CI log
amadan: log truncated — showing the last 467720 bytes of 580827
ainst the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:424: J4 internal/hostbox/restore.go ColdRestore.Install C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Disk.VerifyFile F linux:internal/hostfloor/image_linux.go:Disk.Exec root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go rootRestartRouteWith B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads.
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_settle.go ClaimRootHTTP.beginExecutionRecoveryFence D linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
plan14_input_inventory_test.go:424: J4 internal/hostguard/root.go Guard.AbandonRootInventory C linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials.
plan14_input_inventory_test.go:424: J4 internal/registry/artifacthosts.go Registry.ArtifactHosts E2 linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.member C+G linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movesinstall.go installRun.installAuthority C+G linux:internal/host/movesinstall.go:installRun.local_ root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootbroker.go RootBroker.Execute D linux:internal/host/rootexecution_transport.go:ClaimRootHTTP.serveExecution Retry transient authority reads within existing admission slack; bounded replay and permanent mismatches remain enforced.
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go ColdHandover.retireIntended C linux:internal/hostbox/coldhandover.go:ColdHandover.Run rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=captures persistent identity for root-guarded empty directories before identity-conditional retirement
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates.go initializeMigrationFailures E3+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;run=8;identity=offline journal-migrate uid 0;basis=requires complete root census before creating migration-bound root failure book; missing legacy history supplies no known refusal
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go readLocalFloor F linux:internal/host/movesfloor.go:withMovesFields root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/launchjournal.go LaunchJournal.SessionLaunches C linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesstage.go heldReleaseStaged C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go settingsApply E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:424: J4 internal/host/claimassembly.go ClaimAssembly.Build C+G linux:internal/host/claimassembly.go:productionClaimFactory Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.retryHost E1+E3 linux:internal/host/rolloutdeclined.go:rolloutRetryHost fix1-merge-review;basis=Refuses retry while a failure-book save is owed; verifies the signed current book/epoch grant before clearing.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go JournalService.holdsLegacyRows C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.skipRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go materializeHeld C+E1+E2 linux:internal/release/materializeheld.go:MaterializeHeldUnderWithPins root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/bootstrap.go const tmpfilesConf A+C+G linux:internal/host/bootstrap.go:bootstrapWith root-input;kept=A,C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/worker.go Worker.self C+D linux:internal/hostrelocate/worker.go:Worker.ConvertLanding Worker identity requires current active directory enrollment, home-region match and termination-fence check.
plan14_input_inventory_test.go:424: J4 internal/rootstate/file_other.go CheckPublicConfig A+B3 darwin:internal/host/proofnamed.go:proofBindingSource.trustedBytes fix1;basis=Non-Linux descriptor checks fail closed.
plan14_input_inventory_test.go:424: J4 internal/host/agent.go runAdoptWithEnsureSystemUnits B3+C+D+E1+E2+E3+E4+F linux:internal/host/agent.go:runAdopt PROPOSED E45 / R-E45-3: root checks census presence before opening release exclusion; absent census uses main adoption with no release directory or lock. Retained census remains protected with either flag value. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=passes the same census source to release exclusion and root settings to preserve the no-census branch
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_creation.go RootHistory.ConsumeCreation E1 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_startup.go verifyRootMigrationFloors F+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks installed and guard signed binaries against both locally retained protocol bounds without remote access
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_healthy.go type rootFloorHealthy F linux:internal/host/rootfloor_healthy.go:rootMovesFloors.healthy rev3=PROPOSED-p3;identity=root system apply/adopt health or floor decision uid 0; recovery readers uid 0;basis=binds a root health observation to deployment, box, enrollment and signed binary identity
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/transaction.go type heldTransaction D+F linux:internal/rootparticipation/transaction.go:TransactionLedger rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=binds transaction reuse to a root-opened ledger and live callback lifetime
plan14_input_inventory_test.go:424: J4 internal/host/claimmoveparks.go refusingClaimMoveWake C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go NewJournalService C linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input
plan14_input_inventory_test.go:424: J4 internal/host/proofnamed.go proofBindingSource.trustedBytes B3 linux:internal/host/proofnamed.go:proofBindingSource.record rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=captures persistent evidence from the checked root-owned unit file descriptor alongside its bytes
plan14_input_inventory_test.go:424: J4 internal/rootstate/link_linux.go directory.readLink A+E1 linux:internal/rootstate/link_linux.go:ReadTrustedLink Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/host/namedrecovery.go type namedUnitRecovery E1 linux:internal/host/namedrecovery.go:productionNamedUnitRecovery E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_parked.go generationRetirementRecords E2 linux:internal/host/rootgeneration_parked.go:generationReadRetirements E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor_linux.go movesDir.removedDuringOpen F linux:internal/host/movesfloor_linux.go:movesDir.lockNamed root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/record_unix.go openDirectory C linux:internal/hostguard/flock_unix.go:acquire root-input
plan14_input_inventory_test.go:424: J4 internal/release/healthy_root.go rootHealthyStore B+B4 linux:internal/release/healthy_root.go:recordRootHealthy fix1;basis=Normalizes the no-account operator app to the existing ops namespace before opening the root-owned public history.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go scanStopCgroupsMode C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/persistent.go PersistentIdentity.Same A+E2 linux:internal/hostbox/inventory_identity.go:VerifyInventoryFile rev3=PROPOSED-p3;run=8;identity=root generation verification uid 0;basis=device and mount numbers are exact only within one boot; cross-boot equality requires persistent evidence and unchanged attachment topology;rev3=PROPOSED-p3;run=8;identity=root generation verification uid 0;basis=device and mount numbers are exact only within one boot; cross-boot equality requires persistent evidence and unchanged attachment topology
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go type passConfig E2+E3 linux:internal/release/adopt.go:BakeDir E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=stores the typed census-only root update provider and per-pass resolved input authority
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.decidePrev F linux:internal/host/systemapply.go:systemApplier.install root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go generationKey E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.Install C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Configure Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_boot.go withRootFloorGuardCandidate F linux:internal/host/guardexec.go:RunSystemGuardExec rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=release then previous-binary exclusion; participation check precedes moves and seeds locks; certified current remains executor fallback
plan14_input_inventory_test.go:424: J4 internal/host/claimcleanup_identity.go verifyClaimCleanupEnrollment C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rollout/failures.go OpenFailureBook E1+E3 linux:internal/host/updatesroot.go:updatesPassOption fix1-merge-review;basis=Loads schema-three durable generations and refuses unsafe identity recovery on entropy failure.
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback.go settleRollbackAttempt B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory.go recordRootProgram E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-system-recover.service external F linux:internal/host/bootstrap.go:var unitsFS rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go rootRestartChecks.retainRecoveryHistory E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.mintRefusals Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go MaterializeHeldUnderWithPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_identity.go VerifyInventoryPath C+E2+G linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Launch rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=opens the checked inventory path and delegates strict retained persistent identity verification
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootview.go RootAuthority.Installation E2 linux:internal/host/rootinstallation.go:rootInstallationHostApp E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
plan14_input_inventory_test.go:424: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.Launch C+G linux:internal/host/moveswakesource.go:movesReadLaunch root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/restart.go seedRestartMarks E1+E3 linux:internal/host/restart.go:restartSeed root-input
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go GenerationEvidence.valid E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/rootstate/authorityfile_linux.go openAuthorityFile E2 linux:internal/rootstate/authorityfile_linux.go:OpenAuthorityFile E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go readRootSeedsBinary F linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary rev3=PROPOSED-p3;identity=carlos adopt seeds judgement and root system apply/recover candidate checks, uid 0;basis=delegates checked signed executable read then selects seeds protocol
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootmigration.go migrationDenied C+G linux:internal/hostguard/rootmigration.go:RootAuthority.CompleteMigrationInventory rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationpins.go passConfig.generationWriteCheck E2 linux:internal/release/adopt.go:PassFilter E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:424: J4 internal/release/rollback.go rollbackGroup B3+E1+E3 linux:internal/release/adopt.go:adoptHost root-route;kept=B3,E1,E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/activator/rolelaunch_root_linux.go RoleLaunch.startIsolated C linux:internal/activator/rolelaunch_linux.go:RoleLaunch.Start root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.bind C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootrecovery_rebind.go ClaimRootHTTP.rebindRecoveryInventory C linux:internal/host/rootinventory.go:ClaimRootHTTP.recoverRootInventory Retain fresh claim and inventory checks and refuse a box listed Lost.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Disk.WithParticipation D linux:internal/host/systemapply.go:systemApplier.runWithRelease Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_run.go RunInstanceControl C+D+G linux:main.go:main Refuse premature claim activation and continue serving recovery after per-host startup failures. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go type rootGenerationSource E2+E3 linux:internal/host/claimlaunch_root.go:type ClaimLaunchRoot rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=binds production runtime authority and persistent file capture to the root launch source
plan14_input_inventory_test.go:424: J4 internal/host/claimowners.go ClaimOwnerDispatch.Select C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/file_linux.go CheckPublicConfig A+B3 linux:internal/host/proofnamed.go:proofBindingSource.trustedBytes fix1;basis=Checks root:root ownership, exact 0644 mode and single-link regular-file identity on the already opened operator configuration descriptor.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go RootHistory.ProjectMigrationStatus E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go enrolled E1 linux:internal/historyreadback/workflow.go:Operation.Deliver E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go rootProtocolLegacy F linux:internal/host/rootmovesfloor_source.go:rootFloorLegacy rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded agent-writable JSON and line mirrors contribute only increasing denies; neither can establish accepted state
plan14_input_inventory_test.go:424: J4 internal/host/claimready_linux.go claimProbeSocketReady B3 linux:internal/host/claimconstruction.go:claimGroupDWiring root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go restartScopeLeg E1+E3 linux:internal/host/restart.go:restartPass root-route
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go scopedHosts E1+E3 linux:internal/host/restartscope.go:bounceScopedRoutes root-route
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.gate E1+E3 linux:internal/host/rolloutdeclined.go:honourDeclinedFailures root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go lockJournalMigration C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_requirements.go productionGenerationCreation E2 linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_other.go migrateRootClaimAuthority G darwin:internal/host/claimjournal_migration.go:migrateClaimJournalsWith rev3=PROPOSED-p3;identity=non-Linux offline journal-migrate CLI;basis=unsupported-platform stub returns ErrUnsupported without reading or granting migration authority
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Disk.withParticipation D+F linux:internal/hostfloor/disk.go:Disk.WithParticipation rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=uses a live root-minted scoped ledger only for its original store; otherwise opens the ordinary census; absent census keeps legacy behavior
plan14_input_inventory_test.go:424: J4 internal/caps/caps.go Set.UnmarshalJSON E4 linux:cli.go:readCapabilities root-input
plan14_input_inventory_test.go:424: J4 internal/host/movespass.go armMovesPass B+C linux:internal/host/agent.go:runAgent Agent moves construction passes registration client and existing guarded publication and park providers.
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation.go productionClaimLocal.participateHost D linux:internal/host/claimparticipation.go:productionClaimLocal.participate Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckRootRegisteredRow C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Crash census exception admits only the row named by root pending registration; all other census checks remain required.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_outcomes.go historyRecoveryKey E1 linux:internal/release/roothistory_outcomes.go:RootHistory.RetainRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_timers.go rootMigrationTimers.adopt G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration binds the exact observed pre-claim registrations to root retained stop evidence and denies; durable intention precedes conditional registry adoption and root inventory completion
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go rootUpdateSource.beginRuntime E3 linux:internal/host/rootupdates.go:rootUpdateSource.resolve rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=persists a root intent before effects; independently records failures or readiness plus exact process revalidation and request completion
plan14_input_inventory_test.go:424: J4 internal/hostguard/record_unix.go recordDir.write C linux:internal/hostguard/root.go:Guard.AbandonRootInventory root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation_stale.go productionClaimLocal.clearUntracked D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith Untracked participation cleanup now carries exact controller binding into retirement before stale-state clearing.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go verifyHeldLive B2+C+E1 linux:internal/release/materializeheld.go:VerifyHeldLive Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go copyLegacyJournal C linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go RootHistory.MigrationStatus E1 linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_requirements.go type generationRecord E2 linux:internal/host/rootgeneration_inventory.go:type generationInventory E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/restart.go dispatchBoundedWakes E1+E3 linux:internal/host/restart.go:cycleWorkers root-route
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go adoptHost B3+E1+E2+E3+E4 linux:internal/release/adopt.go:PassFilter E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=applies root settings to canonically resolved routes including named units while legacy settings eligibility remains unchanged
plan14_input_inventory_test.go:424: J4 internal/release/refusal.go ReadRefusal E1+E3 linux:internal/host/buildstate.go:buildStates.heldWakeInput root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation.go productionClaimLocal.prepareLegacyWith D linux:internal/host/rootexecution_client.go:productionClaimLocal.prepareWith Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures.
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_migration_linux.go quiesceLegacyClaimJournals C+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go rootRestartChecks.live B3+E1 linux:internal/host/roothistory_recovery.go:linkRootHistory Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/activator/backend_exec.go ExecBackend.spawnInCgroupGated E2 linux:internal/activator/backend_exec.go:ExecBackend.StartWorkerStaged E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation_stale.go participationCleanupRead.Read D linux:internal/host/rootinstallation.go:rootInstallationHostApp root-input
plan14_input_inventory_test.go:424: J4 internal/host/proofroot.go proofRoot.stillLive B3 linux:internal/host/proofroot.go:proofRoot.mintAndLog route-and-input
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go systemdUnits.Exe B3 linux:internal/host/unitsettle.go:settleUnit root-input
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go heldShape C+E1 linux:internal/release/materializeheld.go:VerifyHeldLive root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootbroker.go RootBroker.retry D linux:internal/hostexec/rootbroker.go:RootBroker.Execute Bound transport retries by original monotonic slack and context; never extend a permit.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go judgeRootSeedsPrev F linux:internal/host/rootseedsfloor.go:rootRefreshAndJudgeSeedsPrev rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness
plan14_input_inventory_test.go:424: J4 internal/host/movesstage.go heldReleaseReady C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile.go Reconciler.holdOnly C linux:internal/hostbox/reconcile.go:Reconciler.installWithWork Hold-only write rechecks claim, record and source inventory under local lock without root RPC there.
plan14_input_inventory_test.go:424: J4 internal/host/relocatepass.go RelocationRuntime.finishCompletion C+D linux:internal/host/relocatepass.go:RelocationRuntime.once Completion dispatch requires authoritative completed operation and current executor before discharge.
plan14_input_inventory_test.go:424: J4 internal/host/proofroot.go proofRoot.around B3+B4 linux:internal/host/agent.go:runAdoptUnderRootRelease Continue minting observations for unaffected routes even when adoption reports a route error.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go materializeHeldChecked E2 linux:internal/release/materializeheld.go:serveHeldStageRequest E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go rootSeedsAllowsBinary F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=compares signed seeds protocol to published root bound only while a certified current, prev or staged candidate meets it; no remote reads
plan14_input_inventory_test.go:424: J4 internal/console/apirestartscope.go restartRouteRows E1+E3 linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope root-route
plan14_input_inventory_test.go:424: J4 internal/host/claimmoveparks.go openProductionClaimMoveWake C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal.
