carlos / platform Public

Sidecar isolation Task 7: workers mint nested only when the box was ready at agent start (D7, D11)

release.WorkerLayoutFloor = v0.29.0 and AtOrAboveFloor (an unparseable
version reads as below). host.WorkersReady evaluates D11's start-time
condition: CARLOS_NESTED_WORKERS exactly "on" (unset or off: off), and
the running build and <optDir>/carlos.prev.version both at or above the
floor (missing, empty or garbled: waiting_for_prev). runAgent arms it
once; agentWorkers() is the cached answer, with Ready/Word/Reason for the
pass (Task 8) and status (Task 9).

ReconcileConfig.Workers carries the cached boolean into the pass
(reconcileSerializedWith sets it from agentWorkers). workerMintLayoutReader
answers nested only when Workers holds and the layout intent is nested;
without Workers it never reads the intent. sidecarRouteFor takes nested
and mints NestedDBPath; a layout read failure defers the mint only when
the answer matters. convergeSidecar accepts the flat or the nested path
for the row's own host and still reports anything else. The co-spawn
check still looks in the flat data directory.

Census: claims for ReconcileSidecars and convergeSidecar appended to the
ledger; the plan9 B8 record-write digest for ReconcileSidecars moves too
(Task 12, with Tasks 1 and 6's).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 9 hours ago 7490ed6998c8713403d28a0a9a217d3e6f3331f0 parent 039914d

9 files changed, +533 −8

implementation/census-claims-sidecar-isolation.txt +2 −0
internal/host/agent.go +15 −0
internal/host/workerready.go +128 −0
internal/host/workerready_test.go +172 −0
internal/provision/reconcile.go +22 −0
internal/provision/sidecar_reconcile.go +37 −8
internal/provision/sidecar_reconcile_test.go +117 −0
internal/release/layoutintent.go +19 −0
internal/release/layoutintent_test.go +21 −0

