amadan
enginesim: mutation harness and the first 3000-seed sweep (#335 plan 1)
mutate.sh adapts hostlife's harness (build once, one sweep and one witness run per rule, the same verdicts, ENGINESIM_ names, serial by default) and runs the unmutated sweep first. expected-outcomes.txt lists the three rules caught only in combination. TestEveryActionFires, TestWitnessesHoldUnmutated and TestEveryRuleHasWitness guard coverage. public-request's weight goes from 6 to 9 (fence-box-wide 7 -> 12 catches at 3000 seeds). Sweep at 3000 seeds: unmutated 0 violations; 34 CAUGHT, 3 EXPECTED-MISS, none MISSED, ERROR or STALE. Spec §8 gains the Simulation table, and five amendments ruled during Tasks 3-5, each marked (sim, plan 1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
6 files changed,
+439
−5
docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md+93 −4internal/sim/engines/expected-outcomes.txt+11 −0internal/sim/engines/launch_test.go+4 −1internal/sim/engines/mutate.sh+195 −0internal/sim/engines/sim_test.go+33 −0internal/sim/engines/witness_test.go+103 −0
CI failed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok amadan.net/carlos/platform.git/launchctx 0.029s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (34 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (176 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 4.946s
ok github.com/carlosframework/platform/cmd/moveprobe 12.976s
ok github.com/carlosframework/platform/cmd/zddprobe 0.778s
ok github.com/carlosframework/platform/internal/activator 64.939s
ok github.com/carlosframework/platform/internal/agentsock 0.108s
ok github.com/carlosframework/platform/internal/alerting 0.007s
ok github.com/carlosframework/platform/internal/analytics 0.031s
ok github.com/carlosframework/platform/internal/appconfig 4.133s
ok github.com/carlosframework/platform/internal/apperr 0.232s
ok github.com/carlosframework/platform/internal/applog 0.364s
ok github.com/carlosframework/platform/internal/awsinv 0.005s
ok github.com/carlosframework/platform/internal/boxchoice 0.012s
ok github.com/carlosframework/platform/internal/boxid 0.808s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.020s
ok github.com/carlosframework/platform/internal/caps 0.066s
ok github.com/carlosframework/platform/internal/certwarm 0.008s
ok github.com/carlosframework/platform/internal/cgroup 1.015s
ok github.com/carlosframework/platform/internal/changelog 0.811s
ok github.com/carlosframework/platform/internal/claimactivation 1.577s
ok github.com/carlosframework/platform/internal/clamd 0.059s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.952s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.015s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.003s
ok github.com/carlosframework/platform/internal/docsite 0.029s
ok github.com/carlosframework/platform/internal/domains 4.293s
ok github.com/carlosframework/platform/internal/doorkey 0.008s
ok github.com/carlosframework/platform/internal/economics 0.009s
ok github.com/carlosframework/platform/internal/edge 47.457s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.011s
ok github.com/carlosframework/platform/internal/fleetapi 0.267s
ok github.com/carlosframework/platform/internal/gate 1.855s
ok github.com/carlosframework/platform/internal/genselect 0.042s
ok github.com/carlosframework/platform/internal/geo 0.021s
ok github.com/carlosframework/platform/internal/geoip 0.064s
ok github.com/carlosframework/platform/internal/historyreadback 0.281s
ok github.com/carlosframework/platform/internal/host 128.501s
ok github.com/carlosframework/platform/internal/hostactors 7.757s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.008s
ok github.com/carlosframework/platform/internal/hostbox 4.042s
ok github.com/carlosframework/platform/internal/hostclaim 1.295s
ok github.com/carlosframework/platform/internal/hostenv 0.006s
ok github.com/carlosframework/platform/internal/hostevidence 0.020s
ok github.com/carlosframework/platform/internal/hostexec 6.816s
ok github.com/carlosframework/platform/internal/hostfence 0.125s
ok github.com/carlosframework/platform/internal/hostfiles 10.948s
ok github.com/carlosframework/platform/internal/hostfloor 0.062s
ok github.com/carlosframework/platform/internal/hostguard 1.120s
ok github.com/carlosframework/platform/internal/hostops 2.658s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.013s
ok github.com/carlosframework/platform/internal/hostquarantine 0.007s
ok github.com/carlosframework/platform/internal/hostrelocate 1.071s
ok github.com/carlosframework/platform/internal/hostresolve 0.312s
ok github.com/carlosframework/platform/internal/hostwrite 0.008s
ok github.com/carlosframework/platform/internal/infraview 0.008s
ok github.com/carlosframework/platform/internal/instancectl 5.290s
ok github.com/carlosframework/platform/internal/instanceexec 2.927s
ok github.com/carlosframework/platform/internal/instancefs 0.015s
ok github.com/carlosframework/platform/internal/instancekey 0.005s
ok github.com/carlosframework/platform/internal/instanceupdates 0.018s
ok github.com/carlosframework/platform/internal/layout 2.516s
ok github.com/carlosframework/platform/internal/lbhealth 0.007s
ok github.com/carlosframework/platform/internal/lease 10.208s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.906s
ok github.com/carlosframework/platform/internal/ledger 0.023s
ok github.com/carlosframework/platform/internal/mail 0.386s
ok github.com/carlosframework/platform/internal/maintenance 0.099s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.820s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.220s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 24.181s
ok github.com/carlosframework/platform/internal/moves/archive 1.446s
ok github.com/carlosframework/platform/internal/objstore 0.529s
ok github.com/carlosframework/platform/internal/ops 0.308s
ok github.com/carlosframework/platform/internal/park 0.470s
ok github.com/carlosframework/platform/internal/plans 0.012s
ok github.com/carlosframework/platform/internal/privatefile 0.006s
2026/10/21 20:06:24 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/21 20:06:24 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/21 20:06:24 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/21 20:06:24 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/21 20:06:24 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/21 20:06:24 provision: an app's records could not be listed: they are skipped
2026/10/21 20:06:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:24 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/21 20:06:24 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/21 20:06:24 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/21 20:06:24 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/21 20:06:24 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/21 20:06:24 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/21 20:06:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/21 20:06:24 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/21 20:06:24 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/21 20:06:24 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:24 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/21 20:06:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/21 20:06:24 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/21 20:06:25 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/21 20:06:25 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/21 20:06:25 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/21 20:06:25 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/21 20:06:25 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/21 20:06:25 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/21 20:06:25 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:25 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:25 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:25 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:25 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/21 20:06:25 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/21 20:06:25 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/21 20:06:25 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/21 20:06:26 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:26 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:26 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io channel stable -> edge
2026/10/21 20:06:28 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/21 20:06:28 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/21 20:06:28 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/21 20:06:28 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io hibernate false -> true
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged acme.go.tito.io status-named false -> true
2026/10/21 20:06:28 provision: converged acme.go.tito.io status-named true -> false
