carlos / platform Public

census: apply census ruling carlos-run (Plan 14 controller, 2026-10-14)

The Plan 14 controller approved the root-read overlay proposed in
7d1ff240. This applies the ruling: every basis now carries
rev3=census-ruling-carlos-run in place of the proposal marker, and the
seal is re-pinned beside the overlay's load in both tests.

As ruled:
- The 54 accepted-legacy rows stand as proposed. The console's rows
  name its user, carlos-console, which the controller confirmed.
- The three re-digested rows keep main's class and family:
  fastConvergeLoop (authority, B3), runAgent (authority, B,C,D,F) and
  instancectl's type Server (diagnostic, H3).
- The four instance-control rows are accepted-legacy, the same class
  as main's J2 and J4 instance-control rows, because they extend the J4
  seed pattern to the run role. handleCmdStatus is read-only systemctl
  state. ensureExeAs is ensureExe's body, parameterised. parseRequest
  only admits the cmd role, and its executable is still refused before
  layout. The cmd unit template equals the seed template outside named
  lines. Root validates the staged executable with the same
  refuseStagedExe the seed and generation paths use, and there is no
  new trust of registry, /data or agent-asserted content.
- The two @removed rows, apiSession.getJSON and ensureExe, stand in
  the H3 census-ruling-carlos-run form, as zddr3's startIn did.
- The root-executed run code the scanner gives no row is noted and
  pinned by the internal/instancectl envelope.

The ruling on the four instance-control rows is conditional, and the
overlay's header records both conditions: the cmd template-equality
test stays, and the cmd verb stays on refuseStagedExe. If either
diverges, those rows need a new ruling.

Load order is unchanged: after hotfix281. No zddr4 overlay is on
origin/main.

The overlay still adds 58 frozen declarations. The new seal is
da1172ebdd62b9701767b2499a6728ef1d9a34aef464abd7177511621c0d3dbc.

Tests: TestPlan14RootReadCensus, the legacy identity tests and the
provision package pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago c34a8e0fe975f06e27bfe66842b1d157e5c6e352 parent 7d1ff24

3 files changed, +146 −143

internal/provision/plan14_legacy_identity_test.go +15 −14
internal/provision/plan14_root_reads_test.go +7 −6
internal/provision/testdata/plan14-root-reads-carlos-run.tsv +124 −123

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	334.458s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.234s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.321s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.381s
ok  	github.com/carlosframework/platform/internal/activator	237.239s
ok  	github.com/carlosframework/platform/internal/agentsock	0.018s
ok  	github.com/carlosframework/platform/internal/alerting	0.005s
ok  	github.com/carlosframework/platform/internal/analytics	0.019s
ok  	github.com/carlosframework/platform/internal/appconfig	2.355s
ok  	github.com/carlosframework/platform/internal/apperr	0.090s
ok  	github.com/carlosframework/platform/internal/applog	0.145s
ok  	github.com/carlosframework/platform/internal/awsinv	0.004s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.846s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.012s
ok  	github.com/carlosframework/platform/internal/certwarm	0.003s
ok  	github.com/carlosframework/platform/internal/cgroup	0.688s
ok  	github.com/carlosframework/platform/internal/changelog	0.298s
ok  	github.com/carlosframework/platform/internal/clamd	0.068s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	369.687s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.470s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.008s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.002s
ok  	github.com/carlosframework/platform/internal/docsite	0.004s
ok  	github.com/carlosframework/platform/internal/domains	2.150s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	25.793s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.121s
ok  	github.com/carlosframework/platform/internal/gate	1.655s
ok  	github.com/carlosframework/platform/internal/genselect	0.014s
ok  	github.com/carlosframework/platform/internal/geo	0.016s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/host	101.941s
ok  	github.com/carlosframework/platform/internal/hostactors	0.408s
ok  	github.com/carlosframework/platform/internal/hostbox	2.098s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.480s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.013s
ok  	github.com/carlosframework/platform/internal/hostexec	4.856s
ok  	github.com/carlosframework/platform/internal/hostfence	0.033s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.495s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.013s
ok  	github.com/carlosframework/platform/internal/hostguard	1.023s
ok  	github.com/carlosframework/platform/internal/hostops	1.418s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.013s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.013s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.459s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.143s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.013s
ok  	github.com/carlosframework/platform/internal/infraview	0.013s
ok  	github.com/carlosframework/platform/internal/instancectl	2.514s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.721s
ok  	github.com/carlosframework/platform/internal/instancefs	0.019s
ok  	github.com/carlosframework/platform/internal/instancekey	0.015s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.019s
ok  	github.com/carlosframework/platform/internal/layout	1.421s
ok  	github.com/carlosframework/platform/internal/lease	9.445s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.005s
ok  	github.com/carlosframework/platform/internal/ledger	0.013s
ok  	github.com/carlosframework/platform/internal/mail	0.170s
ok  	github.com/carlosframework/platform/internal/maintenance	0.079s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.572s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.068s
ok  	github.com/carlosframework/platform/internal/metrics	0.004s
ok  	github.com/carlosframework/platform/internal/moves	20.983s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.770s
ok  	github.com/carlosframework/platform/internal/objstore	0.170s
ok  	github.com/carlosframework/platform/internal/ops	0.155s
ok  	github.com/carlosframework/platform/internal/park	0.196s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	13.104s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	4.081s
ok  	github.com/carlosframework/platform/internal/relay	7.229s
ok  	github.com/carlosframework/platform/internal/release	19.548s
ok  	github.com/carlosframework/platform/internal/rollout	3.720s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.006s
ok  	github.com/carlosframework/platform/internal/rootstate	0.024s
ok  	github.com/carlosframework/platform/internal/runs	0.574s
ok  	github.com/carlosframework/platform/internal/s3compat	0.004s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.278s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.401s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.401s
ok  	github.com/carlosframework/platform/internal/status	0.041s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.208s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.003s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.003s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.558s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.022s
=== RUN   TestT4StorageProbeMinio
2026/10/13 23:30:45 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DE3AB3B83BBC7F, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.020s
minio contract: PASS

diff --git a/internal/provision/plan14_legacy_identity_test.go b/internal/provision/plan14_legacy_identity_test.go

index a8d7d2b64..89355f824 100644

--- a/internal/provision/plan14_legacy_identity_test.go

+++ b/internal/provision/plan14_legacy_identity_test.go

@@ -249,11 +249,11 @@ func TestPlan14Zddr3OverlayPreservesLegacySeal(t *testing.T) {

}

-// PROPOSED, pending the Plan 14 controller's ruling: the carlos-run branch's

-// overlay (carlos run, #259), loaded after hotfix281. It keeps every earlier

-// freeze, adds exactly 58 frozen declarations, and every legacy row it

-// writes says so (rev3=PROPOSED-carlos-run). The two units that still exist

-// and no longer read are retired under the proposal's name, never silently.

+// Census ruling carlos-run (Plan 14 controller, 2026-10-14): the carlos-run

+// branch's overlay (carlos run, #259), loaded after hotfix281. It keeps

+// every earlier freeze, adds exactly 58 frozen declarations, and every row

+// it writes names the ruling. The two units that still exist and no longer

+// read are retired under the ruling's name, in the form zddr3 used.

func TestPlan14CarlosRunOverlayPreservesLegacySeal(t *testing.T) {

root := censusRoot(t)

inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}

@@ -282,10 +282,11 @@ func TestPlan14CarlosRunOverlayPreservesLegacySeal(t *testing.T) {

}

if len(inv.Legacy) != len(original)+58 {

- t.Fatalf("the carlos-run proposal adds exactly 58 frozen declarations, not %d", len(inv.Legacy)-len(original))

+ t.Fatalf("census ruling carlos-run permits exactly 58 new frozen declarations, not %d", len(inv.Legacy)-len(original))

}

- // The proposal's seal: not an approved set until the controller rules.

- const seal = "10b5eb10f4d412fdad136fff7a6bbefd23bcc52225af70bf3a7eb6f1798fba05"

+ // Census ruling carlos-run seal: 54 service-user and CLI rows plus the

+ // four instance-control rows that extend the J4 seed pattern.

+ const seal = "da1172ebdd62b9701767b2499a6728ef1d9a34aef464abd7177511621c0d3dbc"

if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

t.Fatal(errs)

}

@@ -295,15 +296,15 @@ func TestPlan14CarlosRunOverlayPreservesLegacySeal(t *testing.T) {

continue

}

written++

- if !strings.Contains(e.Basis, "rev3=PROPOSED-carlos-run;") {

- t.Fatalf("%s is not marked as proposed: %+v", key, e)

+ if !strings.Contains(e.Basis, "rev3=census-ruling-carlos-run;") {

+ t.Fatalf("%s does not name the ruling: %+v", key, e)

}

- if e.Class == "legacy" && (e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=PROPOSED-carlos-run;")) {

+ if e.Class == "legacy" && (e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-carlos-run;")) {

t.Fatalf("wrong carlos-run disposition: %+v", e)

}

if written != 61 {

- t.Fatalf("the carlos-run proposal writes 61 rows, not %d", written)

+ t.Fatalf("census ruling carlos-run writes 61 rows, not %d", written)

}

// Main's authority and diagnostic rows keep their class and family.

for key, task := range map[string]string{"internal/host/agent.go:runAgent": "B,C,D,F", "internal/host/agent.go:fastConvergeLoop": "B3"} {

@@ -315,8 +316,8 @@ func TestPlan14CarlosRunOverlayPreservesLegacySeal(t *testing.T) {

t.Fatalf("type Server lost main's disposition: %+v", e)

}

for _, key := range []string{"apimode.go:apiSession.getJSON", "internal/instancectl/hardening.go:ensureExe"} {

- if !strings.HasPrefix(inv.Removed[key], "H3;census-ruling-PROPOSED-carlos-run: ") {

- t.Fatalf("%s lost its proposed retirement", key)

+ if !strings.HasPrefix(inv.Removed[key], "H3;census-ruling-carlos-run: ") {

+ t.Fatalf("%s lost its census-ruling removal", key)

}

if _, present := inv.Entries[key]; present {

t.Fatalf("%s still classified", key)

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 8bb2ee2fe..ac3db2081 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -661,15 +661,16 @@ func TestPlan14RootReadCensus(t *testing.T) {

if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

t.Fatal(errs)

}

- // PROPOSED, pending the Plan 14 controller's ruling: the carlos-run

- // branch's overlay (carlos run, #259), loaded last. Every basis in it

- // carries rev3=PROPOSED-carlos-run, and its rows marked NEEDS RULING are

- // placeholders. The seal below is the proposal's, not an approved set:

- // it adds 58 frozen declarations, which a ruling must accept or change.

+ // Census ruling carlos-run (Plan 14 controller, 2026-10-14): the

+ // carlos-run branch's overlay (carlos run, #259), loaded last. It adds

+ // 58 frozen declarations. Its four instance-control rows are accepted

+ // legacy on two conditions, recorded in the overlay's header: the cmd

+ // template-equality test stays, and the cmd verb stays on

+ // refuseStagedExe.

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-carlos-run.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

- seal = "10b5eb10f4d412fdad136fff7a6bbefd23bcc52225af70bf3a7eb6f1798fba05"

+ seal = "da1172ebdd62b9701767b2499a6728ef1d9a34aef464abd7177511621c0d3dbc"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-carlos-run.tsv b/internal/provision/testdata/plan14-root-reads-carlos-run.tsv

index de2361c58..4e090de89 100644

--- a/internal/provision/testdata/plan14-root-reads-carlos-run.tsv

+++ b/internal/provision/testdata/plan14-root-reads-carlos-run.tsv

@@ -1,128 +1,129 @@

-# PROPOSED overlay for the carlos-run branch (carlos run, #259): pending the Plan 14 controller's ruling. Every basis carries rev3=PROPOSED-carlos-run until it is ruled on.

-# Rows marked NEEDS RULING are root-executed or root-applied; their class here mirrors the nearest row on main and is a placeholder, not a classification. Earlier overlays are immutable.