CI failed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (20 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (172 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.754s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.991s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.760s
ok  	github.com/carlosframework/platform/internal/activator	59.189s
ok  	github.com/carlosframework/platform/internal/agentsock	0.077s
ok  	github.com/carlosframework/platform/internal/alerting	0.007s
ok  	github.com/carlosframework/platform/internal/analytics	0.032s
ok  	github.com/carlosframework/platform/internal/appconfig	3.012s
ok  	github.com/carlosframework/platform/internal/apperr	0.211s
ok  	github.com/carlosframework/platform/internal/applog	0.374s
ok  	github.com/carlosframework/platform/internal/awsinv	0.010s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.011s
ok  	github.com/carlosframework/platform/internal/boxid	0.874s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.015s
ok  	github.com/carlosframework/platform/internal/caps	0.033s
ok  	github.com/carlosframework/platform/internal/certwarm	0.007s
ok  	github.com/carlosframework/platform/internal/cgroup	0.772s
ok  	github.com/carlosframework/platform/internal/changelog	0.550s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.266s
ok  	github.com/carlosframework/platform/internal/clamd	0.063s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.047s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.015s
ok  	github.com/carlosframework/platform/internal/dbquery	0.013s
ok  	github.com/carlosframework/platform/internal/dbreads	2.178s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.013s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.007s
ok  	github.com/carlosframework/platform/internal/docsite	0.009s
ok  	github.com/carlosframework/platform/internal/domains	2.848s
ok  	github.com/carlosframework/platform/internal/doorkey	0.021s
ok  	github.com/carlosframework/platform/internal/economics	0.012s
ok  	github.com/carlosframework/platform/internal/edge	45.391s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.142s
ok  	github.com/carlosframework/platform/internal/gate	1.656s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.018s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.163s
ok  	github.com/carlosframework/platform/internal/host	142.130s
ok  	github.com/carlosframework/platform/internal/hostactors	6.084s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.010s
ok  	github.com/carlosframework/platform/internal/hostbox	2.973s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.845s
ok  	github.com/carlosframework/platform/internal/hostenv	0.006s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	5.311s
ok  	github.com/carlosframework/platform/internal/hostfence	0.049s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.327s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.028s
ok  	github.com/carlosframework/platform/internal/hostguard	1.084s
ok  	github.com/carlosframework/platform/internal/hostops	1.982s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.005s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.007s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.591s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.176s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.003s
ok  	github.com/carlosframework/platform/internal/instancectl	6.907s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.765s
ok  	github.com/carlosframework/platform/internal/instancefs	0.005s
ok  	github.com/carlosframework/platform/internal/instancekey	0.005s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	1.726s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.005s
ok  	github.com/carlosframework/platform/internal/lease	10.180s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.459s
ok  	github.com/carlosframework/platform/internal/ledger	0.020s
ok  	github.com/carlosframework/platform/internal/mail	0.213s
ok  	github.com/carlosframework/platform/internal/maintenance	0.120s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.550s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.093s
ok  	github.com/carlosframework/platform/internal/metrics	0.008s
ok  	github.com/carlosframework/platform/internal/moves	22.065s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.002s
ok  	github.com/carlosframework/platform/internal/objstore	0.228s
ok  	github.com/carlosframework/platform/internal/ops	0.220s
ok  	github.com/carlosframework/platform/internal/park	0.252s
ok  	github.com/carlosframework/platform/internal/plans	0.011s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
2026/10/24 22:40:18 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:18 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:18 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:18 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:18 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/24 22:40:18 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:18 provision: an app's records could not be listed: they are skipped
2026/10/24 22:40:18 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:18 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 22:40:18 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 22:40:18 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:40:18 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:40:18 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/24 22:40:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:18 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:40:18 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/24 22:40:18 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:40:18 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 22:40:18 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:40:18 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/24 22:40:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:40:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:40:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:40:19 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:40:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:40:19 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 22:40:19 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:40:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 22:40:19 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 22:40:19 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:19 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:19 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:19 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 22:40:19 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 22:40:19 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/24 22:40:19 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/24 22:40:19 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:19 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:19 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (0.72s)
    plan9_b8_census_test.go:372: record-write census rejected 3 site(s); update the explicit inventory only after reviewing the source:
          changed site internal/instanceexec/exit.go:RunExit: source differs from the reviewed digest
          changed site internal/ops/litestream.go:FleetDBsWithSkipped: source differs from the reviewed digest
          changed site internal/provision/sidecar_reconcile.go:ReconcileSidecars: source differs from the reviewed digest
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/24 22:40:21 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/24 22:40:21 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/24 22:40:21 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io hibernate false -> true
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged acme.go.tito.io status-named false -> true
2026/10/24 22:40:21 provision: converged acme.go.tito.io status-named true -> false
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:40:21 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:40:21 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:40:21 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 22:40:21 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/24 22:40:21 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/24 22:40:21 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 22:40:21 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 22:40:21 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 22:40:21 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:21 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 22:40:21 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/24 22:40:21 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/24 22:40:21 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:21 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 22:40:21 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:21 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/24 22:40:21 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 22:40:21 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:21 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 22:40:21 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:21 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 22:40:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:21 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:21 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/24 22:40:21 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 22:40:21 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/24 22:40:21 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:21 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:40:21 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/24 22:40:21 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/24 22:40:21 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/24 22:40:21 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/24 22:40:21 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/24 22:40:21 provision: dry-run: would converge owned.go.tito.io seed
2026/10/24 22:40:21 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:21 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/24 22:40:21 provision: converged owned.go.tito.io channel stable -> edge
2026/10/24 22:40:21 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/24 22:40:21 provision: converged owned.go.tito.io hibernate false -> true
2026/10/24 22:40:21 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/24 22:40:21 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:21 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/24 22:40:21 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/24 22:40:22 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: removed retired static route site.go.tito.io (record gone)
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/24 22:40:22 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/24 22:40:22 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/24 22:40:22 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:22 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 22:40:22 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 22:40:22 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 22:40:22 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:40:22 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/24 22:40:22 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:40:22 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:40:22 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 22:40:22 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 22:40:22 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/24 22:40:22 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/24 22:40:22 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 22:40:22 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/24 22:40:22 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/24 22:40:22 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 22:40:22 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/24 22:40:22 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 22:40:22 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:22 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:23 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:23 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 22:40:23 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:23 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 22:40:23 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/24 22:40:23 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/24 22:40:23 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 22:40:23 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:23 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:23 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 22:40:23 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 22:40:23 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:23 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:23 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 22:40:23 provision: a.shop.example.com: swapped for import sd_jqfwqwtcxcyolstz4sge5nwj6q (the original route is journaled)
2026/10/24 22:40:23 provision: a.shop.example.com: import sd_jqfwqwtcxcyolstz4sge5nwj6q committed: its gate is cleared and its journal row dropped
2026/10/24 22:40:23 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_y4mpcvseagmxdmpi7q2fgtxksa rolled back to its original route
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_y4mpcvseagmxdmpi7q2fgtxksa: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_y4mpcvseagmxdmpi7q2fgtxksa is cleaned up and its journal row retired
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_livgiu7iu73iv2ltcspiad2zwu rolled back to its original route
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_livgiu7iu73iv2ltcspiad2zwu: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_livgiu7iu73iv2ltcspiad2zwu is cleaned up and its journal row retired
2026/10/24 22:40:24 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_5qcjpotjwwsalg5hkuujlsy6de
2026/10/24 22:40:24 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/24 22:40:24 provision: dry-run: would converge a.shop.example.com seed source
2026/10/24 22:40:24 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/24 22:40:24 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/24 22:40:24 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_vtcqyf5qqacexm4wl5nviaphsq cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_jtewe3vvs3xjwtxrk3kijts7nu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_khvcq535a4e2ic4qpmgtid5bcu is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_f3rtztwetcxgqbhqk6szuyc56a is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_muox5v4f74gtzuon4id62vmkou is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 22:40:24 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/24 22:40:24 provision: b.shop.example.com: import sd_k3fwffq3q5l2bopimjtmyfusdq left alone this pass: the import journal could not be read
2026/10/24 22:40:24 provision: c.shop.example.com: import sd_gfgrnozqpvmilptptmohudgj7i left alone this pass: the import journal could not be read
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_paex2jlxid2pqjbfvbfhiwdxaa committed: its gate is cleared and its journal row dropped
2026/10/24 22:40:24 provision: a.shop.example.com: not converging import sd_wvuek3ebcgdepylpichdbzurja: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 22:40:24 provision: a.shop.example.com: not converging import sd_4nngoxuyfkydzv7wehdrh22zha: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 22:40:24 provision: a.shop.example.com: not converging import sd_4q6d4fcsg3d6v6wu6nx3zubi5y: it is placed but not committed, and the row on this box has no import gate
2026/10/24 22:40:24 provision: a.shop.example.com: not converging import sd_hlbgo7wb5vkgm7vngdas2lskie: it is placed but not committed, and the row on this box has no import gate
2026/10/24 22:40:24 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/24 22:40:24 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_rk4idsilgks4z4dvant3mbpkqa committed: its gate is cleared and its journal row dropped
2026/10/24 22:40:24 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:24 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:24 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/24 22:40:24 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_qx7cl4p4bqk2o35icaxah5w76y: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_qx7cl4p4bqk2o35icaxah5w76y rolled back (no box had swapped it)
2026/10/24 22:40:24 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/24 22:40:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:24 provision: removed instance route acme.go.tito.io (its seed sd_75bxxpriixqagxr42qxszbw56i was aborted); the next pass rolls it back
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_75bxxpriixqagxr42qxszbw56i: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_75bxxpriixqagxr42qxszbw56i rolled back (no box had swapped it)
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_646u5r7z443sccukkcwwu3yrw4 has a row this pass may not remove; leaving the seed aborted
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_yfodeszpn6ljad6u2xq3q2j3pq rolled back (no box had swapped it)
2026/10/24 22:40:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:24 provision: removed instance route acme.go.tito.io (its seed sd_nj3xh2npb7vk25bkekvxr7ksnu was aborted); the next pass rolls it back
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_nj3xh2npb7vk25bkekvxr7ksnu has no route on this box: its local data is removed
2026/10/24 22:40:24 provision: acme.go.tito.io: aborted seed sd_nj3xh2npb7vk25bkekvxr7ksnu rolled back (no box had swapped it)
2026/10/24 22:40:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:24 provision: a.shop.example.com: swapped for import sd_bsd4l77a66lhyazgotmrfkcy4e (the original route is journaled)
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_bsd4l77a66lhyazgotmrfkcy4e rolled back to its original route
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_bsd4l77a66lhyazgotmrfkcy4e is cleaned up and its journal row retired
2026/10/24 22:40:24 provision: a.shop.example.com: swapped for import sd_v4lrlvruqee7rbghawpi4263ma (the original route is journaled)
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_v4lrlvruqee7rbghawpi4263ma rolled back to its original route
2026/10/24 22:40:24 provision: a.shop.example.com: import sd_v4lrlvruqee7rbghawpi4263ma is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_pp3sfsi54key7vf5sdip7df62y (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_pp3sfsi54key7vf5sdip7df62y rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_pp3sfsi54key7vf5sdip7df62y: the host's replica is left alone: its record no longer names this seed
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_pp3sfsi54key7vf5sdip7df62y is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_kk5fe2rhda27xceownwy5ce5qm (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kk5fe2rhda27xceownwy5ce5qm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kk5fe2rhda27xceownwy5ce5qm rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kk5fe2rhda27xceownwy5ce5qm is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_lyu7bwiw67x6s4nlcndjvinxg4 (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_lyu7bwiw67x6s4nlcndjvinxg4 rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_74pvygn5emm6ekzn5dqeotk37y (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_74pvygn5emm6ekzn5dqeotk37y is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_pc45vghxbquklm3x2xtxco2eoy (the original route is journaled)
2026/10/24 22:40:25 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_pc45vghxbquklm3x2xtxco2eoy left alone this pass: its record could not be read
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_4ey5vexk2vyhqzjnfsc7cajniy (the original route is journaled)
2026/10/24 22:40:25 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_4ey5vexk2vyhqzjnfsc7cajniy left alone this pass: its record could not be read
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_asuyvvfgj47fwqqkfrjfc2ynm4 (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_asuyvvfgj47fwqqkfrjfc2ynm4: close the import gate: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_asuyvvfgj47fwqqkfrjfc2ynm4 rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_asuyvvfgj47fwqqkfrjfc2ynm4 is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_hs77ht5bz7co6qghlp6au5fnmq (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_hs77ht5bz7co6qghlp6au5fnmq: close the import gate: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_hs77ht5bz7co6qghlp6au5fnmq rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_hs77ht5bz7co6qghlp6au5fnmq is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_bp7ok2a2favz66bzo7qvvresqq (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_bp7ok2a2favz66bzo7qvvresqq rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_bp7ok2a2favz66bzo7qvvresqq rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_bp7ok2a2favz66bzo7qvvresqq is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_74urklxmpg5hi6wnfzidsnpelu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_74urklxmpg5hi6wnfzidsnpelu rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_74urklxmpg5hi6wnfzidsnpelu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_cennp4tindwr3ewqsjduzmzjhm (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_cennp4tindwr3ewqsjduzmzjhm: retire its instance key: injected failure at retire-key
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_cennp4tindwr3ewqsjduzmzjhm rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_cennp4tindwr3ewqsjduzmzjhm is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_kypquahtu7mf4swd2z3ttkghfu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kypquahtu7mf4swd2z3ttkghfu rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kypquahtu7mf4swd2z3ttkghfu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_z5atmpca6hmvtlrrogtgrsnacy (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_z5atmpca6hmvtlrrogtgrsnacy: remove its local data: injected failure at remove-local
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_z5atmpca6hmvtlrrogtgrsnacy rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_z5atmpca6hmvtlrrogtgrsnacy is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2tkjkmu654udrzfvecyicwjqcq (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2tkjkmu654udrzfvecyicwjqcq rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2tkjkmu654udrzfvecyicwjqcq is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_ooxukl6gtvx4g5uufgqkpncsty (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_ooxukl6gtvx4g5uufgqkpncsty: remove its local data: injected failure at remove-local-done
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_ooxukl6gtvx4g5uufgqkpncsty rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_ooxukl6gtvx4g5uufgqkpncsty is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_wddwsrb4dhvvtuxk57dx74p7k4 (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_wddwsrb4dhvvtuxk57dx74p7k4 rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_wddwsrb4dhvvtuxk57dx74p7k4 is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_mb4pa3jecwzjln5a2few4mcnli (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_mb4pa3jecwzjln5a2few4mcnli: restore the original route: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_mb4pa3jecwzjln5a2few4mcnli rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_mb4pa3jecwzjln5a2few4mcnli is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_l5wcqgkcjo4sow4emzlhrrs6xe (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_l5wcqgkcjo4sow4emzlhrrs6xe: restore the original route: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_l5wcqgkcjo4sow4emzlhrrs6xe rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_l5wcqgkcjo4sow4emzlhrrs6xe is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_rcdop54jvjxdtpswze33n2inim (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_rcdop54jvjxdtpswze33n2inim is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_o3x43fzjd7wmzro7t2swyf7xxe (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_o3x43fzjd7wmzro7t2swyf7xxe rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_o3x43fzjd7wmzro7t2swyf7xxe: delete its snapshot: injected failure at delete-snapshot
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_o3x43fzjd7wmzro7t2swyf7xxe is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2hopu7pev5k5kpdlpyeiuydqsm (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2hopu7pev5k5kpdlpyeiuydqsm rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2hopu7pev5k5kpdlpyeiuydqsm is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_f4nbk7u3gzqoerlmgdl33vgore (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_f4nbk7u3gzqoerlmgdl33vgore rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_f4nbk7u3gzqoerlmgdl33vgore: delete the host's replica: injected failure at delete-replica