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartPass E1+E3 linux:internal/host/agent.go:runAdoptUnderRootRelease root-route
plan14_input_inventory_test.go:424: J4 internal/instancectl/server.go runWithClaim C+D+G linux:internal/instancectl/claim.go:RunWithClaim Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_retirement.go generationRetirement.retireAll E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:424: J4 internal/console/apirestartscope.go resolveRestartScope E1+E3 linux:internal/console/apirestartscope.go:Server.handleAPIRestartScope root-route
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.restoreFiles F linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_recovery.go recoverRootExecution D linux:internal/host/guardtransaction.go:var recoverPendingControllers Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go rootRestartChecks.runningVersion B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-6;basis=Without a census return no running build, so main's cur stays the rollback target and no record is resolved; census-backed retention unchanged.
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go repairSibling E2 linux:internal/release/adopt.go:stageFrom E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go productionClaimRegional.Authorize C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/proofask.go mintAsker.tick B3 linux:internal/host/agent.go:fastConvergeLoop route-and-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_creation.go RootHistory.RecordCreation E1 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go generationDigest E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation_completed.go ClaimAssembly.completedRelocationDischarge C+D linux:internal/host/claimparticipation.go:productionClaimLocal.cleanup Completed-relocation discharge requires exact claim completion and verified retirement receipt; unread evidence refuses cleanup.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go productionLocalGenerationInventory E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.
plan14_input_inventory_test.go:424: J4 internal/host/prooffile.go sameProofFiles B3 linux:internal/host/proofbinding.go:proofBindingSource.binding rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=compares retained and current proof files using persistent evidence, refusing an implicit upgrade of old unproven files
plan14_input_inventory_test.go:424: J4 internal/host/movesinstall.go installRun.local_ C+G linux:internal/host/movesinstall.go:installGeneration root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go writeColdJournal C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go RootHistory.RetireRecovery E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests.go type rootRestartRequests E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/production.go Open D linux:internal/rootparticipation/production.go:OpenForUpdate Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_readback.go publishRootHistoryReadback E1 linux:internal/host/roothistory.go:openRootHistory Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go productionGenerationAbsence E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/hostbox/typedpark_linux.go TypedParker.verifyDestination C linux:internal/hostbox/typedpark_linux.go:TypedParker.Park rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=checks parked artifact replay using persistent evidence under descriptor-held ancestry
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go legacyCheckedUnitRestart B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-6;basis=Restore main stamped-unit restart and D1 settle, including diagnostics; only clock, readiness and health-hook adapters differ.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go RootHistoryPass.begin E1 linux:internal/release/adopt.go:adoptHost Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.persist F linux:internal/host/rootmovesfloor.go:rootMovesFloors.refresh rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.projection F linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum
plan14_input_inventory_test.go:424: J4 internal/host/proofnamed.go proofBindingSource.record B3 linux:internal/host/rootroute.go:proofBindingSource.needsRestart rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=binds named-unit provenance to boot-stable file evidence and preserves the original no-census hash shape
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.pass E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.pointerLoop fix1-merge-review;basis=Saves the failure book before processing pointer retries; preserves signed retry and restriction checks.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.Run D+F linux:internal/host/systemapply.go:systemApplier.runWithRelease root-input;kept=D,F;scope=protected-decision-only PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-stage.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go ProductionClaimOwnerProvider.OpenClaimOwners C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly Production owner factory wires bounded C8 and relocation providers and closes partial construction on error.
plan14_input_inventory_test.go:424: J4 internal/hostbox/restore.go writeGeneration C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go RootHistoryPass.resolve E1 linux:internal/release/roothistory_pass.go:RootHistoryPass.selectRoute E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go rootFloorBinary.forSeeds F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=projects signed SeedsProtocol (zero when absent); comparisons are gated by verified signed publication and available certified builds
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go systemApplier.seedsActivationRefusal F linux:internal/host/systemapply.go:systemApplier.activationRule rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-system-update.path external F linux:internal/host/bootstrap.go:var unitsFS root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/typedretire.go writeJournal C linux:internal/hostbox/typedretire.go:TypedRetirement.Run root-input
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_other.go EnsurePublicDir A+B4 darwin:internal/host/rootrestart.go:productionRootRestartChecks fix1;basis=Non-Linux shared-directory setup fails closed.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RestartTarget E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.binding B3 linux:internal/host/proofbinding.go:proofBindingSource.forHost rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=compares retained rollback files by persistent evidence rather than old-boot device numbers
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_requirements.go ClaimRootHTTP.verifyInventoryTimers E2 linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/migration.go Ledger.MigrationCensus G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go RootGenerations.invalidateCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootFloorDowngradeIdle D+E2+F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=root adopt, guard boot selector and system apply/recover uid 0;basis=uses E network-free retained generation obligations and kernel census under participation before floor; borrowed transaction matches the original root store; no deployment provider read
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/transaction.go type transactionKey D+F linux:internal/rootparticipation/transaction.go:TransactionLedger rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=unexported key prevents callers from forging the held participation scope
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go rootUpdateSource.publishRetry E3 linux:internal/host/rootupdates.go:rootUpdateSource.resolve rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=projects the root book identity and epoch and includes a mirror acknowledgement only after the root denial is durably cleared
plan14_input_inventory_test.go:424: J4 internal/hostbox/typedpark_linux.go sameArtifactAt C+E2+G linux:internal/hostbox/typedpark_linux.go:TypedParker.Park rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=verifies retained typed artifacts through descriptor-relative opens and persistent identity before any retirement effect
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go RootGenerations.writeCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.After C+G linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly_linux.go verifiedClaimExecutable C+G linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Launch root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/relocationreleases.go ReleaseObligation.Complete C linux:internal/host/relocationeffects.go:RelocationEffects.Release Release obligation completion reads fresh claim before verifying and recording root stop receipt.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_launch.go ClaimLaunchRoot.rootInstalledProgram E1 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/hostguard/generationinventory.go RootAuthority.GenerationInstallations E2 linux:internal/host/rootgeneration_inventory.go:generationInventoryAt E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_read.go readRootExecution D linux:internal/host/rootexecution_read.go:rootExecutionRead Descriptor-checked root opener shared by root Prepare/Check, initial launch authorization and final executable checks; no agent fallback.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory.go boundRootHistory E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/buildstate.go Consumed.ForeignTo E3 linux:internal/host/buildstate.go:buildStates.beforeExec ForeignTo binds consumed decisions to account/app before root release history can be reused.
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.heldWakeInput E3 linux:internal/host/buildstate.go:buildStates.beforeExec Held wake reads tenant-bound consumed decisions, refusal ledger and installed release; no downgrade to diagnostic.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_recovery_policy.go RootHistory.recoveryDenials E1 linux:internal/release/roothistory.go:RootHistory.Blocks E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_creation.go rootHistoryInstallation E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/begun.go ReadBegun F linux:internal/host/guardtransaction.go:systemApplier.guardFinished root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_crossbox.go wireClaimAdmission C+D linux:internal/host/claimhandover_crossbox.go:wireProductionAdmission Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind.
plan14_input_inventory_test.go:424: J4 internal/host/claimrecoveryjournal.go claimRecoveryJournal.successor C+G linux:internal/host/claimrecoveryjournal.go:claimCrossBoxHandover.completeRecovery root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_identity.go OpenInventoryFile C+E2+G linux:internal/hostbox/inventory_identity.go:VerifyInventoryPath rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=opens inventory paths through no-follow checked directory and file descriptors for persistent identity verification
plan14_input_inventory_test.go:424: J4 internal/host/movesfloorgate.go floorGateMain F linux:internal/host/movesfloorgate.go:RunSystemFloorAllowsPrev rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=dispatches explicit root previous gate; legacy argument shape preserved
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_production.go NewProductionClaimStopHandler C+G linux:internal/host/claimassembly.go:NewProductionRootClaimStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor_linux.go movesDir.names F linux:internal/host/movesfloor_linux.go:movesDir.lockNamed root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventoryscope.go ReconcileAdapter.retirementRoute C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-route
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go keepsBuildState E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.rebindRecoveryRows C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.installRecoveryInventory root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go generationReconciler.reconcile E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootview.go RootAuthority.viewLocked C+G linux:internal/hostguard/rootview.go:RootAuthority.Installation rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences
plan14_input_inventory_test.go:424: J4 internal/host/agent.go runAgent B+C+D+F linux:internal/host/agent.go:RunAgent rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory.go RootHistory.readRecord E1 linux:internal/release/roothistory.go:RootHistory.read Root reconstruction reads exact durable records and preserves pending restrictions during signed replacement. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:424: J4 history_cli.go historyCommandWithSave E1 linux:history_cli.go:historyCommand E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.Idle D+F linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=checks settled execution and local launch completeness under participation; nested activation uses only its already-held store
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerationpins.go generationPinSource.StagedPins E2 linux:internal/release/adopt.go:PassFilter E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/console/apirestartscope.go routeWithHost E1+E3 linux:internal/console/apirestartscope.go:resolveRestartScope root-route
plan14_input_inventory_test.go:424: J4 internal/host/systemparticipation.go systemApplier.clearUpdateBegun D linux:internal/host/systemparticipation.go:systemApplier.settleUpdateBegun Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.Observe C+G linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram root-input;kept=C,G;scope=protected-decision-only PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go withPrevLock F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/wakepolicy.go relocationProbe C linux:internal/hostbox/wakepolicy.go:Policy.check root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go checkedUnitRestart B3+E1 linux:internal/host/rootrestart.go:rootRestartRouteWith Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go censusRule.check C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/coldhandover.go Guard.AbandonColdHandover C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt.
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go systemdUnits.StartTime B3 linux:internal/host/proofobserve.go:proofObserver.observe kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go legacyRootRestart B3+G linux:internal/host/roothistory_creation.go:productionCreationHistory E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go generationLaunchPermit.started E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/restart.go bounceExecRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_delivery.go HistoryRecoveryRetirementKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/versionsweep.go sweepStagedVersionsPass E2 linux:internal/host/agent.go:runAdoptUnderRootRelease E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go legacySettleOptions B3 linux:internal/host/legacyrestart.go:legacyRollbackRestart rev3=merge-ruling-4;basis=Legacy settle uses main readiness inputs and limits; these do not authorize root health history.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootFloorBinary.supports F linux:internal/host/guardarm.go:RunSystemGuardArm rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go directory.Sync A+F+G linux:internal/rootstate/state.go:Sync rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability
plan14_input_inventory_test.go:424: J4 internal/hostexec/local_unix.go localDir.read D linux:internal/hostexec/rootmirror.go:ProjectRootClient root-input
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go CapabilityRoute E4 linux:internal/host/adopt_advice.go:adviseHostRoleGateMissing root-route;kept=E4;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/caps_pass.go stagedManifestOfLiveVersion E4 linux:internal/host/agent.go:runAgent root-route
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go requireReceiptOfInstallation C linux:internal/hostclaim/relocation.go:RecordLocalInstall Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation.
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go rootJudgePrevWithSource F linux:internal/host/movesfloor.go:rootJudgePrev rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes
plan14_input_inventory_test.go:424: J4 internal/hostfloor/report.go Disk.Running F linux:internal/console/hostreports.go:Server.localHostReport root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_outcomes.go type HistoryRecovery E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go rootRestartRecord.advance E1 linux:internal/release/rootrestart_history.go:RootRestarts.Finish E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootstop_reboot_linux.go LinuxStopKernel.rebootStopFiles C linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.recoverAfterReboot rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=maps old journal descriptor devices only through root-retained filesystem and directory-handle evidence; ambiguous or unknown filesystems refuse, and the resulting inode set only adds denies
plan14_input_inventory_test.go:424: J4 internal/hostbox/restore.go readGeneration C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:424: J4 internal/host/caps_pass.go capabilityPass E4 linux:internal/host/agent.go:runAdoptUnderRootRelease root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go journalPrepare C linux:internal/hostbox/journalservice.go:journalCall root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/hostbox/launchjournal.go OpenLaunchJournal C linux:internal/host/claimjournal_migration.go:var openClaimRootJournal root-input
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go serveHeldStageRequest E2 linux:internal/release/materializeheld.go:ServeHeldStageRequestsWithPins E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_reconstruct.go RootHistory.Reconstruct E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go Respond E1 linux:internal/host/roothistory_readback.go:historyReadbackPublisher.publish Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/guardroster.go readGuardRoster F linux:internal/host/guardarm.go:RunSystemGuardArm root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/transaction.go Ledger.WithTransaction D+F linux:internal/host/systemapply.go:systemApplier.activationGuard rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=takes participation before the effective floor and registry; releases on every return and invalidates the scoped token
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.sourceEvidence C+G linux:internal/host/claimhandover_crossbox.go:claimCrossBoxHandover.After root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootrecovery_rebind.go ClaimRootHTTP.serveRecoveryRebind C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP root installation and fence authority; recovery rebind and timer identity
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go ReadStatus E1 linux:internal/historyreadback/workflow.go:Operation.Read Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/ratchet.go DigestRatchet.marked E1 linux:internal/release/ratchet.go:DigestRatchet.Admit root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movespass.go movesWorker.hostBlocked C linux:internal/host/movesfinal.go:movesWorker.sweepFinalJournals root-input;kept=C;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_recovery.go rootRestartChecks.settleHistory B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go type RootHistoryPass B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go type GenerationBinding E2 linux:internal/host/rootgenerations_launch.go:type rootGenerationSource E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.;rev3=PROPOSED-p3;run=8;identity=root generation journal uid 0;basis=additive persistent executable and tree fields preserve historical device and inode records
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.boot E2 linux:internal/host/rootgeneration_census_linux.go:generationKernel.census E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/host/rootlaunchverifier.go registerProductionLaunchVerifier E2 linux:internal/host/claimstop_run.go:RunInstanceControl PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go stopIdentity C+G linux:internal/host/claimstop_kernel_linux.go:scanStopCgroupsMode root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/link_linux.go ReadTrustedLink A+E1 linux:internal/host/namedrecovery.go:productionNamedUnitRecovery Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go GenerationBinding.valid E2 linux:internal/release/rootgenerations.go:RootGenerations.Read E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/hostbox/generationpayload.go LaunchJournal.GenerationPayloads E2 linux:internal/host/rootgeneration_inventory.go:generationInventoryAt E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
plan14_input_inventory_test.go:424: J4 internal/hostbox/retirement_timers.go retirementWithTimers C+E2 linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.rollback B3 linux:internal/host/rootrestart.go:productionRootRestartChecks canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_parked.go generationPhysicalPayloads E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: Root rejects unfinished live inventory but accepts intended timer entries only behind exact completed retirement.