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/21 20:06:28 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/21 20:06:28 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/21 20:06:28 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/21 20:06:28 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/21 20:06:28 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/21 20:06:28 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/21 20:06:28 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/21 20:06:28 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/21 20:06:28 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:28 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/21 20:06:28 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/21 20:06:28 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/21 20:06:28 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:28 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:28 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/21 20:06:28 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:28 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:28 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/21 20:06:28 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/21 20:06:28 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:28 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/21 20:06:28 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/21 20:06:28 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/21 20:06:28 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:28 provision: converged acme.go.tito.io channel stable -> edge
2026/10/21 20:06:28 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:28 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/21 20:06:28 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/21 20:06:28 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/21 20:06:29 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:29 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/21 20:06:29 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/21 20:06:29 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/21 20:06:29 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/21 20:06:29 provision: dry-run: would converge owned.go.tito.io seed
2026/10/21 20:06:29 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/21 20:06:29 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/21 20:06:29 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/21 20:06:29 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/21 20:06:29 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:29 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/21 20:06:29 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/21 20:06:29 provision: converged owned.go.tito.io channel stable -> edge
2026/10/21 20:06:29 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/21 20:06:29 provision: converged owned.go.tito.io hibernate false -> true
2026/10/21 20:06:29 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/21 20:06:29 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/21 20:06:29 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: removed retired static route site.go.tito.io (record gone)
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/21 20:06:29 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/21 20:06:29 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:29 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:29 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/21 20:06:29 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/21 20:06:29 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/21 20:06:29 provision: converged acme.go.tito.io channel stable -> edge
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/21 20:06:29 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/21 20:06:29 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/21 20:06:29 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/21 20:06:29 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/21 20:06:29 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/21 20:06:29 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/21 20:06:29 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/21 20:06:29 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/21 20:06:29 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/21 20:06:29 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/21 20:06:29 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/21 20:06:29 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/21 20:06:29 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/21 20:06:29 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:29 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/21 20:06:30 provision: a.shop.example.com: swapped for import sd_2b53vy2ydv2gei4l5p6pzkg2qi (the original route is journaled)
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_2b53vy2ydv2gei4l5p6pzkg2qi committed: its gate is cleared and its journal row dropped
2026/10/21 20:06:30 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_7egrys5q7qw4be5euu2vvpxkqu rolled back to its original route
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_7egrys5q7qw4be5euu2vvpxkqu: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_7egrys5q7qw4be5euu2vvpxkqu is cleaned up and its journal row retired
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_yas5fh6uagsrwot7rhmtl5da64 rolled back to its original route
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_yas5fh6uagsrwot7rhmtl5da64: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_yas5fh6uagsrwot7rhmtl5da64 is cleaned up and its journal row retired
2026/10/21 20:06:30 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_mve6g3xhoeokww4lhg6v3snsle
2026/10/21 20:06:30 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/21 20:06:30 provision: dry-run: would converge a.shop.example.com seed source
2026/10/21 20:06:30 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:30 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/21 20:06:30 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/21 20:06:30 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_jzsrenpatd5gx64yolkf3s2iq4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_sb5zqfzm3g4j6vj2othzqfascq cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_rwtgy6suvxz3kqv7tf7cv6gkj4 is journaled, but this box cannot act on imports; its row is left alone
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_jaunlzygsqzgqtuwazfay3z7vm is journaled, but this box cannot act on imports; its row is left alone
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_crw3tebw2brmcuhaddal5raqxq is journaled, but this box cannot act on imports; its row is left alone
2026/10/21 20:06:30 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/21 20:06:30 provision: b.shop.example.com: import sd_lg5ce3h52fmpd6zexq3chl7ioy left alone this pass: the import journal could not be read
2026/10/21 20:06:30 provision: c.shop.example.com: import sd_apvgsuoltwp4xugqlizwtwtgni left alone this pass: the import journal could not be read
2026/10/21 20:06:30 provision: a.shop.example.com: import sd_mww4eptqvtu6xmilcba5l56qga committed: its gate is cleared and its journal row dropped
2026/10/21 20:06:30 provision: a.shop.example.com: not converging import sd_xbmdeekzpwdec7r3vwk7nsazji: it is swapped but not committed, and the row on this box has no import gate
2026/10/21 20:06:30 provision: a.shop.example.com: not converging import sd_x5wlbqh4xpsatodsltowzqfbdq: it is swapped but not committed, and the row on this box has no import gate
2026/10/21 20:06:30 provision: a.shop.example.com: not converging import sd_6hslrzhrtmbweslvaerq2lkgzm: it is placed but not committed, and the row on this box has no import gate
2026/10/21 20:06:30 provision: a.shop.example.com: not converging import sd_dddhzx7pxlnrsdazi5jbweti3m: it is placed but not committed, and the row on this box has no import gate
2026/10/21 20:06:30 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:30 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/21 20:06:30 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_sfxjqxikrclfgw6sdt4vlilxtq committed: its gate is cleared and its journal row dropped
2026/10/21 20:06:31 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:31 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:31 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/21 20:06:31 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_vklq6ui2mu3javrf2dpdrnijte: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_vklq6ui2mu3javrf2dpdrnijte rolled back (no box had swapped it)
2026/10/21 20:06:31 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/21 20:06:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:31 provision: removed instance route acme.go.tito.io (its seed sd_6j53d72cetr24kb6puxosjgvfe was aborted); the next pass rolls it back
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_6j53d72cetr24kb6puxosjgvfe: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_6j53d72cetr24kb6puxosjgvfe rolled back (no box had swapped it)