-@legacy e43cd015d72211ac3a163a815fae63e4f61cb94b16d9da788f28e9bca0cd1aa6 apimode.go apiSession.getJSONHeader legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): body of the frozen apiSession.getJSON, which is now its wrapper; it also returns the response header (the run follow's Retry-After) file:ReadAll@590 e5897a162e1e42a3ffb0904a80e2ef95464c221018ed92444dc384270fe5f49a

-apimode.go apiSession.getJSONHeader legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): body of the frozen apiSession.getJSON, which is now its wrapper; it also returns the response header (the run follow's Retry-After) file:ReadAll@590 e5897a162e1e42a3ffb0904a80e2ef95464c221018ed92444dc384270fe5f49a

-@legacy ac69ccc429e9af73149bb883c24c9929962ab3fb7d4a4d645f52aba134d08d45 cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): main's body with the run sweep started beside the other claim workers; read sites unchanged data-literal@2918,data-literal@4019 d55fd5881179c0ffef47d5becbd69f281d74ed863ade9c908f0c486f275063cc

-cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): main's body with the run sweep started beside the other claim workers; read sites unchanged data-literal@2918,data-literal@4019 d55fd5881179c0ffef47d5becbd69f281d74ed863ade9c908f0c486f275063cc

-@legacy 92072cdbc9e4cafcac3019a27373b18b575fa8e942e00fa8a69f6ccecd5edc4f internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@259,registry:Host@333 e28b89f9c3fb96d60604d0fcaf8b9442c18919c77acb28eb2ea251d372792ac1

-internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@259,registry:Host@333 e28b89f9c3fb96d60604d0fcaf8b9442c18919c77acb28eb2ea251d372792ac1

-@legacy 62571b609fbde2a28f38e12f417e3b7c934a89d5ee390366ab1c6690cccd8f3d internal/activator/activator.go Service.SleepWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Hibernate@169,whole:Route@171,whole:Route@329 6cefa104c59657f49962c4d026d2eb775a3d65542c392adf08a089d4fcd27e44

-internal/activator/activator.go Service.SleepWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Hibernate@169,whole:Route@171,whole:Route@329 6cefa104c59657f49962c4d026d2eb775a3d65542c392adf08a089d4fcd27e44

-@legacy 0349b75046ad4c437444a64625e7772a54345ffce40b8c7395eae3a4c984ced3 internal/activator/activator.go Service.WakeWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1242,registry:Host@1652,registry:Host@834,registry:Host@864,whole:Route@1225 30d0eaa5a884e0c9af935e9e1bbaf1a177c4d77c83ad190789bbb667383f7cd9

-internal/activator/activator.go Service.WakeWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1242,registry:Host@1652,registry:Host@834,registry:Host@864,whole:Route@1225 30d0eaa5a884e0c9af935e9e1bbaf1a177c4d77c83ad190789bbb667383f7cd9

-@legacy ae6776b08075e430dbb7e0297d027dfedd0279ff77827f4eacb7537e5e658f8f internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1197,registry:Host@1276,registry:Host@326,registry:Host@405,whole:Route@1206,whole:Route@1213 b051166b0d24cb2c889fa3b4705b838aea14efa4b5c8056462eaed88cbf2c7db

-internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1197,registry:Host@1276,registry:Host@326,registry:Host@405,whole:Route@1206,whole:Route@1213 b051166b0d24cb2c889fa3b4705b838aea14efa4b5c8056462eaed88cbf2c7db

-@legacy be04436aecf234684e91d6e3681668e416ac65bcc8bd8c81bf10fc037b3706e8 internal/activator/activator.go Service.bounceLocked legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@290 79e4c090b1fd161fe97fd3d68815c649937144c83f275b827c490a9cd93d04a0

-internal/activator/activator.go Service.bounceLocked legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@290 79e4c090b1fd161fe97fd3d68815c649937144c83f275b827c490a9cd93d04a0

-@legacy 360377fc9d13e3b72e9d50a4a712a65ea7ff9461c1fe2928589f8792e96731c9 internal/activator/activator.go Service.finishStop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle checked before replication closes, which keeps the stop pending until the run is proven stopped; read sites unchanged, offsets moved registry:Socket@1775,registry:Socket@1880,whole:Route@1725,whole:Route@1777,whole:Route@1882 28b1c796724636ab314c9004ef1b756868b8b23c9275ef4f1f33a6a73a4ca575

-internal/activator/activator.go Service.finishStop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle checked before replication closes, which keeps the stop pending until the run is proven stopped; read sites unchanged, offsets moved registry:Socket@1775,registry:Socket@1880,whole:Route@1725,whole:Route@1777,whole:Route@1882 28b1c796724636ab314c9004ef1b756868b8b23c9275ef4f1f33a6a73a4ca575

-@legacy c6e792a7d7131939633d2cb219a7844b2f02fe5ec70a37e4144c52375b22861e internal/activator/activator.go Service.respawnWorkerLocked legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@11677,whole:Route@13183,whole:Route@209,whole:Route@4013,whole:Route@6006,whole:Route@6187 28902e42ad7049868521abe4a631f7ba974acb8d38240a5eedc125f1ad519cad

-internal/activator/activator.go Service.respawnWorkerLocked legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@11677,whole:Route@13183,whole:Route@209,whole:Route@4013,whole:Route@6006,whole:Route@6187 28902e42ad7049868521abe4a631f7ba974acb8d38240a5eedc125f1ad519cad

-@legacy c93a209390fe858ad2a09c9913c4d94edec149c9c7cf47af244313221985b3c8 internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the idle check skips an entry with a run attached and each stop carries its reason; read sites unchanged, offsets moved registry:Hibernate@11895,registry:Hibernate@21066,registry:Hibernate@4810,registry:Hibernate@6480,registry:Hibernate@8886,registry:Host@21135,registry:Host@21193,registry:Host@21586,registry:Host@22317,registry:Host@22399,registry:Host@23464,registry:Host@23643,registry:Host@23692,registry:NextDue@22272,registry:Status@21082,whole:Route@11897,whole:Route@13830,whole:Route@15540,whole:Route@15730,whole:Route@16023,whole:Route@16195,whole:Route@16342,whole:Route@20553,whole:Route@21986,whole:Route@22326,whole:Route@22333,whole:Route@23279,whole:Route@23676,whole:Route@4812,whole:Route@6482,whole:Route@8888 1cbdb78664b6a77baf8ba2b92cf77d09e02a839f48f12df07c86c61ec1a1dd6e

-internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the idle check skips an entry with a run attached and each stop carries its reason; read sites unchanged, offsets moved registry:Hibernate@11895,registry:Hibernate@21066,registry:Hibernate@4810,registry:Hibernate@6480,registry:Hibernate@8886,registry:Host@21135,registry:Host@21193,registry:Host@21586,registry:Host@22317,registry:Host@22399,registry:Host@23464,registry:Host@23643,registry:Host@23692,registry:NextDue@22272,registry:Status@21082,whole:Route@11897,whole:Route@13830,whole:Route@15540,whole:Route@15730,whole:Route@16023,whole:Route@16195,whole:Route@16342,whole:Route@20553,whole:Route@21986,whole:Route@22326,whole:Route@22333,whole:Route@23279,whole:Route@23676,whole:Route@4812,whole:Route@6482,whole:Route@8888 1cbdb78664b6a77baf8ba2b92cf77d09e02a839f48f12df07c86c61ec1a1dd6e

-@legacy 9c36f281408f92a8337692a4ee4f53bd25ccdca801e6fde7a411297510154512 internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Socket@6616,registry:Socket@6777,whole:Route@1900,whole:Route@1957,whole:Route@5153,whole:Route@6569,whole:Route@6618,whole:Route@6779,whole:Route@8114,whole:Route@8135 8aae86c7d00daf2d5bbeb6f2e18203201a0a96fdade34b354994edbc2ba58434

-internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Socket@6616,registry:Socket@6777,whole:Route@1900,whole:Route@1957,whole:Route@5153,whole:Route@6569,whole:Route@6618,whole:Route@6779,whole:Route@8114,whole:Route@8135 8aae86c7d00daf2d5bbeb6f2e18203201a0a96fdade34b354994edbc2ba58434

-@legacy 6f85d2695f83ebb89fdef00b8f4ed58abe8bf4d339060cf501f55899155e8d95 internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; it calls prepareKeyedAt and keeps the launch environment and its key layer on the generation's handle; read sites unchanged, offsets moved registry:Host@1071,registry:Host@1488,registry:Host@1591,registry:Host@2009,registry:Host@2489,registry:Host@3415,registry:Host@4001,registry:Host@4271,registry:Host@4491,registry:Host@4676,registry:Host@4778,registry:Host@5058,registry:Host@5120,registry:Host@5273,registry:Host@5312,registry:Host@6144,registry:Host@6238,whole:Route@1182,whole:Route@1417,whole:Route@194,whole:Route@2693,whole:Route@4324,whole:Route@5211,whole:Route@5370,whole:Route@758,whole:Route@856 075d65bdf24d08727704acd3f20a58eb56b6a593f44eab2f47f5cd9b4e0ea03b

-internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; it calls prepareKeyedAt and keeps the launch environment and its key layer on the generation's handle; read sites unchanged, offsets moved registry:Host@1071,registry:Host@1488,registry:Host@1591,registry:Host@2009,registry:Host@2489,registry:Host@3415,registry:Host@4001,registry:Host@4271,registry:Host@4491,registry:Host@4676,registry:Host@4778,registry:Host@5058,registry:Host@5120,registry:Host@5273,registry:Host@5312,registry:Host@6144,registry:Host@6238,whole:Route@1182,whole:Route@1417,whole:Route@194,whole:Route@2693,whole:Route@4324,whole:Route@5211,whole:Route@5370,whole:Route@758,whole:Route@856 075d65bdf24d08727704acd3f20a58eb56b6a593f44eab2f47f5cd9b4e0ea03b

-@legacy 938918d76a7828cc12d5c9246d672d4e48baee33edc6d4a063eacfaa0f72cbd6 internal/activator/backend_exec.go ExecBackend.waitRoleCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen waitSeedCgroupEmpty with the role as a parameter (seed or cmd); the agent waits on a unit it asked root to stop; no root decision registry:Host@302,registry:Host@347 3e6efa7123da935badb22b78db2b8ac96c03a259edbc3a2619c14e9d3fa3860f

-internal/activator/backend_exec.go ExecBackend.waitRoleCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen waitSeedCgroupEmpty with the role as a parameter (seed or cmd); the agent waits on a unit it asked root to stop; no root decision registry:Host@302,registry:Host@347 3e6efa7123da935badb22b78db2b8ac96c03a259edbc3a2619c14e9d3fa3860f

-@legacy 6789d78a085c29530f54fc02633782d92fc357ee93d3595454b96c6b28cc0e44 internal/activator/backend_exec.go ExecBackend.waitSeedCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its two Host reads moved, unchanged, into waitRoleCgroupEmpty whole:Route@125 b3518b1d0beeb19d97dd8d42ffb3fc43e8824a7d85a325e97e0fd1b0bad55585

-internal/activator/backend_exec.go ExecBackend.waitSeedCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its two Host reads moved, unchanged, into waitRoleCgroupEmpty whole:Route@125 b3518b1d0beeb19d97dd8d42ffb3fc43e8824a7d85a325e97e0fd1b0bad55585

-@legacy 433760f67c0bcf8a2d56da78928693a0272947b0614978f91a29e4bbdf60c99b internal/activator/backend_unit.go SplitBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): forwards a run's start to the exec half and refuses a unit-backed row; no root decision registry:Host@252,whole:Route@125,whole:Route@173 22f86731751264007ac43ea7e828d9491dbef025aa23f27338a097b40bed47a1

-internal/activator/backend_unit.go SplitBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): forwards a run's start to the exec half and refuses a unit-backed row; no root decision registry:Host@252,whole:Route@125,whole:Route@173 22f86731751264007ac43ea7e828d9491dbef025aa23f27338a097b40bed47a1

-@legacy 5c90ab945c2013714cd94ef33a113e3c7bdf74aaf5fd33f9be45a9248e9a3cab internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names file:Prepare@1670,file:Prepare@1704,registry:Host@1042,registry:Host@6676,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7276 2eeae4cc80aff44ba09f138a443281a58cf7b7309582b228210f007be20dbc29

-internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names file:Prepare@1670,file:Prepare@1704,registry:Host@1042,registry:Host@6676,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7276 2eeae4cc80aff44ba09f138a443281a58cf7b7309582b228210f007be20dbc29

-@legacy f1241d642d09b9bf3702eb563eee872b168b6b451a9056829a4b49af786af1b4 internal/activator/cmdunit.go ExecBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): writes launch.cmd.json in the instance's own directory and asks instance control to start the cmd unit; root validates the staged executable it names (refuseStagedExe) and decides the start registry:Host@1514,registry:Host@1638,registry:Host@1702,registry:Host@1825,registry:Host@1972,registry:Host@2126,registry:Host@218,registry:Host@2254,registry:Host@2342,registry:Host@2746,registry:Host@2815,registry:Host@2866,registry:Host@343,registry:Host@562,registry:Host@644,registry:Host@748,whole:Route@1298,whole:Route@130,whole:Route@1405,whole:Route@2024,whole:Route@2270,whole:Route@2358,whole:Route@2678,whole:Route@2682,whole:Route@275,whole:Route@2911,whole:Route@2915,whole:Route@384 04f120834c56628defe2cdb51a7ac2e209cb3cfd5d4a3c4d850f6111c520c36c

-internal/activator/cmdunit.go ExecBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): writes launch.cmd.json in the instance's own directory and asks instance control to start the cmd unit; root validates the staged executable it names (refuseStagedExe) and decides the start registry:Host@1514,registry:Host@1638,registry:Host@1702,registry:Host@1825,registry:Host@1972,registry:Host@2126,registry:Host@218,registry:Host@2254,registry:Host@2342,registry:Host@2746,registry:Host@2815,registry:Host@2866,registry:Host@343,registry:Host@562,registry:Host@644,registry:Host@748,whole:Route@1298,whole:Route@130,whole:Route@1405,whole:Route@2024,whole:Route@2270,whole:Route@2358,whole:Route@2678,whole:Route@2682,whole:Route@275,whole:Route@2911,whole:Route@2915,whole:Route@384 04f120834c56628defe2cdb51a7ac2e209cb3cfd5d4a3c4d850f6111c520c36c

-@legacy 3d6935d2d2e5c67f6e0adf471c36c0a9accaafcc7ed656b8e99543363eb059c9 internal/activator/cmdunit.go ExecBackend.cmdLayout legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): refuses a run on anything but the nested layout; agent-side refusal only whole:Route@114,whole:Route@138 c46e69297add3fdcd19f9401e2dc875cf20054ccbf5b22b7d1dc946a5de89a70