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_f4nbk7u3gzqoerlmgdl33vgore is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_bkxqb7qapgahuxsidrekeseeum (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_bkxqb7qapgahuxsidrekeseeum rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_bkxqb7qapgahuxsidrekeseeum is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_kdme2hdzp2yyippdu6dtukcssu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kdme2hdzp2yyippdu6dtukcssu rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kdme2hdzp2yyippdu6dtukcssu: retire its journal row: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_kdme2hdzp2yyippdu6dtukcssu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_7i3uquc5shxlwzfng4jtie35kq (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_7i3uquc5shxlwzfng4jtie35kq rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_7i3uquc5shxlwzfng4jtie35kq: retire its journal row: constraint failed: injected (1811)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_7i3uquc5shxlwzfng4jtie35kq is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2mivi3re4had27u62xvw3nufdi (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2mivi3re4had27u62xvw3nufdi rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2mivi3re4had27u62xvw3nufdi is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: mark import sd_2mivi3re4had27u62xvw3nufdi rolled back: injected failure at cas
2026/10/24 22:40:25 provision: a.shop.example.com: aborted seed sd_2mivi3re4had27u62xvw3nufdi rolled back (no box had swapped it)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_jqe7lk2hfa4cq6567xgdcgzs6e (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_jqe7lk2hfa4cq6567xgdcgzs6e rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_jqe7lk2hfa4cq6567xgdcgzs6e is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: aborted seed sd_jqe7lk2hfa4cq6567xgdcgzs6e rolled back (no box had swapped it)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_xxwx6bvspienciwvbye7lppfiu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_xxwx6bvspienciwvbye7lppfiu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_xxwx6bvspienciwvbye7lppfiu rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_xxwx6bvspienciwvbye7lppfiu rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_xxwx6bvspienciwvbye7lppfiu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_vabgrz66l5ullufm5q2q6andzu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_vabgrz66l5ullufm5q2q6andzu rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_vabgrz66l5ullufm5q2q6andzu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2tayhnvmullyrouzmr5xoudd5i (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2tayhnvmullyrouzmr5xoudd5i rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2tayhnvmullyrouzmr5xoudd5i is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_5t4nnyt63abpevusgcinyjeamm (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_5t4nnyt63abpevusgcinyjeamm rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_5t4nnyt63abpevusgcinyjeamm is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_lwjoy4u2euashrykrqxnj7mi3a (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_lwjoy4u2euashrykrqxnj7mi3a rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_lwjoy4u2euashrykrqxnj7mi3a is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_fl5hzletqvw3upwyatwnxyr47m (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_fl5hzletqvw3upwyatwnxyr47m rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_fl5hzletqvw3upwyatwnxyr47m is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_7ncrb6vjz4uxw5bhd5eerxhkpa (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_7ncrb6vjz4uxw5bhd5eerxhkpa rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_7ncrb6vjz4uxw5bhd5eerxhkpa is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_wpnsatqlrw5bfcqqo24d47ob5m (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_wpnsatqlrw5bfcqqo24d47ob5m rolled back to its original route
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_wpnsatqlrw5bfcqqo24d47ob5m is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_shw6yndqld4cuisx4ls6f73gdu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_shw6yndqld4cuisx4ls6f73gdu has no route on this box: its local data is removed and no route is put back
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_shw6yndqld4cuisx4ls6f73gdu is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_nmubbpdo5p2f7rucyfptmgtmke (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2l2ew6z2rkjw2ks2zy72ounbai (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_hjiy2tbsob3u7i5535kklvoipe (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_hjiy2tbsob3u7i5535kklvoipe cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_2yp3uigb2o5mfn4thhdlknic24 (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_2yp3uigb2o5mfn4thhdlknic24 is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/24 22:40:25 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/24 22:40:25 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_wcvax2wrnckyp2kdvmzzfpso2m (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_fp4yw4y35a5vx3rqesarh4dtxi (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_np65ju6i7evwozwerlbdwx6mti (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_nn3hf4kme455wvystyyrqrbj5u (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_oazmxjs3p75rrjsm52thmifbwu (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_oazmxjs3p75rrjsm52thmifbwu rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_puoqqwk4qgfjtd72cmmze6m3bi (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_puoqqwk4qgfjtd72cmmze6m3bi has no route on this box: its local data is removed and no route is put back
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_puoqqwk4qgfjtd72cmmze6m3bi is cleaned up and its journal row retired
2026/10/24 22:40:25 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_drcx3up3bd5z2j7xguh6ktvjwe (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_drcx3up3bd5z2j7xguh6ktvjwe: remove its local data: injected failure at remove-local
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_drcx3up3bd5z2j7xguh6ktvjwe is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_yx7q4q5rkskxm4txrk63n2qy5q (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_yx7q4q5rkskxm4txrk63n2qy5q: a route appeared at the host, so its local database is left and the rollback waits
2026/10/24 22:40:25 provision: a.shop.example.com: swapped for import sd_vz5nxcxwj45c6hz24rr4546xzi (the original route is journaled)
2026/10/24 22:40:25 provision: a.shop.example.com: import sd_vz5nxcxwj45c6hz24rr4546xzi rollback deferred: no fence generation: registry busy
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_xnmvo7bz4xs3sxggpr722vpvyu (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_xnmvo7bz4xs3sxggpr722vpvyu rollback deferred: no fence generation: the generation source answered 0
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_xfsqe5ui2y2qyava4bje7kxhdy (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_tcgoro4lixkhj2ooh3aw27wzhq (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_zeajnpvry2t5ptdkzxglfvzswy (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_wwmvmegoc23jtxqybr43yvrcbm (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wwmvmegoc23jtxqybr43yvrcbm rolled back to its original route
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wwmvmegoc23jtxqybr43yvrcbm is cleaned up and its journal row retired
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_dgtjofgdqg2dfr3s7r343appzi (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_dgtjofgdqg2dfr3s7r343appzi rolled back to its original route
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_dgtjofgdqg2dfr3s7r343appzi is cleaned up and its journal row retired
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_6befm6uvxgq7ipx5nfvwysd7ey (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_6befm6uvxgq7ipx5nfvwysd7ey rolled back to its original route
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_6befm6uvxgq7ipx5nfvwysd7ey is cleaned up and its journal row retired
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_wgds7msforefqcwc7davwylbpm (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wgds7msforefqcwc7davwylbpm: retire its instance key: the env file is a symlink
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wgds7msforefqcwc7davwylbpm rolled back to its original route
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wgds7msforefqcwc7davwylbpm is cleaned up and its journal row retired
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_6fmhuxl3jclzfktz6gst2flf2a (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_rulzwt4gg66dlacpkrdamzbktu (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_sfbq4wdgbij5gf3tyykp3xlv4e refused: there is no route at a.shop.example.com to replace
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_53nwbnlep56xzzyebq2f67zpoa refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_644hppobe6fuiceikkeccuzhp4 refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_k6hvtjap7efzv4l2wgv6jd4agm refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_cximr36jfiv4lcfuffyzqalzki refused: the route belongs to app other
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_jfghaxcskcnbggvg3hn4jpjks4 refused: the route is filed under another account
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_nxagekm3lrdhqj3mhikwk4figi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_jidw43p7bvld77xeey7b37lypq refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_aah3udjlpespnflg334ulv7c2a refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wpi4sdzsuweegxx7j4evgkyh6y refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_e2fcho53enns7m7etqiyy634l4 refused: the route is not an address route this import can take over (socket)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_rp3uanzpsgt6ibrh23uwpjd53m refused: the route is not an address route this import can take over (no address)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_vbrvg25n4hnwsqabnobbmj77sm refused: the route is not an address route this import can take over (provisioned)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_ezio442ufpqayrd5k6qt33itcq refused: the route is not an address route this import can take over (kind static)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_kr7wigqj7jwgpp4u3vsi74lxve refused: the route is not an address route this import can take over (backing)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_d4wz7sgsi6ebdansvq74sov5h4 refused: the route is not an address route this import can take over (tunnel)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_lq65lvwsowfq6agm2v3hg3rpnm refused: the route is not an address route this import can take over (caps)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_honleulk3ceg5hscucuialomgu refused: the route is not an address route this import can take over (platform)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_rze7uhoeqx2y52nikgvawihbmy refused: the route is not an address route this import can take over (canary)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_hbdhj25a53y7mzdv75p3ce4mhu refused: the route is not an address route this import can take over (kind sidecar)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_jlm7epppcco46kpp2ooqpfclca refused: the route is not an address route this import can take over (region)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_v4b2ux7c6g6lnr5tbu3mniknom refused: the route is not an address route this import can take over (fleet_box)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_apw4w5x7iwjq2ti2viyeyvns7y refused: the route is not an address route this import can take over (hibernate)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_wpuyly3yi6jdlzei2szb7inv5m refused: the route is not an address route this import can take over (claim_owner)
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_d67udur6qsx7cwzd3t5d2i7vim refused: this box does not run instances nested
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_6zsi63ybmfmza5xtgqjusxba7a refused: this box does not run instances nested
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_k34ml27w26v4motxxnh7k76gr4 refused: claim control is on for this box
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_aobs5dj5h6lzzx5mulqz6ovcpa (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_vz2bq4p4ozpsyyglvdshex63iy (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_kqvh6arqd6y366xjlq4fxcibtm: its verify hash is not a sha256
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_kjymfwrcooa7mee7aklvkxc7au: its verify hash is not a sha256
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_s3vld4etwx77bkptm2p4f6j3f4: its verify hash is not a sha256
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/24 22:40:26 provision: A.shop.example.com/..: not swapping for import sd_5ezh545e4szb5wdbnni6re2wni: its host or seed id is malformed (seeds: not a host)
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_yzkjz7ycmr65ds66vhwuuru7sq: its record does not describe a nested, hibernating instance
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_guheqirwv2td5wxq3izezahk5i: its record does not describe a nested, hibernating instance
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_lahblismh22veklk5s5wufieka: its record does not describe a nested, hibernating instance
2026/10/24 22:40:26 provision: a.shop.example.com: not swapping for import sd_6x24d6wg57l7f3376vavjd4aky: its record does not describe a nested, hibernating instance
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_gjupauardnazbhavi2tpc7sh5a (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_aof3wctxqw3ah3rd6yiftdnbl4 (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_j4xkxuc7kaliidfes5ltigddb4 (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/24 22:40:26 provision: dry-run: would consider swapping a.shop.example.com for import sd_5kqju2u5tojd5ziusuafn2o2f4
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_fm4vxqfjl2fgkshhhdjii64gd4 rolled back to its original route
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_fm4vxqfjl2fgkshhhdjii64gd4: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_fm4vxqfjl2fgkshhhdjii64gd4 is cleaned up and its journal row retired
2026/10/24 22:40:26 provision: a.shop.example.com: import sd_vzcpbw3uq4hk5rpnxbx5tzsiey left alone: the import journal holds seed sd_bbic23yo7joy23shvdyk2qdyqi at swapped
2026/10/24 22:40:26 provision: a.shop.example.com: not minting import sd_jhj34rchk7b2dltcxdjt6duljq: it is swapped but not committed, and only its swap makes its row
2026/10/24 22:40:26 provision: a.shop.example.com: not minting import sd_h5gfos57np3rluemxc32n54jv4: it is placed but not committed, and only its swap makes its row
2026/10/24 22:40:26 provision: a.shop.example.com: swapped for import sd_mjybhu3s7hrxbpj4pdzwsnpyhu (the original route is journaled)
2026/10/24 22:40:26 provision: a.shop.example.com: not minting import sd_mjybhu3s7hrxbpj4pdzwsnpyhu: it is swapped but not committed, and only its swap makes its row
2026/10/24 22:40:26 provision: a.shop.example.com: not minting import sd_mjybhu3s7hrxbpj4pdzwsnpyhu: it is placed but not committed, and only its swap makes its row
2026/10/24 22:40:26 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 22:40:27 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/24 22:40:27 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/24 22:40:27 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/24 22:40:27 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/24 22:40:27 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/24 22:40:27 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 22:40:27 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/24 22:40:27 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/24 22:40:27 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 22:40:27 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:40:27 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/24 22:40:27 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 22:40:27 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/24 22:40:27 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/24 22:40:27 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 22:40:27 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: sidecar bot.eleven.bac.sidecar.internal: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 22:40:27 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 22:40:27 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 22:40:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:27 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/24 22:40:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:27 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:40:27 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:40:27 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 22:40:27 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 22:40:27 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 22:40:27 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 22:40:27 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 22:40:27 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:27 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/24 22:40:27 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:27 provision: record view: change index unusable (get refused): walking
2026/10/24 22:40:27 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 22:40:27 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/24 22:40:27 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 22:40:27 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:27 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 22:40:27 provision: an app's records could not be listed: they are skipped
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:40:27 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:40:27 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 22:40:27 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/24 22:40:27 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:40:27 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:40:27 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 22:40:27 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 22:40:27 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 22:40:27 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 22:40:27 provision: removed retired instance route one.example.com (record gone)
2026/10/24 22:40:27 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 22:40:27 provision: removed retired instance route one.example.com (record gone)
2026/10/24 22:40:27 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 22:40:27 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/24 22:40:27 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (14.55s)
    plan14_root_reads_test.go:600: root read census: 75 discrepancies
        changed root read internal/activator/activator.go:Service.doWake; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.respawnWorkerLocked; review class, task, sites and digest
        changed root read internal/activator/activator.go:Service.stop; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged; review class, task, sites and digest
        changed root read internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom; review class, task, sites and digest
        changed root read internal/activator/backend_unit.go:SplitBackend.LegacyRunGone; review class, task, sites and digest
        changed root read internal/activator/containment.go:Service.legacyRunGone; review class, task, sites and digest
        changed root read internal/activator/layout.go:Classify; review class, task, sites and digest
        changed root read internal/activator/maintenance.go:Service.cleanupFailedWake; review class, task, sites and digest
        changed root read internal/activator/opset.go:Service.reapUnprovenWake; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareAt; review class, task, sites and digest
        changed root read internal/activator/prepare.go:ExecBackend.prepareKeyedAt; review class, task, sites and digest
        changed root read internal/activator/unitproc.go:ExecBackend.observe; review class, task, sites and digest
        changed root read internal/activator/workerswap.go:Service.ReplaceWorker; review class, task, sites and digest
        changed root read internal/host/agent.go:runAgent; review class, task, sites and digest
        changed root read internal/instancectl/server.go:parseRequest; review class, task, sites and digest
        changed root read internal/instancectl/server.go:type Server; review class, task, sites and digest
        changed root read internal/ops/hibernate_verify.go:HibernatingHosts; review class, task, sites and digest
        changed root read internal/ops/litestream.go:FleetDBsWithSkipped; review class, task, sites and digest
        changed root read internal/ops/ops.go:runLitestream; review class, task, sites and digest
        changed root read internal/provision/sidecar_reconcile.go:ReconcileSidecars; review class, task, sites and digest
        changed root read internal/provision/sidecar_reconcile.go:convergeSidecar; review class, task, sites and digest
        changed root source envelope internal/activator
        changed root source envelope internal/agentsock
        changed root source envelope internal/host
        changed root source envelope internal/host/units
        changed root source envelope internal/instancectl
        changed root source envelope internal/instanceexec
        changed root source envelope internal/ops
        changed root source envelope internal/provision
        changed root source envelope internal/release
        stale root read internal/activator/control.go:systemctlUnitState
        unclassified root read internal/activator/activator.go:Service.SharedWorkerToken whole:Route@329
        unclassified root read internal/activator/activator.go:Service.agentSocketFor whole:Route@148
        unclassified root read internal/activator/backend_exec.go:ExecBackend.RoleGone registry:Host@192,registry:Host@228,registry:Host@271,registry:Host@562
        unclassified root read internal/activator/backend_exec.go:ExecBackend.startWorkerUnit registry:Host@1137,registry:Host@1299,registry:Host@1647,registry:Host@1775,registry:Host@2094,registry:Host@2193,registry:Host@626,registry:Host@698,whole:Route@1341,whole:Route@2291,whole:Route@328,whole:Route@419
        unclassified root read internal/activator/backend_unit.go:SplitBackend.RoleGone file:Exec@263,registry:Backing@107,registry:Host@217,registry:Host@323,whole:Route@377
        unclassified root read internal/activator/backend_unit.go:SplitBackend.nestedWorkerRow file:Exec@134,registry:Backing@69,whole:Route@193
        unclassified root read internal/activator/backend_unit.go:SplitBackend.perHostAgentSocket file:Exec@154,registry:Backing@82,whole:Route@217
        unclassified root read internal/activator/containment.go:Service.roleGone whole:Route@581
        unclassified root read internal/activator/control.go:systemctlUnitFacts file:CommandContext@105
        unclassified root read internal/activator/layout.go:WorkerManaged registry:Backing@71,registry:Tunnel@91
        unclassified root read internal/activator/opset.go:Service.stopUnitProven registry:Host@309,whole:Route@101,whole:Route@177
        unclassified root read internal/activator/prepare.go:ExecBackend.agentSocketFor whole:Route@102
        unclassified root read internal/activator/prepare.go:ExecBackend.nestedWorkerRow registry:DBPath@112,registry:Host@159,registry:Socket@93,whole:Route@86
        unclassified root read internal/activator/prepare.go:ExecBackend.perHostAgentSocket whole:Route@141,whole:Route@96
        unclassified root read internal/activator/prepare.go:ExecBackend.prepareWorker whole:Route@210
        unclassified root read internal/activator/unitproc.go:ExecBackend.newWorkerUnitProc registry:Host@244,registry:Host@286,whole:Route@167,whole:Route@171
        unclassified root read internal/host/units/carlos-instance-worker@.service:external file:external@0
        unclassified root read internal/ops/litestream.go:ActivatorReplicated registry:Backing@59,registry:DBPath@97,registry:Hibernate@117
        unclassified root read internal/ops/litestream.go:ActivatorReplicatedPaths registry:DBPath@257,whole:Route@178,whole:Route@212
        changed legacy declaration internal/activator/activator.go:Service.doWake
        changed legacy declaration internal/activator/activator.go:Service.stop
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.LegacyRunGone
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged
        changed legacy declaration internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom
        changed legacy declaration internal/activator/backend_unit.go:SplitBackend.LegacyRunGone
        changed legacy declaration internal/activator/containment.go:Service.legacyRunGone
        changed legacy declaration internal/activator/layout.go:Classify
        changed legacy declaration internal/activator/maintenance.go:Service.cleanupFailedWake
        changed legacy declaration internal/activator/opset.go:Service.reapUnprovenWake
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareAt
        changed legacy declaration internal/activator/prepare.go:ExecBackend.prepareKeyedAt
        changed legacy declaration internal/activator/unitproc.go:ExecBackend.observe
        changed legacy declaration internal/instancectl/server.go:parseRequest
        changed legacy declaration internal/instancectl/server.go:type Server
        changed legacy declaration internal/ops/hibernate_verify.go:HibernatingHosts
        changed legacy declaration internal/ops/litestream.go:FleetDBsWithSkipped
        changed legacy declaration internal/ops/ops.go:runLitestream
        changed legacy declaration internal/provision/sidecar_reconcile.go:ReconcileSidecars
        changed legacy declaration internal/provision/sidecar_reconcile.go:convergeSidecar
        changed reclassified declaration internal/activator/activator.go:Service.respawnWorkerLocked
        changed reclassified declaration internal/activator/workerswap.go:Service.ReplaceWorker
        legacy declaration needs explicit reclassification or removal internal/activator/control.go:systemctlUnitState
        