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_zlfnkajazghtdzqbbp7467cn2a has a row this pass may not remove; leaving the seed aborted
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_35fc2737fkpib23llqxsz7xzq4 rolled back (no box had swapped it)
2026/10/21 20:06:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:31 provision: removed instance route acme.go.tito.io (its seed sd_2c3syyom6exchfbvoqko3bcml4 was aborted); the next pass rolls it back
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_2c3syyom6exchfbvoqko3bcml4 has no route on this box: its local data is removed
2026/10/21 20:06:31 provision: acme.go.tito.io: aborted seed sd_2c3syyom6exchfbvoqko3bcml4 rolled back (no box had swapped it)
2026/10/21 20:06:31 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_hyzuapllztzxjuyby57odlkcri (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_hyzuapllztzxjuyby57odlkcri rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_hyzuapllztzxjuyby57odlkcri is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_2vzb4bli53plna7lbakb4s6oia (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_2vzb4bli53plna7lbakb4s6oia rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_2vzb4bli53plna7lbakb4s6oia is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_hrd3c22q3vgzi3u7jwvviyxqsm (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_hrd3c22q3vgzi3u7jwvviyxqsm rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_hrd3c22q3vgzi3u7jwvviyxqsm: the host's replica is left alone: its record no longer names this seed
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_hrd3c22q3vgzi3u7jwvviyxqsm is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_j2mvrspnvew2cbxen7vu2tjwze (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_j2mvrspnvew2cbxen7vu2tjwze rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_j2mvrspnvew2cbxen7vu2tjwze rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_j2mvrspnvew2cbxen7vu2tjwze is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_tjscqefaezh4etixm3h2wurw4q (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_tjscqefaezh4etixm3h2wurw4q rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_a5u65r4rwjgrohlgj4qsognwxq (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_a5u65r4rwjgrohlgj4qsognwxq is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_gljhrhxoradi4feokukvqq5bwu (the original route is journaled)
2026/10/21 20:06:31 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_gljhrhxoradi4feokukvqq5bwu left alone this pass: its record could not be read
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_xornfmj3zx63655crb6qbrsfou (the original route is journaled)
2026/10/21 20:06:31 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_xornfmj3zx63655crb6qbrsfou left alone this pass: its record could not be read
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_thpkcyxty5ml7tqxku5tttyvo4 (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_thpkcyxty5ml7tqxku5tttyvo4: close the import gate: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_thpkcyxty5ml7tqxku5tttyvo4 rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_thpkcyxty5ml7tqxku5tttyvo4 is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_qgyywvj3qzpc7ayvzitevvgxtm (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_qgyywvj3qzpc7ayvzitevvgxtm: close the import gate: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_qgyywvj3qzpc7ayvzitevvgxtm rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_qgyywvj3qzpc7ayvzitevvgxtm is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_udkdmyd3kxyalfjfqojy7ikxmm (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_udkdmyd3kxyalfjfqojy7ikxmm rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_udkdmyd3kxyalfjfqojy7ikxmm rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_udkdmyd3kxyalfjfqojy7ikxmm is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_cbinz5bvqpmq36ndujrthp5j7a (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_cbinz5bvqpmq36ndujrthp5j7a rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_cbinz5bvqpmq36ndujrthp5j7a is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_dudlbnic4w34qwqjz44jtjuieu (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_dudlbnic4w34qwqjz44jtjuieu: retire its instance key: injected failure at retire-key
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_dudlbnic4w34qwqjz44jtjuieu rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_dudlbnic4w34qwqjz44jtjuieu is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_2pv3wxfkycq7uwxy3dqxh4gmzm (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_2pv3wxfkycq7uwxy3dqxh4gmzm rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_2pv3wxfkycq7uwxy3dqxh4gmzm is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_7cd7l47swyxncxg6mw7hatngte (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_7cd7l47swyxncxg6mw7hatngte: remove its local data: injected failure at remove-local
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_7cd7l47swyxncxg6mw7hatngte rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_7cd7l47swyxncxg6mw7hatngte is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_x3g75i3k2ekatlqwhwmvtbg3ii (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_x3g75i3k2ekatlqwhwmvtbg3ii rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_x3g75i3k2ekatlqwhwmvtbg3ii is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_45djuxolcqxbgxkjzroap4maii (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_45djuxolcqxbgxkjzroap4maii: remove its local data: injected failure at remove-local-done
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_45djuxolcqxbgxkjzroap4maii rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_45djuxolcqxbgxkjzroap4maii is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_t3tdlbid7fqz65nthrzom6ctnu (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_t3tdlbid7fqz65nthrzom6ctnu rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_t3tdlbid7fqz65nthrzom6ctnu is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_jtlgq44q3qjj6pqfayqtbiopjy (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_jtlgq44q3qjj6pqfayqtbiopjy: restore the original route: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_jtlgq44q3qjj6pqfayqtbiopjy rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_jtlgq44q3qjj6pqfayqtbiopjy is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_pa6fmmkufiri5jtt7lxjqb276e (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_pa6fmmkufiri5jtt7lxjqb276e: restore the original route: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_pa6fmmkufiri5jtt7lxjqb276e rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_pa6fmmkufiri5jtt7lxjqb276e is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_vmi6phdiy5dm7qtymm3w3wt624 (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_vmi6phdiy5dm7qtymm3w3wt624 is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_uh4xkjwqolcwpnb7gz4ybhohhu (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_uh4xkjwqolcwpnb7gz4ybhohhu rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_uh4xkjwqolcwpnb7gz4ybhohhu: delete its snapshot: injected failure at delete-snapshot
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_uh4xkjwqolcwpnb7gz4ybhohhu is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_ev2axpk2v224rdnhsn4hrzdhbi (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_ev2axpk2v224rdnhsn4hrzdhbi rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_ev2axpk2v224rdnhsn4hrzdhbi is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_aoh7twlzqjboqbn7moxfxkncha (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_aoh7twlzqjboqbn7moxfxkncha rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_aoh7twlzqjboqbn7moxfxkncha: delete the host's replica: injected failure at delete-replica
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_aoh7twlzqjboqbn7moxfxkncha is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_evndzc3paxcue7mbnjszj7t27i (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_evndzc3paxcue7mbnjszj7t27i rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_evndzc3paxcue7mbnjszj7t27i is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_sk2nbjb3iituwctn5madoe6nwq (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_sk2nbjb3iituwctn5madoe6nwq rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_sk2nbjb3iituwctn5madoe6nwq: retire its journal row: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_sk2nbjb3iituwctn5madoe6nwq is cleaned up and its journal row retired
2026/10/21 20:06:31 provision: a.shop.example.com: swapped for import sd_ozqldxzvwlqvq2gy3de6uc3k7q (the original route is journaled)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_ozqldxzvwlqvq2gy3de6uc3k7q rolled back to its original route
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_ozqldxzvwlqvq2gy3de6uc3k7q: retire its journal row: constraint failed: injected (1811)