-internal/activator/cmdunit.go ExecBackend.cmdLayout legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): refuses a run on anything but the nested layout; agent-side refusal only whole:Route@114,whole:Route@138 c46e69297add3fdcd19f9401e2dc875cf20054ccbf5b22b7d1dc946a5de89a70

-@legacy b4270e73187eb05a072089b473081470b542180e367f2cd7696e687e189b1884 internal/activator/cmdunit.go ExecBackend.cmdVars legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): composes the command's environment over the serving generation's launch snapshot; the host comes from the row, never from a tenant file registry:Host@341 c9ef783dde10acb03cb56692660f9a6d256c515e48894bb2c09fb0dcd7231ebc

-internal/activator/cmdunit.go ExecBackend.cmdVars legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): composes the command's environment over the serving generation's launch snapshot; the host comes from the row, never from a tenant file registry:Host@341 c9ef783dde10acb03cb56692660f9a6d256c515e48894bb2c09fb0dcd7231ebc

-@legacy 7eab3254e6622c32384d391cceeb87ab840782eb1c208b8f2434b3e05ce6f833 internal/activator/cmdunit.go cmdUnit.Poll legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): a status read over the control socket; no decision registry:Host@112,whole:Route@114 563bd26c8e64505347c80f06528b8b72f0af55a901862cdf938be5d0d0a22c78

-internal/activator/cmdunit.go cmdUnit.Poll legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): a status read over the control socket; no decision registry:Host@112,whole:Route@114 563bd26c8e64505347c80f06528b8b72f0af55a901862cdf938be5d0d0a22c78

-@legacy d4fc0fa15595d4a4e2aa41645b779f7ea3650a79ae2c5a669589d480eff6cdca internal/activator/cmdunit.go cmdUnit.StopAndSettle legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): asks instance control to stop the unit, then waits; the agent keeps the lease until this is proven; no root decision registry:Host@255,whole:Route@257,whole:Route@424 711ba4a7cf317690f0279ad9098907cc8c37276542052245dc89b6b24eb7410c

-internal/activator/cmdunit.go cmdUnit.StopAndSettle legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): asks instance control to stop the unit, then waits; the agent keeps the lease until this is proven; no root decision registry:Host@255,whole:Route@257,whole:Route@424 711ba4a7cf317690f0279ad9098907cc8c37276542052245dc89b6b24eb7410c

-@legacy 3fc6172b5a80afb35e6578d6bef4d47080aab38c140a98cfee9843d1532cee1f internal/activator/cmdunit.go type CmdSpec legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): declaration only; Prepare is a callback field, not a prepared statement file:Prepare@487 cad374cb1f168f80afb84de87c5604d609e7cf0d4b327f2038a18cd659187d0c

-internal/activator/cmdunit.go type CmdSpec legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): declaration only; Prepare is a callback field, not a prepared statement file:Prepare@487 cad374cb1f168f80afb84de87c5604d609e7cf0d4b327f2038a18cd659187d0c

-@legacy c4621de9b0b0519938fc7683ae40afbc15bfb3646e54e200839f0accac04b936 internal/activator/opset.go Service.releasable legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle added to the termination proof; read sites unchanged whole:Route@174,whole:Route@297 1a8dcd7feb1839ba35d1cf174300f4e8c2847d0c44ef7902a39c995b93d87eef

-internal/activator/opset.go Service.releasable legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle added to the termination proof; read sites unchanged whole:Route@174,whole:Route@297 1a8dcd7feb1839ba35d1cf174300f4e8c2847d0c44ef7902a39c995b93d87eef

-@legacy 828d251d6abbecedec419bfdd606f1f8e9bc8eecaea70d52231c1690cdace154 internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its ReadDir and its Host and route reads moved, unchanged, into prepareKeyedAt whole:Route@227 61f70f635dfde7f43e297aab5ec37888ee6d4946ab1ce320de1a0fede49f7223

-internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its ReadDir and its Host and route reads moved, unchanged, into prepareKeyedAt whole:Route@227 61f70f635dfde7f43e297aab5ec37888ee6d4946ab1ce320de1a0fede49f7223

-@legacy 24d3f8c5bd716302ded4d9176fb6931d5ed3ee2886c0136162e84bbf8927594f internal/activator/prepare.go ExecBackend.prepareKeyedAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen prepareAt, which is now its wrapper; it also returns the instance key's layer and reads no env for the cmd role; same reads, same nested launch paths file:ReadDir@2287,registry:Host@1031,registry:Host@1149,registry:Host@1417,registry:Host@4373,registry:Host@4562,registry:Host@513,whole:Route@1227,whole:Route@1493,whole:Route@221,whole:Route@3501,whole:Route@3986,whole:Route@4407 a871c0510b7a0b1627fa83976b9a0265c3e6ddd0b07d37b2688951eea2e90acf

-internal/activator/prepare.go ExecBackend.prepareKeyedAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen prepareAt, which is now its wrapper; it also returns the instance key's layer and reads no env for the cmd role; same reads, same nested launch paths file:ReadDir@2287,registry:Host@1031,registry:Host@1149,registry:Host@1417,registry:Host@4373,registry:Host@4562,registry:Host@513,whole:Route@1227,whole:Route@1493,whole:Route@221,whole:Route@3501,whole:Route@3986,whole:Route@4407 a871c0510b7a0b1627fa83976b9a0265c3e6ddd0b07d37b2688951eea2e90acf

-@legacy fd2d366766f89696625c5340a48a771f1d6b5b8755d9440b9fb1d68597865648 internal/activator/recoveryprobe.go Service.finishRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@850 dbc0b4a8848f420321ac721ed77cf3fe8a8ec46255582a478d07d9dd75e23a77

-internal/activator/recoveryprobe.go Service.finishRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@850 dbc0b4a8848f420321ac721ed77cf3fe8a8ec46255582a478d07d9dd75e23a77

-@legacy c6e1305d2290eae841a46fd82b87f043a0f1e400fb0f762d2704c03a736b61e3 internal/activator/recoveryprobe.go Service.joinRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@1126 518662a23bb1a21d7aab64b268b24d16a19aec1ca5566138aeb0b1d8b3f1556b

-internal/activator/recoveryprobe.go Service.joinRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@1126 518662a23bb1a21d7aab64b268b24d16a19aec1ca5566138aeb0b1d8b3f1556b

-@legacy b15e3e4029b625c3943a730780e5092cb2d518de3ceadb62ab79a5c516c91fd8 internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@207,file:Read@379,registry:Socket@1673,registry:Socket@1834,whole:Route@1626,whole:Route@1675,whole:Route@1836 81086a6bb084a4d587f18ce3de91e4a18d4bc2e8a8719aae0d35a15c3506f341

-internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@207,file:Read@379,registry:Socket@1673,registry:Socket@1834,whole:Route@1626,whole:Route@1675,whole:Route@1836 81086a6bb084a4d587f18ce3de91e4a18d4bc2e8a8719aae0d35a15c3506f341

-@legacy 2a25e9d9ecdc789275c1e85eb364cd41b5e1d92a5191775305063d0adc38518b internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; admission and the switch refuse while a run's unit is starting, and the switch interrupts runs on the retiring generation; read sites unchanged, offsets moved registry:Kind@1902,whole:Route@10200,whole:Route@10207,whole:Route@10247,whole:Route@1904,whole:Route@2151,whole:Route@2996,whole:Route@3014,whole:Route@3609,whole:Route@3657,whole:Route@4172,whole:Route@5656,whole:Route@8367 25992cb1aa5419170f2ff837eb23029d8045a6436cdab4569bb89b923642450f

-internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; admission and the switch refuse while a run's unit is starting, and the switch interrupts runs on the retiring generation; read sites unchanged, offsets moved registry:Kind@1902,whole:Route@10200,whole:Route@10207,whole:Route@10247,whole:Route@1904,whole:Route@2151,whole:Route@2996,whole:Route@3014,whole:Route@3609,whole:Route@3657,whole:Route@4172,whole:Route@5656,whole:Route@8367 25992cb1aa5419170f2ff837eb23029d8045a6436cdab4569bb89b923642450f

-@legacy 1b7a74396f71e84876a08a921de953feb2823bd9eb6835a59c6bdf068a6f29e6 internal/activator/wakeplan.go Service.BounceFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@194 1bbdcf6a4960bfc6e8bbc4b4899ff041bf1a1d7926b1b59b04c433d65f919f1b

-internal/activator/wakeplan.go Service.BounceFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@194 1bbdcf6a4960bfc6e8bbc4b4899ff041bf1a1d7926b1b59b04c433d65f919f1b

-@legacy 9d94086cd73f437358f05992c07f750741a7ce79bf48f38125a35c9d96990c17 internal/activator/workerswap.go Service.ReplaceWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@2082 551b75677e29d3db600b1d186cbb0b316d4f8760eed59cdf66135ffc8a1b99be

-internal/activator/workerswap.go Service.ReplaceWorker legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@2082 551b75677e29d3db600b1d186cbb0b316d4f8760eed59cdf66135ffc8a1b99be

-@legacy 4df2f426620b75b072589629c9fa1a599b95a41b180ab3224651b8619c16702c internal/console/apiruns.go Server.handleAPIRunCreate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the run create door; it reads the record from the bucket and refuses an open run; no root decision file:Open@1346 0e4b06365efe529dc5f86f2cf174ac2642c413984c78fa197440b9ed8abed1d3

-internal/console/apiruns.go Server.handleAPIRunCreate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the run create door; it reads the record from the bucket and refuses an open run; no root decision file:Open@1346 0e4b06365efe529dc5f86f2cf174ac2642c413984c78fa197440b9ed8abed1d3

-@legacy 882fcf7cc6bd4c3f33e73ab9332a53eb32e735f1eb55b3ed33071bde74c85da1 internal/console/apiruns.go Server.writeRunObjects legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): uploads the files spoolRunFiles just wrote to the bucket; the paths are the console's own, never a caller's file:Open@327 228773cd5a10ea4772c60450956e7fe43d2bf741303b29217f5d241513165b06

-internal/console/apiruns.go Server.writeRunObjects legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): uploads the files spoolRunFiles just wrote to the bucket; the paths are the console's own, never a caller's file:Open@327 228773cd5a10ea4772c60450956e7fe43d2bf741303b29217f5d241513165b06

-@legacy 7a4d4fbc6f451572c87c96fb83a774c373de016a3714080198cf7342dac4587f internal/console/apiruns.go spoolRunFiles legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): spools each uploaded --file to a temp file while it is hashed and sized file:CreateTemp@438 3b303ed6fdecb8bdcc94c1e23de0f6532fcf2e82104495c0168a868eddd41f67

-internal/console/apiruns.go spoolRunFiles legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): spools each uploaded --file to a temp file while it is hashed and sized file:CreateTemp@438 3b303ed6fdecb8bdcc94c1e23de0f6532fcf2e82104495c0168a868eddd41f67

-@legacy 00df9faaad2487d18c9a26f66bb595866341fb95475211b130c50b82ae775899 internal/console/apirunsfollow.go Server.handleAPIRunAck legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the ack door; clears a finished run from the record by CAS file:Open@1149 463d44dd5efb9d3da3ced08712bf9107afed708a9e503ea327b4bd8b1c062452

-internal/console/apirunsfollow.go Server.handleAPIRunAck legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the ack door; clears a finished run from the record by CAS file:Open@1149 463d44dd5efb9d3da3ced08712bf9107afed708a9e503ea327b4bd8b1c062452

-@legacy 94cb630d314a6773bef2796de2d72e2a38bf414a5d9e758c923168f90b2e744f internal/console/apirunsfollow.go Server.handleAPIRunGet legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the follow door; pages a run's chunks and result from the bucket file:Query@169 81c22c2d1277a29f7e3bc5e2f818ad08b4bfc4fc12af02b8afe3f6b9e71ce900

-internal/console/apirunsfollow.go Server.handleAPIRunGet legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the follow door; pages a run's chunks and result from the bucket file:Query@169 81c22c2d1277a29f7e3bc5e2f818ad08b4bfc4fc12af02b8afe3f6b9e71ce900

-@legacy be86d994a81d62e4b2db0a3354676820ce6bf6aae6beeaf3179961212fbe8fc1 internal/console/apirunsfollow.go Server.runTransitionRefused legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): words a refused cancel, expire or ack from the record's run state file:Open@546 a9b5c170b403697393199c4727f4705e0162880df83cd246d82855804591a207

-internal/console/apirunsfollow.go Server.runTransitionRefused legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): words a refused cancel, expire or ack from the record's run state file:Open@546 a9b5c170b403697393199c4727f4705e0162880df83cd246d82855804591a207

-@legacy c95089e8c1ec06714bf84d0e8f167d5e779759369473c0563f688089b1be3977 internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the console's run sweep: expires queued runs and ends lost ones by CAS on the record file:Open@1399 e33e1833d207ea3873e2c410586aa53bb812cef9b55440adf17a93c9a0f52134

-internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the console's run sweep: expires queued runs and ends lost ones by CAS on the record file:Open@1399 e33e1833d207ea3873e2c410586aa53bb812cef9b55440adf17a93c9a0f52134

-internal/host/agent.go fastConvergeLoop authority B3 rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained whole:Route@8636,whole:Route@9199 9a279be19ff8609e17de1caa0b9dd75fa68af2e494dfd809b8e697ad32a753fc