plan14_input_inventory_test.go:424: J4 internal/host/seedsfloor.go systemApplier.armSeedsFloor F linux:internal/host/systemapply.go:systemApplier.armFloor rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.Verify C+G linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/pins.go BuildStateKept E2 linux:internal/release/pins.go:SettingsRefs root-route
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_production.go WithProductionMovesHeldRelease B2+C+E1+E2 linux:internal/host/claimstop_run.go:RunInstanceControl Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go install C linux:internal/hostclaim/relocation.go:ToInstalling Install transition allocates authoritative stamp and pinned release, records target before effects and removes prior local receipt.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory.go RootHistory.Refusals E1 linux:internal/release/roothistory_app.go:RootHistory.MintRefusals E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go validHistoryRetirement E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go type GenerationCompleteness E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Certify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/rootstate/authorityfile_linux.go OpenAuthorityFile E2 linux:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_runtime.go newClaimExecutionRuntime D linux:internal/host/claimassembly.go:NewProductionRootClaimStop Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootrebind.go Guard.RebindRootInventory E2 linux:internal/host/rootrecovery_rebind.go:ClaimRootHTTP.rebindRecoveryInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/hostguard/guard.go Guard.locked C linux:internal/hostguard/fence.go:Guard.CompleteFence rev3=merge-ruling-4;basis=Only positively unsafe legacy locks durably quarantine; timeout and I/O errors return without changing root installation state.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration.go rootMigrationSnapshot.preflight G linux:internal/host/rootmigration_startup.go:verifyRootMigrationState rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refuses active moves, unfinished seeds, incomplete inventories or mismatched migration identity before effects
plan14_input_inventory_test.go:424: J4 internal/rollout/rootfailures.go OpenRootFailures E3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=requires exact root migration marker and durable book; rewrites visible state before exposing any retry or failure permission
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartEligible E1+E3 linux:internal/host/rollout.go:feedRestarts root-route
plan14_input_inventory_test.go:424: J4 internal/host/relocationflush.go ReleasePositionsFile.Recorded C linux:internal/host/relocationeffects.go:RelocationEffects.flushStopped Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.read E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.startRecorded E1+E2+E3 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.start rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=persists the root failure intent before launch and independently revalidates readiness and the exact unit invocation before served/request completion
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go scanRebootCgroups C+G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/namedrecovery.go namedUnitRecovery.checkHistory E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.localBound F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance
plan14_input_inventory_test.go:424: J4 internal/host/claimwakestop.go ClaimAssembly.collectRetirementStop C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build route-and-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go rootJudgePrev F linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=normal adopt combines moves and seeds verdict errors; unpublished seeds remain inert; raised bounds never block recording signed prev
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.heldRoute E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.skipRoutes root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile.go Reconciler.installWithWork C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote Install dispatch preserves serving registration and distinguishes hold-only relocation from installation.
plan14_input_inventory_test.go:424: J4 internal/host/movesstage.go heldReleaseProbeRelease C+E1 linux:internal/host/moveswakesource.go:movesWakeSources.Open root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go GenerationProcess.valid E2 linux:internal/release/rootgenerations.go:validGeneration E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationpins.go stageGenerationSibling E2 linux:internal/release/adopt.go:backfillManifestDigest E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/rollout/failures.go FailureBook.saveLocked E3 linux:internal/rollout/rootfailures.go:RootFailures.ImportLegacy rev3=PROPOSED-p3;run=8;identity=root adoption uid 0 or legacy rollout uid carlos;basis=root instance uses checked store writer; legacy instances retain the original atomic file writer and epoch semantics
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_delivery.go RootHistory.ReceiveReconstruction E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/caps/render.go RenderService E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.BeginUpdateWith D linux:internal/hostfloor/disk.go:Disk.Begin rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go validScope E1 linux:internal/historyreadback/readback.go:enrolled Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_containment_linux.go generationContainedStatus E2 linux:internal/host/rootgeneration_containment_linux.go:generationKernel.containedTask PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration.go rootMigration.run G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=offline guarded migration reobserves changed claims, retains union of session tuples, publishes only durable completion and verifies completed replay without rewriting census
plan14_input_inventory_test.go:424: J4 internal/hostguard/record_unix.go recordDir.openRecord C linux:internal/hostguard/record_unix.go:recordDir.read root-input
plan14_input_inventory_test.go:424: J4 internal/host/relocationowners.go relocationAfterAdmission C linux:internal/host/relocationowners.go:RelocationSource.Open After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_linux.go randomMigrationID G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=cryptographic nonce identifies newly collected stop evidence, never authorizes a stop
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.VerifyDigest C+G linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authorize root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go Adoptable C+E3 linux:internal/host/proofask.go:mintAsker.tick root-route;kept=C,E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/participant.go Participant.Sweep C+D Sweep reads fresh claim before retiring a participant; absence never manufactures a local discharge.
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go rootUpdateReady E3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=probes the canonical deployment endpoint before root records runtime served/request success
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.retained E3 linux:internal/host/buildstate.go:buildStates.heldTarget root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/launchjournal.go LaunchJournal.Prelaunch C linux:internal/host/claimroleassembly_linux.go:ClaimRoleAssembly.Prelaunch root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease.go decodeHeldReleaseRequest C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.ServeHTTP root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go ClaimAssembly.relocationVerifyLocal C linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed.
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go ColdHandover.Recover C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending A provably superseded cold admission can abandon its barrier without discarding its receipt.
plan14_input_inventory_test.go:424: J4 internal/release/rollback.go writeGroupRefusals E1 linux:internal/release/adopt.go:adoptHost E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go type Request E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.start E1+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.Serve E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go directory.write A+F+G linux:internal/rootstate/state_linux.go:directory.Write rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go rootRestartChecks.noteLegacy B3 linux:internal/host/rootrestart.go:rollbackUnitRestart rev3=merge-ruling-4;basis=Log the no-census legacy restart once through the pass-shared diagnostic latch.
plan14_input_inventory_test.go:424: J4 internal/release/releaseexclusion.go type ReleaseExclusion E2 linux:internal/host/rootlaunchverifier.go:type rootLaunchVerifier PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_containment_linux.go generationKernel.containedBinding E2 linux:internal/host/rootgeneration_containment_linux.go:generationKernel.containedTask PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/namedrecovery_pass.go namedUnitRecovery.passOption B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Production recovery wrapper preserves main exit status for per-host failures; only remaining named routes can probe the census for history selection. Ordinary routes make no census or binding-store reads. Fixtures: TestPlan14ERecoveryOrdinaryPass, TestPlan14Fix4AdoptPerHostFailureExitsZero, TestPlan14Fix5MainEquivalence.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/production.go Ledger.UpdateRequired D linux:internal/rootparticipation/production.go:OpenForUpdate Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go generationInstallation E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go JournalService.read C linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/writerstop.go operationWriter C linux:internal/hostguard/writerstop.go:LandingWriter root-input
plan14_input_inventory_test.go:424: J4 internal/release/proofgate.go ProofGate.admit B3 linux:internal/release/adopt.go:adoptHost root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_authority.go ClaimRootHTTP.executionAuthority D linux:internal/host/rootexecution_migration.go:ClaimRootHTTP.executionAuthorityWithMigration Fresh claim, deployment binding and root installation authorize participation, including the retained source only.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go type generationInventory E2 linux:internal/host/rootgeneration_inventory.go:productionLocalGenerationInventory E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootserving.go RootBroker.servingView D linux:internal/hostexec/rootbroker.go:RootBroker.Execute Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.readCensus D linux:internal/rootparticipation/ledger.go:Ledger.Census Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_readback.go type historyReadbackPublisher E1 linux:internal/host/roothistory_readback.go:publishRootHistoryReadback Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go readRootProtocolProjection F linux:internal/host/rootmovesfloor_source.go:readRootFloorProjection rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_healthy.go rootMovesFloors.healthy F linux:internal/host/rootfloor_healthy.go:rootMovesFloors.capLegacy rev3=PROPOSED-p3;identity=root health acceptance, normal floor refresh and local seeds-bound readers, uid 0;basis=reads bounded private root health record; missing or malformed record supplies no legacy cap
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_timers.go type rootMigrationTimerRecord G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=retains original stopped inventory, exact observed timer contents and registrations, successor inventory and root revision through interrupted migration
plan14_input_inventory_test.go:424: J4 internal/rollout/failures.go newBookID E1+E3 linux:internal/rollout/failures.go:OpenFailureBook fix1-merge-review;basis=Uses the named entropy source and propagates failure; retains authority classification despite no scanner-recognized direct read.
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerationpins.go type generationPinSource E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration.go rootMigration.write G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability
plan14_input_inventory_test.go:424: J4 internal/host/claimunit.go readClaimUnitSettings C+E3+G linux:internal/host/bootstrap.go:bootstrapWith rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=retains exact no-census unit settings; a claims-enabled complete census prepares the root-owned retry directory before the hardened controller starts
plan14_input_inventory_test.go:424: J4 internal/host/restart.go cycleWorkers E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_crossbox.go relocationBefore C linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission Before-admission dispatch binds relocation executor and probe phase before typed handover.
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go RouteAccount B3+E3+E4 linux:cli.go:runRoute root-route;kept=B3,E3,E4;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/heldwake.go DecideHeldWake E3 linux:internal/host/buildstate.go:buildStates.beforeExec root-input;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.unitBinding B3+E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=hashes persistent file identity into the canonical unit binding while preserving exact legacy source hashes without census
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_census_linux.go generationKernel.census E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go JournalService.Replay C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending root-input
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Disk.Load F linux:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/guard.go Guard.With C linux:internal/hostbox/work.go:selectedWork.With Recheck remote root denial immediately before the protected effect.
plan14_input_inventory_test.go:424: J4 history_cli.go historySave E1 linux:history_cli.go:historyCommand E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_kernel_linux.go linuxClaimLaunchKernel.tenant C+G linux:internal/host/claimlaunch_kernel_linux.go:linuxClaimLaunchKernel.Observe root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/guardtransaction.go installFloorHook D linux:internal/host/systemapply.go:RunSystemApply Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-config-sync.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/typedpark_linux.go TypedParker.Park C linux:internal/hostbox/typedretire.go:TypedRetirement.Run rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires persistent evidence for root-protected retirement and verifies source or replay destination before rename
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go validRootRestart E1 linux:internal/release/rootrestart_history.go:RootRestarts.Bindings E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationRead E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go type GenerationEvidence E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/hostexec/controller.go ClearStale D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/local_unix.go openDir D linux:internal/hostexec/local_unix.go:openLocal root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/pending_linux.go recoverPending D linux:internal/hostexec/pending_linux.go:RecoverPending root-input
plan14_input_inventory_test.go:424: J4 internal/release/program.go ArtifactProgram E1 linux:internal/release/program.go:ReleaseProgram root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_writers_linux.go rootInstallationCoverage C+G linux:internal/host/claimstop_writers_linux.go:verifyNoProcessAt rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=captures current checked descriptor identity for the extra state directory root derives from the canonical host; this ephemeral directory only expands the stop scan denial set
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofRouteReady B3 linux:internal/host/proofobserve.go:productionProofObserver kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.beforeExec E3 linux:internal/host/buildstate.go:buildStateHook Consumed request is tenant-bound before execution; unread registry refuses before state merge.