2026/10/21 20:06:31 provision: a.shop.example.com: import sd_ozqldxzvwlqvq2gy3de6uc3k7q is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_nttjublu6dzuanhbgpkesynkgm (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_nttjublu6dzuanhbgpkesynkgm rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_nttjublu6dzuanhbgpkesynkgm is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: mark import sd_nttjublu6dzuanhbgpkesynkgm rolled back: injected failure at cas
2026/10/21 20:06:32 provision: a.shop.example.com: aborted seed sd_nttjublu6dzuanhbgpkesynkgm rolled back (no box had swapped it)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_vczyj6j6oboxgvmxfhhg3qzom4 (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_vczyj6j6oboxgvmxfhhg3qzom4 rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_vczyj6j6oboxgvmxfhhg3qzom4 is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: aborted seed sd_vczyj6j6oboxgvmxfhhg3qzom4 rolled back (no box had swapped it)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_p6elfo7ftlad3n4sminsxkvlde (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_p6elfo7ftlad3n4sminsxkvlde rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_p6elfo7ftlad3n4sminsxkvlde rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_p6elfo7ftlad3n4sminsxkvlde rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_p6elfo7ftlad3n4sminsxkvlde is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_tezgqn3sncpdvwsek53vzyugua (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_tezgqn3sncpdvwsek53vzyugua rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_tezgqn3sncpdvwsek53vzyugua is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_nb4l2itdds7o2vkanlnbha5mhq (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_nb4l2itdds7o2vkanlnbha5mhq rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_nb4l2itdds7o2vkanlnbha5mhq is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_w2p5uzasuvzhjkuouitsohyjly (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_w2p5uzasuvzhjkuouitsohyjly rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_w2p5uzasuvzhjkuouitsohyjly is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_byq7fegm3y2tjpshlsd3ynnbqa (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_byq7fegm3y2tjpshlsd3ynnbqa rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_byq7fegm3y2tjpshlsd3ynnbqa is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_3ylkohbdesyql424x6pbkl4ksa (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_3ylkohbdesyql424x6pbkl4ksa rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_3ylkohbdesyql424x6pbkl4ksa is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_opl33zkoln5yxigu3i7rvyzori (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_opl33zkoln5yxigu3i7rvyzori rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_opl33zkoln5yxigu3i7rvyzori is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_5yquh5cyi7dsct3ugrws4kbbvy (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_5yquh5cyi7dsct3ugrws4kbbvy rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_5yquh5cyi7dsct3ugrws4kbbvy is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_bgxhmwnh42hvr6ycuvr2qhwiyy (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_bgxhmwnh42hvr6ycuvr2qhwiyy has no route on this box: its local data is removed and no route is put back
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_bgxhmwnh42hvr6ycuvr2qhwiyy is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_lm3i7fnxfw63h2ojads4f3cnze (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_n7njxsszvzpzsusadfiixt7bpm (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_dkeballe7prytphuudjcorncvu (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_dkeballe7prytphuudjcorncvu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_sj5o5amzx6pu2lfkfafw2bhozm (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_sj5o5amzx6pu2lfkfafw2bhozm is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/21 20:06:32 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/21 20:06:32 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_recvowrosg5xubpwosn5josnyy (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_rcc7lszhg3bouwfqfjqgd2w75m (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_52ortcbvnao2p7dl254cr5362m (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_azuahjjktlk3vyzb6k2w3vcaiy (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_q4ceio2dye6t3k3vsu4hfs4cra (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_q4ceio2dye6t3k3vsu4hfs4cra rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_5sj2uyzt3v4uvciqfddk4sbhpu (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_5sj2uyzt3v4uvciqfddk4sbhpu has no route on this box: its local data is removed and no route is put back
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_5sj2uyzt3v4uvciqfddk4sbhpu is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_rlxkgg5xjoetx3fquyfzf6kcou (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_rlxkgg5xjoetx3fquyfzf6kcou: remove its local data: injected failure at remove-local
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_rlxkgg5xjoetx3fquyfzf6kcou is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_zpzghg7jllem3yjdvgqho2r53q (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_zpzghg7jllem3yjdvgqho2r53q: a route appeared at the host, so its local database is left and the rollback waits
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_ijfbfd2wongwftio7y6ywg2kwe (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_ijfbfd2wongwftio7y6ywg2kwe rollback deferred: no fence generation: registry busy
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_emetcj5shrg427ewxedw65anzq (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_emetcj5shrg427ewxedw65anzq rollback deferred: no fence generation: the generation source answered 0
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_foykpwszlt3usj56v762mzm6cy (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_dhzogw2heaw6wcdsdnnm2q2e4a (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_wdbya7u42mqg7krsy35sdbtjye (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/21 20:06:32 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_zbnnkvjxwbccwlpz4gqkvwjuna (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_zbnnkvjxwbccwlpz4gqkvwjuna rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_zbnnkvjxwbccwlpz4gqkvwjuna is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_tgknulah575fdmhcdp6ugnypr4 (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_tgknulah575fdmhcdp6ugnypr4 rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_tgknulah575fdmhcdp6ugnypr4 is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_ow23muci6crllepiziododgdye (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_ow23muci6crllepiziododgdye rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_ow23muci6crllepiziododgdye is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_bw3qzigiwjcmxmkbaafwskhsvm (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_bw3qzigiwjcmxmkbaafwskhsvm: retire its instance key: the env file is a symlink
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_bw3qzigiwjcmxmkbaafwskhsvm rolled back to its original route
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_bw3qzigiwjcmxmkbaafwskhsvm is cleaned up and its journal row retired
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_wwiwi7eqhqggkgjmr4a5cyx6yi (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/21 20:06:32 provision: a.shop.example.com: swapped for import sd_wthsugawmn5zy6ktjqghr4s4de (the original route is journaled)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_g4pp6z7meyw4ude2cirrdnvxgy refused: there is no route at a.shop.example.com to replace
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_t3dr5equpmufk7w76dle2ju44a refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_arcttxkmmij2rt3vclfot36nhm refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_u5grwnq6twszt6mz6hvrbvxtce refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_fgqosymqpe7ieubpb4bhmv24ou refused: the route belongs to app other
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_x7qgkjktkmeodetnobxv4azvvy refused: the route is filed under another account
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_pe7q77lbcealguqjcbw4jicx5q refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_ax26a3bgib26u6d4x6qtkqbycu refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_z55arb2ko4scobjjsbnmspe6p4 refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_vghoiozmw7ejg4nocdpofasfue refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_uzyrrnqkmo2huf4szb2b3r7awe refused: the route is not an address route this import can take over (socket)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_gyrrf46qoztuf6exxckhdildjm refused: the route is not an address route this import can take over (no address)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_rlkfnslktdsqkxyu3pabfphfty refused: the route is not an address route this import can take over (provisioned)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_jzafwq4q4wptnxbskpk7tfvqq4 refused: the route is not an address route this import can take over (kind static)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_gf4khg5q5uayghi3xj5jpjx72y refused: the route is not an address route this import can take over (backing)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_gwx6vel6jrnfnk5tvve3ev24ti refused: the route is not an address route this import can take over (tunnel)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_ny5whth52zx65odkc64dm7f3ri refused: the route is not an address route this import can take over (caps)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_m3inaujbh22mjdzggxwer4j4zm refused: the route is not an address route this import can take over (platform)