-internal/host/agent.go runAgent authority B,C,D,F rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with armRunsPass called in the activator start's Configure step beside armMovesPass; registry, route, data-directory and backend inputs unchanged; main's B,C,D,F authority retained file:Exec@13674,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@21820 09b67e9f24e0937c2f02141fad96b475ec9469fd4a0edc4c30adf041d5606586

-@legacy e1cb0560459a37dab84e1fa92e06c73ec378ae59171675f15a677170361747da internal/host/runexec.go runsWorker.execute legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): runs one picked run to its result in the bucket; every root action goes through instance control file:Prepare@1838,whole:Route@2539 7667d92507de93fc1bfafcc4217271615d7eae4dab0700a6e7197d369dd1bc80

-internal/host/runexec.go runsWorker.execute legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): runs one picked run to its result in the bucket; every root action goes through instance control file:Prepare@1838,whole:Route@2539 7667d92507de93fc1bfafcc4217271615d7eae4dab0700a6e7197d369dd1bc80

-@legacy 497ca33daa602b8a5759d1ba86305fb1ee8733fc5adc73976ad471195f97d256 internal/host/runs.go newBootID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): mints the agent process's random boot id file:Read@56 69f45e3448abd77a5bf685bf7656c8d3b85de07baa9e4cecdbb41ca382a5af62

-internal/host/runs.go newBootID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): mints the agent process's random boot id file:Read@56 69f45e3448abd77a5bf685bf7656c8d3b85de07baa9e4cecdbb41ca382a5af62

-@legacy 59b3ddb9fd1d252badb6b605c212fe395c0fecf6fca457eb2f5a405913ceec35 internal/host/runs.go runsWorker.consider legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): acts on a record's run only for a row this box owns; agent-side whole:Route@267 e554387a45cc9bac6cc95c1d17f6580c3fff9e4b3c95a5141d9605753d235216

-internal/host/runs.go runsWorker.consider legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): acts on a record's run only for a row this box owns; agent-side whole:Route@267 e554387a45cc9bac6cc95c1d17f6580c3fff9e4b3c95a5141d9605753d235216

-@legacy 865885679b7e818b4c7a082f68c879ea0757ca223127aa5ec226a9d2a577f15e internal/host/runs.go runsWorker.owned legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): decides whether this box picks up a run; an agent-side choice that grants nothing: the pickup is a CAS on the record and root still validates the start registry:Account@155,registry:App@184,registry:Provisioned@137,whole:Route@123,whole:Route@234,whole:Route@285 e80bbc5dc99660f39a0b408e8d560e1eb8da999ba211e35831cb1b26f693cbc5

-internal/host/runs.go runsWorker.owned legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): decides whether this box picks up a run; an agent-side choice that grants nothing: the pickup is a CAS on the record and root still validates the start registry:Account@155,registry:App@184,registry:Provisioned@137,whole:Route@123,whole:Route@234,whole:Route@285 e80bbc5dc99660f39a0b408e8d560e1eb8da999ba211e35831cb1b26f693cbc5

-@legacy 1f3a33360d8d6ceefeb8fa42ba3bbabdd63cd4c1f172b4b7f9fa1d2bcb14c872 internal/host/runs.go runsWorker.pickup legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): picks the run by CAS on the record and starts its execution in the agent whole:Route@1350 d5f092e8a69d0c9907dbfb065b06f46895cb1eeafd2251009622923f797ee3b5

-internal/host/runs.go runsWorker.pickup legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): picks the run by CAS on the record and starts its execution in the agent whole:Route@1350 d5f092e8a69d0c9907dbfb065b06f46895cb1eeafd2251009622923f797ee3b5

-@legacy 80ff5fc80d233a38cea7034eaf76c9ac166e6c3f40f441803d692ad8b51e9bcf internal/host/units/carlos-instance-cmd@.service external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. the cmd unit template (applied by PID 1 as root; its process runs as carlos): a new unit file. It is the seed template (accepted-legacy on main, rev3=J4) outside seven lines, which a host test holds. The seven are the description, the start timeout, the two exec lines, the two output sockets and the executable bind sources file:external@0 65cbbd3cd72dacbddf93d2a371ab1623b90622f935271208367d3c03aa70800b

-internal/host/units/carlos-instance-cmd@.service external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. the cmd unit template (applied by PID 1 as root; its process runs as carlos): a new unit file. It is the seed template (accepted-legacy on main, rev3=J4) outside seven lines, which a host test holds. The seven are the description, the start timeout, the two exec lines, the two output sockets and the executable bind sources file:external@0 65cbbd3cd72dacbddf93d2a371ab1623b90622f935271208367d3c03aa70800b

-@legacy a2fffdf02667c9c26e359a24f19ddf3c286d456f66c8bfa235a39fb8a71f2a01 internal/instancectl/cmd.go Server.handleCmdStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed and new. Answers GET /cmd/{host} with the cmd unit's state; it starts and stops nothing. Proposed legacy only as its siblings on main are (parseRequest, handleParent: accepted-legacy, rev3=J2,J4) file:Query@246 18ee232cb0a406e76f6307145317790e8bd306a54fc64fcea98875bee8b55807

-internal/instancectl/cmd.go Server.handleCmdStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed and new. Answers GET /cmd/{host} with the cmd unit's state; it starts and stops nothing. Proposed legacy only as its siblings on main are (parseRequest, handleParent: accepted-legacy, rev3=J2,J4) file:Query@246 18ee232cb0a406e76f6307145317790e8bd306a54fc64fcea98875bee8b55807

-@legacy a508df6eb204bfcdd0dd76a9d1644607c4d6cfaac8fd41e41b4df5e0bb5798ed internal/instancectl/hardening.go ensureExeAs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed. Body of the frozen ensureExe (accepted-legacy, rev3=J2,J4) with the two source names as parameters, so a run's command gets cmd-app and cmd-live; ensureExe is now its wrapper. Same reads, same root-only directory file:Lstat@582,file:ReadDir@903 1535d31fb203d835e78306333331290521287540261af333e943ccbd338032ae

-internal/instancectl/hardening.go ensureExeAs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed. Body of the frozen ensureExe (accepted-legacy, rev3=J2,J4) with the two source names as parameters, so a run's command gets cmd-app and cmd-live; ensureExe is now its wrapper. Same reads, same root-only directory file:Lstat@582,file:ReadDir@903 1535d31fb203d835e78306333331290521287540261af333e943ccbd338032ae

-@legacy f26c5f1fcbca2386b27dbd63c241d485b02e9a9a02ff829992e9db026fd7d4ae internal/instancectl/server.go parseRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed, changed. Main's body (accepted-legacy, rev3=J2,J4) with the cmd role accepted on stop and reset and a staged executable accepted on the cmd verb; the executable is still validated by refuseStagedExe before anything is laid out file:Query@73 e46489a7f7429c538a594a9e52b762a4fbb6ac23b6677e30da1c8cebb95a595a

-internal/instancectl/server.go parseRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=NEEDS RULING. instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): root-executed, changed. Main's body (accepted-legacy, rev3=J2,J4) with the cmd role accepted on stop and reset and a staged executable accepted on the cmd verb; the executable is still validated by refuseStagedExe before anything is laid out file:Query@73 e46489a7f7429c538a594a9e52b762a4fbb6ac23b6677e30da1c8cebb95a595a

-internal/instancectl/server.go type Server diagnostic H3 rev3=PROPOSED-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): the struct gains the cmd start's poll and wait bounds and its per-host lock map; declaration only, as main ruled it file:Statfs@2708 82bbe54e035edd5fafc46a0ba44a88c7283f28f47f45fa6dfda35bb9dcfb8ff1

-@legacy 36061fc18bff0a663a3279afd546ee9078cb92ae9f7ed889bd80ccb7192b70ce internal/instancefs/dirs_linux.go removeAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): reached only through RemoveAllBeneath from internal/runs (staging cleanup, RemoveRunDir, SweepRunDirs), all in the agent's runs worker; removes a run's own directory without following a link file:Fstatat@187,file:Openat@600,file:Readdirnames@822 d40cfdfa591b7e9df45b2002a64a5d7d32a6cccb215b8386a07cad435fe0bb81

-internal/instancefs/dirs_linux.go removeAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): reached only through RemoveAllBeneath from internal/runs (staging cleanup, RemoveRunDir, SweepRunDirs), all in the agent's runs worker; removes a run's own directory without following a link file:Fstatat@187,file:Openat@600,file:Readdirnames@822 d40cfdfa591b7e9df45b2002a64a5d7d32a6cccb215b8386a07cad435fe0bb81

-@legacy 11a3cf6ae29b4ef81f01d9ae2ca318337e417c2886a44c6c811ce8ecd67798ee internal/provision/provision.go MoveRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a record transition the console's move door runs; it now refuses a move while a run is open file:Open@104 a71c79d06b66ebdbe8b3c7841d8fd03809dfb965dee5d4f7d243a2ef3e6da780

-internal/provision/provision.go MoveRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a record transition the console's move door runs; it now refuses a move while a run is open file:Open@104 a71c79d06b66ebdbe8b3c7841d8fd03809dfb965dee5d4f7d243a2ef3e6da780

-@legacy 56a0cbce5889f48122051a375ae576361ff6b908fc108833713b78210ae4099b internal/provision/provision.go MoveStartTransition legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a record transition the console's move door runs, directly and through hostops.StartClaimMoveRecord; it now refuses a move while a run is open file:Open@99 73ff37df4e54a9fac3468a14febb50045f078e66cd990c50590f50635e5d3e8f

-internal/provision/provision.go MoveStartTransition legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a record transition the console's move door runs, directly and through hostops.StartClaimMoveRecord; it now refuses a move while a run is open file:Open@99 73ff37df4e54a9fac3468a14febb50045f078e66cd990c50590f50635e5d3e8f

-@legacy 2d62066ebe606583958d80e272996a2530d78ffa22cf893a5d986dbe43c585ab internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with one RunSeen call on each in-scope record that carries a run; the reads are unchanged and nothing is written registry:Account@17413,registry:Account@18505,registry:Account@31221,registry:Account@31267,registry:App@17386,registry:App@18478,registry:App@31241,registry:App@31279,registry:ClaimOwnership@18000,registry:DBPath@23332,registry:DBPath@23347,registry:DBPath@23593,registry:DBPath@24124,registry:DBPath@24137,registry:Gate@21141,registry:Gate@21281,registry:Gate@21546,registry:Hibernate@20119,registry:Hibernate@20437,registry:Hibernate@20788,registry:Hibernate@21076,registry:Host@12707,registry:Host@31199,registry:Host@31367,registry:Host@31482,registry:Host@31827,registry:Host@31924,registry:Host@32060,registry:Host@32218,registry:Host@32320,registry:Kind@18142,registry:Kind@18405,registry:Kind@23250,registry:Kind@23263,registry:Kind@23373,registry:Kind@23386,registry:Kind@24035,registry:Kind@24046,registry:Kind@30435,registry:Kind@32051,registry:Kind@32209,registry:Kind@32311,registry:Pool@30527,registry:Provisioned@17362,registry:Provisioned@18454,registry:Provisioned@30485,registry:Region@30516,registry:Replication@20522,registry:Replication@20649,registry:Seed@21752,registry:Socket@23298,registry:Socket@23313,registry:Socket@23610,registry:Socket@24094,registry:Socket@24107,registry:Unit@23216,registry:Unit@23229,registry:Unit@24061,registry:Unit@24072,whole:ClaimOwnership@18003,whole:ClaimOwnership@18020,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13271,whole:Route@14020,whole:Route@14376,whole:Route@14385,whole:Route@14431,whole:Route@17007,whole:Route@17478,whole:Route@17488,whole:Route@17845,whole:Route@17852,whole:Route@17920,whole:Route@18243,whole:Route@18886,whole:Route@20209,whole:Route@23442,whole:Route@24921,whole:Route@24966,whole:Route@24976,whole:Route@25839,whole:Route@26591,whole:Route@29883,whole:Route@30552,whole:Route@32131 fb5dce248023ff696af058ad675bc4ec13a8f5641bffb66c3318825f1b28b4d2

-internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with one RunSeen call on each in-scope record that carries a run; the reads are unchanged and nothing is written registry:Account@17413,registry:Account@18505,registry:Account@31221,registry:Account@31267,registry:App@17386,registry:App@18478,registry:App@31241,registry:App@31279,registry:ClaimOwnership@18000,registry:DBPath@23332,registry:DBPath@23347,registry:DBPath@23593,registry:DBPath@24124,registry:DBPath@24137,registry:Gate@21141,registry:Gate@21281,registry:Gate@21546,registry:Hibernate@20119,registry:Hibernate@20437,registry:Hibernate@20788,registry:Hibernate@21076,registry:Host@12707,registry:Host@31199,registry:Host@31367,registry:Host@31482,registry:Host@31827,registry:Host@31924,registry:Host@32060,registry:Host@32218,registry:Host@32320,registry:Kind@18142,registry:Kind@18405,registry:Kind@23250,registry:Kind@23263,registry:Kind@23373,registry:Kind@23386,registry:Kind@24035,registry:Kind@24046,registry:Kind@30435,registry:Kind@32051,registry:Kind@32209,registry:Kind@32311,registry:Pool@30527,registry:Provisioned@17362,registry:Provisioned@18454,registry:Provisioned@30485,registry:Region@30516,registry:Replication@20522,registry:Replication@20649,registry:Seed@21752,registry:Socket@23298,registry:Socket@23313,registry:Socket@23610,registry:Socket@24094,registry:Socket@24107,registry:Unit@23216,registry:Unit@23229,registry:Unit@24061,registry:Unit@24072,whole:ClaimOwnership@18003,whole:ClaimOwnership@18020,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13271,whole:Route@14020,whole:Route@14376,whole:Route@14385,whole:Route@14431,whole:Route@17007,whole:Route@17478,whole:Route@17488,whole:Route@17845,whole:Route@17852,whole:Route@17920,whole:Route@18243,whole:Route@18886,whole:Route@20209,whole:Route@23442,whole:Route@24921,whole:Route@24966,whole:Route@24976,whole:Route@25839,whole:Route@26591,whole:Route@29883,whole:Route@30552,whole:Route@32131 fb5dce248023ff696af058ad675bc4ec13a8f5641bffb66c3318825f1b28b4d2