plan14_input_inventory_test.go:424: J4 internal/release/healthy_root.go readRootHealthy B+B4 linux:internal/release/healthy.go:ReadHealthy root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go historyRetirementKey E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootRefreshAndJudgeMovesPrev F linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return
plan14_input_inventory_test.go:424: J4 internal/host/namedrecovery_active.go namedUnitRecovery.recover B3+E1 linux:internal/host/namedrecovery_pass.go:namedUnitRecovery.passOption E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_available.go systemApplier.activationFloor F linux:internal/host/systemapply.go:systemApplier.activationRule rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound
plan14_input_inventory_test.go:424: J4 internal/release/healthy.go ReadHealthy B+B4 linux:internal/host/proofbinding.go:productionProofBindingSource root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback.go captureRollback B3+E1 linux:internal/host/roothistory_recovery.go:linkRootHistory Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go const RootGenerationsDir E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/hostguard/root.go type InstallationArtifacts E2 linux:internal/hostguard/root.go:type RootInstallation E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.floorArmed F linux:internal/host/systemapply.go:systemApplier.activationGuard rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go readLegacyJournals C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_boot.go rootFloorJournalPresent F linux:internal/host/guardexec.go:RunSystemGuardExec rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=checked authority-file presence selects recovery without opening a deployment store
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootview.go Guard.fenceLocked C+G linux:internal/hostguard/recoveryfence.go:Guard.ResumeFence rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.RecoverAcquisition D+F linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=retains acquisition-recovery checks and census commit under the same participation transaction; no new authority from a missing record
plan14_input_inventory_test.go:424: J4 internal/host/rootroute.go rootRecordRoute B3 linux:internal/host/rootroute.go:proofBindingSource.needsRestart trusted deployment record and root unit binding; durable per-attempt rollback and recovery
plan14_input_inventory_test.go:424: J4 internal/hostguard/retirement.go Guard.WithNoInstallation C linux:internal/host/claimproduction.go:claimAdminTokens.With Use the already-held root host lock for empty-installation authority checks.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go type HistoryHostStatus E1 linux:internal/release/roothistory_status.go:type HistoryMigrationStatus Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/console/browserrestart.go Server.handleBrowserRestart E1+E3 linux:internal/console/browserrestart.go:Server.handleAppRestart root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go coldNamespaceEmpty C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:424: J4 internal/release/consumedfence_linux.go lockConsumedCarry E3 linux:internal/release/consumedfence.go:FenceCarry root-input;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go syncSibling E2 linux:internal/release/adopt.go:stageFrom E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go PinFailover C linux:internal/hostrelocate/worker.go:Worker.Step Failover pinning requires recorded source fence and completed acknowledgement barrier.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go RootGenerations.Reserve E2 linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go rootMovesFloorIdentity F linux:internal/host/guardarm.go:RunSystemGuardArm rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=root-only census reader supplies deployment/box/enrollment; edge mode cannot call it
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBinding.authorizedRecovery B3+E1 linux:internal/host/rootupdates.go:rootUpdateSource.resolve Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go recoveryResultKey E1 linux:internal/host/rootrollback.go:settleRollbackAttempt Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/proofnamed.go proofExecPath B3 linux:internal/host/proofobserve.go:proofObserver.observe fix1;basis=Authorizes recordless units only from descriptor-checked root configuration, installed console guard evidence, root history or the matching root update capture.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RestartIntent E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_requirements.go inventoryTimerNames E2 linux:internal/host/rootgeneration_requirements.go:generationRequiredInventory E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly_linux.go ClaimRoleAssembly.PrepareState C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build rev3=PROPOSED-p3;identity=carlos agent claim lifecycle uid carlos; final authorization remains in root;basis=reuses state directories using root-captured persistent identity when present; legacy local inventories retain the prior same-device comparison
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-restart.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go backfillManifest E2 linux:internal/release/adopt.go:backfillManifestDigest E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/participation.go checkLegacyParticipation D linux:internal/hostfloor/disk.go:Disk.Begin Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.heldGenerationPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.armFloor F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go readLine F linux:internal/host/movesfloor.go:withMovesFields root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/pending_linux.go tryExistingPendingLock D linux:internal/hostexec/pending_linux.go:recoverPending root-input
plan14_input_inventory_test.go:424: J4 internal/release/versions.go PointLive B3+E2 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover rev3=merge-ruling-5;basis=Compare resolved current and previous paths before retaining the running build; preserve repoint errors and canonical retained pointers.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Finish E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/releaseexclusion.go ReleaseExclusion.With E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/release/updatetarget.go NextConsumed E3 linux:internal/release/adopt.go:settingsTarget Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go retirementEvidence E1 linux:internal/release/roothistory_retirement.go:RootHistory.RetireRecovery Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/proofgate.go ProofGate.hold B3 linux:internal/release/proofgate.go:ProofGate.admit root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go type generationMount E2 linux:internal/host/rootgeneration_kernel_linux.go:generationMounts E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_boot.go rootFloorPrevVerdict F linux:internal/host/rootmovesfloor_boot.go:rootFloorBootCandidate rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches actual signed previous binary to identity and accepted generation before allowing its gate
plan14_input_inventory_test.go:424: J4 internal/hostfloor/image_linux.go ExecutingHash F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go stageHeld C+E1+E2 linux:internal/release/materializeheld.go:StageHeldVerifiedWithPins root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_requirements.go rootInventoryArtifacts E2 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/guardarm.go RunSystemGuardArm F linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go capabilityPlan E4 linux:internal/release/adopt.go:adoptHost root-route
plan14_input_inventory_test.go:424: J4 internal/host/seedsfloor.go readLocalSeedsFloor F linux:internal/host/seedsfloor.go:withSeedsFields rev3=census-ruling-seeded-instances;basis=system apply (/opt/carlos/carlos system apply, or carlos.prev system apply, with --recover at boot; carlos-system-update.service and carlos-system-recover.service; root) and the adopt pass (/opt/carlos/carlos adopt in every mode; carlos-adopt.service, carlos-config-sync.service, carlos-restart.service and carlos-stage.service; root); also the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), for its hourly refresh and its edges file: seeds twin of the moves floor (F,J4); deny-only; Part 3 F2-F4 must cover the seeds floor alongside the moves floor.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_recovery.go linkRootHistory B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_delivery.go RootHistory.ReceiveRecoveryRetirements E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_retirement.go generationRetirement.retire E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retireAll E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_evidence.go readMigrationStop G linux:internal/host/rootmigration_collect_linux.go:recoverMigrationStop rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_linux.go rootMigrationLegacySuspects G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go openRootMovesFloors F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed moves namespace then delegates checked root store opening
plan14_input_inventory_test.go:424: J4 internal/host/seedsfloor.go withSeedsFields F linux:internal/host/edgesfile.go:edgesFileLoop rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go type GenerationProcess E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.runWithRelease D+F linux:internal/host/systemapply.go:RunSystemApply rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=root CLI carries E release exclusion through apply and recovery; nested guards reuse its token; absent census runs the exact legacy body
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationCurrentBinding E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=permits an old generation without persistent evidence only in its recorded boot; otherwise refuses instead of guessing identity
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-adopt.service external B3+C+D+E1 linux:internal/host/bootstrap.go:var unitsFS root-input;kept=B3,C,D,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/regionalworker.go RegionalWorker.runHost C linux:internal/hostbox/regionalworker.go:RegionalWorker.Run root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory.go ClaimRootHTTP.verifyInventoryPath C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=uses checked persistent evidence for protected installation entries; explicit legacy fixtures preserve their same-boot check
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.absent E2 linux:internal/host/rootgeneration_census_linux.go:generationKernel.census E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.;rev3=PROPOSED-p3;run=8;identity=root generation kernel census uid 0;basis=uses current-boot scanner identities only after retained filesystem and handle verification; immutable reservations remain unchanged
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go withMovesFields F linux:internal/host/edgesfile.go:edgesFileLoop rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent uses root-owned public projection when participating and its original writable mirror otherwise
plan14_input_inventory_test.go:424: J4 internal/release/buildstate.go ReadConsumed E3 linux:internal/host/updatesreport.go:updatesReader root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.RegisterLanding C linux:internal/host/claimassembly.go:ClaimAssembly.Build Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.selector F linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_proof.go legacyJournalProof C+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movespass.go armPhase1 B2+C linux:internal/host/movespass.go:armMovesPass rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the S1 probe hook refusing a row whose import gate is set; main's B2,C authority retained
plan14_input_inventory_test.go:424: J4 internal/hostfloor/remote.go CheckRemote F linux:internal/hostexec/controller.go:Config.checkRemoteUpdateIdentity root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go type HistoryMigrationStatus E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/participant.go Participant.sameInstallation C linux:internal/hostrelocate/participant.go:Participant.Step Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_linux.go publishMigrationReceipt G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reconstructs immutable key/digest from original signed receipt bytes without changing evidence time
plan14_input_inventory_test.go:424: J4 internal/host/versionsweep.go settingsPins E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-route
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.authority C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate.
plan14_input_inventory_test.go:424: J4 internal/host/proofnamed.go proofBindingSource.findRecord B3 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover rev3=merge-ruling-5;basis=Cache index success or failure once per pass; selected records and ETags remain freshly read.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_payload_linux.go generationPayloadFiles E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=verifies materialized payload entries by persistent filesystem evidence before admitting their files into the absence scan
plan14_input_inventory_test.go:424: J4 internal/host/claimunit_binding.go claimUnitBindings.check E2 linux:internal/host/claimunit_placement.go:ClaimLaunchRoot.checkUnitBinding PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go rootRefreshAndJudgeSeedsPrev F linux:internal/host/movesfloor.go:rootJudgePrevWithSource rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests.go productionRestartRequestPass E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.write E1 linux:internal/release/rootrestart_history.go:RootRestarts.Finish E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_identity.go VerifyInventoryFile C+E2+G linux:internal/host/rootgeneration_payload_linux.go:generationPayloadFiles rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires persistent root evidence and compares filesystem handle, ownership and stable mount attachment across boots
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.report E1+E3 linux:internal/host/rollout.go:legacyRolloutStatusProbe fix1-merge-review;basis=Reports only durable published restriction epochs and the supported retry protocol; reports do not grant authority.
plan14_input_inventory_test.go:424: J4 internal/host/guardtransaction.go systemApplier.beginGuard D linux:internal/host/systemapply.go:systemApplier.Run Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/hostbox/rolelaunch.go LaunchJournal.UnitReservation C linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/root.go RootAuthority.read C+G linux:internal/hostguard/root.go:Guard.Capture rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=strict checked root record decoding includes retained migration session denials
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationRootTask E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/hostbox/restore.go syncFile C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/guard.go Guard.freshObserved C linux:internal/hostguard/guard.go:Guard.fresh root-input
plan14_input_inventory_test.go:424: J4 internal/console/apirestartscope.go environmentNames E1+E3 linux:internal/console/apirestartscope.go:resolveRestartScope root-route
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go productionSysOps D+F linux:internal/host/agent.go:runAdopt root-input;kept=D,F;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_migration.go migrateClaimJournalsWith G linux:internal/host/claimjournal_migration.go:RunSystemJournalMigrate rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=opens verified actor and root journal then selects full offline census or unchanged legacy journal import
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootFloorAdvertisementFor F linux:internal/host/rootmovesfloor_refresh.go:withRootMovesFields rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict
plan14_input_inventory_test.go:424: J4 internal/hostops/move_fence_release.go MoveRecoveryGrant.ReleaseFencedTarget C+D linux:internal/console/movesrecovery.go:Server.movesRecovery Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation.
plan14_input_inventory_test.go:424: J4 internal/release/program.go FileProgram E1 linux:internal/release/adopt.go:adoptHost root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration.go rootMigrationSnapshot.fingerprint G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=binds exclusion and membership across observations/restart while allowing boot metadata and independently recovered payload revision
plan14_input_inventory_test.go:424: J4 internal/host/claimunit.go var readClaimUnitFile C+G linux:internal/host/claimunit.go:readClaimUnitSettings root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_install.go landingRegistrationMatches C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.activationGuard D+F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos system apply/recover root units and offline root CLI uid 0;basis=release exclusion then scoped participation transaction then effective moves/seeds floor and registry; signed candidate checks remain inside guard; nested journal close reuses live exclusion
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go journalPrune C linux:internal/hostbox/journalservice.go:JournalService.executeWithInventory root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/writer.go Writer.Published C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback_resume.go recoverRootRestarts B3 linux:internal/host/agent.go:runAdoptUnderRootRelease Recover every attempt independently, skip settled writes and remove leftover capabilities.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go RequestKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go rootGenerationSource.reserve E2+E3 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=writes root runtime intent after the generation reservation and before launch under release and host exclusion
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go const rootGenerationCompletenessLimit E2 linux:internal/release/rootgenerationcompleteness.go:RootGenerations.Completeness E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go generationOwner E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/hostexec/local_unix.go tryAcquireNamed D linux:internal/hostexec/local_unix.go:tryAcquire root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimowners.go claimServingOwners.launchDigest C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/pins.go GenerationVersions E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/clock_linux.go BootID D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime root-input
plan14_input_inventory_test.go:424: J4 internal/release/proofgate.go ProofGate.bindRecording B3 linux:internal/release/roothistory_pass.go:passConfig.bindProof root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerationpins.go productionRootGenerationPins E2 linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go publishHeld C+E1 linux:internal/release/materializeheld.go:materializeHeld root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootclient.go requestIdentity D linux:internal/hostexec/rootclient.go:RootClient.close D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently.
plan14_input_inventory_test.go:424: J4 internal/host/systemunits.go ensureSystemUnits F linux:internal/host/agent.go:runAdopt root-input;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/stopjournal_reader.go LaunchJournal.ReadStopKernelJournal C linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped root-input
plan14_input_inventory_test.go:424: J4 internal/host/relocationowners.go ClaimAssembly.relocationReleaseHold C+D linux:internal/host/relocatepass.go:newCompletionRuntime Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go type generationKernel E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/registry/remote.go serveRemote E2 linux:internal/registry/remote.go:ServeRemote Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go FenceSource C linux:internal/hostrelocate/worker.go:Worker.Step Source-loss transition independently verifies termination fence and enrollment before revoking its participation.
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_root.go type movesHeldReleaseRoot E2 linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/caps/converge.go Ops.ensureUser E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/root.go type RootInstallation E2 linux:internal/host/rootinstallation.go:rootInstallationHostApp E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/controllers_linux.go EnsureControllerDir F linux:internal/host/guardarm.go:guardArmControllers root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimunit.go claimUnitContent E1+E3 linux:internal/host/bootstrap.go:bootstrapWith rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=adds write permission for exactly the public retry directory only when the root settings reader has verified a complete census and prepared that directory
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_timers.go rootMigrationTimers.key G linux:internal/host/rootmigration_timers.go:rootMigrationTimers.adopt rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=scopes the durable timer adoption intention to the root-observed installation and denied session
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go const generationCompletenessKey E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_healthy.go systemApplier.acceptRootFloorHealthy F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=reads signed installed bytes after the system health gate; writes independent moves and published-seeds root observations
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor_linux.go openMovesDir F linux:internal/host/movesheldlock.go:withHeldStageLock root-input
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go routeReady B3 linux:internal/host/agent.go:agentCheckedUnitRestart root-route
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go JournalRelease C linux:internal/hostrelocate/participant.go:Participant.Step Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy.
plan14_input_inventory_test.go:424: J4 internal/host/claimretire_transport.go ClaimRootHTTP.retire C+G linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=requires persistent root-captured artifact evidence when constructing the protected retirement parker
plan14_input_inventory_test.go:424: J4 internal/release/sweep.go treeStats E2 linux:internal/release/sweep.go:SweepStaged root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go claimInputPolicy C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.pointerLoop E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Delegates each iteration to pass; retains ownership of the retry/restriction authority path despite no direct read.
plan14_input_inventory_test.go:424: J4 internal/instancectl/peer_tuple_linux.go AuthenticatePeerTuple C+G linux:internal/host/claimstop_production.go:NewProductionClaimStopHandler root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/generationpayload.go type GenerationPayload E2 linux:internal/host/rootgeneration_inventory.go:type generationInventory E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.install F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=root verifies staged signature and final locked bounds before rename, then records root accepted floor history only after health succeeds
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor_publication.go readRootSeedsBound F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=root normal adopt/apply refresh, system apply/recover and guard floor readers, uid 0;basis=unpublished seeds supplies no bound; verified retained publication and root-capped denies determine the bound
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go rootUpdateSource.retryStatus E3 linux:internal/host/rootupdates_runtime.go:rootUpdateSource.publishRetry rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=derives retry identity and restrictions from root-held failures and epoch-bound served observations
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.MintHeld C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.MintHeldUnder Local held-row mint requires matching nested installation ownership and operation; production remote path uses separate registration.
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_client.go productionClaimLocal.prepareWith D linux:internal/host/claimparticipation.go:productionClaimLocal.Prepare Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority.