2026/10/21 20:06:32 provision: a.shop.example.com: import sd_4dx6oo4ygi6prwu3lyjlsf5o7m refused: the route is not an address route this import can take over (canary)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_oxtmialjmdzehv6pq67xq3e24y refused: the route is not an address route this import can take over (kind sidecar)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_y6um6lkhpb3oy24olwqmggrmki refused: the route is not an address route this import can take over (region)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_wzoo4qbqaycuzykcnp6whntc3q refused: the route is not an address route this import can take over (fleet_box)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_77grfjhgxgoznjxwi2thhfw46e refused: the route is not an address route this import can take over (hibernate)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_ximjyd5kemvagdxls2w5dvr3ty refused: the route is not an address route this import can take over (claim_owner)
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_5fz7vi5zso5rlsjywdhhrtqglu refused: this box does not run instances nested
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_d6tpzxizkpiuqbbog6gutvyzde refused: this box does not run instances nested
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_67kccx7ukdd5lpemiryx3g7dxm refused: claim control is on for this box
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_vxqvwif4tvfztjieaonwavy324 (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_h73kbhpatvxnrdfwisqpqaj6mu (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/21 20:06:33 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_tfxwxcu3mywwn47mmpg5hm5pei: its verify hash is not a sha256
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_6xq3rj3wqkn5zsi73f6cm26ere: its verify hash is not a sha256
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_f77jkcd3ndhv5qijv2qyjytdpq: its verify hash is not a sha256
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/21 20:06:33 provision: A.shop.example.com/..: not swapping for import sd_tcfql4lgpmybcubxh5rmnplucm: its host or seed id is malformed (seeds: not a host)
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_wep43ilmy4prdmvpgzaxyef4zm: its record does not describe a nested, hibernating instance
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_fmup5qrybtd45ehjhohircikeu: its record does not describe a nested, hibernating instance
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_lryj6kzmop5uc5nrkhr7qgxugu: its record does not describe a nested, hibernating instance
2026/10/21 20:06:33 provision: a.shop.example.com: not swapping for import sd_gdfhrsapouxpfaywhy4critdhu: its record does not describe a nested, hibernating instance
2026/10/21 20:06:33 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_bas5vhi6up75fak7w4grtg55lq (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_utapoyvi2jtcvu6d5dty5si73m (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_pwwgnxqak2x6f2unvhbbbr2ndy (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/21 20:06:33 provision: dry-run: would consider swapping a.shop.example.com for import sd_3wc7o56oetenqfjwtiwbqqxoxa
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_g3mdj3y7wd5uzfiwoiny45uxt4 rolled back to its original route
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_g3mdj3y7wd5uzfiwoiny45uxt4: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_g3mdj3y7wd5uzfiwoiny45uxt4 is cleaned up and its journal row retired
2026/10/21 20:06:33 provision: a.shop.example.com: import sd_eqrwpwmb5gha57wfwkrhfljxvm left alone: the import journal holds seed sd_zuoeuelmjzjhz2ahaictojc7va at swapped
2026/10/21 20:06:33 provision: a.shop.example.com: not minting import sd_3xlpo5uuhuevr357dph442uvee: it is swapped but not committed, and only its swap makes its row
2026/10/21 20:06:33 provision: a.shop.example.com: not minting import sd_xrvnkwi4bt4h3fjf4t7aw3qz54: it is placed but not committed, and only its swap makes its row
2026/10/21 20:06:33 provision: a.shop.example.com: swapped for import sd_mqam3hhbnhxnjwhqtd7glvgdse (the original route is journaled)
2026/10/21 20:06:33 provision: a.shop.example.com: not minting import sd_mqam3hhbnhxnjwhqtd7glvgdse: it is swapped but not committed, and only its swap makes its row
2026/10/21 20:06:33 provision: a.shop.example.com: not minting import sd_mqam3hhbnhxnjwhqtd7glvgdse: it is placed but not committed, and only its swap makes its row
2026/10/21 20:06:33 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/21 20:06:33 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/21 20:06:33 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/21 20:06:33 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/21 20:06:33 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/21 20:06:33 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/21 20:06:33 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/21 20:06:33 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/21 20:06:33 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/21 20:06:33 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/21 20:06:33 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/21 20:06:33 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/21 20:06:33 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/21 20:06:33 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/21 20:06:33 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/21 20:06:33 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/21 20:06:33 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/21 20:06:33 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/21 20:06:33 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/21 20:06:33 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/21 20:06:33 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/21 20:06:33 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:33 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/21 20:06:33 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:33 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:33 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/21 20:06:33 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/21 20:06:33 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/21 20:06:33 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/21 20:06:33 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/21 20:06:33 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/21 20:06:33 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
--- FAIL: TestPlan14RootReadCensus (15.83s)
plan14_root_reads_test.go:1107: root read census: 2 discrepancies
changed root source envelope internal/sim/engines
unclassified root read internal/sim/engines/mutate.sh:external file:external@0
FAIL
FAIL github.com/carlosframework/platform/internal/provision 25.278s
ok github.com/carlosframework/platform/internal/publicrelease 0.012s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 6.172s
ok github.com/carlosframework/platform/internal/relay 7.198s
ok github.com/carlosframework/platform/internal/release 28.561s
ok github.com/carlosframework/platform/internal/rollout 4.449s
ok github.com/carlosframework/platform/internal/rolloutwords 0.009s
ok github.com/carlosframework/platform/internal/rootaws 0.012s
ok github.com/carlosframework/platform/internal/rootparticipation 0.064s
ok github.com/carlosframework/platform/internal/rootstate 0.027s
ok github.com/carlosframework/platform/internal/runs 0.587s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 3.272s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/engines 4.417s
ok github.com/carlosframework/platform/internal/sim/hostlife 15.518s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.832s
ok github.com/carlosframework/platform/internal/status 0.115s
ok github.com/carlosframework/platform/internal/steering 0.009s
ok github.com/carlosframework/platform/internal/stopevidence 0.398s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.006s
ok github.com/carlosframework/platform/internal/termfence 0.006s
ok github.com/carlosframework/platform/internal/tunnelclient 0.006s
ok github.com/carlosframework/platform/internal/unixdial 0.010s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.017s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.928s
FAIL
=== internal_console@0 (210 s)