-@legacy 5fb001777b8c2eddb59c63614844f4a054991bf4ce6c1301fc09c070dd075834 internal/provision/run.go RunAdmit legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the record transition the console's run create door runs file:Open@257 2ba6caac7b67f779695227a0ad636b308d5b80853a65a0fabc5cde9c13ae5607

-internal/provision/run.go RunAdmit legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): the record transition the console's run create door runs file:Open@257 2ba6caac7b67f779695227a0ad636b308d5b80853a65a0fabc5cde9c13ae5607

-@legacy b910b667f2fcc7fc8eff4115190ba7a8d1af460d048ee8ef19e167971f455c9c internal/provision/run.go RunState.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a pure predicate on a record's run state, called by the console's doors and sweep and by the transitions above file:Open@19 d22e3386cd7079e6bf2ec7110eef2466f48a0d0ef63febf0ff6bdf5a4ec1aa05

-internal/provision/run.go RunState.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the console (cmd/console serve under console.service, its own service user): a pure predicate on a record's run state, called by the console's doors and sweep and by the transitions above file:Open@19 d22e3386cd7079e6bf2ec7110eef2466f48a0d0ef63febf0ff6bdf5a4ec1aa05

-@legacy 05ac418ae15f672efcdf9168e45c395148e9abb260ba7d6e3ceea383d477b6da internal/runs/stage.go SweepRunDirs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the runs worker's boot pass removes run directories no open run owns, beneath each instance's own directory file:ReadDir@101 3c469bec8c6ec91936dff0dd18ca6708d30147c1f30c826ebbb02e0bafaa535c

-internal/runs/stage.go SweepRunDirs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the runs worker's boot pass removes run directories no open run owns, beneath each instance's own directory file:ReadDir@101 3c469bec8c6ec91936dff0dd18ca6708d30147c1f30c826ebbb02e0bafaa535c

-@legacy 61d21571b4b74b47cdb3f16e6cd864d6af72e090af4c5b2faed6cd6d9d66e5fc run.go copyRunFilePart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): checks the file did not change size while it was uploaded file:Stat@113,file:Stat@598 4597e1729a93910ef618eca234a77e68563693abf65526328d9ab0bfe1828ed4

-run.go copyRunFilePart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): checks the file did not change size while it was uploaded file:Stat@113,file:Stat@598 4597e1729a93910ef618eca234a77e68563693abf65526328d9ab0bfe1828ed4

-@legacy 3dee2d08890d929f0f977922d4e0c241ffddd74a3d2d79fc26180c0f0738f9c2 run.go runMetaFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): builds the run request's file list file:Stat@162 6cd58b0235d2f0b535ecfd190eff7588261564e0639a24a24249b0e93fda2ce9

-run.go runMetaFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): builds the run request's file list file:Stat@162 6cd58b0235d2f0b535ecfd190eff7588261564e0639a24a24249b0e93fda2ce9

-@legacy 006fb64725dfb1b8019ff0dab578c577e50cb65c28af5caaddc1505051563936 run.go type runFileHandle legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): declaration only file:Stat@43 52f66acacaa48c28cb8b5abed11f8af36ca41ec80669272000dbb88faa47c07e

-run.go type runFileHandle legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): declaration only file:Stat@43 52f66acacaa48c28cb8b5abed11f8af36ca41ec80669272000dbb88faa47c07e

-@legacy 717b2c8d8960403a4f3081d01896d44b0eedadd86757aa9f5fcb851d00715f62 run.go writeRunFilePart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): streams one --file into the multipart request file:Open@96 61b956d3287c8d72686390effe589e584d928a2947414a80d6a4b5d784f0341d

-run.go writeRunFilePart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): streams one --file into the multipart request file:Open@96 61b956d3287c8d72686390effe589e584d928a2947414a80d6a4b5d784f0341d

+# Plan 14 census ruling carlos-run (Plan 14 controller, 2026-10-14): the carlos-run branch's overlay (carlos run, #259). Code that runs only as the agent (carlos), the console (carlos-console) or the CLI on a person's machine, and makes no root decision, is accepted legacy; each basis names the executing identity.

+# The four instance-control rows (handleCmdStatus, ensureExeAs, parseRequest and the cmd unit file) are accepted legacy because they extend the J4 seed pattern to the run role. That ruling is CONDITIONAL on two things: the template-equality test stays (TestCmdTemplateEqualsSeedOutsideTheNamedLines), and the cmd verb stays on refuseStagedExe. If either diverges, those rows need a new ruling.

+# The root-executed run code the scanner gives no row (handleCmd, cleanCmdExe, ensureCmdExeAt, removeCmdExe, and the changed Handler, handleStop, handleReset and handleSweep) is noted by the ruling and pinned by the internal/instancectl envelope. Earlier overlays are immutable.

+@legacy 49d62a0659f47a38f7805ef396254be16a123fc56878e8dd2581ccf90a133bc6 apimode.go apiSession.getJSONHeader legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): body of the frozen apiSession.getJSON, which is now its wrapper; it also returns the response header (the run follow's Retry-After) file:ReadAll@590 e5897a162e1e42a3ffb0904a80e2ef95464c221018ed92444dc384270fe5f49a

+apimode.go apiSession.getJSONHeader legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): body of the frozen apiSession.getJSON, which is now its wrapper; it also returns the response header (the run follow's Retry-After) file:ReadAll@590 e5897a162e1e42a3ffb0904a80e2ef95464c221018ed92444dc384270fe5f49a

+@legacy 9baa346c72279d5235e8d97691f2fc7ce677b4ac8a904229335d4405467bda55 cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the run sweep started beside the other claim workers; read sites unchanged data-literal@2918,data-literal@4019 d55fd5881179c0ffef47d5becbd69f281d74ed863ade9c908f0c486f275063cc

+cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): main's body with the run sweep started beside the other claim workers; read sites unchanged data-literal@2918,data-literal@4019 d55fd5881179c0ffef47d5becbd69f281d74ed863ade9c908f0c486f275063cc

+@legacy 3f92107c64886ba640e006a99c38c80513cf5c4acb7799ff5dea946326b89158 internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@259,registry:Host@333 e28b89f9c3fb96d60604d0fcaf8b9442c18919c77acb28eb2ea251d372792ac1

+internal/activator/activator.go Service.BeginSidecarRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@259,registry:Host@333 e28b89f9c3fb96d60604d0fcaf8b9442c18919c77acb28eb2ea251d372792ac1

+@legacy 26a81314daa5da0bb1769205fc31323ab348b8a31bda222b85497604d09e09c1 internal/activator/activator.go Service.SleepWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Hibernate@169,whole:Route@171,whole:Route@329 6cefa104c59657f49962c4d026d2eb775a3d65542c392adf08a089d4fcd27e44

+internal/activator/activator.go Service.SleepWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Hibernate@169,whole:Route@171,whole:Route@329 6cefa104c59657f49962c4d026d2eb775a3d65542c392adf08a089d4fcd27e44

+@legacy 92acc0df89e8aa4cc7e810a21d2e22a8a4351ef3552911657a64b807633db1ca internal/activator/activator.go Service.WakeWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1242,registry:Host@1652,registry:Host@834,registry:Host@864,whole:Route@1225 30d0eaa5a884e0c9af935e9e1bbaf1a177c4d77c83ad190789bbb667383f7cd9

+internal/activator/activator.go Service.WakeWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1242,registry:Host@1652,registry:Host@834,registry:Host@864,whole:Route@1225 30d0eaa5a884e0c9af935e9e1bbaf1a177c4d77c83ad190789bbb667383f7cd9

+@legacy 0bc88087837e41659bf706617ea9dd54d277fc0f0ebffb6896ac3bbe88f645ba internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1197,registry:Host@1276,registry:Host@326,registry:Host@405,whole:Route@1206,whole:Route@1213 b051166b0d24cb2c889fa3b4705b838aea14efa4b5c8056462eaed88cbf2c7db

+internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Host@1197,registry:Host@1276,registry:Host@326,registry:Host@405,whole:Route@1206,whole:Route@1213 b051166b0d24cb2c889fa3b4705b838aea14efa4b5c8056462eaed88cbf2c7db

+@legacy 52f2768948c06e3509a5929549ba3d6cde3f45263d5e27b0dbd579d0c4e86ed3 internal/activator/activator.go Service.bounceLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@290 79e4c090b1fd161fe97fd3d68815c649937144c83f275b827c490a9cd93d04a0

+internal/activator/activator.go Service.bounceLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@290 79e4c090b1fd161fe97fd3d68815c649937144c83f275b827c490a9cd93d04a0

+@legacy 2f21d32ab1999ab7615b05a71ddb37cdfcd6c2e6dd5cab32965b2c8d8cf02483 internal/activator/activator.go Service.finishStop legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle checked before replication closes, which keeps the stop pending until the run is proven stopped; read sites unchanged, offsets moved registry:Socket@1775,registry:Socket@1880,whole:Route@1725,whole:Route@1777,whole:Route@1882 28b1c796724636ab314c9004ef1b756868b8b23c9275ef4f1f33a6a73a4ca575

+internal/activator/activator.go Service.finishStop legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle checked before replication closes, which keeps the stop pending until the run is proven stopped; read sites unchanged, offsets moved registry:Socket@1775,registry:Socket@1880,whole:Route@1725,whole:Route@1777,whole:Route@1882 28b1c796724636ab314c9004ef1b756868b8b23c9275ef4f1f33a6a73a4ca575

+@legacy 542e0217b6772f180fa4faaeb01d550544ff5c2647014d17a18169c83865f274 internal/activator/activator.go Service.respawnWorkerLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@11677,whole:Route@13183,whole:Route@209,whole:Route@4013,whole:Route@6006,whole:Route@6187 28902e42ad7049868521abe4a631f7ba974acb8d38240a5eedc125f1ad519cad

+internal/activator/activator.go Service.respawnWorkerLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@11677,whole:Route@13183,whole:Route@209,whole:Route@4013,whole:Route@6006,whole:Route@6187 28902e42ad7049868521abe4a631f7ba974acb8d38240a5eedc125f1ad519cad

+@legacy 48493a98214dac7c995cccc8ce50d46042e9f6b4cb1e597fec5a5f9c16b268d3 internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the idle check skips an entry with a run attached and each stop carries its reason; read sites unchanged, offsets moved registry:Hibernate@11895,registry:Hibernate@21066,registry:Hibernate@4810,registry:Hibernate@6480,registry:Hibernate@8886,registry:Host@21135,registry:Host@21193,registry:Host@21586,registry:Host@22317,registry:Host@22399,registry:Host@23464,registry:Host@23643,registry:Host@23692,registry:NextDue@22272,registry:Status@21082,whole:Route@11897,whole:Route@13830,whole:Route@15540,whole:Route@15730,whole:Route@16023,whole:Route@16195,whole:Route@16342,whole:Route@20553,whole:Route@21986,whole:Route@22326,whole:Route@22333,whole:Route@23279,whole:Route@23676,whole:Route@4812,whole:Route@6482,whole:Route@8888 1cbdb78664b6a77baf8ba2b92cf77d09e02a839f48f12df07c86c61ec1a1dd6e

+internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the idle check skips an entry with a run attached and each stop carries its reason; read sites unchanged, offsets moved registry:Hibernate@11895,registry:Hibernate@21066,registry:Hibernate@4810,registry:Hibernate@6480,registry:Hibernate@8886,registry:Host@21135,registry:Host@21193,registry:Host@21586,registry:Host@22317,registry:Host@22399,registry:Host@23464,registry:Host@23643,registry:Host@23692,registry:NextDue@22272,registry:Status@21082,whole:Route@11897,whole:Route@13830,whole:Route@15540,whole:Route@15730,whole:Route@16023,whole:Route@16195,whole:Route@16342,whole:Route@20553,whole:Route@21986,whole:Route@22326,whole:Route@22333,whole:Route@23279,whole:Route@23676,whole:Route@4812,whole:Route@6482,whole:Route@8888 1cbdb78664b6a77baf8ba2b92cf77d09e02a839f48f12df07c86c61ec1a1dd6e

+@legacy da60ee510c40bf75874d3afd0439e3ed123b2fc578e0ef7dcc5982604a4592ec internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Socket@6616,registry:Socket@6777,whole:Route@1900,whole:Route@1957,whole:Route@5153,whole:Route@6569,whole:Route@6618,whole:Route@6779,whole:Route@8114,whole:Route@8135 8aae86c7d00daf2d5bbeb6f2e18203201a0a96fdade34b354994edbc2ba58434

+internal/activator/activator.go Service.wake legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved registry:Socket@6616,registry:Socket@6777,whole:Route@1900,whole:Route@1957,whole:Route@5153,whole:Route@6569,whole:Route@6618,whole:Route@6779,whole:Route@8114,whole:Route@8135 8aae86c7d00daf2d5bbeb6f2e18203201a0a96fdade34b354994edbc2ba58434