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.plan E1+E3 linux:internal/host/rolloutdeclined.go:honourDeclinedFailures root-route
plan14_input_inventory_test.go:424: J4 internal/registry/importjournal.go Registry.ImportJournalHosts G linux:internal/registry/remote_dispatch.go:Registry.dispatchRemote rev3=census-ruling-seeded-instances;basis=its SQLite arm as carlos, in the agent or the registry child (carlos __registry-child); its remote arm in whichever process holds a remote handle, and a root pass does. No caller in the tree yet, outside the child's dispatch: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go StageHeldVerifiedWithPins E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.stageRelease E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/rootstate/file_linux.go OpenTrustedFile A+B3 linux:internal/host/rootgenerations_launch.go:productionRootGenerations kept=B3;scope=canonical-binding-and-readiness;implementation-incomplete
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_linux.go migrateRootClaimAuthority E3+G linux:internal/host/claimjournal_migration.go:migrateClaimJournalsWith rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration adopts pre-claim timers only after verified root stop evidence; resumes its exact saved intention under release and migration exclusion, rechecking kernel absence before completion;rev3=PROPOSED-p3;run=8;identity=offline journal-migrate uid 0;basis=initializes root failure history after a complete census; legacy bytes add only denies and never retry permission
plan14_input_inventory_test.go:424: J4 internal/hostfloor/image_linux.go OpenProtected F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_retirement.go generationRetirement.closure E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/claimwakestop.go ClaimAssembly.stopRetryAttempt C+G linux:internal/host/claimwakestop.go:ClaimAssembly.bindClaimWakeStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/guardtransaction.go legacyGuardEntries D linux:internal/host/guardtransaction.go:installFloorHook Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go JournalService.CheckLegacyMigration C linux:internal/host/claimjournal_migration.go:checkClaimJournalMigration root-input
plan14_input_inventory_test.go:424: J4 internal/release/healthy_root.go addRootHealthy B+B4 linux:internal/release/healthy_root.go:recordRootHealthy root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile.go Reconciler.completedHold C linux:internal/hostbox/reconcile.go:Reconciler.checkOn Completed relocation catch-up can hold only its recorded old source row and creates no installation authority.
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_timer_mutation.go ClaimRootHTTP.applyTimerMutation E2 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/release/pins.go nextGenerationsSeq E2 linux:internal/release/pins.go:WriteGenerations root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go passConfig.recheckHistory E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go relocationRecord C+E3 linux:internal/host/relocatepass.go:relocationRelocatable Canonical relocation record and update policy derive nested installation shape; source account/incarnation is rechecked by root registration.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationpins.go WithRootGenerationPins E2 linux:internal/host/agent.go:runAdoptUnderRootRelease E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go LaunchJournal.HasHost C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal root-input
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.forHost B3 linux:internal/host/rootrestart.go:productionRootRestartChecks canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/hostbox/restore.go loadPinned C linux:internal/hostbox/restore.go:ColdRestore.Install root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go RootHistory.recoveryRetired E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/rootstate/live.go HoldLive A+D linux:internal/hostexec/rootbroker.go:RootBroker.write fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests_source.go rootRestartRequestSource.target E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootFloorJudge.judge F linux:internal/host/systemapply.go:systemApplier.notePrev rev3=PROPOSED-p3;identity=carlos adopt normal refresh and carlos system apply notePrev, uid 0;basis=observes participation before floor lock; writes identity-bound current/prev verdict even under unknown history without blocking repair executor
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go productionGenerationInventory E2 linux:internal/host/rootgenerationpins.go:productionRootGenerationPins E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go journalIdentity C linux:internal/hostbox/generationinventory.go:LaunchJournal.GenerationLaunches root-input
plan14_input_inventory_test.go:424: J4 internal/host/heldstage.go heldStageRow C+E1 linux:internal/host/heldstage.go:heldStageAuthority root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostfloor/floor.go Read F linux:internal/host/hostfencepass.go:hostFenceOnce root-input
plan14_input_inventory_test.go:424: J4 internal/provision/reconcile.go RouteFor C+E3 linux:internal/host/rootupdates.go:rootUpdateSource.resolve rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos); also root, in the claim root's landing registration (ClaimRootHTTP.rootLandingRoute) and the relocation install (relocationRecord): main's body with one more field: the row's seed column, derived from the record's seed (SeedColumn). Every caller gets it, the two root ones included, so a root-registered row for a seeded record now carries the seed the activator places from; main's C,E3 authority retained
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_settle.go ClaimRootHTTP.settleExecution D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim.
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go rootGenerationSource.resolve E2 linux:internal/host/rootgenerations_launch.go:rootGenerationSource.reserve E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.;rev3=PROPOSED-p3;run=8;identity=root claim launch uid 0;basis=captures persistent executable and tree proofs only after canonical installation and signed artifact verification under exclusion
plan14_input_inventory_test.go:424: J4 internal/host/claimcleanup_identity.go claimCleanupEnrollment.configureSigner C+G linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.Launch C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimparticipation_relocation.go productionClaimLocal.Acknowledged D linux:internal/host/relocatepass.go:NewRelocationRuntime Relocation acknowledgement waits for bound controller readiness; participates in execution admission.
plan14_input_inventory_test.go:424: J4 internal/host/proofroot.go proofRoot.recordLive B3 linux:internal/host/proofroot.go:proofRoot.around rev3=merge-ruling-5;basis=Exclude ordinary unstamped and derived routes before pre-pass binding and health observation.
plan14_input_inventory_test.go:424: J4 internal/release/restartscope.go RestartScope.Selects E1+E3 linux:internal/host/restartscope.go:scopedHosts root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go checkLegacySchema C linux:internal/hostbox/journalmigration_linux.go:readLegacyJournals root-input
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go validStatus E1 linux:internal/historyreadback/readback.go:ReadStatus Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go RootHistory.MigrationStatusWithSources E1 linux:internal/host/roothistory_maintenance.go:rootHistoryMaintenance.run Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 history_cli.go historyReadFile E1 linux:history_cli.go:historyCommandWithSave E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_transport.go ClaimRootHTTP.serveJournal C linux:internal/host/claimretire_transport.go:ClaimRootHTTP.ServeHTTP root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go claimUnitStopKernel.settleUnits C+E2+G linux:internal/host/claimlaunch_root.go:claimUnitStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckHeld C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install Hold-only source checks its own row-owned installation inventory rather than the target holder stamp.
plan14_input_inventory_test.go:424: J4 internal/hostguard/recoveryfence.go Guard.recordNames C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go rootRestartChecks.allowLegacy B3+G linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-4;basis=Evaluate the explicit census selector; omitted test selector remains strict.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/report.go ReadEnrollment F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_creation.go rootRestartRequestSource.creation E1 linux:internal/host/roothistory_creation.go:rootHistoryCreation E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootmigration.go RootAuthority.CompleteMigrationInventory G linux:internal/host/rootmigration_timers.go:rootMigrationTimers.adopt rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=root fence completion binds the migration inventory revision; timer adoption permits only its exact previous revision plus one and recommits visible failed writes
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go WithRunningVersion B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=fix3-Astra-P2;basis=Root-only hook supplies verified current or previous running authority before replacing pointers.
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go ColdHandover.Run C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=carries persistent identity into root-guarded cold retirement without treating old device numbers as filesystem identity
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.CheckLocal C linux:internal/host/claimassembly.go:ClaimAssembly.Build Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception.
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.installRemote C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install Remote install snapshots old source inventory outside host lock and rechecks revision in hold-only path.
plan14_input_inventory_test.go:424: J4 history_cli.go historySync E1 linux:history_cli.go:historySave E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/movesfloorgate_linux.go readFloorGateFile F linux:internal/host/movesfloorgate_linux.go:floorAllowsPrev root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go withRootMovesFields F linux:internal/host/movesfloor.go:withMovesFields rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go refreshRootMovesFloor F linux:internal/host/systemapply.go:systemApplier.armFloor rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=normal adopt/update combines remote object with independent deny-only legacy evidence under root floor lock
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.heldTarget E3 linux:internal/host/buildstate.go:buildStates.wakeTarget root-route
plan14_input_inventory_test.go:424: J4 internal/host/retention.go retentionPass E2 linux:internal/host/agent.go:retentionLoop root-route
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.checkHeldInventory C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckHeld Held-inventory validator requires exact box/enrollment, ownership and single materialized route.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationKernel.task E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationLinkRef E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/caps/converge.go scanClaims E4 linux:internal/caps/converge.go:Ops.checkClaimsOnDisk root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimwakestop.go ClaimAssembly.localStopIdentity C+G linux:internal/host/claimparticipation.go:productionClaimLocal.bind root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/instancectl/peer_tuple_linux.go procStart C+G linux:internal/instancectl/peer_tuple_linux.go:AuthenticatePeerTuple root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go ClaimAssembly.relocationInstall B2+C+E2 linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open.
plan14_input_inventory_test.go:424: J4 internal/hostops/completion_fence.go ProductionAuthority.completionFence C linux:internal/hostops/production_held_start.go:ProductionAuthority.startAppLifecycle Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go LinuxStopKernel.recoverAfterReboot C linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=rechecks the persisted inventory filesystem before rebasing deny-only descriptor identities into the current boot; old process and cgroup identities remain boot-scoped
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalnamespace_linux.go prepareJournalDirectory C+G linux:internal/hostbox/journalnamespace_linux.go:PrepareRootJournalDirectory rev3=PROPOSED-p3;identity=offline journal migration and instance-control/adopt startup uid 0;basis=admits only private root-owned authority and held-release alongside existing retire/migration namespaces; every ownership/type/mode check and unknown-directory refusal remains
plan14_input_inventory_test.go:424: J4 internal/host/heldstage.go heldStagePass E2 linux:internal/host/agent.go:runAdoptUnderRootRelease E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.resolve B3 linux:internal/host/rootupdates.go:productionRootUpdates fix1;basis=Binds deployment or root-managed named-unit evidence, trusted unit identity and digest history; registry names are hints only.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_startup.go verifyRootMigrationRetained F+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory
plan14_input_inventory_test.go:424: J4 internal/host/heldstage.go heldStageCheck C+E1 linux:internal/host/heldstage.go:heldStageAuthority route-and-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go digest E1 linux:internal/historyreadback/readback.go:RequestKey Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_creation.go RootHistory.FreshInstallation E1 linux:internal/host/rootgeneration_requirements.go:productionGenerationCreation E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go MaterializeHeldUnder C+E1+E2 linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go ClaimAssembly.relocationBuildAuthority C+D linux:internal/host/relocationbuild.go:ClaimAssembly.relocationBuild Relocation build revalidates operation, captured install stamp, prepared pin and execution participation before writes.
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go judgePrevWith F linux:internal/host/movesfloor.go:rootJudgeMovesPrevWithSource route-and-input
plan14_input_inventory_test.go:424: J4 internal/instanceexec/claimexec_linux.go checkClaimExec E2 linux:internal/instanceexec/claimexec_linux.go:scopedClaimInit PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/release/bake.go LoadFirstSeen E1+E3 linux:internal/release/adopt.go:PassFilter root-input
plan14_input_inventory_test.go:424: J4 internal/provision/rootrecord.go RecordIndex.Find B3+C linux:internal/provision/rootrecord.go:FindRecordByHost Use cached key identity but read and validate current record body and ETag.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_outcomes.go RootHistory.recoveryRefusals E1 linux:internal/release/roothistory.go:RootHistory.Refusals Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go type RootGenerations E2 linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/host/claimbackfill.go newClaimBackfill C+G linux:internal/host/agent.go:instancesLoop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationStart E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.controllerGone E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_migration_linux.go createClaimEdgeMask C+G linux:internal/host/claimjournal_migration_linux.go:quiesceLegacyClaimJournals root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/roleintention_linux.go LaunchJournal.ResolveRoleIntentions C linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.resolveRoleIntentions root-input
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go backfillManifestDigest E2 linux:internal/release/adopt.go:adoptHost E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/hostguard/generationinventory.go RootAuthority.generationInstallation E2 linux:internal/hostguard/generationinventory.go:RootAuthority.GenerationInstallations E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go systemdUnits.JournalTail B3 linux:internal/host/unitsettle.go:settleUnit root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_timers.go rootMigrationTimers.owner G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=derives installation ownership from root-observed host, incarnation, stamp and box, never a service row owner
plan14_input_inventory_test.go:424: J4 internal/host/relocationattempts.go relocationAttemptReader.ReadAttempt C linux:internal/host/claimlaunch_authority.go:ClaimLaunchRoot.authoritativeAttempt Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizeReconstruction F rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction_linux.go readClaimEvidenceKey C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostguard/guard.go Guard.Activate C linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build Pending intent and durable quarantine remain denial conditions.
plan14_input_inventory_test.go:424: J4 internal/provision/reconcile.go mintHeld C linux:internal/provision/reconcile.go:Reconcile Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior.
plan14_input_inventory_test.go:424: J4 internal/host/agent.go agentRollbackUnitRestart B3 linux:internal/host/agent.go:adoptLoop kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_stopped_linux.go verifyMigrationStopped G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery
plan14_input_inventory_test.go:424: J4 internal/host/claimcensus.go claimUnitCensus C+G linux:internal/host/claimcensus.go:claimGlobalSharedPaths root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimconstruction.go refusingRootWake C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/versionsweep.go sweepStagedVersions E2 linux:internal/host/versionsweep.go:sweepStagedVersionsPass root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.
plan14_input_inventory_test.go:424: J4 internal/host/claimrelocationrelease.go RelocationReleaseReceipts.Complete C+G linux:internal/host/relocationreleases.go:verifyDischargedReceipt root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go relocationActivationReader.Read C linux:internal/host/rootinstallation.go:rootInstallationHostApp Activation reader obtains a fresh claim and applies typed relocation installation authority before activation.