ok github.com/carlosframework/platform/internal/console 207.707s
=== internal_console@1 (38 s)
ok github.com/carlosframework/platform/internal/console 35.307s
=== internal_console@2 (37 s)
ok github.com/carlosframework/platform/internal/console 34.615s
=== internal_console@3 (40 s)
ok github.com/carlosframework/platform/internal/console 37.528s
=== internal_console@4 (40 s)
ok github.com/carlosframework/platform/internal/console 38.077s
=== internal_console@5 (41 s)
ok github.com/carlosframework/platform/internal/console 39.102s
=== internal_console@6 (42 s)
ok github.com/carlosframework/platform/internal/console 39.780s
=== internal_console@7 (42 s)
ok github.com/carlosframework/platform/internal/console 39.420s
=== root@0 (38 s)
ok github.com/carlosframework/platform 36.199s
=== root@1 (47 s)
ok github.com/carlosframework/platform 44.638s
=== root@2 (44 s)
ok github.com/carlosframework/platform 42.133s
FAILED: rest
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md b/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md| index c7eb4c996..cc2821c62 100644 |
| --- a/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md |
| +++ b/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md |
| @@ -276,7 +276,9 @@ copying the source's kind and backend but no version, and adoption skips it |
| the group. |
| - A minted `instance` row whose owner the edge cannot find, or finds |
| ambiguously, is treated as `NULL` and refused, and logged by name, until |
| - the reconciler records its owner. |
| + the reconciler records its owner. `--grant doc-engine` on a minted row |
| + whose owner is unresolved or ambiguous is refused; the row stays |
| + unclassified and refused (sim, plan 1). |
| **The invariant (codex R9-1).** |
| @@ -288,7 +290,9 @@ copying the source's kind and backend but no version, and adoption skips it |
| What protects the public is the edge's serving map, not the registry row |
| (codex R10-1): a `1` written while the edge's `Reload` fails |
| (`edge.go:925`, `:993`) refuses nobody. So the registry mark is the |
| -intent, and the fence is the fact I1 is about. |
| +intent, and the fence is the fact I1 is about. A group closed as |
| +unclassified (`NULL`) counts as fenced, because the edge refuses `NULL` |
| +before any listener opens (sim, plan 1). |
| Rounds 2 to 9 each found one more path by which a declaring build could |
| run under a public mark: adoption's order, requests admitted early, a |
| @@ -340,6 +344,8 @@ activator (`caps/converge.go:241`). So: |
| route of an internal group, whatever its grants, and removes an existing |
| one (stopping the socket unit) before the launch gate's fence completes |
| for that group; it logs the grant it is ignoring with the revoke command. |
| + A `ports` listener is removed on every write of `1` or `NULL` (a grant, |
| + the upgrade, the launch gate), not only at the launch gate (sim, plan 1). |
| **Setting the mark: the serving barrier (codex R2-1).** Adoption |
| repoints the live symlink (`release/adopt.go:1751`), restarts |
| @@ -502,7 +508,9 @@ the door-key mirror does, and adds a **durable revision floor**: |
| - The edge persists the highest revision it has admitted, with the record |
| itself, to its data directory (write to a temporary file, fsync, rename). |
| - It loads both at start, before any engine socket opens. |
| + It loads both at start, before any engine socket opens. The mirror also |
| + persists the time of its last good read, so a restart is not a fresh |
| + read (sim, plan 1). |
| - A record whose revision is below the floor is refused, at runtime and |
| after a restart. An equal revision must be byte-identical. |
| - Stale (no good read for ten minutes), expired, or never read: the grant |
| @@ -516,6 +524,12 @@ the door-key mirror does, and adds a **durable revision floor**: |
| box until a newer record is read. The engine box's own floor still refuses |
| it unless the engine box is itself new. The same residual the door-key |
| plan accepted. |
| +- **Residual, stated (sim, plan 1):** a bucket writer who replaces the |
| + newest record with the previous signed one before any edge has read a |
| + revoke keeps the revoked grant alive until that record expires (up to 72 |
| + hours), the same exposure the door-key design accepts (open for Paul's |
| + ruling: a `signed_at` freshness bound would close it, at the cost of |
| + engine calls failing when the console is down for that bound). |
| ### 5.4 The call path |
| @@ -700,7 +714,11 @@ This spec makes that a rule the box enforces: |
| process (any `instance`, `service` or sidecar row: a socket path or an |
| address) must belong to that group. Rows the edge answers without a |
| local process (`static`, the status host, the tunnel and steering |
| - handlers) are unaffected. |
| + handlers) are unaffected. An unclassified (`NULL`) route homes its box |
| + like an internal one for this rule, since otherwise a declaring `carlos |
| + run` on a shared box is publicly reachable; the cost is that an |
| + unclassifiable route on a shared box refuses its proxying neighbours |
| + until it is classified (sim, plan 1). |
| - **The fence is box-wide on an engine's box (codex R13-2).** The fence a |
| declaring launch waits for (§5.1) cancels every non-engine proxy request |
| the box's edge admitted before it, on any row, not only the group's. That |
| @@ -943,6 +961,77 @@ process, real unix sockets and a real cgroup check where the kernel allows |
| - A 45-second conversion completes; a declared 65 MiB body gets 413 before |
| the engine sees a byte. |
| +### Simulation (#335 plan 1) |
| + |
| +`internal/sim/engines` is a test-only model of this spec: 37 named rules, |
| +each with a mutation that turns it off, checked against the invariants |
| +INV-P (no public request is delivered to a declaring build), INV-I1, |
| +INV-AV (at the end, every row of a `0` group answers a public request), |
| +INV-G (an engine call reaches only the engine's exact route, and none is |
| +granted past the freshness bound after a revoke), INV-ID (the caller the |
| +engine box records is the app whose code made the call) and INV-ARM (no |
| +unisolated tenant process on a box while an engine socket is open there). |
| +`internal/sim/engines/mutate.sh 3000` runs each |
| +mutation through a 3000-seed random walk and through the rule's |
| +hand-scheduled witnesses; `expected-outcomes.txt` lists the rules caught |
| +only in combination. |
| + |
| +First sweep, 2026-10-21, on the tree committed as "enginesim: mutation |
| +harness and the first 3000-seed sweep" (parent 4648305e). The unmutated |
| +sweep: 0 of 3000 seeds violated, 0 residuals. Result: 34 rules CAUGHT, 3 |
| +EXPECTED-MISS, none MISSED, ERROR or STALE. |
| + |
| +| Rule | Verdict | Sweep catches (of 3000) | First seed | Witness | |
| +|---|---|---|---|---| |
| +| `set-before-repoint` | CAUGHT | 1382 | 2 | violated | |
| +| `fence-needs-reload` | CAUGHT | 442 | 18 | violated | |
| +| `fence-drains-admitted` | CAUGHT | 241 | 5 | violated | |
| +| `fence-box-wide` | CAUGHT | 12 | 14 | violated | |
| +| `gate-adopt` | EXPECTED-MISS | 0 | - | held | |
| +| `gate-swap` | CAUGHT | 1575 | 2 | violated | |
| +| `gate-fallback` | CAUGHT | 250 | 17 | violated | |
| +| `gate-recovery` | CAUGHT | 269 | 8 | violated | |
| +| `gate-seed` | CAUGHT | 1086 | 5 | violated | |
| +| `gate-cmd` | CAUGHT | 1073 | 8 | violated | |
| +| `gate-waits-when-written` | CAUGHT | 307 | 24 | violated | |
| +| `unreadable-declares` | CAUGHT | 1486 | 5 | violated | |
| +| `live-link-only-adoption` | CAUGHT | 512 | 5 | violated | |
| +| `mark-on-final-upstream` | CAUGHT | 2835 | 1 | violated | |
| +| `classify-null-refused` | CAUGHT | 455 | 13 | violated | |
| +| `classify-staged` | CAUGHT | 70 | 98 | violated | |
| +| `minted-follow-owner` | CAUGHT | 782 | 5 | violated | |
| +| `grant-marks-group` | CAUGHT | 443 | 271 | violated | |
| +| `static-minted-public` | CAUGHT | 2979 | 1 | violated | |
| +| `owner-nonempty-unique` | CAUGHT | 32 | 2496 | held | |
| +| `public-checks-live` | CAUGHT | 742 | 6 | violated | |
| +| `public-stops-group` | EXPECTED-MISS | 0 | - | held | |
| +| `public-holds-lock` | CAUGHT | 55 | 85 | violated | |
| +| `public-confirms-empty` | CAUGHT | 152 | 24 | violated | |
| +| `ports-excluded` | CAUGHT | 2012 | 1 | violated | |
| +| `dedicated-launch-check` | EXPECTED-MISS | 0 | - | held | |
| +| `dedicated-edge-refusal` | CAUGHT | 1156 | 4 | violated | |
| +| `ingress-precondition` | CAUGHT | 1276 | 1 | violated | |
| +| `cgroup-identity` | CAUGHT | 319 | 4 | violated | |
| +| `door-uid` | CAUGHT | 169 | 4 | violated | |
| +| `hop-caller-signed` | CAUGHT | 282 | 4 | violated | |
| +| `engine-box-recheck` | CAUGHT | 79 | 29 | violated | |
| +| `exact-route-engine` | CAUGHT | 442 | 3 | violated | |
| +| `floor-persisted` | CAUGHT | 88 | 27 | violated | |
| +| `stale-clears-grants` | CAUGHT | 112 | 4 | violated | |
| +| `armed-refuses-unisolated` | CAUGHT | 2722 | 2 | violated | |
| +| `arm-checks-box` | CAUGHT | 2315 | 1 | violated | |