+@legacy a14eb6ffce172faec9ebe06e5ebda85aa86803e4972265cc8f2d01e6eeecdf55 internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; it calls prepareKeyedAt and keeps the launch environment and its key layer on the generation's handle; read sites unchanged, offsets moved registry:Host@1071,registry:Host@1488,registry:Host@1591,registry:Host@2009,registry:Host@2489,registry:Host@3415,registry:Host@4001,registry:Host@4271,registry:Host@4491,registry:Host@4676,registry:Host@4778,registry:Host@5058,registry:Host@5120,registry:Host@5273,registry:Host@5312,registry:Host@6144,registry:Host@6238,whole:Route@1182,whole:Route@1417,whole:Route@194,whole:Route@2693,whole:Route@4324,whole:Route@5211,whole:Route@5370,whole:Route@758,whole:Route@856 075d65bdf24d08727704acd3f20a58eb56b6a593f44eab2f47f5cd9b4e0ea03b

+internal/activator/backend_exec.go ExecBackend.spawnUnitFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; it calls prepareKeyedAt and keeps the launch environment and its key layer on the generation's handle; read sites unchanged, offsets moved registry:Host@1071,registry:Host@1488,registry:Host@1591,registry:Host@2009,registry:Host@2489,registry:Host@3415,registry:Host@4001,registry:Host@4271,registry:Host@4491,registry:Host@4676,registry:Host@4778,registry:Host@5058,registry:Host@5120,registry:Host@5273,registry:Host@5312,registry:Host@6144,registry:Host@6238,whole:Route@1182,whole:Route@1417,whole:Route@194,whole:Route@2693,whole:Route@4324,whole:Route@5211,whole:Route@5370,whole:Route@758,whole:Route@856 075d65bdf24d08727704acd3f20a58eb56b6a593f44eab2f47f5cd9b4e0ea03b

+@legacy e17c024e736888465f01caadf567834ceaa99240653bcf42548bad1f5eb1f012 internal/activator/backend_exec.go ExecBackend.waitRoleCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen waitSeedCgroupEmpty with the role as a parameter (seed or cmd); the agent waits on a unit it asked root to stop; no root decision registry:Host@302,registry:Host@347 3e6efa7123da935badb22b78db2b8ac96c03a259edbc3a2619c14e9d3fa3860f

+internal/activator/backend_exec.go ExecBackend.waitRoleCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen waitSeedCgroupEmpty with the role as a parameter (seed or cmd); the agent waits on a unit it asked root to stop; no root decision registry:Host@302,registry:Host@347 3e6efa7123da935badb22b78db2b8ac96c03a259edbc3a2619c14e9d3fa3860f

+@legacy 7c4bc81c3eeea089a8be16165772b2b97d50e02cd5d9a94cbe2396e6ed3f0866 internal/activator/backend_exec.go ExecBackend.waitSeedCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its two Host reads moved, unchanged, into waitRoleCgroupEmpty whole:Route@125 b3518b1d0beeb19d97dd8d42ffb3fc43e8824a7d85a325e97e0fd1b0bad55585

+internal/activator/backend_exec.go ExecBackend.waitSeedCgroupEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its two Host reads moved, unchanged, into waitRoleCgroupEmpty whole:Route@125 b3518b1d0beeb19d97dd8d42ffb3fc43e8824a7d85a325e97e0fd1b0bad55585

+@legacy c98d6f74d626ce4d297be5101291bf802e384aca4a93658dd113945c892a45d6 internal/activator/backend_unit.go SplitBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): forwards a run's start to the exec half and refuses a unit-backed row; no root decision registry:Host@252,whole:Route@125,whole:Route@173 22f86731751264007ac43ea7e828d9491dbef025aa23f27338a097b40bed47a1

+internal/activator/backend_unit.go SplitBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): forwards a run's start to the exec half and refuses a unit-backed row; no root decision registry:Host@252,whole:Route@125,whole:Route@173 22f86731751264007ac43ea7e828d9491dbef025aa23f27338a097b40bed47a1

+@legacy 7e74f82ef26b39ad3878b44f1bd8a382593ba8749172249979cc687a886f8de4 internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names file:Prepare@1670,file:Prepare@1704,registry:Host@1042,registry:Host@6676,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7276 2eeae4cc80aff44ba09f138a443281a58cf7b7309582b228210f007be20dbc29

+internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names file:Prepare@1670,file:Prepare@1704,registry:Host@1042,registry:Host@6676,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7276 2eeae4cc80aff44ba09f138a443281a58cf7b7309582b228210f007be20dbc29

+@legacy 8a4ffed94c09c5eade8911596344135ae148563d229ba36f926005d43748540f internal/activator/cmdunit.go ExecBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): writes launch.cmd.json in the instance's own directory and asks instance control to start the cmd unit; root validates the staged executable it names (refuseStagedExe) and decides the start registry:Host@1514,registry:Host@1638,registry:Host@1702,registry:Host@1825,registry:Host@1972,registry:Host@2126,registry:Host@218,registry:Host@2254,registry:Host@2342,registry:Host@2746,registry:Host@2815,registry:Host@2866,registry:Host@343,registry:Host@562,registry:Host@644,registry:Host@748,whole:Route@1298,whole:Route@130,whole:Route@1405,whole:Route@2024,whole:Route@2270,whole:Route@2358,whole:Route@2678,whole:Route@2682,whole:Route@275,whole:Route@2911,whole:Route@2915,whole:Route@384 04f120834c56628defe2cdb51a7ac2e209cb3cfd5d4a3c4d850f6111c520c36c

+internal/activator/cmdunit.go ExecBackend.StartCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): writes launch.cmd.json in the instance's own directory and asks instance control to start the cmd unit; root validates the staged executable it names (refuseStagedExe) and decides the start registry:Host@1514,registry:Host@1638,registry:Host@1702,registry:Host@1825,registry:Host@1972,registry:Host@2126,registry:Host@218,registry:Host@2254,registry:Host@2342,registry:Host@2746,registry:Host@2815,registry:Host@2866,registry:Host@343,registry:Host@562,registry:Host@644,registry:Host@748,whole:Route@1298,whole:Route@130,whole:Route@1405,whole:Route@2024,whole:Route@2270,whole:Route@2358,whole:Route@2678,whole:Route@2682,whole:Route@275,whole:Route@2911,whole:Route@2915,whole:Route@384 04f120834c56628defe2cdb51a7ac2e209cb3cfd5d4a3c4d850f6111c520c36c

+@legacy d1a1aaf29b5385f697045520a9a80e645f46d79f82fbd52061765b2ab106e3b8 internal/activator/cmdunit.go ExecBackend.cmdLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): refuses a run on anything but the nested layout; agent-side refusal only whole:Route@114,whole:Route@138 c46e69297add3fdcd19f9401e2dc875cf20054ccbf5b22b7d1dc946a5de89a70

+internal/activator/cmdunit.go ExecBackend.cmdLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): refuses a run on anything but the nested layout; agent-side refusal only whole:Route@114,whole:Route@138 c46e69297add3fdcd19f9401e2dc875cf20054ccbf5b22b7d1dc946a5de89a70

+@legacy bb0129c7bd242a4f4d28555232d655d8e3f9819d742c82c251bc30841bee93cb internal/activator/cmdunit.go ExecBackend.cmdVars legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): composes the command's environment over the serving generation's launch snapshot; the host comes from the row, never from a tenant file registry:Host@341 c9ef783dde10acb03cb56692660f9a6d256c515e48894bb2c09fb0dcd7231ebc

+internal/activator/cmdunit.go ExecBackend.cmdVars legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): composes the command's environment over the serving generation's launch snapshot; the host comes from the row, never from a tenant file registry:Host@341 c9ef783dde10acb03cb56692660f9a6d256c515e48894bb2c09fb0dcd7231ebc

+@legacy 222a29bf41282ccb908fa148e1e00eb57e66c0bb5c5fd503be4186ea5d1a8a19 internal/activator/cmdunit.go cmdUnit.Poll legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): a status read over the control socket; no decision registry:Host@112,whole:Route@114 563bd26c8e64505347c80f06528b8b72f0af55a901862cdf938be5d0d0a22c78

+internal/activator/cmdunit.go cmdUnit.Poll legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): a status read over the control socket; no decision registry:Host@112,whole:Route@114 563bd26c8e64505347c80f06528b8b72f0af55a901862cdf938be5d0d0a22c78

+@legacy b15487d0c79c50ce90ef55f35de287c8d916861eb6274657edbc98b797368a0e internal/activator/cmdunit.go cmdUnit.StopAndSettle legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): asks instance control to stop the unit, then waits; the agent keeps the lease until this is proven; no root decision registry:Host@255,whole:Route@257,whole:Route@424 711ba4a7cf317690f0279ad9098907cc8c37276542052245dc89b6b24eb7410c

+internal/activator/cmdunit.go cmdUnit.StopAndSettle legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): asks instance control to stop the unit, then waits; the agent keeps the lease until this is proven; no root decision registry:Host@255,whole:Route@257,whole:Route@424 711ba4a7cf317690f0279ad9098907cc8c37276542052245dc89b6b24eb7410c

+@legacy 7eb240202d14daba60b29db6a5b265d34c029aa738cdcf80aab2da2d031a6942 internal/activator/cmdunit.go type CmdSpec legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): declaration only; Prepare is a callback field, not a prepared statement file:Prepare@487 cad374cb1f168f80afb84de87c5604d609e7cf0d4b327f2038a18cd659187d0c

+internal/activator/cmdunit.go type CmdSpec legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): declaration only; Prepare is a callback field, not a prepared statement file:Prepare@487 cad374cb1f168f80afb84de87c5604d609e7cf0d4b327f2038a18cd659187d0c

+@legacy 4841aba4244fda46261b0e67538a1d6b88955d28934ad3c6f56c3fb8c5d9c952 internal/activator/opset.go Service.releasable legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle added to the termination proof; read sites unchanged whole:Route@174,whole:Route@297 1a8dcd7feb1839ba35d1cf174300f4e8c2847d0c44ef7902a39c995b93d87eef

+internal/activator/opset.go Service.releasable legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with a run's settle added to the termination proof; read sites unchanged whole:Route@174,whole:Route@297 1a8dcd7feb1839ba35d1cf174300f4e8c2847d0c44ef7902a39c995b93d87eef

+@legacy 0fde36cf3db4ab25ea25c7045769e467efc5278209f7ee361213b9da71a247e1 internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its ReadDir and its Host and route reads moved, unchanged, into prepareKeyedAt whole:Route@227 61f70f635dfde7f43e297aab5ec37888ee6d4946ab1ce320de1a0fede49f7223

+internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): now a wrapper: its ReadDir and its Host and route reads moved, unchanged, into prepareKeyedAt whole:Route@227 61f70f635dfde7f43e297aab5ec37888ee6d4946ab1ce320de1a0fede49f7223

+@legacy 64132876da72ea155c61093c595249045b7d8ed8d50b6d7fd8c47bfe30ae47e3 internal/activator/prepare.go ExecBackend.prepareKeyedAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen prepareAt, which is now its wrapper; it also returns the instance key's layer and reads no env for the cmd role; same reads, same nested launch paths file:ReadDir@2287,registry:Host@1031,registry:Host@1149,registry:Host@1417,registry:Host@4373,registry:Host@4562,registry:Host@513,whole:Route@1227,whole:Route@1493,whole:Route@221,whole:Route@3501,whole:Route@3986,whole:Route@4407 a871c0510b7a0b1627fa83976b9a0265c3e6ddd0b07d37b2688951eea2e90acf

+internal/activator/prepare.go ExecBackend.prepareKeyedAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): body of the frozen prepareAt, which is now its wrapper; it also returns the instance key's layer and reads no env for the cmd role; same reads, same nested launch paths file:ReadDir@2287,registry:Host@1031,registry:Host@1149,registry:Host@1417,registry:Host@4373,registry:Host@4562,registry:Host@513,whole:Route@1227,whole:Route@1493,whole:Route@221,whole:Route@3501,whole:Route@3986,whole:Route@4407 a871c0510b7a0b1627fa83976b9a0265c3e6ddd0b07d37b2688951eea2e90acf

+@legacy 0b248501583aaa9d65cb3958d89b955f53ece40ede9bf5d2beaf4d66766cf77c internal/activator/recoveryprobe.go Service.finishRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@850 dbc0b4a8848f420321ac721ed77cf3fe8a8ec46255582a478d07d9dd75e23a77

+internal/activator/recoveryprobe.go Service.finishRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@850 dbc0b4a8848f420321ac721ed77cf3fe8a8ec46255582a478d07d9dd75e23a77

+@legacy 0d6868f32e3f6533ea86b5fa3811a1fddbcbd5994545261fce79d10df6cdd409 internal/activator/recoveryprobe.go Service.joinRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@1126 518662a23bb1a21d7aab64b268b24d16a19aec1ca5566138aeb0b1d8b3f1556b

+internal/activator/recoveryprobe.go Service.joinRecoveryProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@1126 518662a23bb1a21d7aab64b268b24d16a19aec1ca5566138aeb0b1d8b3f1556b