plan14_input_inventory_test.go:424: J4 internal/hostguard/root.go RootAuthority.write C+G linux:internal/hostguard/record_unix.go:recordDir.write rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=retains migration denials atomically with the existing root installation, fence and retired-state record
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go passConfig.bindProof E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.idle D linux:internal/rootparticipation/ledger.go:Ledger.RecoverAcquisition D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_readback.go historyReadbackPublisher.publish E1 linux:internal/host/roothistory_readback.go:publishRootHistoryReadback Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor_publication.go type rootSeedsPublication F linux:internal/host/rootseedsfloor_publication.go:verifyRootSeedsPublication rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose
plan14_input_inventory_test.go:424: J4 internal/hostexec/controller.go Open D linux:internal/host/claimparticipation.go:productionClaimLocal.prepareLegacyWith root-input
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartGenPass E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:424: J4 internal/hostfloor/image_linux.go Disk.Run F linux:internal/host/guardtransaction.go:systemApplier.guardRun root-input
plan14_input_inventory_test.go:424: J4 internal/host/restart.go loadRestartMarks E1+E3 linux:internal/host/restart.go:restartPass root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration.go rootMigration.census G linux:internal/host/rootmigration.go:rootMigration.run rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=writes through Ledger.MigrationCensus under transaction.lock and preserves revisions on completed replay
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go prepareRootRetryUnitDirectory E3 linux:internal/host/claimunit.go:readClaimUnitSettings rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=root unit installer requires an independently opened complete census before creating the public retry directory or enabling its controller write path
plan14_input_inventory_test.go:424: J4 internal/activator/backend_exec.go ExecBackend.startSidecarUnitFrom E2 linux:internal/activator/genbackend.go:ExecBackend.StartSidecarGen E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:424: J4 internal/host/edgesfile.go edgesFileWriteClaims F linux:internal/host/edgesfile.go:edgesFileLoop root-route;kept=F;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go Open A linux:internal/host/movesheldrelease_production.go:WithProductionMovesHeldRelease root-input
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go restartEffectFailed B3 linux:internal/host/rootrestart.go:restartBoundUnit E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_containment_linux.go generationIdentity E2 linux:internal/host/rootgeneration_containment_linux.go:generationKernel.containedBinding PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go declinedClaimGate C+G linux:internal/host/claimmoveaccess.go:claimMoveLaunchSource root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_writers_linux.go LinuxStopKernel.VerifyNoProcess C+G linux:internal/host/rootexecution_settle.go:ClaimRootHTTP.cleanupExecution root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/roothistory.go RootHistory.read E1 linux:internal/release/roothistory.go:RootHistory.RecordInstalledProgram Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.
plan14_input_inventory_test.go:424: J4 internal/activator/backend_exec.go ExecBackend.seedUnit E2 linux:internal/activator/backend_exec.go:ExecBackend.Seed E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_available.go rootFloorAvailable F linux:internal/host/rootseedsfloor.go:rootSeedsAllowsBinary rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available
plan14_input_inventory_test.go:424: J4 internal/hostbox/launchjournal.go LaunchJournal.mutate C linux:internal/hostbox/rolelaunch.go:LaunchJournal.CloseWriters root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_boot.go rootFloorAllowsPrev F linux:internal/host/movesfloorgate.go:floorGateMain rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=signed prev identity satisfies local moves and published seeds bounds, relaxed only when no certified build meets bound; caller checks participation separately
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go readRootProtocolBound F linux:internal/host/rootmigration_startup.go:verifyRootMigrationFloors rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance
plan14_input_inventory_test.go:424: J4 internal/host/claim_evidence_producer.go ConfigureStopEvidence C+G linux:internal/host/claim_evidence_wiring.go:ClaimOwnerBindings.claimEvidenceCoordinator root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.ownedRow C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install Extracted row writer retains complete typed inventory and immutable route identity around guarded write.
plan14_input_inventory_test.go:424: J4 internal/host/claimowners.go claimServingOwners.Select C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go verifyStopKernelMounts C+G linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go StartRelocation C Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_startup.go verifyRootMigrationStartup F+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=checks root-owned migration records and typed journal revisions before issuing startup grants; absent census leaves main path intact
plan14_input_inventory_test.go:424: J4 internal/host/claimready_linux.go claimProbePeer B3 linux:internal/host/claimready_linux.go:claimProbeSocketReady root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go stageFrom E2 linux:internal/release/adopt.go:ensureStagedDigest E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.layoutReversalReasons F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.BeginUpdate D linux:internal/host/systemparticipation.go:systemApplier.checkUnarmedParticipationRecovery Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go applyRetries E1+E3 linux:internal/host/restart.go:restartRequestLeg rev3=PROPOSED-p3;identity=carlos agent retry consumer uid carlos;basis=preserves legacy local retry behavior and relays independently verified root-book retry requests to the existing root adoption marker
plan14_input_inventory_test.go:424: J4 internal/instanceexec/claim_generation_linux.go ScopeClaimGeneration E2 linux:internal/instanceexec/claimexec_linux.go:scopedClaimInit PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RootRestarts E1 linux:internal/host/rootrestart_requests.go:productionRestartRequestPass E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.restoreVersion F linux:internal/host/systemapply.go:systemApplier.recoverIfNeeded rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.refreshAll E3 linux:internal/host/agent.go:fastConvergeLoop root-route
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_linux.go readHeldRenderHash C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_authority.go ClaimLaunchRoot.authorize D+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation. PROPOSED E47: final named-unit launch authorization rechecks the retained root binding and refuses missing, retired, foreign or changed canonical shape.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go restartVerifiedOrdinaryUnit B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-4;basis=Retain the checked ordinary-unit path for strict census-backed operation.
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go rootRestartChecks.mintRefusals B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.carryRequest E3 linux:internal/host/buildstate.go:moveCarry Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary.
plan14_input_inventory_test.go:424: J4 internal/release/sweep.go LivePins B3+E2 linux:internal/host/versionsweep.go:sweepStagedVersions Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping.
plan14_input_inventory_test.go:424: J4 internal/host/claimready_other.go claimProbeSocketReady B3 darwin:internal/host/claimconstruction.go:claimGroupDWiring root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.heldHost E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.skipHost root-route
plan14_input_inventory_test.go:424: J4 internal/release/rootupdates.go RootUpdateInputs.target E3 linux:internal/release/adopt.go:settingsTarget rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=re-resolves canonical route before selection and persists root request decision before permitting adoption
plan14_input_inventory_test.go:424: J4 internal/host/agent.go makeStartRoute B3 linux:internal/host/agent.go:adoptLoop root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.write E3 linux:internal/host/buildstate.go:buildStates.beforeExec root-input
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.skipGet E1+E3 linux:internal/host/agent.go:convergeLegFor root-route
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Observe E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RestartBinding E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_creation.go type rootHistoryAccess E1 linux:internal/host/claimretire_transport.go:type ClaimRootHTTP E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/host/movesland.go landingRun.checking C linux:internal/host/movesland.go:landingRun.step Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple.
plan14_input_inventory_test.go:424: J4 internal/host/claimwakewriters.go claimWakeAttempt.StopWriters C+G linux:internal/host/claimstop_writers.go:ClaimAssembly.writersStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go descendSync A linux:internal/rootstate/state_linux.go:descend root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesstage.go heldReleasePublished C+E1 linux:internal/host/movesstage.go:heldReleaseHooksVia root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go RootGenerations.Check E2 linux:internal/host/rootgenerations_launch.go:generationLaunchPermit.check E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_parked.go generationRetirements E2 linux:internal/host/rootgeneration_parked.go:generationPhysicalPayloads rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=carries root-captured persistent artifact identity through generation retirement inventory
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.record F linux:internal/host/rootmovesfloor.go:rootMovesFloors.localBound rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=bounded strict private JSON read requires matching deployment, box and enrollment
plan14_input_inventory_test.go:424: J4 internal/activator/workerbuild.go Service.startWorker E2 linux:internal/activator/activator.go:Service.doWake E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go systemdUnits.Show B3 linux:internal/host/agent.go:agentCheckedUnitRestart root-input
plan14_input_inventory_test.go:424: J4 internal/hostguard/guard.go Guard.readLocked C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences Read-only access takes only the root host lock.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go ResponseKey E1 linux:internal/historyreadback/readback.go:ReadStatus Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.recoverIfNeeded F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_healthy.go rootMovesFloors.acceptHealthy F linux:internal/host/rootfloor_healthy.go:systemApplier.acceptRootFloorHealthy rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory.go ClaimRootHTTP.commitRootInventoryPending E2 linux:internal/host/rootinventory.go:ClaimRootHTTP.withRootInventoryHistory rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=canonicalizes persistent evidence under root exclusion while preserving the original request digest and durable replay
plan14_input_inventory_test.go:424: J4 internal/host/guardtransaction.go systemApplier.guardRun F linux:internal/host/systemapply.go:systemApplier.onDiskBuild rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=verifies signed target digest and local retained bounds before executing a version or bootstrap request
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_collect_linux.go type migrationStopKernel G linux:internal/host/rootmigration_collect_linux.go:migrationStopKernel.RecoverStopped rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates.go rootFailureLegacy E3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;run=8;identity=carlos adopt and offline migration uid 0;basis=bounded legacy byte read feeds only failure tuples and unresolved intents to the root deny importer; no legacy book opener or retry grant
plan14_input_inventory_test.go:424: J4 internal/host/relocationowners.go relocationBeforeAdmission C linux:internal/host/relocationowners.go:RelocationSource.Open Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationpins.go RootGenerations.Reservations E2 linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/claimconstruction.go OpenProductionClaimAssembly G linux:internal/host/claimconstruction.go:ensureProductionClaimAssembly rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=verifies complete retained migration and typed inventories before constructing claim authority on a census box; no census preserves prior path
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go rootStartRoute B3 linux:internal/host/agent.go:runAdoptUnderRootRelease rev3=merge-ruling-4;basis=Use main systemctl start for legacy non-NotUp recovery while retaining checked rollback when authority binds.
plan14_input_inventory_test.go:424: J4 internal/instancectl/claimexec_socket_linux.go claimListenExecSocket C+G linux:internal/instancectl/claimexec.go:ClaimUnits.prepareExecGate root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/consumedfence.go publishConsumed E3 linux:internal/release/adopt.go:settingsTarget root-route;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/persistent_linux.go Persistent A+E2 linux:internal/host/claimassembly.go:NewProductionRootClaimStop rev3=PROPOSED-p3;run=8;identity=root generation capture and verification uid 0;basis=captures filesystem ID, export handle, boot, inode, ownership and stable mount attachment from caller-checked descriptor;rev3=PROPOSED-p3;run=8;identity=root generation capture and verification uid 0;basis=captures filesystem ID, export handle, boot, inode, ownership and stable mount attachment from caller-checked descriptor
plan14_input_inventory_test.go:424: J4 internal/activator/activator.go Service.respawnWorkerLocked E2 linux:internal/activator/activator.go:Service.convergeWorkerLocked E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/worker.go Worker.ConvertLanding C linux:internal/host/relocatepass.go:convertFencedLanding Landing conversion requires verified local worker and termination-fence authority before claim conversion.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go systemApplier.rootProtocolAllowsBinary F linux:internal/host/systemapply.go:systemApplier.install rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held
plan14_input_inventory_test.go:424: J4 internal/release/rootupdates.go RootUpdateInputs.routes E3 linux:internal/release/adopt.go:PassFilter rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=uses registry hostname only as selector and replaces protected dispatch fields with independently resolved root inputs
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile.go Reconciler.Install C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Install root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/release/proofgate.go ProofGate.bind B3 linux:internal/release/roothistory_pass.go:passConfig.bindProof root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/rootstate/authorityfile_other.go OpenAuthorityFile E2 darwin:internal/host/rootmovesfloor_boot.go:rootFloorJournalPresent E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:424: J4 internal/rollout/failures.go FailureBook.markLocked E1+E3 linux:internal/rollout/rootfailures.go:RootFailures.ImportLegacy fix1-merge-review;basis=Advances durable app restriction generations so old grants cannot clear new failures.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.Census D linux:internal/rootparticipation/production.go:Ledger.ActivationReady Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_retirement.go type generationRetirement E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.recoveryEvidence C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/relocatepass.go RelocationRuntime.once C+D linux:internal/host/relocatepass.go:RelocationRuntime.Run Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_census_other.go productionGenerationKernelCensus E2 darwin:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_requirements.go generationRetainedTimers E2 linux:internal/host/rootgeneration_requirements.go:generationLocalObligations E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.
plan14_input_inventory_test.go:424: J4 internal/registry/registry.go Registry.Upsert E3 linux:cli.go:runAdd rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged, in the process that holds a remote handle, root passes included: main's body with its insert defaults moved to normalizeRoute and its bind list to routeArgs, and two columns added (seed_source, import_gate); the conflict clause, with the tenant-change rule E3 names, is unchanged; main's E3 authority retained
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.publishRelease C+E1+E2 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.Serve Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.
plan14_input_inventory_test.go:424: J4 internal/host/guardarm.go guardArmIdle F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/pending_linux.go controllerProcessStart D linux:internal/hostexec/rootprocess_linux.go:ControllerAlive root-input
plan14_input_inventory_test.go:424: J4 internal/hostfloor/image_other.go Disk.Exec F darwin:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation_probestop.go RecordProbeStop C linux:internal/hostrelocate/participant.go:Participant.Step Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification.