| + |
| +The three EXPECTED-MISS rules are each caught in combination, by their |
| +witness and by the sweep (200 seeds: 119, 21 and 128 catches): |
| +`gate-adopt` with `set-before-repoint` (adoption's set-before is the same |
| +gate, reached earlier), `public-stops-group` with `public-confirms-empty` |
| +(step 3 refuses while the declaring generation still runs), and |
| +`dedicated-launch-check` with `dedicated-edge-refusal` (the edge refuses |
| +the proxying row once the group is internal). `owner-nonempty-unique`'s |
| +witness needs `dedicated-edge-refusal` gone too, so it holds alone; the |
| +sweep catches the rule alone through INV-I1 (a misgrouped `0` row makes the |
| +owner's group read public). |
| + |
| ## 9. Docs |
| `docs/site/cli.md`: a `carlos engines` section. The README's doc-engine |
diff --git a/internal/sim/engines/expected-outcomes.txt b/internal/sim/engines/expected-outcomes.txt| new file mode 100644 |
| index 000000000..ba3bd6bf0 |
| --- /dev/null |
| +++ b/internal/sim/engines/expected-outcomes.txt |
| @@ -0,0 +1,11 @@ |
| +# rule outcome reason. Read by mutate.sh: a rule listed `missed` is not |
| +# expected to be caught alone, by the random sweep or by its witness |
| +# (witness_test.go), and is reported EXPECTED-MISS; the sweep fails if it |
| +# is caught (the expectation is stale). Each reason names the combination |
| +# that catches the rule; its witness's `needs` is that combination, and |
| +# TestWitnesses proves the witness holds under every proper subset of it. |
| +# A rule listed `rare N` is reached by the random sweep only at N seeds or |
| +# more; below N its miss is expected. No rule is listed rare. |
| +gate-adopt missed caught with set-before-repoint (witness): adoption's set-before is the same gate reached earlier, so with it in place the restart's gate always finds the group already fenced |
| +public-stops-group missed caught with public-confirms-empty (witness): without the stop, --public step 3 finds the declaring generation still serving and refuses, so the clear never writes 0 under it |
| +dedicated-launch-check missed caught with dedicated-edge-refusal (witness): without the launch check a declaring adoption beside a proxying row goes ahead, but the edge's refusal then refuses that row once the group is internal, so no public request reaches the engine |
diff --git a/internal/sim/engines/launch_test.go b/internal/sim/engines/launch_test.go| index 8c9cf0a37..b5335a95b 100644 |
| --- a/internal/sim/engines/launch_test.go |
| +++ b/internal/sim/engines/launch_test.go |
| @@ -361,7 +361,10 @@ func init() { |
| b.ReloadFails = !b.ReloadFails && !w.calm() |
| w.logf("box%d: reload fails = %v", b.ID, b.ReloadFails) |
| }}, |
| - action{name: "public-request", weight: 6, run: func(w *world) { |
| + // 9, not 6 (Task 6): fence-box-wide's sweep catch needs a request held |
| + // through a service row that is deleted before a declaring adoption's |
| + // fence; at 6 the 3000-seed sweep caught it 7 times, at 9 12 times |
| + action{name: "public-request", weight: 9, run: func(w *world) { |
| b := w.pickBox() |
| r := w.randomPublic(b) |
| if r == nil { |
diff --git a/internal/sim/engines/mutate.sh b/internal/sim/engines/mutate.sh| new file mode 100755 |
| index 000000000..a0b05813a |
| --- /dev/null |
| +++ b/internal/sim/engines/mutate.sh |
| @@ -0,0 +1,195 @@ |
| +#!/bin/bash |
| +# Mutation checks for the engines model (fleet-internal engines spec §8; |
| +# #335 plan 1). Adapted from internal/sim/hostlife/mutate.sh: the same |
| +# build-once, run-per-rule shape and the same verdicts. |
| +# |
| +# Build the test binary once (this is the only step that writes the Go |
| +# build cache), then run the sweep. The sweep never copies or edits the |
| +# source: each rule runs the same binary with ENGINESIM_MUTATE set. |
| +# |
| +# go test -c -o "$TMPDIR/enginesim/engines.test" ./internal/sim/engines/ |
| +# nice -n 19 internal/sim/engines/mutate.sh 3000 # every rule |
| +# nice -n 19 internal/sim/engines/mutate.sh 3000 @all # the same |
| +# nice -n 19 internal/sim/engines/mutate.sh 3000 rule-a rule-b # named rules |
| +# nice -n 19 internal/sim/engines/mutate.sh 3000 rule-a,rule-b # a combination, dropped together |
| +# ENGINESIM_LIST=1 internal/sim/engines/mutate.sh 0 # print the rules a run would check, and run nothing |
| +# |
| +# Each rule gets two runs under its mutation: the random sweep (TestEngines |
| +# over the seeds) and the rule's deterministic witness scenarios |
| +# (TestWitnesses, witness_test.go). The verdict line reports both, |
| +# separately: |
| +# |
| +# CAUGHT rule: sweep N of S (first seed n); witness violated|held|none |
| +# |
| +# Classification: |
| +# |
| +# CAUGHT the sweep completed and reported at least one seed that |
| +# violated an invariant, with the seed number parsed from its |
| +# output (so it can be replayed with ENGINESIM_SEED), OR a |
| +# witness of the rule violated an invariant under the mutation; |
| +# MISSED the sweep completed with every seed passing, and every |
| +# witness held (or the rule has none); |
| +# ERROR anything else: an unknown rule, a stale binary, a panic, a |
| +# timeout, output the harness cannot parse, or a witness run |
| +# that failed (a witness that must violate under this mutation |
| +# and held: the witness is broken). An error is never a |
| +# detection. |
| +# |
| +# Expected outcomes live in expected-outcomes.txt beside this script: a |
| +# rule listed there as `missed` (caught only in a stated combination: its |
| +# witness holds alone) is reported as EXPECTED-MISS. A rule listed as |
| +# `rare <N>` is caught by the random sweep only at N seeds or more: below |
| +# N a miss is EXPECTED-MISS and a catch is CAUGHT; at N or more a miss is |
| +# MISSED. The sweep exits nonzero on any ERROR, on any unexpected MISSED, |
| +# and on any rule listed as `missed` that is CAUGHT (STALE). |
| +# |
| +# The machine is shared: run the sweep once per revision, serially, under |
| +# nice -n 19. ENGINESIM_PAR (default 1) runs that many rules at once. |
| +# |
| +# Scratch (the binary, every run's log, the verdicts) lives under |
| +# ${ENGINESIM_SCRATCH:-$TMPDIR/enginesim}; remove that one directory, by |
| +# its exact path, once, after the whole sweep. |
| +set -u |
| +SEEDS=${1:?seeds} |
| +shift |
| +ROOT=$(git -C "$(dirname "$0")" rev-parse --show-toplevel) |
| +PKG="$ROOT/internal/sim/engines" |
| +SCRATCH=${ENGINESIM_SCRATCH:-${TMPDIR:?}/enginesim} |
| +BIN=${ENGINESIM_BIN:-$SCRATCH/engines.test} |
| +RULES="$*" |
| +if [ -z "$RULES" ] || [ "$RULES" = "@all" ]; then |
| + RULES=$(sed -n '/^var allRules/,/^}/p' "$PKG/rules_test.go" | grep -o '^\s*"[a-z0-9-]*"' | tr -d ' "\t') |
| +fi |
| +if [ -n "${ENGINESIM_LIST:-}" ]; then |
| + printf '%s\n' $RULES |
| + exit 0 |
| +fi |
| +mkdir -p "$SCRATCH/logs" "$SCRATCH/verdicts" || { echo "cannot create $SCRATCH" >&2; exit 2; } |
| +EXPECT="$PKG/expected-outcomes.txt" |
| +if [ ! -x "$BIN" ]; then |
| + echo "no test binary at $BIN; build it with: go test -c -o $BIN ./internal/sim/engines/" >&2 |
| + exit 2 |
| +fi |
| +if [ -n "$(find "$PKG" -name '*.go' -newer "$BIN")" ]; then |
| + echo "the test binary $BIN is older than the source; rebuild it" >&2 |
| + exit 2 |
| +fi |
| +# the rules that have witnesses (the witnesses table in witness_test.go): a |
| +# run of one of them with no witness output is an ERROR, never "none" |
| +WRULES=$(sed -n '/^var witnesses/,/^}/p' "$PKG/witness_test.go" | grep -o '^\s*{"[a-z0-9-]*",' | tr -d ' \t{",' | sort -u) |
| +# the verdicts of this run only: remove the files inside, by exact name |
| +for f in "$SCRATCH"/verdicts/*; do |
| + [ -e "$f" ] && { rm -f -- "$f" || exit 2; } |
| +done |
| + |
| +# the unmutated sweep first, at the same seed count: if the model violates |
| +# with every rule in place, no catch below means anything |
| +blog="$SCRATCH/logs/unmutated.log" |
| +ENGINESIM_SEEDS=$SEEDS "$BIN" -test.run '^TestEngines$' -test.count=1 -test.v -test.timeout 180m >"$blog" 2>&1 |
| +brc=$? |
| +if [ $brc -ne 0 ] || [ "$(grep -c "^ sim_test.go:[0-9]*: $SEEDS seeds, 0 failed, 0 residuals; mutated=\"\"" "$blog")" -ne 1 ]; then |
| + echo "BASELINE unmutated: FAILED (rc=$brc); see $blog" >&2 |
| + exit 1 |
| +fi |
| +echo "BASELINE unmutated: sweep 0 of $SEEDS" |
| + |
| +one() { |
| + r=$1 |
| + tag=$(echo "$r" | tr ',' '+') |
| + log="$SCRATCH/logs/$tag.log" |
| + verdict="$SCRATCH/verdicts/$tag" |
| + for x in $(echo "$r" | tr ',' ' '); do |
| + if ! sed -n '/^var allRules/,/^}/p' "$PKG/rules_test.go" | grep -q "^\s*\"$x\","; then |
| + echo "ERROR $r: no rule named $x" | tee "$verdict" |
| + return |
| + fi |
| + done |
| + # the random sweep |
| + ENGINESIM_MUTATE=$r ENGINESIM_SEEDS=$SEEDS "$BIN" -test.run '^TestEngines$' -test.count=1 -test.v -test.timeout 180m >"$log" 2>&1 |
| + rc=$? |
| + expect=$(awk -v r="$r" '$1==r {print $2}' "$EXPECT" 2>/dev/null) |
| + depth=$(awk -v r="$r" '$1==r {print $3}' "$EXPECT" 2>/dev/null) |