+@legacy 92e6f567006eab4a4b310abf71309e9b449eb83347407dd00259c3db0fb09a15 internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@207,file:Read@379,registry:Socket@1673,registry:Socket@1834,whole:Route@1626,whole:Route@1675,whole:Route@1836 81086a6bb084a4d587f18ce3de91e4a18d4bc2e8a8719aae0d35a15c3506f341

+internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved file:Read@207,file:Read@379,registry:Socket@1673,registry:Socket@1834,whole:Route@1626,whole:Route@1675,whole:Route@1836 81086a6bb084a4d587f18ce3de91e4a18d4bc2e8a8719aae0d35a15c3506f341

+@legacy 5dd2ce50c42cbdc49bb5b6c99d8fa1b9b1f13cfee371eb8b54081a82c2b789bd internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; admission and the switch refuse while a run's unit is starting, and the switch interrupts runs on the retiring generation; read sites unchanged, offsets moved registry:Kind@1902,whole:Route@10200,whole:Route@10207,whole:Route@10247,whole:Route@1904,whole:Route@2151,whole:Route@2996,whole:Route@3014,whole:Route@3609,whole:Route@3657,whole:Route@4172,whole:Route@5656,whole:Route@8367 25992cb1aa5419170f2ff837eb23029d8045a6436cdab4569bb89b923642450f

+internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; admission and the switch refuse while a run's unit is starting, and the switch interrupts runs on the retiring generation; read sites unchanged, offsets moved registry:Kind@1902,whole:Route@10200,whole:Route@10207,whole:Route@10247,whole:Route@1904,whole:Route@2151,whole:Route@2996,whole:Route@3014,whole:Route@3609,whole:Route@3657,whole:Route@4172,whole:Route@5656,whole:Route@8367 25992cb1aa5419170f2ff837eb23029d8045a6436cdab4569bb89b923642450f

+@legacy 5d29564930f79f45adde2abac591f34c50ce705a45319b3e48a54a31c6e24471 internal/activator/wakeplan.go Service.BounceFor legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@194 1bbdcf6a4960bfc6e8bbc4b4899ff041bf1a1d7926b1b59b04c433d65f919f1b

+internal/activator/wakeplan.go Service.BounceFor legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@194 1bbdcf6a4960bfc6e8bbc4b4899ff041bf1a1d7926b1b59b04c433d65f919f1b

+@legacy ddff7291610e3f801976bbaecb435290ce5301aba5aa676cb0012c320e2f8653 internal/activator/workerswap.go Service.ReplaceWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@2082 551b75677e29d3db600b1d186cbb0b316d4f8760eed59cdf66135ffc8a1b99be

+internal/activator/workerswap.go Service.ReplaceWorker legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved whole:Route@2082 551b75677e29d3db600b1d186cbb0b316d4f8760eed59cdf66135ffc8a1b99be

+@legacy b42e65c9d2ee71c116a47f296aadb03c6fa89154f5e3c44b2e3f1c3ba2a50049 internal/console/apiruns.go Server.handleAPIRunCreate legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the run create door; it reads the record from the bucket and refuses an open run; no root decision file:Open@1346 0e4b06365efe529dc5f86f2cf174ac2642c413984c78fa197440b9ed8abed1d3

+internal/console/apiruns.go Server.handleAPIRunCreate legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the run create door; it reads the record from the bucket and refuses an open run; no root decision file:Open@1346 0e4b06365efe529dc5f86f2cf174ac2642c413984c78fa197440b9ed8abed1d3

+@legacy 17336ef966068e283a28bf401b573d217c4e8b862cab52af44129d376a629416 internal/console/apiruns.go Server.writeRunObjects legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): uploads the files spoolRunFiles just wrote to the bucket; the paths are the console's own, never a caller's file:Open@327 228773cd5a10ea4772c60450956e7fe43d2bf741303b29217f5d241513165b06

+internal/console/apiruns.go Server.writeRunObjects legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): uploads the files spoolRunFiles just wrote to the bucket; the paths are the console's own, never a caller's file:Open@327 228773cd5a10ea4772c60450956e7fe43d2bf741303b29217f5d241513165b06

+@legacy 56664b1f2126f4c348d5317ce7c71ddabd67bd584399adfa825e8cf8152285c3 internal/console/apiruns.go spoolRunFiles legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): spools each uploaded --file to a temp file while it is hashed and sized file:CreateTemp@438 3b303ed6fdecb8bdcc94c1e23de0f6532fcf2e82104495c0168a868eddd41f67

+internal/console/apiruns.go spoolRunFiles legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): spools each uploaded --file to a temp file while it is hashed and sized file:CreateTemp@438 3b303ed6fdecb8bdcc94c1e23de0f6532fcf2e82104495c0168a868eddd41f67

+@legacy 12784a02de72b0116380de78cac59b368b0dcb451245fe660dc0144b3ae8f80f internal/console/apirunsfollow.go Server.handleAPIRunAck legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the ack door; clears a finished run from the record by CAS file:Open@1149 463d44dd5efb9d3da3ced08712bf9107afed708a9e503ea327b4bd8b1c062452

+internal/console/apirunsfollow.go Server.handleAPIRunAck legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the ack door; clears a finished run from the record by CAS file:Open@1149 463d44dd5efb9d3da3ced08712bf9107afed708a9e503ea327b4bd8b1c062452

+@legacy 07c5c0f86a8ca9c34600fb2b3ecf5b307b36514328183fd8da9b22c973a7fa19 internal/console/apirunsfollow.go Server.handleAPIRunGet legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the follow door; pages a run's chunks and result from the bucket file:Query@169 81c22c2d1277a29f7e3bc5e2f818ad08b4bfc4fc12af02b8afe3f6b9e71ce900

+internal/console/apirunsfollow.go Server.handleAPIRunGet legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the follow door; pages a run's chunks and result from the bucket file:Query@169 81c22c2d1277a29f7e3bc5e2f818ad08b4bfc4fc12af02b8afe3f6b9e71ce900

+@legacy 36cbd4743276d1e3a9a295388b19a1a5379263b8388f9a2c266240c0c72df4e1 internal/console/apirunsfollow.go Server.runTransitionRefused legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): words a refused cancel, expire or ack from the record's run state file:Open@546 a9b5c170b403697393199c4727f4705e0162880df83cd246d82855804591a207

+internal/console/apirunsfollow.go Server.runTransitionRefused legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): words a refused cancel, expire or ack from the record's run state file:Open@546 a9b5c170b403697393199c4727f4705e0162880df83cd246d82855804591a207

+@legacy f2a8e89ccf136d98071ddd6ca9b37c3da630c2568e9590864b3527a40bdaa23d internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record file:Open@1399 e33e1833d207ea3873e2c410586aa53bb812cef9b55440adf17a93c9a0f52134

+internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record file:Open@1399 e33e1833d207ea3873e2c410586aa53bb812cef9b55440adf17a93c9a0f52134

+internal/host/agent.go fastConvergeLoop authority B3 rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained whole:Route@8636,whole:Route@9199 9a279be19ff8609e17de1caa0b9dd75fa68af2e494dfd809b8e697ad32a753fc

+internal/host/agent.go runAgent authority B,C,D,F rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with armRunsPass called in the activator start's Configure step beside armMovesPass; registry, route, data-directory and backend inputs unchanged; main's B,C,D,F authority retained file:Exec@13674,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@21820 09b67e9f24e0937c2f02141fad96b475ec9469fd4a0edc4c30adf041d5606586

+@legacy 66b994d25951186d5a5212eadd35b055699024104a62b82a0f046d57052b5873 internal/host/runexec.go runsWorker.execute legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): runs one picked run to its result in the bucket; every root action goes through instance control file:Prepare@1838,whole:Route@2539 7667d92507de93fc1bfafcc4217271615d7eae4dab0700a6e7197d369dd1bc80

+internal/host/runexec.go runsWorker.execute legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): runs one picked run to its result in the bucket; every root action goes through instance control file:Prepare@1838,whole:Route@2539 7667d92507de93fc1bfafcc4217271615d7eae4dab0700a6e7197d369dd1bc80

+@legacy 1410e45e95c8721ec227da341ab4180b7202921af96c75934dc89704cd9f4b11 internal/host/runs.go newBootID legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): mints the agent process's random boot id file:Read@56 69f45e3448abd77a5bf685bf7656c8d3b85de07baa9e4cecdbb41ca382a5af62

+internal/host/runs.go newBootID legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): mints the agent process's random boot id file:Read@56 69f45e3448abd77a5bf685bf7656c8d3b85de07baa9e4cecdbb41ca382a5af62

+@legacy d8de8df9c49a524c5da0a8b866fd675277c04d756c49c7edb114bed5f741dbd8 internal/host/runs.go runsWorker.consider legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): acts on a record's run only for a row this box owns; agent-side whole:Route@267 e554387a45cc9bac6cc95c1d17f6580c3fff9e4b3c95a5141d9605753d235216

+internal/host/runs.go runsWorker.consider legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): acts on a record's run only for a row this box owns; agent-side whole:Route@267 e554387a45cc9bac6cc95c1d17f6580c3fff9e4b3c95a5141d9605753d235216

+@legacy 3fdf0464322b6ac4b877f23d0448df1fd5afa6d5cd19d1553e760193c592e70e internal/host/runs.go runsWorker.owned legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): decides whether this box picks up a run; an agent-side choice that grants nothing: the pickup is a CAS on the record and root still validates the start registry:Account@155,registry:App@184,registry:Provisioned@137,whole:Route@123,whole:Route@234,whole:Route@285 e80bbc5dc99660f39a0b408e8d560e1eb8da999ba211e35831cb1b26f693cbc5

+internal/host/runs.go runsWorker.owned legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): decides whether this box picks up a run; an agent-side choice that grants nothing: the pickup is a CAS on the record and root still validates the start registry:Account@155,registry:App@184,registry:Provisioned@137,whole:Route@123,whole:Route@234,whole:Route@285 e80bbc5dc99660f39a0b408e8d560e1eb8da999ba211e35831cb1b26f693cbc5

+@legacy 233ae20a33044f711fff16ab1568c62d6927e85230c270116bcf68f94e3e9b10 internal/host/runs.go runsWorker.pickup legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): picks the run by CAS on the record and starts its execution in the agent whole:Route@1350 d5f092e8a69d0c9907dbfb065b06f46895cb1eeafd2251009622923f797ee3b5

+internal/host/runs.go runsWorker.pickup legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): picks the run by CAS on the record and starts its execution in the agent whole:Route@1350 d5f092e8a69d0c9907dbfb065b06f46895cb1eeafd2251009622923f797ee3b5

+@legacy 04a7bd8d05792e77cf8a041f67b311893308fae581e45afa8a8f1cecc36b3d88 internal/host/units/carlos-instance-cmd@.service external legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the cmd unit template (applied by PID 1 as root; its process runs as carlos): extends the J4 seed pattern to the run role. The template equals the seed template outside named lines, and the template-equality test pins that. Root lays out a staged executable validated by the same refuseStagedExe the seed and generation paths use, then starts this unit, which runs as carlos with the instance's own reach. No new trust of registry, /data or agent-asserted content beyond the seed path file:external@0 65cbbd3cd72dacbddf93d2a371ab1623b90622f935271208367d3c03aa70800b

+internal/host/units/carlos-instance-cmd@.service external legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the cmd unit template (applied by PID 1 as root; its process runs as carlos): extends the J4 seed pattern to the run role. The template equals the seed template outside named lines, and the template-equality test pins that. Root lays out a staged executable validated by the same refuseStagedExe the seed and generation paths use, then starts this unit, which runs as carlos with the instance's own reach. No new trust of registry, /data or agent-asserted content beyond the seed path file:external@0 65cbbd3cd72dacbddf93d2a371ab1623b90622f935271208367d3c03aa70800b

+@legacy d57bf1db2483e0b05258750e03f26814dfe91e6d7c6ce303e91d82e9a6b11c54 internal/instancectl/cmd.go Server.handleCmdStatus legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. Read-only systemctl state: it answers GET /cmd/{host} with the cmd unit's state from systemctl show, and starts and stops nothing. The one flagged site is the URL's Query, not a file read. No new trust of registry, /data or agent-asserted content beyond the seed path file:Query@246 18ee232cb0a406e76f6307145317790e8bd306a54fc64fcea98875bee8b55807

+internal/instancectl/cmd.go Server.handleCmdStatus legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. Read-only systemctl state: it answers GET /cmd/{host} with the cmd unit's state from systemctl show, and starts and stops nothing. The one flagged site is the URL's Query, not a file read. No new trust of registry, /data or agent-asserted content beyond the seed path file:Query@246 18ee232cb0a406e76f6307145317790e8bd306a54fc64fcea98875bee8b55807

+@legacy 74e81500b23a0c002aa97e53815df352611c53ee2924c4fa2f703ad01b5f80f0 internal/instancectl/hardening.go ensureExeAs legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. It is ensureExe's body, parameterised by the two source names, so a run's command gets cmd-app and cmd-live beside the host's app and live. Same reads of the same root-only directory. The staged executable it points at is validated by the same refuseStagedExe the seed and generation paths use (stagedexe.go:90; cmd.go:69). No new trust of registry, /data or agent-asserted content beyond the seed path file:Lstat@582,file:ReadDir@903 1535d31fb203d835e78306333331290521287540261af333e943ccbd338032ae