        make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	23.370s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.010s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.573s
ok  	github.com/carlosframework/platform/internal/relay	7.237s
ok  	github.com/carlosframework/platform/internal/release	25.587s
ok  	github.com/carlosframework/platform/internal/rollout	3.771s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.029s
ok  	github.com/carlosframework/platform/internal/runs	0.513s
ok  	github.com/carlosframework/platform/internal/s3compat	0.006s
ok  	github.com/carlosframework/platform/internal/safefile	0.006s
ok  	github.com/carlosframework/platform/internal/schedule	2.658s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.537s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	10.016s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.567s
ok  	github.com/carlosframework/platform/internal/status	0.067s
ok  	github.com/carlosframework/platform/internal/steering	0.008s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.315s
ok  	github.com/carlosframework/platform/internal/svcrole	0.003s
ok  	github.com/carlosframework/platform/internal/telemetry	0.005s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.675s
FAIL
=== internal_console@0 (89 s)
ok  	github.com/carlosframework/platform/internal/console	87.348s
=== internal_console@1 (44 s)
ok  	github.com/carlosframework/platform/internal/console	41.990s
=== internal_console@2 (40 s)
ok  	github.com/carlosframework/platform/internal/console	38.454s
=== internal_console@3 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.538s
=== internal_console@4 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.375s
=== internal_console@5 (42 s)
ok  	github.com/carlosframework/platform/internal/console	39.790s
=== internal_console@6 (38 s)
ok  	github.com/carlosframework/platform/internal/console	35.562s
=== internal_console@7 (47 s)
ok  	github.com/carlosframework/platform/internal/console	45.005s
=== root@0 (110 s)
ok  	github.com/carlosframework/platform	107.963s
=== root@1 (84 s)
ok  	github.com/carlosframework/platform	82.397s
=== root@2 (92 s)
using http://127.0.0.1:40763 as a@keymail.dev
using http://127.0.0.1:46383 as vicky@keymail.dev
titogo (staging):
KEY   VALUE
PORT  8080
--- FAIL: TestRunBuiltCopyIsApplied (0.14s)
    approved_run_copy_test.go:139: RUN-C13: internal/instanceexec/exec.go does not contain the approved text "instance-exec: role <role> is not run, seed, sidecar or cmd"
    approved_run_copy_test.go:139: RUN-C14: internal/instanceexec/exit.go does not contain the approved text "instance-exit: role <role> is not run, seed, sidecar or cmd"
2026/10/24 22:40:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:30 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43467": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:30 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:30 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A38997": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:30 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:32 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43955": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:32 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:32 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A32851": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:32 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:34 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A36051": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:34 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:37 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:37 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43537": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:37 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
using http://127.0.0.1:43201 as paul@keymail.dev
account: ops (bab)
2026/10/24 22:40:39 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A43201": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:39 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
set 1 env var(s) for titogo (default)
using http://127.0.0.1:43201 as paul@keymail.dev
account: ops (bab)
set 1 secret(s) for titogo (default)
account: ops (bab)
account: ops (bab)
using http://127.0.0.1:43201 as paul@keymail.dev
account: ops (bab)
config sync requested for titogo the files land within seconds; programs carlos owns restart themselves, and anything else keeps its old values until you restart it
2026/10/24 22:40:39 console: delivery to mallory@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=mallory%40keymail.dev&from=console%40127.0.0.1%3A43201": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:39 console: could not notify mallory@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:41 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:40:41 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:40:41 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:40:42 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:40:42 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:40:42 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:40:42 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:42 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A34655": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:42 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:40:42 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:40:42 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:40:42 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:40:43 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:40:43 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:40:43 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:40:44 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:40:44 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A39675": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:40:44 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:25 console: db read dbr_ww7djmejkwebvoqozumgcnssfu: relayed 1 chunks (101 bytes) in 41.033s, ended done
2026/10/24 22:41:25 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:41:25 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:41:25 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:41:26 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:41:26 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:41:26 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:41:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:41:26 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A36329": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:26 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:27 console: db read dbr_3ikjno7eae62f2uew3276wxzn4: relayed 1 chunks (1070 bytes) in 1.001s, ended done
2026/10/24 22:41:28 console: db read dbr_il5oyhdhv7arnomzennxuv3y7e: relayed 1 chunks (805 bytes) in 1.002s, ended done
2026/10/24 22:41:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:41:28 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=708
2026/10/24 22:41:28 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:41:29 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:41:29 INFO ltx file uploaded system=store db=shop.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=265
2026/10/24 22:41:29 INFO replica sync system=store db=shop.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:41:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:41:29 console: delivery to member@example.com: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A37553": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:29 console: could not notify member@example.com of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:30 console: db read dbr_mdf3uyxovhnewxoczgzu75fhyy: relayed 2 chunks (8386 bytes) in 1.044s, ended client gone
using http://127.0.0.1:46203 as paul@keymail.dev
account: ops (bab)
attached tickets.example.com -> default.go.tito.io
DNS: pointing
using http://127.0.0.1:46203 as paul@keymail.dev
account: ops (bab)
attached carloku.example.com -> default.go.tito.io
2026/10/24 22:41:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:41:31 console: delivery to rival@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=rival%40keymail.dev&from=console%40127.0.0.1%3A40327": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:31 console: could not notify rival@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:31 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A40327": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:31 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:40 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A38173": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:40 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:40 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 22:41:40 console: delivery to paul@keymail.dev: keymail lookup unreachable, trying email: keymail: lookup unreachable: Get "http://keymail.invalid/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A42903": dial tcp: lookup keymail.invalid on 127.0.0.53:53: no such host
2026/10/24 22:41:40 console: could not notify paul@keymail.dev of a CLI token issue: console: no email sender is configured
2026/10/24 22:41:41 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/24 22:41:41 domains: minted platform domain blog.mdbbndjqx.oncarlos.test (upstream blog.kass.test)
2026/10/24 22:41:41 domains: minted platform domain blog.gdpkwhwrw.oncarlos.test (upstream blog.woodstar.test)
2026/10/24 22:41:41 domains: minted platform domain oldsite.bab.oncarlos.test (upstream old.test)
2026/10/24 22:41:41 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 22:41:42 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 22:41:42 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
FAIL
FAIL	github.com/carlosframework/platform	89.948s
FAIL