| + nviol=$(grep -o "[0-9]* of $SEEDS seeds violated an invariant" "$log" | head -1 | awk '{print $1}') |
| + seed=$(grep -o "first seed [0-9]*" "$log" | head -1 | awk '{print $3}') |
| + clean=$(grep -c "^ sim_test.go:[0-9]*: $SEEDS seeds, 0 failed.*mutated=\"$r\"" "$log") |
| + sweep="" |
| + if [ $rc -ne 0 ] && [ -n "$nviol" ] && [ -n "$seed" ] && ! grep -q "^panic:\|test timed out" "$log"; then |
| + sweep="sweep $nviol of $SEEDS (first seed $seed)" |
| + elif [ $rc -eq 0 ] && [ "$clean" -eq 1 ]; then |
| + sweep="sweep 0 of $SEEDS" |
| + fi |
| + # the witnesses: the rule's own hand-scheduled scenarios, run under the |
| + # same mutation; "violated" if any of them violates an invariant, "held" |
| + # if they all hold, "none" if the rule has no witness. A witness that |
| + # must violate under this mutation and holds fails the test, which is an |
| + # ERROR here: the witness is broken, not the rule |
| + wlog="$SCRATCH/logs/$tag.witness.log" |
| + ENGINESIM_MUTATE=$r "$BIN" -test.run '^TestWitnesses$' -test.count=1 -test.v -test.timeout 10m >"$wlog" 2>&1 |
| + wrc=$? |
| + wit=none |
| + if grep -q "^ witness_test.go:[0-9]*: witness .*: violated" "$wlog"; then |
| + wit=violated |
| + elif grep -q "^ witness_test.go:[0-9]*: witness .*: held" "$wlog"; then |
| + wit=held |
| + fi |
| + if [ $wrc -ne 0 ] || grep -q "^panic:\|test timed out" "$wlog"; then |
| + echo "ERROR $r: witness run rc=$wrc; see $wlog" | tee "$verdict" |
| + return |
| + fi |
| + if [ "$wit" = none ]; then |
| + for x in $(echo "$r" | tr ',' ' '); do |
| + if echo "$WRULES" | grep -qx "$x"; then |
| + echo "ERROR $r: $x has witnesses but the run produced no witness output; see $wlog" | tee "$verdict" |
| + return |
| + fi |
| + done |
| + fi |
| + if [ -z "$sweep" ]; then |
| + echo "ERROR $r: rc=$rc, no parsable sweep verdict; see $log" | tee "$verdict" |
| + return |
| + fi |
| + caught=0 |
| + if [ "$sweep" != "sweep 0 of $SEEDS" ] || [ "$wit" = violated ]; then |
| + caught=1 |
| + fi |
| + if [ $caught -eq 1 ]; then |
| + if [ "$expect" = "missed" ]; then |
| + echo "STALE $r: $sweep; witness $wit; but expected-outcomes.txt says missed" | tee "$verdict" |
| + else |
| + echo "CAUGHT $r: $sweep; witness $wit" | tee "$verdict" |
| + fi |
| + elif [ "$expect" = "missed" ]; then |
| + echo "EXPECTED-MISS $r: $sweep; witness $wit" | tee "$verdict" |
| + elif [ "$expect" = "rare" ] && [ -n "$depth" ] && [ "$SEEDS" -lt "$depth" ]; then |
| + echo "EXPECTED-MISS $r: $sweep; witness $wit (rare: caught at $depth seeds)" | tee "$verdict" |
| + else |
| + echo "MISSED $r: $sweep; witness $wit" | tee "$verdict" |
| + fi |
| +} |
| +export -f one |
| +export SEEDS PKG SCRATCH BIN WRULES EXPECT |
| +printf '%s\n' $RULES | xargs -P "${ENGINESIM_PAR:-1}" -I{} bash -c 'one "$@"' _ {} |
| +xrc=$? |
| +if [ $xrc -ne 0 ]; then |
| + echo "sweep: orchestration failed (xargs rc=$xrc)" >&2 |
| + exit 2 |
| +fi |
| +# exactly one well-formed verdict per requested mutation |
| +want=$(printf '%s\n' $RULES | wc -l) |
| +have=$(find "$SCRATCH/verdicts" -type f | wc -l) |
| +if [ "$have" -ne "$want" ]; then |
| + echo "sweep: $want mutation(s) requested, $have verdict(s) written" >&2 |
| + exit 2 |
| +fi |
| +for r in $RULES; do |
| + v="$SCRATCH/verdicts/$(echo "$r" | tr ',' '+')" |
| + if ! grep -qE '^(CAUGHT|MISSED|EXPECTED-MISS|STALE|ERROR) ' "$v" 2>/dev/null; then |
| + echo "sweep: no well-formed verdict for $r" >&2 |
| + exit 2 |
| + fi |
| +done |
| +bad=$(cat "$SCRATCH"/verdicts/* | grep -c "^ERROR\|^MISSED\|^STALE") |
| +if [ "$bad" -gt 0 ]; then |
| + echo "sweep: $bad rule(s) ERROR, MISSED or STALE" >&2 |
| + exit 1 |
| +fi |
diff --git a/internal/sim/engines/sim_test.go b/internal/sim/engines/sim_test.go| index 3d17dd14d..b5bef5d7e 100644 |
| --- a/internal/sim/engines/sim_test.go |
| +++ b/internal/sim/engines/sim_test.go |
| @@ -286,3 +286,36 @@ func TestOnMutation(t *testing.T) { |
| t.Fatal("only the named rules are off") |
| } |
| } |
| + |
| +// TestEveryActionFires: over 200 seeds of the unmutated walk every registered |
| +// action is chosen at least once. A rule that guards an action no seed fires |
| +// is untested however green the sweep looks (Review Focus 2). |
| +func TestEveryActionFires(t *testing.T) { |
| + saved := mutated |
| + mutated = "" |
| + defer func() { mutated = saved }() |
| + if len(actions) == 0 { |
| + t.Fatal("no actions registered") |
| + } |
| + names := map[string]bool{} |
| + for _, a := range actions { |
| + if names[a.name] { |
| + t.Errorf("action %q registered twice", a.name) |
| + } |
| + names[a.name] = true |
| + if a.weight <= 0 { |
| + t.Errorf("action %q has weight %d: the walk never picks it", a.name, a.weight) |
| + } |
| + } |
| + stats := map[string]int{} |
| + for seed := int64(1); seed <= 200; seed++ { |
| + for k, v := range runSeed(seed, false).stats { |
| + stats[k] += v |
| + } |
| + } |
| + for _, a := range actions { |
| + if stats[a.name] == 0 { |
| + t.Errorf("action %q never fired over 200 seeds", a.name) |
| + } |
| + } |
| +} |
diff --git a/internal/sim/engines/witness_test.go b/internal/sim/engines/witness_test.go| index 91604595a..e1de808bb 100644 |
| --- a/internal/sim/engines/witness_test.go |
| +++ b/internal/sim/engines/witness_test.go |
| @@ -1737,3 +1737,106 @@ func TestResidualCoversOnlyItsOwnBreaches(t *testing.T) { |
| } |
| }) |
| } |
| + |
| +// TestWitnessesHoldUnmutated: every witness holds with every rule in place. |
| +// A witness that violates unmutated is a model bug, and a witness that |
| +// passes under its mutation for the wrong reason starts here (Review Focus 1). |
| +func TestWitnessesHoldUnmutated(t *testing.T) { |
| + saved := mutated |
| + mutated = "" |
| + defer func() { mutated = saved }() |
| + if len(witnesses) == 0 { |
| + t.Fatal("no witnesses") |
| + } |
| + for _, x := range witnesses { |
| + w := newWitness() |
| + x.run(t, w) |
| + if len(w.violations) > 0 { |
| + t.Errorf("witness %s (needs %q) violates with no mutation: %v", x.rule, x.needs, w.violations) |
| + dump(t, w) |
| + } |
| + } |
| +} |
| + |
| +// expectedOutcome is one line of expected-outcomes.txt: `rule missed reason` |
| +// or `rule rare N reason` (hostlife's format, read by mutate.sh). |
| +type expectedOutcome struct { |
| + rule, outcome string |
| + depth int |
| + reason string |
| +} |
| + |
| +func readExpectedOutcomes(t *testing.T) []expectedOutcome { |
| + t.Helper() |
| + data, err := os.ReadFile("expected-outcomes.txt") |
| + if err != nil { |
| + t.Fatalf("mutate.sh reads expected-outcomes.txt beside it: %v", err) |
| + } |
| + var out []expectedOutcome |
| + for i, line := range strings.Split(string(data), "\n") { |
| + if strings.HasPrefix(line, "#") || strings.TrimSpace(line) == "" { |
| + continue |
| + } |
| + f := strings.Fields(line) |
| + e := expectedOutcome{rule: f[0]} |
| + if len(f) > 1 { |
| + e.outcome = f[1] |
| + } |
| + rest := f[min(2, len(f)):] |
| + if e.outcome == "rare" { |
| + if len(f) < 3 { |
| + t.Errorf("expected-outcomes.txt:%d: rare needs a seed count: %q", i+1, line) |
| + continue |
| + } |
| + if _, err := fmt.Sscanf(f[2], "%d", &e.depth); err != nil || e.depth <= 0 { |
| + t.Errorf("expected-outcomes.txt:%d: rare needs a positive seed count: %q", i+1, line) |
| + } |
| + rest = f[3:] |
| + } |
| + e.reason = strings.Join(rest, " ") |
| + out = append(out, e) |
| + } |
| + return out |
| +} |
| + |
| +// TestEveryRuleHasWitness: each rule in allRules has a witness or a line in |
| +// expected-outcomes.txt that says why it has none or why it is not caught |
| +// alone; every line there is well formed and names a known rule; and a rule |
| +// listed `missed` has no witness that its mutation alone must violate (the |
| +// harness would report it STALE). |
| +func TestEveryRuleHasWitness(t *testing.T) { |
| + known := map[string]bool{} |
| + for _, r := range allRules { |
| + known[r] = true |
| + } |
| + expected := map[string]expectedOutcome{} |
| + for _, e := range readExpectedOutcomes(t) { |
| + if !known[e.rule] { |
| + t.Errorf("expected-outcomes.txt names unknown rule %q", e.rule) |
| + } |
| + if _, dup := expected[e.rule]; dup { |
| + t.Errorf("expected-outcomes.txt lists %q twice", e.rule) |
| + } |
| + if e.outcome != "missed" && e.outcome != "rare" { |
| + t.Errorf("expected-outcomes.txt: %s: outcome %q, want missed or rare N", e.rule, e.outcome) |
| + } |
| + if e.reason == "" { |
| + t.Errorf("expected-outcomes.txt: %s gives no reason", e.rule) |
| + } |
| + expected[e.rule] = e |
| + } |
| + witnessed := map[string]bool{} |
| + for _, x := range witnesses { |
| + witnessed[x.rule] = true |
| + if e, ok := expected[x.rule]; ok && e.outcome == "missed" && x.needs == x.rule { |
| + t.Errorf("%s is listed missed, but a witness must violate under its mutation alone", x.rule) |
| + } |
| + } |
| + for _, r := range allRules { |
| + if !witnessed[r] { |
| + if _, ok := expected[r]; !ok { |
| + t.Errorf("rule %q has neither a witness nor an expected-outcomes.txt line", r) |
| + } |
| + } |
| + } |
| +} |