+internal/instancectl/hardening.go ensureExeAs legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. It is ensureExe's body, parameterised by the two source names, so a run's command gets cmd-app and cmd-live beside the host's app and live. Same reads of the same root-only directory. The staged executable it points at is validated by the same refuseStagedExe the seed and generation paths use (stagedexe.go:90; cmd.go:69). No new trust of registry, /data or agent-asserted content beyond the seed path file:Lstat@582,file:ReadDir@903 1535d31fb203d835e78306333331290521287540261af333e943ccbd338032ae

+@legacy 8d38598dfc9f280dbbe5caee8e470276ea5a4602320a4c64f769efbf40e3d84c internal/instancectl/server.go parseRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. Main's body, which now only admits the cmd role on stop and reset and a staged executable on the cmd verb. That executable is still refused by refuseStagedExe before anything is laid out. The read sites are main's: the request's URL query, no file read file:Query@73 e46489a7f7429c538a594a9e52b762a4fbb6ac23b6677e30da1c8cebb95a595a

+internal/instancectl/server.go parseRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): extends the J4 seed pattern to the run role. Main's body, which now only admits the cmd role on stop and reset and a staged executable on the cmd verb. That executable is still refused by refuseStagedExe before anything is laid out. The read sites are main's: the request's URL query, no file read file:Query@73 e46489a7f7429c538a594a9e52b762a4fbb6ac23b6677e30da1c8cebb95a595a

+internal/instancectl/server.go type Server diagnostic H3 rev3=census-ruling-carlos-run;basis=instance control (/opt/carlos/carlos instance-control, carlos-instance-control.service, root): the struct gains the cmd start's poll and wait bounds and its per-host lock map; declaration only, as main ruled it file:Statfs@2708 82bbe54e035edd5fafc46a0ba44a88c7283f28f47f45fa6dfda35bb9dcfb8ff1

+@legacy 3f426a0718ec6d992e312c83e0244df51f682b6cb9e9f1be966126e4faea70c0 internal/instancefs/dirs_linux.go removeAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): reached only through RemoveAllBeneath from internal/runs (staging cleanup, RemoveRunDir, SweepRunDirs), all in the agent's runs worker; removes a run's own directory without following a link file:Fstatat@187,file:Openat@600,file:Readdirnames@822 d40cfdfa591b7e9df45b2002a64a5d7d32a6cccb215b8386a07cad435fe0bb81

+internal/instancefs/dirs_linux.go removeAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): reached only through RemoveAllBeneath from internal/runs (staging cleanup, RemoveRunDir, SweepRunDirs), all in the agent's runs worker; removes a run's own directory without following a link file:Fstatat@187,file:Openat@600,file:Readdirnames@822 d40cfdfa591b7e9df45b2002a64a5d7d32a6cccb215b8386a07cad435fe0bb81

+@legacy e1a7b34c213748567425e62256c32d37c719c4a9a7faab5265399407738a76f3 internal/provision/provision.go MoveRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a record transition the console's move door runs; it now refuses a move while a run is open file:Open@104 a71c79d06b66ebdbe8b3c7841d8fd03809dfb965dee5d4f7d243a2ef3e6da780

+internal/provision/provision.go MoveRequest legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a record transition the console's move door runs; it now refuses a move while a run is open file:Open@104 a71c79d06b66ebdbe8b3c7841d8fd03809dfb965dee5d4f7d243a2ef3e6da780

+@legacy 6c0a94a365dc696a00ce93f336e77b7ee2cd79b9714e6ca46af011abd20aca57 internal/provision/provision.go MoveStartTransition legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a record transition the console's move door runs, directly and through hostops.StartClaimMoveRecord; it now refuses a move while a run is open file:Open@99 73ff37df4e54a9fac3468a14febb50045f078e66cd990c50590f50635e5d3e8f

+internal/provision/provision.go MoveStartTransition legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a record transition the console's move door runs, directly and through hostops.StartClaimMoveRecord; it now refuses a move while a run is open file:Open@99 73ff37df4e54a9fac3468a14febb50045f078e66cd990c50590f50635e5d3e8f

+@legacy 35a4500e6cc0dc28734eeb5b9422ce6b13b3780d3db4ce140766c47191cafda8 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with one RunSeen call on each in-scope record that carries a run; the reads are unchanged and nothing is written registry:Account@17413,registry:Account@18505,registry:Account@31221,registry:Account@31267,registry:App@17386,registry:App@18478,registry:App@31241,registry:App@31279,registry:ClaimOwnership@18000,registry:DBPath@23332,registry:DBPath@23347,registry:DBPath@23593,registry:DBPath@24124,registry:DBPath@24137,registry:Gate@21141,registry:Gate@21281,registry:Gate@21546,registry:Hibernate@20119,registry:Hibernate@20437,registry:Hibernate@20788,registry:Hibernate@21076,registry:Host@12707,registry:Host@31199,registry:Host@31367,registry:Host@31482,registry:Host@31827,registry:Host@31924,registry:Host@32060,registry:Host@32218,registry:Host@32320,registry:Kind@18142,registry:Kind@18405,registry:Kind@23250,registry:Kind@23263,registry:Kind@23373,registry:Kind@23386,registry:Kind@24035,registry:Kind@24046,registry:Kind@30435,registry:Kind@32051,registry:Kind@32209,registry:Kind@32311,registry:Pool@30527,registry:Provisioned@17362,registry:Provisioned@18454,registry:Provisioned@30485,registry:Region@30516,registry:Replication@20522,registry:Replication@20649,registry:Seed@21752,registry:Socket@23298,registry:Socket@23313,registry:Socket@23610,registry:Socket@24094,registry:Socket@24107,registry:Unit@23216,registry:Unit@23229,registry:Unit@24061,registry:Unit@24072,whole:ClaimOwnership@18003,whole:ClaimOwnership@18020,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13271,whole:Route@14020,whole:Route@14376,whole:Route@14385,whole:Route@14431,whole:Route@17007,whole:Route@17478,whole:Route@17488,whole:Route@17845,whole:Route@17852,whole:Route@17920,whole:Route@18243,whole:Route@18886,whole:Route@20209,whole:Route@23442,whole:Route@24921,whole:Route@24966,whole:Route@24976,whole:Route@25839,whole:Route@26591,whole:Route@29883,whole:Route@30552,whole:Route@32131 fb5dce248023ff696af058ad675bc4ec13a8f5641bffb66c3318825f1b28b4d2

+internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with one RunSeen call on each in-scope record that carries a run; the reads are unchanged and nothing is written registry:Account@17413,registry:Account@18505,registry:Account@31221,registry:Account@31267,registry:App@17386,registry:App@18478,registry:App@31241,registry:App@31279,registry:ClaimOwnership@18000,registry:DBPath@23332,registry:DBPath@23347,registry:DBPath@23593,registry:DBPath@24124,registry:DBPath@24137,registry:Gate@21141,registry:Gate@21281,registry:Gate@21546,registry:Hibernate@20119,registry:Hibernate@20437,registry:Hibernate@20788,registry:Hibernate@21076,registry:Host@12707,registry:Host@31199,registry:Host@31367,registry:Host@31482,registry:Host@31827,registry:Host@31924,registry:Host@32060,registry:Host@32218,registry:Host@32320,registry:Kind@18142,registry:Kind@18405,registry:Kind@23250,registry:Kind@23263,registry:Kind@23373,registry:Kind@23386,registry:Kind@24035,registry:Kind@24046,registry:Kind@30435,registry:Kind@32051,registry:Kind@32209,registry:Kind@32311,registry:Pool@30527,registry:Provisioned@17362,registry:Provisioned@18454,registry:Provisioned@30485,registry:Region@30516,registry:Replication@20522,registry:Replication@20649,registry:Seed@21752,registry:Socket@23298,registry:Socket@23313,registry:Socket@23610,registry:Socket@24094,registry:Socket@24107,registry:Unit@23216,registry:Unit@23229,registry:Unit@24061,registry:Unit@24072,whole:ClaimOwnership@18003,whole:ClaimOwnership@18020,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13271,whole:Route@14020,whole:Route@14376,whole:Route@14385,whole:Route@14431,whole:Route@17007,whole:Route@17478,whole:Route@17488,whole:Route@17845,whole:Route@17852,whole:Route@17920,whole:Route@18243,whole:Route@18886,whole:Route@20209,whole:Route@23442,whole:Route@24921,whole:Route@24966,whole:Route@24976,whole:Route@25839,whole:Route@26591,whole:Route@29883,whole:Route@30552,whole:Route@32131 fb5dce248023ff696af058ad675bc4ec13a8f5641bffb66c3318825f1b28b4d2

+@legacy 01991921d4c6a057d8957944f52daf52da403c8f04aae094f4664e5c1742f41e internal/provision/run.go RunAdmit legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the record transition the console's run create door runs file:Open@257 2ba6caac7b67f779695227a0ad636b308d5b80853a65a0fabc5cde9c13ae5607

+internal/provision/run.go RunAdmit legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the record transition the console's run create door runs file:Open@257 2ba6caac7b67f779695227a0ad636b308d5b80853a65a0fabc5cde9c13ae5607

+@legacy 89a8ef2baefc0e2e4e96581ca5dc940971c9a7191e43d961a66ebd91ae4f7563 internal/provision/run.go RunState.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a pure predicate on a record's run state, called by the console's doors and sweep and by the transitions above file:Open@19 d22e3386cd7079e6bf2ec7110eef2466f48a0d0ef63febf0ff6bdf5a4ec1aa05

+internal/provision/run.go RunState.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): a pure predicate on a record's run state, called by the console's doors and sweep and by the transitions above file:Open@19 d22e3386cd7079e6bf2ec7110eef2466f48a0d0ef63febf0ff6bdf5a4ec1aa05

+@legacy f68d4ddc8bd492ee19e969e63fcaf5a7173de711f86a9236952f01ffc4cd248b internal/runs/stage.go SweepRunDirs legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the runs worker's boot pass removes run directories no open run owns, beneath each instance's own directory file:ReadDir@101 3c469bec8c6ec91936dff0dd18ca6708d30147c1f30c826ebbb02e0bafaa535c

+internal/runs/stage.go SweepRunDirs legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the runs worker's boot pass removes run directories no open run owns, beneath each instance's own directory file:ReadDir@101 3c469bec8c6ec91936dff0dd18ca6708d30147c1f30c826ebbb02e0bafaa535c

+@legacy 995eda3b2d535e39da890812169991d71b75d47c4359b32d8509e540b86049d7 run.go copyRunFilePart legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): checks the file did not change size while it was uploaded file:Stat@113,file:Stat@598 4597e1729a93910ef618eca234a77e68563693abf65526328d9ab0bfe1828ed4

+run.go copyRunFilePart legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): checks the file did not change size while it was uploaded file:Stat@113,file:Stat@598 4597e1729a93910ef618eca234a77e68563693abf65526328d9ab0bfe1828ed4

+@legacy 41dbd3553d8cf0cdaab02dd69cbd7c83932591ef8a04979d2a78ef7ef7d29577 run.go runMetaFor legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): builds the run request's file list file:Stat@162 6cd58b0235d2f0b535ecfd190eff7588261564e0639a24a24249b0e93fda2ce9

+run.go runMetaFor legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): builds the run request's file list file:Stat@162 6cd58b0235d2f0b535ecfd190eff7588261564e0639a24a24249b0e93fda2ce9

+@legacy 4bd4f7e16082aad7b5fbf17715aa6c4c8e991573988fd9bd11373b68cf3f0c1b run.go type runFileHandle legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): declaration only file:Stat@43 52f66acacaa48c28cb8b5abed11f8af36ca41ec80669272000dbb88faa47c07e

+run.go type runFileHandle legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): declaration only file:Stat@43 52f66acacaa48c28cb8b5abed11f8af36ca41ec80669272000dbb88faa47c07e

+@legacy 22bff07147b14d287befa5492d05d2b173b1e94340b4acde11575f01ebf4255f run.go writeRunFilePart legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): streams one --file into the multipart request file:Open@96 61b956d3287c8d72686390effe589e584d928a2947414a80d6a4b5d784f0341d

+run.go writeRunFilePart legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the carlos CLI on a person's machine, as that person (no box unit): streams one --file into the multipart request file:Open@96 61b956d3287c8d72686390effe589e584d928a2947414a80d6a4b5d784f0341d

@remove apimode.go apiSession.getJSON

-@removed apimode.go apiSession.getJSON H3 census-ruling-PROPOSED-carlos-run: NEEDS RULING. still declared, and reads nothing now: it calls getJSONHeader, which holds its former read.

+@removed apimode.go apiSession.getJSON H3 census-ruling-carlos-run: still declared, and reads nothing now: it calls getJSONHeader, which holds its former read. It runs in the carlos CLI as the person.

@remove internal/instancectl/hardening.go ensureExe

-@removed internal/instancectl/hardening.go ensureExe H3 census-ruling-PROPOSED-carlos-run: NEEDS RULING. still declared, and reads nothing now: it calls ensureExeAs, which holds its former reads. Root-executed.

+@removed internal/instancectl/hardening.go ensureExe H3 census-ruling-carlos-run: still declared, and reads nothing now: its reads moved unchanged into ensureExeAs, an accepted-legacy row in this overlay.

@coverage . 78e65520d544d1b53bb713774ae78f16868a9c4ab4b86d54b47aaceef321c9bf

@coverage cmd/console f77208c587db2166ccc032a824c5be48fe92de8efcf77d84b6b1ecd70e2ac7ed

@coverage internal/activator d5556cc6e5d7988b7b7071a6d99b3d26c93dd380cb62b73c8201412cffca698f