FAILED: rest root@2
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/implementation/census-claims-sidecar-isolation.txt b/implementation/census-claims-sidecar-isolation.txt

index 73431fbaf..2221b81f9 100644

--- a/implementation/census-claims-sidecar-isolation.txt

+++ b/implementation/census-claims-sidecar-isolation.txt

@@ -3,3 +3,5 @@ internal/ops/hibernate_verify.go:HibernatingHosts selects by ActivatorReplicated

internal/ops/litestream.go:FleetDBsWithSkipped the activator-owned exclusion tests ActivatorReplicated (workers included) instead of Hibernate alone; reads the whole route through the predicate

internal/instancectl/server.go:parseRequest admits the worker role on /start, /stop and /reset and lets a worker start name its staged exe (validated by host, D1/D5); a worker with a generation is still refused; the role error names worker; no new read

internal/instancectl/server.go:type Server the #292 start fence maps (legacyStarts, legacyStopping, legacyBarrier) are keyed by roleHost{role, host} instead of host, so the worker unit is fenced apart from the run unit (D19); no new read

+internal/provision/sidecar_reconcile.go:ReconcileSidecars a fresh worker row is minted at NestedDBPath only when the box's layout intent is nested and the agent-start workers readiness (cfg.Workers, D7/D11) holds; sidecarRouteFor is now called once per branch (existing row flat-derived, mint after the layout read), so the route is built at two sites; a layout read failure defers that mint only when cfg.Workers is set; no new read

+internal/provision/sidecar_reconcile.go:convergeSidecar the DB path shape check accepts the flat or the nested path for the row's own host (NestedDBPath, D7) and still reports anything else; the path is never rewritten; reads the row's DBPath it already compared

diff --git a/internal/host/agent.go b/internal/host/agent.go

index 05c00277c..ebcfc3141 100644

--- a/internal/host/agent.go

+++ b/internal/host/agent.go

@@ -239,6 +239,15 @@ func runAgent(args []string, buildClaims ClaimFactory) {

log.Fatalf("agent: host claims: %v", err)

}

dd := dataDir()

+ // The box's workers readiness is decided here, once, for the life of

+ // this agent (sidecar isolation spec D11): the reconciler and the

+ // layout pass read the cached answer, so an install rewriting

+ // carlos.prev.version while the agent runs changes nothing.

+ if w := armWorkersReadiness(os.Getenv, release.OptDir(), version.Build); w.Ready() {

+ log.Printf("agent: workers readiness %s", w.Word())

+ } else {

+ log.Printf("agent: workers readiness %s: %s", w.Word(), w.Reason())

+ }

regPath := peekRegistryPath(args, dd)

// A second handle on the same registry file the edge opens — the registry

// is designed for concurrent handles (fresh-connection reads), and this

@@ -1626,6 +1635,12 @@ func reconcileSerializedWith(ctx context.Context, s release.Store, reg *registry

return mintLayoutIntentWith(ctx, s, reg.List)

}

+ // A worker row is minted nested only when this agent's workers

+ // readiness held at its start (sidecar isolation D7, D11): the cached

+ // answer, never re-read here.

+ if !cfg.Workers {

+ cfg.Workers = agentWorkers().Ready()

+ }

// Seeded records (seeded-instances spec §3.2): acted on only once the

// activator has armed the data bucket (wireSeedPlacement).

if cfg.Seeds == nil {

diff --git a/internal/host/workerready.go b/internal/host/workerready.go

new file mode 100644

index 000000000..469363e6f

--- /dev/null

+++ b/internal/host/workerready.go

@@ -0,0 +1,128 @@

+package host

+import (

+ "strconv"

+ "sync/atomic"

+ "github.com/carlosframework/platform/internal/release"

+// The box's workers readiness (sidecar isolation spec rev 4, D11): whether

+// this agent may mint worker rows nested (D7) and move worker rows (D8).

+// A binary from before the nested worker runs a nested worker row flat and

+// unisolated, so a box only goes nested when both binaries a recovery or a

+// rollback could put in front of the rows are at or above

+// release.WorkerLayoutFloor, and only on the operator's say-so in

+// root-owned host.env.

+//

+// The answer is fixed when the agent starts. An install's decidePrev

+// copies the running build into carlos.prev while this agent runs (R3-1);

+// had eligibility followed the file live, the agent could mint or move a

+// worker after install's row check and before the candidate replaced it.

+// So nothing that changes while the agent runs makes it eligible; only a

+// restart does.

+//

+// The layout intent and the nested gate are not part of this answer: the

+// reconciler and the pass check them where they already do.

+// nestedWorkersEnv is the root-owned opt-in. Unset means off.

+const nestedWorkersEnv = "CARLOS_NESTED_WORKERS"

+// The readiness words this file produces. Status (Task 9) reports them;

+// "blocked" is decided by status itself, from the claim gate.

+const (

+ workersNested = "nested"

+ workersOff = "off"

+ workersWaitingForPrev = "waiting_for_prev"

+// WorkersReady evaluates D11's start-time condition: CARLOS_NESTED_WORKERS

+// exactly "on", and both running (this build) and the release recorded in

+// <optDir>/carlos.prev.version at or above release.WorkerLayoutFloor. A

+// version that does not parse (a dev build, a missing, empty or garbled

+// file) reads as below the floor (Review Focus 5: an old box that never

+// wrote the file stays flat). word is "nested", "off" or

+// "waiting_for_prev"; reason is a private diagnostic for status and logs.

+//

+// It reads the file every time it is called. The agent calls it once, at

+// start (armWorkersReadiness), and everything after reads the cached

+// answer.