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go proofBindingSource.recovered B3+E1 linux:internal/host/rootrestart.go:productionRootRestartChecks Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go bounceScopedRoutes E1+E3 linux:internal/host/restart.go:restartRequestLeg root-route
plan14_input_inventory_test.go:424: J4 internal/hostexec/probe_unix.go probeExisting D linux:internal/hostexec/probe_unix.go:probeLifetime root-input
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go recoveryHistoryOutcome E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go checkUnresolvedRecoveries E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go historyRecoveryDigest E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveRecoveryRetirements Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Fail E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go newBuildStates E3 linux:internal/host/agent.go:runAgent root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootreleaselock.go withClaimReleaseCensus E2 linux:internal/host/rootreleaselock.go:withClaimRootRelease PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go scanStopDescriptors C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go UpdateIdle F linux:internal/host/claimreport.go:claimReport root-input
plan14_input_inventory_test.go:424: J4 internal/hostfloor/image_linux.go Disk.Exec F linux:internal/host/guardexec.go:RunSystemGuardExec root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_migration.go ClaimRootHTTP.executionAuthorityWithMigration D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/production.go OpenForUpdate D linux:internal/host/claimstop_run.go:RunInstanceControl Unactivated absent census does not block update or recovery; retained census remains authoritative.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationTaskFDs E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go type GenerationOwner E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_recovery.go claimCrossBoxHandover.installRecoveryInventory C+G linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimmovefence.go claimBoxFenceVerifier C+G linux:internal/host/claimassembly.go:ClaimAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostexec/controller.go Controller.authority D linux:internal/hostexec/controller.go:Open root-input
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_app.go RootHistory.AppRefusals E1 linux:internal/release/roothistory_app.go:RootHistory.MintRefusals E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_creation.go productionCreationHistory E1 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go validGeneration E2 linux:internal/release/rootgenerationpins.go:RootGenerations.Reservations E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:424: J4 internal/host/claimconstruction.go claimConstructionProcessStart C+G linux:internal/host/claimconstruction.go:OpenProductionClaimAssembly root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/hold.go RegistryHoldPolicy C linux:internal/host/claimassembly.go:ClaimAssembly.Build root-route
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.launchRecord C+E2+G linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/caps/converge.go Ops.checkClaimsOnDisk E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_expected.go StopInventoryDB.SnapshotRequest C linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning.
plan14_input_inventory_test.go:424: J4 internal/host/relocationeffects.go RelocationEffects.EnsureLocal C linux:internal/hostrelocate/participant.go:Participant.Step Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_census_linux.go checkedGenerationTree E2 linux:internal/host/rootgeneration_census_linux.go:productionGenerationKernelCensus E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/hostguard/recoveryfence.go Guard.PendingFences C linux:internal/host/claimstop_recovery.go:ClaimStopHTTP.RecoverPending Root-only read lock avoids an agent-held legacy lock at startup.
plan14_input_inventory_test.go:424: J4 internal/host/claimunit_binding_source.go readClaimUnitShapes E2 PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/heldstage.go heldStageAuthority C+E1 linux:internal/host/heldstage.go:heldStagePass route-and-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go rootFloorLegacy F linux:internal/host/rootmovesfloor_source.go:refreshRootMovesFloor rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=selects existing moves mirror paths for denial-only generic legacy reader
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.verifyPointer F linux:internal/host/systemapply.go:systemApplier.Run rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists
plan14_input_inventory_test.go:424: J4 internal/hostbox/journaltrust_linux.go readTrustedJournal C linux:internal/hostbox/coldhandover.go:ColdHandover.Recover root-input
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocating.go ConvertCommittedLanding C linux:internal/hostrelocate/worker.go:Worker.ConvertLanding Committed landing conversion verifies exact target termination fence and record commit before transferring installation authority.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootmigration.go RootAuthority.RetainMigrationDeny C+G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority
plan14_input_inventory_test.go:424: J4 internal/host/updatesroot.go updatesPassOption E3 linux:internal/host/agent.go:adoptLoop rev3=PROPOSED-p3;run=8;identity=root adopt uid 0; unchanged agent opener uid carlos;basis=installs census-only root input provider while preserving the legacy failure-book opener for nonparticipating passes
plan14_input_inventory_test.go:424: J4 internal/host/movesfinal.go sourceFinal.parkLocal C linux:internal/host/movesfinal.go:sourceFinal.run root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_replace.go replacementReconstruction E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_census_linux.go productionGenerationKernelCensus E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_writers.go ClaimStopCoordinator.WritersStopped C+G linux:internal/host/claimstop_writers.go:ClaimStopHTTP.serveWritersStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go restoreLive C+E1 linux:internal/release/materializeheld.go:publishHeld root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/safefile/file_linux.go writeAt A+F+G linux:internal/safefile/file_linux.go:Write rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation
plan14_input_inventory_test.go:424: J4 internal/hostbox/reconcile_adapter.go ReconcileAdapter.MintHeldUnder C linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership.
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Disk.Begin D linux:internal/host/guardtransaction.go:systemApplier.beginGuard Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go directory.Read A linux:internal/rootparticipation/production.go:OpenForUpdate root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go readBeneathLine F linux:internal/host/movesfloor.go:syncLocalFloor root-input
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go restartScopePass E1+E3 linux:internal/host/restart.go:restartRequestLeg fix1-merge-review;basis=Hands historical signed retry entries to the common verifier; unknown selectors do not widen scope.
plan14_input_inventory_test.go:424: J4 internal/host/rootroute.go sameProofCandidate B3 linux:internal/host/proofbinding.go:proofBindingSource.resolve canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go RunSystemApply D+F linux:system.go:runSystem rev3=PROPOSED-p3;identity=carlos system apply/recover root systemd units uid 0;basis=registers local launch verifier and delegates to the census-gated outer release wrapper while retaining local root floor checks and main no-census path
plan14_input_inventory_test.go:424: J4 internal/release/materializeheld.go VerifyHeldLiveUnder C+E1 linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Under-lock held verification enforces claim-aware shape and delegates root proof validation.
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback_resume.go resumeRootRestart B3+E1 linux:internal/host/rootrollback_resume.go:recoverRootRestarts Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootread.go ReadRoot D linux:internal/host/rootexecution_read.go:readRootExecution fix1;basis=Queries broker OFD lock ownership without acquiring a lock; rechecks unchanged durable evidence and monotonic expiry.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go rootFloorJudge.refresh F linux:internal/host/rootmovesfloor_refresh.go:rootRefreshAndJudgeMovesPrev rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent
plan14_input_inventory_test.go:424: J4 internal/host/movespass.go movesWorker.liftFences C linux:internal/host/movespass.go:movesPass root-route;kept=C;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/systemapply.go systemApplier.notePrev F linux:internal/host/systemapply.go:systemApplier.decidePrev rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes
plan14_input_inventory_test.go:424: J4 proof_cli.go runProof E1 linux:main.go:main E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/rootinstallation.go rootInstallationHostApp E2 linux:internal/host/claimstop_run.go:RunInstanceControl E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.
plan14_input_inventory_test.go:424: J4 internal/hostbox/migration_census_linux.go CheckMigrationRoots G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=checks retained materialized roots against persistent filesystem evidence before census migration accepts coverage
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/transaction.go TransactionLedger D+F linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=returns only an active root-minted held ledger; stale and cancelled scopes refuse
plan14_input_inventory_test.go:424: J4 internal/host/relocationhandover.go relocationCompletedHandover.completedPrior C linux:internal/host/claimhandover_crossbox.go:wireCompletedHandover Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer.
plan14_input_inventory_test.go:424: J4 internal/hostbox/launchjournal.go LaunchJournal.Create C linux:internal/hostbox/launchjournal.go:LaunchJournal.Prelaunch root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_state_linux.go ClaimRoleAssembly.prepareStateInventory C linux:internal/host/rootinventory_state_linux.go:ClaimRoleAssembly.prepareStateRemote rev3=PROPOSED-p3;identity=carlos agent claim lifecycle uid carlos; final authorization remains in root;basis=uses root-supplied persistent state identity for remote inventory reuse while keeping agent proposals non-authoritative
plan14_input_inventory_test.go:424: J4 internal/historyreadback/completion.go ReadReconstruction E1 linux:internal/historyreadback/workflow.go:Operation.Read Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/claimmoveaccess.go claimMoveReadAccess.selected C+G linux:internal/host/claimmoveaccess.go:claimMoveReadWork.With root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/moveswakesource.go movesWakeSources.Open B2+C linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor.
plan14_input_inventory_test.go:424: J4 internal/host/rootexecution_read.go rootExecutionRead D linux:internal/host/rootexecution_read.go:productionClaimLocal.checkRootParticipation Production root observer selects the descriptor-checked participation reader.
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_identity.go ClaimRootHTTP.bindInventoryPaths C+E2 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=discards all caller-supplied persistent evidence and captures or revalidates it independently against the retained root inventory
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_execpermit.go ClaimLaunchRoot.execPermit D linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/hostbox/journaltrust_linux.go checkTrustedJournalDir C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/wakepolicy.go Policy.check C linux:internal/hostbox/wakepolicy.go:Policy.Check root-input
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go execBounceable E1+E3 linux:internal/host/restart.go:bounceExecRoutes root-route
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go CompleteRelocation C linux:internal/hostrelocate/worker.go:Worker.Step Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_kernel_linux.go LinuxStopKernel.readContainedJournal C+G linux:internal/host/claimstop_kernel_linux.go:LinuxStopKernel.RecoverStopped root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/empty_census.go EmptyInstallationCensus.checkLocal C+G linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.CheckLocal Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go type Receipt E1 linux:internal/historyreadback/workflow.go:Operation.Read Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/proofbinding.go productionProofBindingSource B3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=enables persistent unit-file identity only for the census-required root proof path
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.CaptureInventory C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.RegisterLanding root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_containment_linux.go generationKernel.containedTask E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly.go ClaimRoleAssembly.PreflightLaunch C+G linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalmigration_linux.go legacyJournalFiles C linux:internal/hostbox/journalmigration_linux.go:JournalService.MigrateLegacy root-input
plan14_input_inventory_test.go:424: J4 internal/release/pins.go readGenerationsSeq E2 linux:internal/release/pins.go:ReadGenerations root-input
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationpins.go type RootGenerationPins E2 linux:internal/host/rootmovesfloor_refresh.go:rootFloorDowngradeIdle E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates_runtime.go beginRootGenerationUpdate E2+E3 linux:internal/host/rootgenerations_launch.go:productionRootGenerations rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=opens census-only root update authority, resolves the canonical host and refuses a known failure before runtime intent
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStateRegions E3 linux:internal/host/buildstate.go:newBuildStates root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_run.go instanceRegistryHostApp C+G linux:internal/host/claimstop_run.go:RunInstanceControl root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go publish E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/adopt.go PassFilter B3+E1+E2+E3 linux:internal/release/adopt.go:Pass Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=resolves protected route inputs before filters, recovery and dispatch on census boxes and bypasses service-owned failure opener only there
plan14_input_inventory_test.go:424: J4 internal/host/relocatepass.go newCompletionRuntime C+D linux:internal/host/relocatepass.go:NewRelocationRuntime Completion-only runtime treats registry and journal hostnames as discovery and verifies claim and bound identity before discharge.
plan14_input_inventory_test.go:424: J4 internal/release/signedhead.go StageSignedHead E1 linux:internal/host/namedrecovery_active.go:namedUnitRecovery.recover Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_parked.go generationReadRetirements E2 linux:internal/host/rootgeneration_parked.go:productionGenerationRetirements E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.
plan14_input_inventory_test.go:424: J4 internal/host/rootlaunchverifier.go var participationRelease E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/hostbox/coldhandover.go LaunchJournal.HasInstallationEffects C linux:internal/hostbox/coldhandover.go:ColdHandover.Run root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease.go newHeldReleaseRequestID C+E1 linux:internal/host/movesheldrelease.go:heldReleaseVia.request root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerations.go RootGenerations.Retire E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationNames E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.absent E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.
plan14_input_inventory_test.go:424: J4 internal/hostbox/typedpark_linux.go TypedParker.VerifyEmptyDirectory C linux:internal/hostbox/coldhandover.go:ColdHandover.retireIntended rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires protected persistent identity before using emptiness to retire an intended directory
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RestartProgress E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_retirement.go generationRetirement.verify E2 linux:internal/host/rootgeneration_retirement.go:generationRetirement.retire E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go generationPayloadBindings E2 linux:internal/host/rootgeneration_inventory.go:generationReconciler.reconcile E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease.go heldReleaseVia.publish C+E1 linux:internal/host/movesstage.go:heldReleasePublished root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_delivery.go HistoryReconstructionKey E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartRequestLeg E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Reads the new host-retry log while preserving root-signed grant verification and ordinary restart gates.
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go productionClaimRoster.Actor C+G linux:internal/hostbox/identity.go:IdentityProvider.Verify root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.PrepareState C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go generationLaunchPermit.check E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.
plan14_input_inventory_test.go:424: J4 internal/activator/containment.go ExecBackend.spawnInCgroupAtTier E2 linux:internal/activator/backend_exec.go:ExecBackend.seedChild E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_containment.go validateClaimJournalContainment C+G linux:internal/host/claimjournal_transport.go:ClaimRootHTTP.serveJournal root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimjournal_migration_linux.go currentClaimEdgeMaskAt C+G linux:internal/host/claimjournal_migration_linux.go:claimEdgeMaskStillOwned root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movesfloor.go rootJudgeMovesPrevWithSource F linux:internal/host/movesfloor.go:rootJudgePrevWithSource rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged
plan14_input_inventory_test.go:424: J4 internal/hostbox/regionalworker.go RegionalWorker.Census C linux:internal/hostbox/regionalworker.go:RegionalWorker.Run root-input
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go ToProbing C linux:internal/hostrelocate/participant.go:Participant.Step Probe transition requires exact local-install receipt at target enrollment and install stamp before admission.
plan14_input_inventory_test.go:424: J4 internal/caps/converge.go Ops.query E4 linux:internal/caps/converge.go:Ops.applyUnitState root-input
plan14_input_inventory_test.go:424: J4 internal/rollout/rootfailures.go RootFailures.ImportLegacy E3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;run=8;identity=root adoption and migration uid 0;basis=imports bounded negative tuples, hold markers and unresolved intents once; ignores legacy epochs and retries and durably retains import fingerprints
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go type ClaimLaunchRoot E1+E2 linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/caps/converge.go Ops.checkStateDirShape E4 linux:internal/caps/converge.go:Converge root-input
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventory_registration.go ReconcileAdapter.registerRemote C linux:internal/hostbox/inventory_registration.go:ReconcileAdapter.installRemote root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RestartTarget.valid E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_identity.go rememberRootFloorSystemIdentity F linux:internal/host/systemapply.go:systemApplier.verifyPointer rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=re-fetches and verifies signed pointer equality before retaining its executable identity
plan14_input_inventory_test.go:424: J4 internal/host/movesstage.go writeHeldStageRequest C+E1 linux:internal/host/movesstage.go:heldReleaseReady root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimunit_binding.go claimUnitBindings.read E2 linux:internal/host/claimunit_placement.go:ClaimLaunchRoot.checkUnitBinding PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/adoptlock.go lockExclusive C+E1 linux:internal/host/adoptlock.go:lockAdoptPass root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimretire_transport.go type ClaimRootHTTP E1 linux:internal/host/claimstop_run.go:RunInstanceControl rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=binds the production inventory identity capturer to the root request handler; the agent cannot choose the capture implementation
plan14_input_inventory_test.go:424: J4 internal/console/seedfloor.go Server.seedRegionReady F linux:internal/console/apiinstanceimport.go:Server.handleAPIImportStopped rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizedReconstruction F rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize
plan14_input_inventory_test.go:424: J4 internal/rollout/rootfailures.go rootFailureWriter E3 linux:internal/rollout/rootfailures.go:OpenRootFailures rev3=PROPOSED-p3;run=8;identity=root adoption and migration uid 0;basis=writes migration identity, failure epochs and import fingerprints atomically through checked private root store
plan14_input_inventory_test.go:424: J4 internal/host/claimassembly.go NewProductionRootClaimStop C+E2 linux:internal/host/claimstop_run.go:RunInstanceControl rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=installs root filesystem identity capture in the production inventory handler
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests.go logRestartRequestError E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_startup.go verifyRootMigrationState F+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=binds complete root census and durable complete migration record to deployment box enrollment and migration generation
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go type RestartSnapshot E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/unitsettle.go systemctlVerb B3 linux:internal/host/unitsettle.go:systemdUnits.ResetFailed root-input
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go claimServingLaunchSource C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/proofpolicy.go LoadProofPolicy B3 linux:internal/host/proofask.go:mintAsker.tick root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimwakeassembly.go claimSocketReady C+G linux:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartApps E1+E3 linux:internal/host/restart.go:restartPass root-route
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartSeed E1+E3 linux:internal/host/agent.go:fastConvergeLoop fix1-merge-review;basis=Baselines both request logs without applying historical ordinary restarts; signed retry grants remain independently verified.
