live/<host> repointed for it. A nil

+// guard is refused: nothing is published on a request's word alone.

+//

+// Before guard it runs D3 as adoption does (admit, then bind on the staged

+// bytes), so a release the box's proof policy does not admit is

+// ErrHeldNotProven and live/<host> is untouched. A nil proof is refused.

+func PublishHeld(ctx context.Context, s Store, optDir string, rt registry.Route, version string, proof *ProofGate, guard func(publish func() error) error) error {

+ if err := heldStageable(rt, version); err != nil {

+ return err

+ }

+ if guard == nil {

+ return errHeldNoGuard

+ }

+ if proof == nil {

+ return errHeldNoProofGate

+ }

+ proof.BeginPass()

+ ptr, v, err := heldProofAdmit(ctx, s, optDir, rt, version, proof)

+ if err != nil {

+ return err

+ }

+ return publishHeld(optDir, rt, version, proof, ptr, v, guard)

+// ServeHeldStageRequests is the root side of the held-stage relay, run by

+// `carlos adopt` after its release adoption. For each <name>.json in

+// HeldStageDir it validates every field before any filesystem effect (Host

+// equal to name and a valid host shape, valid account, app and version, a

+// non-empty op and box), asks authorize, stages, asks authorize again with

+// the publication as its then, writes the HeldStaged ack and removes the

+// request. A request that fails validation, that authorize refuses at

+// either point with ErrStaleHeldStage, that D3 refuses (proof, as

+// MaterializeHeld applies it: ErrHeldNotProven), or that §4.1 does not

+// authorize (ErrHeldNotAuthorized, or a build that does not hash to its

+// authorizing digest: ErrManifestDigest) is removed with a log line,

+// and live/<host> is never repointed for it. A request whose staging, ack or

+// publication fails any other way is kept for the next pass. With no

+// request directory it reads nothing and creates nothing.

+//

+// authorize(req, then) checks req and, if it passes, runs then (when

+// non-nil) under whatever guard keeps the check true until then returns.

+// Before staging it is called with a nil then.

+//

+// The directory is agent-owned and this runs as root, so every read, write

+// and removal goes through safefile: no symlink is followed at any

+// component, and only a regular file with one link is read.

+func ServeHeldStageRequests(ctx context.Context, s Store, pub ed25519.PublicKey, r *DigestRatchet, optDir, dataDir string, proof *ProofGate, authorize func(req HeldStageRequest, then func() error) error) error {

+ return ServeHeldStageRequestsWithPins(ctx, s, pub, r, optDir, dataDir, proof, authorize)

diff --git a/internal/release/roothistory_delivery.go b/internal/release/roothistory_delivery.go

index 8a6353741..a0239ab66 100644

--- a/internal/release/roothistory_delivery.go

+++ b/internal/release/roothistory_delivery.go

@@ -3,7 +3,6 @@ package release

import (

"context"

"crypto/ed25519"

- "encoding/hex"

"errors"

"os"

"strconv"

@@ -14,21 +13,6 @@ func HistoryReconstructionKey(acct, app, identity string, revision uint64) strin

return appPrefix(acct, app) + "release-history/" + identity + "/" + strconv.FormatUint(revision, 10) + ".json"

}

-func PublishHistoryReconstruction(ctx context.Context, store Store, signer Signer, g HistoryReconstruction) error {

- if !ValidAccount(g.Account) || !ValidApp(g.App) || len(g.Identity) != 64 || g.Revision == 0 {

- return os.ErrPermission

- }

- if _, err := hex.DecodeString(g.Identity); err != nil {

- return os.ErrPermission

- }

- wire, err := SignRootEnvelope(signer, g)

- if err != nil {

- return err

- }

- _, err = store.Put(ctx, HistoryReconstructionKey(g.Account, g.App, g.Identity, g.Revision), wire, "")

- return err

func (h *RootHistory) ReceiveReconstruction(ctx context.Context, store Store, pub ed25519.PublicKey, b HistoryBinding, now time.Time, resolve func(HistoryBinding) (string, error)) error {

if !b.valid() || store == nil {

return os.ErrPermission

@@ -52,23 +36,6 @@ func HistoryRecoveryRetirementKey(b HistoryBinding, identity, outcomeDigest stri

return appPrefix(b.Account, b.App) + "release-history/" + identity + "/recovery/" + outcomeDigest + ".json"