+func WorkersReady(getenv func(string) string, optDir string, running string) (ready bool, word string, reason string) {

+ switch v := getenv(nestedWorkersEnv); v {

+ case "on":

+ case "":

+ return false, workersOff, nestedWorkersEnv + " is unset; workers stay flat"

+ case "off":

+ return false, workersOff, nestedWorkersEnv + "=off; workers stay flat"

+ default:

+ return false, workersOff, nestedWorkersEnv + "=" + strconv.Quote(v) + " is not on or off; workers stay flat"

+ }

+ floor := "v" + release.WorkerLayoutFloor.String()

+ if !release.AtOrAboveFloor(running, release.WorkerLayoutFloor) {

+ return false, workersWaitingForPrev, "this agent runs " + strconv.Quote(running) + ", not a release at or above " + floor

+ }

+ path := prevVersionPath(optDir)

+ prev, ok := readLine(path)

+ if !ok {

+ return false, workersWaitingForPrev, path + " is missing or unreadable, so carlos.prev cannot be placed against " + floor

+ }

+ if !release.AtOrAboveFloor(prev, release.WorkerLayoutFloor) {

+ return false, workersWaitingForPrev, "carlos.prev is " + strconv.Quote(prev) + " (" + path + "), not a release at or above " + floor

+ }

+ return true, workersNested, ""

+// WorkersReadiness is one evaluation of WorkersReady, held for the life of

+// the agent. A nil *WorkersReadiness reads as off.

+type WorkersReadiness struct {

+ ready bool

+ word string

+ reason string

+// Ready reports whether this agent may mint and move worker rows nested.

+func (w *WorkersReadiness) Ready() bool { return w != nil && w.ready }

+// Word is the readiness word for status: "nested", "off" or

+// "waiting_for_prev".

+func (w *WorkersReadiness) Word() string {

+ if w == nil {

+ return workersOff

+ }

+ return w.word

+// Reason is why the box is not ready, "" when it is. Private: it may name

+// a path.

+func (w *WorkersReadiness) Reason() string {

+ if w == nil {

+ return "workers readiness was not evaluated in this process"

+ }

+ return w.reason

+// startWorkers is the agent's start-time answer, set once by

+// armWorkersReadiness.

+var startWorkers atomic.Pointer[WorkersReadiness]

+// armWorkersReadiness evaluates WorkersReady and caches it for the life of

+// the process. Only the first call evaluates; a later one returns the

+// cached answer, so nothing after start can change it.

+func armWorkersReadiness(getenv func(string) string, optDir, running string) *WorkersReadiness {

+ if w := startWorkers.Load(); w != nil {

+ return w

+ }

+ ready, word, reason := WorkersReady(getenv, optDir, running)

+ startWorkers.CompareAndSwap(nil, &WorkersReadiness{ready: ready, word: word, reason: reason})

+ return startWorkers.Load()

+// agentWorkers is the cached start-time readiness: what the reconciler,

+// the layout pass and status read. Before (or without) an arm it reads as

+// off.

+func agentWorkers() *WorkersReadiness {

+ if w := startWorkers.Load(); w != nil {

+ return w

+ }

+ return &WorkersReadiness{word: workersOff, reason: "workers readiness was not evaluated in this process"}

diff --git a/internal/host/workerready_test.go b/internal/host/workerready_test.go

new file mode 100644

index 000000000..549ca572d

--- /dev/null

+++ b/internal/host/workerready_test.go

@@ -0,0 +1,172 @@

+package host

+import (

+ "context"

+ "os"

+ "path/filepath"

+ "testing"

+ "github.com/carlosframework/platform/internal/domains"

+ "github.com/carlosframework/platform/internal/moves"

+ "github.com/carlosframework/platform/internal/provision"

+ "github.com/carlosframework/platform/internal/registry"

+ "github.com/carlosframework/platform/internal/release"

+// TestWorkersReadyTable pins D11's start-time condition (sidecar isolation

+// spec rev 4): CARLOS_NESTED_WORKERS exactly "on", and both the running

+// build and carlos.prev.version at or above release.WorkerLayoutFloor.

+// Unset means off. A missing, empty or unparseable carlos.prev.version, and

+// a dev build, read as below the floor (Review Focus 5).

+func TestWorkersReadyTable(t *testing.T) {

+ const missing = "\x00missing"

+ for _, tc := range []struct {

+ name string

+ env string

+ prev string

+ running string

+ ready bool

+ word string

+ }{

+ {name: "unset is off", env: "", prev: "v0.29.0", running: "v0.29.0", word: "off"},

+ {name: "on", env: "on", prev: "v0.29.0", running: "v0.29.0", ready: true, word: "nested"},

+ {name: "off", env: "off", prev: "v0.29.0", running: "v0.29.0", word: "off"},

+ {name: "not exactly on", env: "ON", prev: "v0.29.0", running: "v0.29.0", word: "off"},

+ {name: "prev missing", env: "on", prev: missing, running: "v0.29.0", word: "waiting_for_prev"},

+ {name: "prev empty", env: "on", prev: "\n", running: "v0.29.0", word: "waiting_for_prev"},

+ {name: "prev below", env: "on", prev: "v0.28.12", running: "v0.29.0", word: "waiting_for_prev"},

+ {name: "prev unparseable", env: "on", prev: "abc1234", running: "v0.29.0", word: "waiting_for_prev"},

+ {name: "running below", env: "on", prev: "v0.29.0", running: "v0.28.12", word: "waiting_for_prev"},

+ {name: "running dev build", env: "on", prev: "v0.29.0", running: "dev", word: "waiting_for_prev"},

+ {name: "both at floor", env: "on", prev: "v0.29.0\n", running: "v0.29.0", ready: true, word: "nested"},

+ {name: "both above floor", env: "on", prev: "v0.30.1", running: "0.31.0", ready: true, word: "nested"},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ opt := t.TempDir()

+ if tc.prev != missing {

+ if err := os.WriteFile(filepath.Join(opt, moves.PrevVersionFile), []byte(tc.prev), 0o644); err != nil {

+ t.Fatal(err)

+ }

+ getenv := func(k string) string {

+ if k == "CARLOS_NESTED_WORKERS" {

+ return tc.env

+ }

+ return ""

+ }

+ ready, word, reason := WorkersReady(getenv, opt, tc.running)

+ if ready != tc.ready || word != tc.word {

+ t.Fatalf("WorkersReady = (%v, %q, %q), want (%v, %q)", ready, word, reason, tc.ready, tc.word)

+ }

+ if !ready && reason == "" {

+ t.Fatal("a box that is not ready must say why")

+ }

+ })

+ }

+// TestWorkersReadyFixedAtStart is R3-1's pin: eligibility is decided once,

+// when the agent starts. An install's decidePrev rewriting

+// carlos.prev.version while the agent runs must not make it eligible, so a

+// worker minted after the rewrite is still flat, through the agent's own

+// reconcile entry point. Only a restart (a fresh evaluation) does.

+func TestWorkersReadyFixedAtStart(t *testing.T) {

+ prevArmed := startWorkers.Load()

+ t.Cleanup(func() { startWorkers.Store(prevArmed) })

+ startWorkers.Store(nil)

+ opt := t.TempDir()

+ prevFile := filepath.Join(opt, moves.PrevVersionFile)

+ if err := os.WriteFile(prevFile, []byte("v0.28.12\n"), 0o644); err != nil {

+ t.Fatal(err)

+ }

+ on := func(k string) string {

+ if k == "CARLOS_NESTED_WORKERS" {

+ return "on"

+ }

+ return ""

+ }

+ if got := armWorkersReadiness(on, opt, "v0.29.0"); got.Ready() || got.Word() != "waiting_for_prev" {

+ t.Fatalf("at start: ready %v word %q, want waiting_for_prev", got.Ready(), got.Word())

+ }

+ // decidePrev copies the running N into carlos.prev while the agent runs.

+ if err := os.WriteFile(prevFile, []byte("v0.29.0\n"), 0o644); err != nil {

+ t.Fatal(err)

+ }

+ // A second arm in the same process is not a restart: it keeps the answer.

+ armWorkersReadiness(on, opt, "v0.29.0")

+ if w := agentWorkers(); w.Ready() || w.Word() != "waiting_for_prev" {

+ t.Fatalf("after the rewrite: ready %v word %q, want the start-time answer waiting_for_prev", w.Ready(), w.Word())

+ }

+ dataDir := t.TempDir()

+ host := mintOneWorker(t, dataDir)

+ if host.DBPath != provision.DefaultDBPath(dataDir, host.Host) {

+ t.Fatalf("worker minted at %q after carlos.prev.version changed under a running agent; want the flat %q",

+ host.DBPath, provision.DefaultDBPath(dataDir, host.Host))

+ }

+ // The positive control: a restart evaluates afresh and mints nested.

+ startWorkers.Store(nil)

+ if got := armWorkersReadiness(on, opt, "v0.29.0"); !got.Ready() || got.Word() != "nested" {

+ t.Fatalf("after a restart: ready %v word %q, want nested", got.Ready(), got.Word())

+ }

+ dataDir = t.TempDir()

+ host = mintOneWorker(t, dataDir)

+ if host.DBPath != provision.NestedDBPath(dataDir, host.Host) {

+ t.Fatalf("worker minted at %q on a box ready at start; want the nested %q",

+ host.DBPath, provision.NestedDBPath(dataDir, host.Host))

+ }

+// TestAgentWorkersUnarmedIsOff: a process that never armed the readiness

+// (a test, a command that is not the agent) reads as off, never nested.

+func TestAgentWorkersUnarmedIsOff(t *testing.T) {

+ prevArmed := startWorkers.Load()

+ t.Cleanup(func() { startWorkers.Store(prevArmed) })

+ startWorkers.Store(nil)

+ if w := agentWorkers(); w.Ready() || w.Word() != "off" || w.Reason() == "" {

+ t.Fatalf("unarmed: ready %v word %q reason %q, want off with a reason", w.Ready(), w.Word(), w.Reason())

+ }

+ var nilW *WorkersReadiness

+ if nilW.Ready() || nilW.Word() != "off" {

+ t.Fatal("a nil readiness must read as off")

+ }

+// mintOneWorker runs the agent's reconcile entry point once over a store

+// holding one sidecar record, on a box whose layout intent is nested, and

+// returns the minted row.

+func mintOneWorker(t *testing.T, dataDir string) *registry.Route {

+ t.Helper()

+ ctx := context.Background()

+ s := release.NewDirStore(t.TempDir())

+ sqid := domains.Sqid(2)

+ manifest := []byte(`{"id":2,"sqid":"` + sqid + `","name":"Eleven","created_at":"2026-08-02T09:00:00Z"}`)

+ if _, err := s.Put(ctx, "accounts/"+sqid+"/account.json", manifest, ""); err != nil {

+ t.Fatal(err)

+ }

+ if err := provision.PutSidecarManifest(ctx, s, sqid, "eleven", provision.SidecarManifest{

+ Schema: 1, App: "eleven", Args: []string{"sidecar", "run"}, Channel: "stable"}); err != nil {

+ t.Fatal(err)

+ }

+ host := provision.SidecarHost("bot", "eleven", sqid)

+ if err := provision.CreateSidecarRecord(ctx, s, provision.SidecarRecord{

+ Schema: 1, Name: "bot", Host: host, App: "eleven", Account: sqid, Channel: "stable"}); err != nil {

+ t.Fatal(err)

+ }

+ reg := restartTestRegistry(t)

+ cfg := provision.ReconcileConfig{DataDir: dataDir,

+ Layout: func(context.Context, release.Store) (string, error) { return release.LayoutModeNested, nil }}

+ if err := reconcileSerialized(ctx, s, reg, cfg); err != nil {

+ t.Fatalf("reconcileSerialized: %v", err)

+ }

+ rt, err := reg.Get(host)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if rt == nil {

+ t.Fatal("no worker row minted")

+ }

+ return rt

diff --git a/internal/provision/reconcile.go b/internal/provision/reconcile.go

index 31945adc1..72c4a57a7 100644

--- a/internal/provision/reconcile.go

+++ b/internal/provision/reconcile.go

@@ -75,6 +75,15 @@ type ReconcileConfig struct {

// not mint a flat row the fleet may want nested. Nil is flat (tests,

// and a caller with no intent to read).

Layout func(ctx context.Context, s release.Store) (string, error)

+ // Workers is the box's workers readiness as its agent found it at

+ // start (sidecar isolation spec D11: CARLOS_NESTED_WORKERS=on and both

+ // the running build and carlos.prev at or above

+ // release.WorkerLayoutFloor). The sidecar pass mints a worker row

+ // nested only when this holds and Layout names nested (D7); false

+ // mints every worker flat, as before, and never reads Layout for one.

+ // The agent sets it from its cached start-time answer; nothing in a

+ // pass recomputes it.

+ Workers bool

// DryRun reports what the pass would do and writes nothing — not to the

// registry, not anywhere. The backfill mitigation (design §4.3): a

// production route is adopted only after someone has read what adopting

@@ -489,6 +498,19 @@ func mintLayoutReader(ctx context.Context, s release.Store, cfg ReconcileConfig)

}

+// workerMintLayoutReader answers "mint this worker nested?" (sidecar

+// isolation spec D7): the instance mint's answer from mintLayoutReader,

+// and only on a box whose workers readiness held at agent start

+// (cfg.Workers, D11). Without that readiness it answers flat at once and

+// never reads the intent, so a box that has not opted in mints workers

+// exactly as before, an unreadable intent included.

+func workerMintLayoutReader(ctx context.Context, s release.Store, cfg ReconcileConfig) func() (bool, error) {

+ if !cfg.Workers {

+ return func() (bool, error) { return false, nil }

+ }

+ return mintLayoutReader(ctx, s, cfg)

// upstreamCols renders a record's THREE upstream columns exactly as a minted

// route carries them: the legacy single addr, the comma-joined addr set, and

// the probe-config JSON.

diff --git a/internal/provision/sidecar_reconcile.go b/internal/provision/sidecar_reconcile.go

index 4a7c6d8d6..b19934367 100644

--- a/internal/provision/sidecar_reconcile.go

+++ b/internal/provision/sidecar_reconcile.go

@@ -125,10 +125,19 @@ func placeable(rec SidecarRecord, m SidecarManifest, cfg ReconcileConfig) bool {

// by ops.FleetDBs' dataDir glob and replicated box-wide as if it never slept

// (routeFor's comment records what that costs).

+// nested derives that path at the nested layout's helper instead

+// (NestedDBPath, sidecar isolation spec D7): only the mint passes true, from

+// workerMintLayoutReader. A worker binds nothing on either layout, so the

+// socket stays empty both ways.

+//

// The ceilings are materialized onto the row from the manifest precisely so

// the activator's sweeper never needs a bucket read to decide a worker has

// outrun its limits.

-func sidecarRouteFor(rec SidecarRecord, m SidecarManifest, dataDir string) registry.Route {

+func sidecarRouteFor(rec SidecarRecord, m SidecarManifest, dataDir string, nested bool) registry.Route {

+ dbPath := DefaultDBPath(dataDir, rec.Host)

+ if nested {

+ dbPath = NestedDBPath(dataDir, rec.Host)

+ }

return registry.Route{

Host: rec.Host, Slug: rec.Name, Kind: SidecarKind,

App: rec.App, Account: rec.Account, Pool: rec.Pool, Region: rec.Region,

@@ -138,7 +147,7 @@ func sidecarRouteFor(rec SidecarRecord, m SidecarManifest, dataDir string) regis

// nothing here for a manifest-side fallback to rescue. The manifest's

// Channel is the console door's default at CREATE time.

Channel: rec.Channel, Environment: rec.Environment,

- DBPath: DefaultDBPath(dataDir, rec.Host),

+ DBPath: dbPath,

Hibernate: m.HibernateOrDefault(),

Args: sidecarArgsJSON(m),

IdleSeconds: int(m.IdleOrDefault() / time.Second),

@@ -389,6 +398,11 @@ func ReconcileSidecars(ctx context.Context, s release.Store, reg *registry.Regis

byHost[rt.Host] = rt

}

+ // A fresh worker row is minted nested on a box whose intent names

+ // nested and whose workers readiness held at agent start (D7, D11);

+ // read once per pass, lazily, like the instance mint's.

+ mintNested := workerMintLayoutReader(ctx, s, cfg)

for _, rec := range recs {

if trashed(rec.Account, rec.App) {

continue

@@ -404,9 +418,10 @@ func ReconcileSidecars(ctx context.Context, s release.Store, reg *registry.Regis

// record this pass will not act on must never cause. Only work that

// is going to touch the registry reaches it.

var prior *registry.Route

- nr := sidecarRouteFor(rec, m, cfg.DataDir)

+ var nr registry.Route

if ok {

prior = &existing

+ nr = sidecarRouteFor(rec, m, cfg.DataDir, false)

} else {

// One host, one mechanism: a host already carrying the legacy

// file-staged co-spawn must not ALSO get a native sidecar row, or

@@ -429,6 +444,16 @@ func ReconcileSidecars(ctx context.Context, s release.Store, reg *registry.Regis

rec.Host, rec.Host, sidecarCoSpawnSuffix)

continue

}

+ // The layout the row is minted at. A read that fails defers

+ // this mint rather than guessing flat for a worker the box may

+ // owe nested (ReconcileConfig.Layout); it is only read on a box

+ // whose workers readiness held at start.

+ nested, lerr := mintNested()

+ if lerr != nil {

+ log.Printf("provision: sidecar %s: not minting this pass: the box's layout intent could not be read: %v", rec.Host, lerr)

+ continue

+ }

+ nr = sidecarRouteFor(rec, m, cfg.DataDir, nested)

// Same admission rule as the instance pass (amadan #213): a

// sidecar that would start without its sealed config is not

// minted here. See ReconcileConfig.ConfigGate.

@@ -560,7 +585,7 @@ func ReconcileSidecars(ctx context.Context, s release.Store, reg *registry.Regis

// that REVERT an operator's own `carlos route` edit, and a row that moved with

// nothing saying so is the failure class behind #130 seen from the outside.

func convergeSidecar(reg *registry.Registry, existing registry.Route, rec SidecarRecord, m SidecarManifest, cfg ReconcileConfig) {

- want := sidecarRouteFor(rec, m, cfg.DataDir)

+ want := sidecarRouteFor(rec, m, cfg.DataDir, false)

if want.Channel != "" && existing.Channel != want.Channel {

if cfg.DryRun {

@@ -617,11 +642,15 @@ func convergeSidecar(reg *registry.Registry, existing registry.Route, rec Sideca

// under a running process would point it at a second copy of its own

// data) and the two reachability columns a sidecar row must never carry.

// Reported, never rewritten — `carlos remove` purges a route's capability

- // grants, so it is a last resort, not a routine fix.

- if existing.DBPath != want.DBPath || existing.Socket != "" || existing.Addr != "" {

+ // grants, so it is a last resort, not a routine fix. Either layout's path

+ // for this row's own host is its shape (D7): the mint may have chosen

+ // nested, or the layout pass moved it; the pass's own move, never this

+ // one, is what changes it.

+ nestedPath := NestedDBPath(cfg.DataDir, rec.Host)

+ if (existing.DBPath != want.DBPath && existing.DBPath != nestedPath) || existing.Socket != "" || existing.Addr != "" {

log.Printf("provision: sidecar %s: row disagrees with the shape this record describes "+

- "(db %q/%q socket %q addr %q) — not converged in place; a sidecar binds nothing, "+

+ "(db %q, want %q or %q; socket %q addr %q) — not converged in place; a sidecar binds nothing, "+

"so a socket or addr on this row is a row that was not minted by this pass",

- rec.Host, existing.DBPath, want.DBPath, existing.Socket, existing.Addr)

+ rec.Host, existing.DBPath, want.DBPath, nestedPath, existing.Socket, existing.Addr)

}

diff --git a/internal/provision/sidecar_reconcile_test.go b/internal/provision/sidecar_reconcile_test.go

index 81c1cf25b..f03304c43 100644

--- a/internal/provision/sidecar_reconcile_test.go

+++ b/internal/provision/sidecar_reconcile_test.go

@@ -578,3 +578,120 @@ func TestSidecarReconcileLeavesAForeignRowAlone(t *testing.T) {

t.Fatalf("Args = %q — a row this pass does not own must be left alone", rt.Args)

}

+// --- minting nested (sidecar isolation D7) ----------------------------------------

+// nestedLayout is a box whose layout intent names nested: the answer the

+// instance mint takes from ReconcileConfig.Layout.