}

-func PublishHistoryRecoveryRetirement(ctx context.Context, store Store, signer Signer, g HistoryRecoveryRetirement) error {

- if !validHistoryRetirement(g) {

- return os.ErrPermission

- }

- for _, digest := range []string{g.Identity, g.OutcomeDigest, g.VerifiedDigest} {

- if _, err := hex.DecodeString(digest); err != nil {

- return os.ErrPermission

- }

- wire, err := SignRootEnvelope(signer, g)

- if err != nil {

- return err

- }

- _, err = store.Put(ctx, HistoryRecoveryRetirementKey(g.Binding, g.Identity, g.OutcomeDigest), wire, "")

- return err

func (h *RootHistory) ReceiveRecoveryRetirements(ctx context.Context, store Store, pub ed25519.PublicKey, b HistoryBinding, now time.Time, resolve func(HistoryBinding) (string, error)) error {

if !b.valid() || store == nil {

return os.ErrPermission

diff --git a/internal/release/roothistory_delivery_removed_test.go b/internal/release/roothistory_delivery_removed_test.go

new file mode 100644

index 000000000..9829a4044

--- /dev/null

+++ b/internal/release/roothistory_delivery_removed_test.go

@@ -0,0 +1,39 @@

+package release

+import (

+ "context"

+ "encoding/hex"

+ "os"

+func PublishHistoryReconstruction(ctx context.Context, store Store, signer Signer, g HistoryReconstruction) error {

+ if !ValidAccount(g.Account) || !ValidApp(g.App) || len(g.Identity) != 64 || g.Revision == 0 {

+ return os.ErrPermission

+ }

+ if _, err := hex.DecodeString(g.Identity); err != nil {

+ return os.ErrPermission

+ }

+ wire, err := SignRootEnvelope(signer, g)

+ if err != nil {

+ return err

+ }

+ _, err = store.Put(ctx, HistoryReconstructionKey(g.Account, g.App, g.Identity, g.Revision), wire, "")

+ return err

+func PublishHistoryRecoveryRetirement(ctx context.Context, store Store, signer Signer, g HistoryRecoveryRetirement) error {

+ if !validHistoryRetirement(g) {

+ return os.ErrPermission

+ }

+ for _, digest := range []string{g.Identity, g.OutcomeDigest, g.VerifiedDigest} {

+ if _, err := hex.DecodeString(digest); err != nil {

+ return os.ErrPermission

+ }

+ wire, err := SignRootEnvelope(signer, g)

+ if err != nil {

+ return err

+ }

+ _, err = store.Put(ctx, HistoryRecoveryRetirementKey(g.Binding, g.Identity, g.OutcomeDigest), wire, "")

+ return err

diff --git a/internal/rootparticipation/ledger.go b/internal/rootparticipation/ledger.go

index c8507fc0b..66617f575 100644

--- a/internal/rootparticipation/ledger.go

+++ b/internal/rootparticipation/ledger.go

@@ -175,9 +175,6 @@ func (l Ledger) BeginUpdateWith(ctx context.Context, id string, commit func() er

}

return nil

}

-func (l Ledger) EndUpdate(ctx context.Context, id string) error {

- return l.EndUpdateWith(ctx, id, nil)

func (l Ledger) EndUpdateWith(ctx context.Context, id string, commit func() error) error {

if l.State == nil {

diff --git a/internal/rootparticipation/ledger_removed_test.go b/internal/rootparticipation/ledger_removed_test.go

new file mode 100644

index 000000000..81a135c8c

--- /dev/null

+++ b/internal/rootparticipation/ledger_removed_test.go

@@ -0,0 +1,7 @@

+package rootparticipation

+import "context"

+func (l Ledger) EndUpdate(ctx context.Context, id string) error {

+ return l.EndUpdateWith(ctx, id, nil)

diff --git a/internal/rootparticipation/production.go b/internal/rootparticipation/production.go

index 7508ae92c..0234e5743 100644

--- a/internal/rootparticipation/production.go

+++ b/internal/rootparticipation/production.go

@@ -88,15 +88,6 @@ func OpenForUpdate() (Ledger, bool, error) {

return l, required, nil

}

-func ActivationReady(ctx context.Context) error {

- l, err := Open()

- if err != nil {

- return err

- }

- defer l.State.Close()

- return l.ActivationReady(ctx)

func (l Ledger) ActivationReady(ctx context.Context) error {

c, err := l.Census()

if err != nil {