+func nestedLayout(context.Context, release.Store) (string, error) {

+ return release.LayoutModeNested, nil

+// TestSidecarMintNestedOnlyWhenWorkersReady pins D7: a fresh worker row is

+// minted at NestedDBPath exactly when the instance mint would mint nested

+// (the box's layout intent) AND the box's workers readiness held at agent

+// start (cfg.Workers, D11). Every other answer mints flat, as before. A

+// layout read that fails defers the mint only when the answer matters.

+func TestSidecarMintNestedOnlyWhenWorkersReady(t *testing.T) {

+ flatLayout := func(context.Context, release.Store) (string, error) { return release.LayoutModeFlat, nil }

+ broken := func(context.Context, release.Store) (string, error) { return "", fmt.Errorf("store down") }

+ for _, tc := range []struct {

+ name string

+ layout func(context.Context, release.Store) (string, error)

+ workers bool

+ want string // "flat", "nested", or "none"

+ }{

+ {name: "nested intent, workers ready", layout: nestedLayout, workers: true, want: "nested"},

+ {name: "nested intent, workers not ready", layout: nestedLayout, workers: false, want: "flat"},

+ {name: "flat intent, workers ready", layout: flatLayout, workers: true, want: "flat"},

+ {name: "no intent reader, workers ready", layout: nil, workers: true, want: "flat"},

+ {name: "unreadable intent, workers ready", layout: broken, workers: true, want: "none"},

+ {name: "unreadable intent, workers not ready", layout: broken, workers: false, want: "flat"},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ f := sidecarSetup(t)

+ f.putManifest(t, "eleven", SidecarManifest{Schema: 1, App: "eleven", Args: []string{"sidecar", "run"}})

+ f.putRecord(t, SidecarRecord{Schema: 1, Name: "bot", App: "eleven", Channel: "stable"})

+ host := f.host("bot", "eleven")

+ f.reconcile(t, ReconcileConfig{Layout: tc.layout, Workers: tc.workers})

+ if tc.want == "none" {

+ noRoute(t, f.reg, host, "a box that cannot read its layout intent must not guess flat for a worker it may owe nested")

+ return

+ }

+ rt := hasRoute(t, f.reg, host, "no worker row minted")

+ want := DefaultDBPath(f.dir, host)

+ if tc.want == "nested" {

+ want = NestedDBPath(f.dir, host)

+ }

+ if rt.DBPath != want {

+ t.Fatalf("DBPath = %q, want %q", rt.DBPath, want)

+ }

+ if rt.Socket != "" || rt.Addr != "" {

+ t.Fatalf("a worker binds nothing on either layout, got socket=%q addr=%q", rt.Socket, rt.Addr)

+ }

+ })

+ }

+// TestSidecarMintNestedKeepsTheCoSpawnCheck: the one-host-one-mechanism

+// check still looks in the flat data directory on a nested-ready box (D7:

+// a co-spawn file belongs to an instance host, which never ends in

+// .sidecar.internal, so the flat directory is where it is).

+func TestSidecarMintNestedKeepsTheCoSpawnCheck(t *testing.T) {

+ f := sidecarSetup(t)

+ host := f.host("bot", "eleven")

+ if err := os.WriteFile(filepath.Join(f.dir, host+"-sidecar.env"), []byte("X=1\n"), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ f.putManifest(t, "eleven", SidecarManifest{Schema: 1, App: "eleven", Args: []string{"sidecar", "run"}})

+ f.putRecord(t, SidecarRecord{Schema: 1, Name: "bot", App: "eleven", Channel: "stable"})

+ f.reconcile(t, ReconcileConfig{Layout: nestedLayout, Workers: true})

+ noRoute(t, f.reg, host, "a staged co-spawn file must still keep its host on a nested-ready box")

+// TestConvergeSidecarAcceptsBothPaths: a worker row is converged, not

+// reported, at either the flat or the nested path for its own host,

+// whichever the pass would mint now; any other path is reported as before

+// and never rewritten.

+func TestConvergeSidecarAcceptsBothPaths(t *testing.T) {

+ const complaint = "row disagrees with the shape this record describes"

+ for _, tc := range []struct {

+ name string

+ path func(dir, host string) string

+ workers bool

+ report bool

+ }{

+ {name: "nested row, pass would mint flat", path: NestedDBPath, workers: false},

+ {name: "nested row, pass would mint nested", path: NestedDBPath, workers: true},

+ {name: "flat row, pass would mint nested", path: DefaultDBPath, workers: true},

+ {name: "flat row, pass would mint flat", path: DefaultDBPath, workers: false},

+ {name: "another host's nested path", path: func(dir, host string) string { return NestedDBPath(dir, "other."+host) }, report: true},

+ {name: "a path outside the data dir", path: func(dir, host string) string { return "/elsewhere/" + host + ".db" }, report: true},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ f := sidecarSetup(t)

+ host := f.host("bot", "eleven")

+ f.putManifest(t, "eleven", SidecarManifest{Schema: 1, App: "eleven", Args: []string{"sidecar", "run"}})

+ f.putRecord(t, SidecarRecord{Schema: 1, Name: "bot", App: "eleven", Channel: "stable"})

+ path := tc.path(f.dir, host)

+ f.mustUpsert(t, registry.Route{Host: host, Kind: SidecarKind, Slug: "bot", App: "eleven", Account: f.sqid,

+ Channel: "stable", DBPath: path, Hibernate: true, Args: `["sidecar","run"]`,

+ IdleSeconds: 300, MaxRunSeconds: 3600, Provisioned: true, Status: "ready"})

+ logged := captureLog(t)

+ f.reconcile(t, ReconcileConfig{Layout: nestedLayout, Workers: tc.workers})

+ if got := strings.Contains(logged.String(), complaint); got != tc.report {

+ t.Fatalf("reported = %v, want %v; log:\n%s", got, tc.report, logged.String())

+ }

+ rt := hasRoute(t, f.reg, host, "route gone")

+ if rt.DBPath != path {

+ t.Fatalf("DBPath = %q, want %q unchanged: the database path is never converged in place", rt.DBPath, path)

+ }

+ })

+ }

diff --git a/internal/release/layoutintent.go b/internal/release/layoutintent.go

index f488f603a..2e1f53336 100644

--- a/internal/release/layoutintent.go

+++ b/internal/release/layoutintent.go

@@ -210,6 +210,25 @@ func AppendLayoutIntent(ctx context.Context, s Store, in LayoutIntent) (LayoutIn

// this floor. TestLayoutFloorIsTheFirstReleaseWhereNestedRowsWake pins it.

var LayoutFloor = SemVer{Major: 0, Minor: 25, Patch: 0}

+// WorkerLayoutFloor is the first platform release that runs a nested

+// sidecar worker (sidecar isolation spec D11): release N, the one cut from

+// a main carrying that change. A box mints and moves worker rows nested

+// only when both its running build and carlos.prev were at or above this

+// floor when its agent started, and install refuses a candidate below it

+// while the box opts in. The latest published tag at the time of writing

+// is v0.28.12, so this names the next. If the release is cut under another

+// tag, change this constant and TestWorkerLayoutFloorIsReleaseN.

+var WorkerLayoutFloor = SemVer{Major: 0, Minor: 29, Patch: 0}

+// AtOrAboveFloor reports whether version parses and is at or above floor.

+// A tag that does not parse is false: the strict reading, for a rule that

+// must not hold for a build nobody can place (a dev build, a garbled

+// carlos.prev.version).

+func AtOrAboveFloor(version string, floor SemVer) bool {

+ v, ok := ParseReleaseVersion(version)

+ return ok && v.Compare(floor) >= 0

// ParseReleaseVersion parses a release tag with or without its leading v.

func ParseReleaseVersion(version string) (SemVer, bool) {

return ParseSemVer(strings.TrimPrefix(version, "v"))

diff --git a/internal/release/layoutintent_test.go b/internal/release/layoutintent_test.go

index fdd32e88b..38ff3e83d 100644

--- a/internal/release/layoutintent_test.go

+++ b/internal/release/layoutintent_test.go

@@ -130,6 +130,27 @@ func TestLayoutFloorIsTheFirstReleaseWhereNestedRowsWake(t *testing.T) {

}

+// TestWorkerLayoutFloorIsReleaseN pins the workers floor (sidecar isolation

+// spec D11) to the release that carries the nested worker: v0.29.0, the

+// next tag after v0.28.12. If the release is cut under another tag, change

+// the constant and this test together.

+func TestWorkerLayoutFloorIsReleaseN(t *testing.T) {

+ if WorkerLayoutFloor != (SemVer{Major: 0, Minor: 29, Patch: 0}) {

+ t.Fatalf("WorkerLayoutFloor = %+v, want v0.29.0", WorkerLayoutFloor)

+ }

+ // AtOrAboveFloor is the strict half: a version nobody can place against

+ // the floor reads as below it (D11: a dev build or a garbled

+ // carlos.prev.version never makes a box eligible).

+ for v, at := range map[string]bool{

+ "v0.28.12": false, "0.28.99": false, "v0.29.0": true, "0.29.0": true, "v0.29.1": true, "v1.0.0": true,

+ "dev": false, "": false, "v0.29": false, "abc1234": false, "0.29.0-3": false, " v0.29.0": false,

+ } {

+ if got := AtOrAboveFloor(v, WorkerLayoutFloor); got != at {

+ t.Errorf("AtOrAboveFloor(%q, WorkerLayoutFloor) = %v, want %v", v, got, at)

+ }

func TestRecordLayoutIntentAppendsWithForceAndScope(t *testing.T) {

s := NewDirStore(t.TempDir())

ctx := context.Background()