plan14_input_inventory_test.go:424: J4 internal/release/consumedfence.go publishGate E3 linux:internal/release/consumedfence.go:publishConsumed root-route;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostops/backfill_seeds.go CollectCensusSeeds G linux:internal/host/rootmigration_census.go:rootMigrationCollector.collect rev3=census-ruling-seeded-instances;basis=no caller in the tree yet; G wires the census collector that will call it: deny-only activation input; G wires its caller and must keep it deny-only. If it ever feeds a decision that allows rather than refuses, it needs a new ruling.
plan14_input_inventory_test.go:424: J4 internal/release/bake.go LoadFirstSeenMigrating E1+E3 linux:internal/release/adopt.go:PassFilter root-input
plan14_input_inventory_test.go:424: J4 internal/host/agent.go agentCheckedUnitRestart B3 linux:internal/host/agent.go:adoptLoop kept=B3;scope=agent-only-legacy-behavior-preservation;not-root-authority
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_production.go claimLaunchFor D linux:internal/host/claimlaunch_production.go:WithProductionClaimLaunch Production root runtime receives the unit-aware kernel wrapper before startup recovery.
plan14_input_inventory_test.go:424: J4 internal/release/updatetarget.go Target E3 linux:internal/release/adopt.go:settingsTarget root-input
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease_root.go movesHeldReleaseRoot.replayed C+E1 linux:internal/host/movesheldrelease_root.go:movesHeldReleaseRoot.publishRelease root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostexec/participation.go PreinstallationParticipant D linux:internal/host/rootexecution_authority.go:ClaimRootHTTP.executionAuthority D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority.
plan14_input_inventory_test.go:424: J4 internal/release/rootgenerationcompleteness.go generationHash E2 linux:internal/release/rootgenerationcompleteness.go:GenerationEvidence.valid E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.
plan14_input_inventory_test.go:424: J4 internal/instancectl/legacy_claim_cleanup.go Server.clearLegacyClaimLaunch C+G linux:internal/instancectl/server.go:Server.handleStart root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/sweep.go SweepStaged E2 linux:internal/host/versionsweep.go:sweepStagedVersions root-input
plan14_input_inventory_test.go:424: J4 internal/registry/registry.go normalizeRoute E3 linux:internal/registry/registry.go:Registry.Upsert rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever Upsert's SQLite arm and the import swap run: the insert defaults from Registry.Upsert's body; E3, the same family as Registry.Upsert, whose body they came from
plan14_input_inventory_test.go:424: J4 internal/hostops/production_delete.go ProductionAuthority.StartDeleteClaim C linux:internal/hostops/operations.go:Controller.BeginRetire Production delete obtains verified completed-box fence before permitting claim transition across completion barrier.
plan14_input_inventory_test.go:424: J4 internal/release/refusal.go ListRefusals E1+E3 linux:internal/host/refusalwatch.go:refusalWatch.tick root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go productionRootRestartChecks B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go recheck E1 linux:internal/historyreadback/workflow.go:Operation.Deliver Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_refresh.go readRootFloorBinary F linux:internal/host/rootmovesfloor_boot.go:withRootFloorGuardCandidate rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_requirements.go generationLocalObligations E2 linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootmigration_inventory.go RootAuthority.MigrationInstallations C+G linux:internal/host/rootmigration_startup.go:verifyRootMigrationStartup rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0; also root claim startup uid 0;basis=read-only root installation enumeration includes incomplete records and never repairs before preflight
plan14_input_inventory_test.go:424: J4 internal/host/claimstate_linux.go claimPrivatePathOwner C+G linux:internal/host/claimstate_linux.go:prepareClaimStateDirectory root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/units/carlos-system-update.service external F linux:internal/host/bootstrap.go:var unitsFS rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor
plan14_input_inventory_test.go:424: J4 internal/host/rootupdates.go rootUpdateSource.resolve E3 linux:internal/host/rootupdates.go:productionRootUpdates rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=resolves canonical settings and signed retries; saves exact old legacy-book acknowledgements only after durable independent root retry
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go RootHistory.RecoveryRetired E1 linux:internal/host/recoveryrefusals.go:checkUnresolvedRecoveries Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/hostbox/renewing.go RenewingLeases.Acquire C linux:internal/host/movespass.go:armPhase1 root-input
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootbroker.go RootBroker.settle D linux:internal/hostexec/rootbroker.go:RootBroker.recoverSettlement On uncertain ETag or delete conflict require both root and remote expiry, then conditionally delete the current ETag.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_rows.go generationRegistryInventory E2 linux:internal/host/rootgeneration_rows.go:productionGenerationRegistryInventory E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_production_linux.go migrationExecutionEmpty G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains
plan14_input_inventory_test.go:424: J4 internal/host/movesheldrelease.go heldReleaseVia.claim C+E1 linux:internal/host/movesheldrelease.go:heldReleaseVia.request root-input;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory_install.go ClaimRootHTTP.rootLandingRoute C+E3 linux:internal/host/rootinventory.go:ClaimRootHTTP.commitRootInventoryPending Root derives flat landing row and settings from authoritative record and app policy after target/phase binding.
plan14_input_inventory_test.go:424: J4 internal/hostbox/relocationrows.go RelocationRow C linux:internal/hostbox/reconcile.go:Reconciler.rowDecision Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_outcomes.go validHistoryRecovery E1 linux:internal/release/roothistory_status.go:RootHistory.MigrationStatusWithSources Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/hostguard/fence.go StopAuthorityMatches C linux:internal/host/claimwakestop.go:ClaimAssembly.collectCapturedStop root-input
plan14_input_inventory_test.go:424: J4 internal/release/pins.go GenerationPins E2 linux:internal/release/adopt.go:PassFilter root-route
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go type HistoryRecoveryRetirement E1 linux:history_cli.go:historyCommandWithSave Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Begin E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/hostbox/rolelaunch.go LaunchJournal.UnitIntentions C linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.launchLocked root-input
plan14_input_inventory_test.go:424: J4 internal/rootstate/state.go Sync A+F+G linux:internal/host/rootmovesfloor_source.go:readRootProtocolProjection rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement
plan14_input_inventory_test.go:424: J4 internal/host/rootfloor_healthy.go rootMovesFloors.capLegacy F linux:internal/host/rootseedsfloor_publication.go:readRootSeedsBound rev3=PROPOSED-p3;identity=root normal adopt/apply refresh and local seeds-bound readers in apply/recover/guard, uid 0;basis=caps service-written protocol and release minima by highest root-observed healthy build; absent observation supplies no bound
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go RootHistoryPass.complete E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationRetainedFiles E2 linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.;rev3=PROPOSED-p3;run=8;identity=root generation recovery uid 0;basis=requires verified persistent executable and tree identity through generationCurrentBinding
plan14_input_inventory_test.go:424: J4 internal/host/prooffile.go proofFileSource B3 linux:internal/host/proofbinding.go:proofBindingSource.unitBinding rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=excludes only boot-local numbers from persistent proof hashes; filesystem, handle, ownership and mount attachment remain bound
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback.go readRollbackAttempt B3 linux:internal/host/rootrollback.go:rootRestartChecks.finish canonical record/unit/executable authority and one-attempt rollback; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_outcomes.go RootHistory.RetainRecovery E1 linux:internal/host/roothistory_recovery.go:rootRestartChecks.settleHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/claimhandover_crossbox.go claimCrossBoxHandover.Before C+G linux:internal/host/claimhandover_crossbox.go:wireClaimAdmission root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_recovery.go historyRestartAttempt B3+E1 linux:internal/host/rootrestart.go:checkedUnitRestart Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationMounts E2 linux:internal/host/rootgeneration_kernel_linux.go:generationKernel.task E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.
plan14_input_inventory_test.go:424: J4 internal/host/restartscope.go retryRequests E1+E3 linux:internal/host/restartscope.go:applyRetries root-route
plan14_input_inventory_test.go:424: J4 internal/release/proof.go FileSHA256 B3 linux:internal/host/proofobserve.go:proofObserver.observe root-input;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimrecovery_remote.go claimCrossBoxHandover.installRecoveryRemote C linux:internal/host/claimhandover_recovery.go:claimCrossBoxHandover.afterRecovery root installation and fence authority; recovery rebind and timer identity
plan14_input_inventory_test.go:424: J4 internal/host/movesfiles.go relocationPreparedManifest C linux:internal/host/movesfiles.go:movesFiles.preparedBinding Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/transaction.go Ledger.lockTransaction D+F linux:internal/rootparticipation/ledger.go:Ledger.Acquire rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=reuses transaction exclusion only for the identical root store; foreign stores refuse
plan14_input_inventory_test.go:424: J4 internal/host/rootrollback.go loadRollback B3+E1 linux:internal/host/rootrestart.go:rollbackUnitRestart Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go directory.Remove A+B3 linux:internal/host/rootrollback.go:captureRollback descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_status.go const RootHistoryStatusDir E1 linux:internal/host/roothistory.go:openRootHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go restartBoundUnit B3 linux:internal/host/rootrestart.go:rollbackUnitRestart E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_source.go readEffectiveMovesFloor F linux:internal/host/systemapply.go:systemApplier.activationRule rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_timers.go type rootMigrationTimers G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=holds root-private migration state, root inventory, root fence authority and isolated registry interface under offline exclusion
plan14_input_inventory_test.go:424: J4 internal/host/claimlaunch_root.go ClaimLaunchRoot.launchLocked E1+E2 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/rollout/rootfailures.go RootFailures.VerifiedRetry E3 linux:internal/host/rootupdates.go:rootUpdateSource.resolve rev3=PROPOSED-p3;run=8;identity=root adoption uid 0;basis=verifies deployment-root signature, tuple, freshness and exact root book epoch before existing durable retry transition
plan14_input_inventory_test.go:424: J4 internal/hostbox/wakepolicy.go WakePhase C linux:internal/hostbox/wakepolicy.go:Policy.check root-input
plan14_input_inventory_test.go:424: J4 internal/release/consumedfence_linux.go lockConsumedPublish E3 linux:internal/release/consumedfence.go:publishConsumed root-input;kept=E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/release/pins.go ReadGenerations E2 linux:internal/release/pins.go:GenerationPins root-input
plan14_input_inventory_test.go:424: J4 internal/rootstate/state.go type Store A+B3 linux:internal/host/claimassembly.go:NewProductionRootClaimStop descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:424: J4 internal/hostbox/journalservice.go JournalService.executeWithInventory C linux:internal/hostbox/journalservice.go:JournalService.ExecuteRootInventory Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt.
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/worker.go Worker.Step C+D linux:internal/host/relocatepass.go:RelocationRuntime.once Worker transitions revalidate claim and fence and consume verified root stop receipts; generic transition timing remains legacy.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Complete E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.consume E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/guardtransaction.go systemApplier.checkGuardRecovery D linux:internal/host/systemapply.go:systemApplier.Run Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go restartOrdinaryUnit B3 linux:internal/host/rootrestart.go:rootRestartRouteWith rev3=merge-ruling-4;basis=No-census derived-unit try-restart is unconditional and nonfatal, matching main for absent rows and systemd lookup failures.
plan14_input_inventory_test.go:424: J4 internal/host/legacyrestart.go legacyRollbackRestart B3 linux:internal/host/rootrestart.go:rollbackUnitRestart rev3=merge-ruling-6;basis=Restore main reset-failed, restart and D1 settle even after an operator reset; retain main error wrapping and diagnostics.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_reconstruct.go RootHistory.reconstructionState E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.reconstructionReady E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_reconstruct.go RootHistory.resumeReconstruction E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_retirement.go RootHistory.recoveryRetirementDigest E1 linux:internal/release/roothistory_retirement.go:RootHistory.recoveryRetired Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go restartIntentID E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/agent.go makeRestartRoute B3 linux:internal/host/agent.go:adoptLoop root-route;kept=B3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootgenerations_launch.go type generationLaunchPermit E2+E3 linux:internal/host/claimlaunch_root.go:ClaimLaunchRoot.startRecorded rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=retains the root runtime completion and close callbacks for the reserved launch
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_pass.go passConfig.recordRefusal E1 linux:internal/release/adopt.go:adoptHost E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.refresh E3 linux:internal/host/buildstate.go:buildStates.wakeTarget route-and-input
plan14_input_inventory_test.go:424: J4 internal/host/systemparticipation.go systemApplier.beginExecutableChange D linux:internal/host/systemapply.go:systemApplier.install Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/claimroleassembly_other.go ClaimRoleAssembly.Prelaunch C+G darwin:internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build root-route;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimproduction.go readProductionRosterRow C+G linux:internal/host/movessources.go:productionRosterRegion root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootroute.go proofBindingSource.needsRestart B3 linux:internal/host/rootrestart.go:productionRootRestartChecks Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch.
plan14_input_inventory_test.go:424: J4 internal/hostbox/generationinventory.go OpenGenerationLaunchReader E2 linux:internal/host/rootgeneration_inventory.go:openGenerationLaunchInventory E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/console/boxselect.go Server.selectMoveBoxes F linux:internal/console/apiinstancemove.go:Server.handleAPIInstanceMoveRequest rev3=PROPOSED-p3;identity=carlos console serve, console.service uid carlos-console;basis=applies accepted/generation refusal only to advertised root-floor participants; legacy selection retains main exactly
plan14_input_inventory_test.go:424: J4 internal/hostfloor/disk.go Durable F linux:internal/host/guardarm.go:RunSystemGuardArm root-input
plan14_input_inventory_test.go:424: J4 internal/rootstate/state_linux.go directory.Names A linux:internal/hostexec/rootbroker.go:RootBroker.Recover root-input
plan14_input_inventory_test.go:424: J4 internal/host/recoveryrefusals.go rootRestartChecks.copyRecoveryHistory E1 linux:internal/host/recoveryrefusals.go:rootRestartChecks.retainRecoveryHistory Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.
plan14_input_inventory_test.go:424: J4 internal/release/rollback.go processGroup B3+E1+E3 linux:internal/release/rollback.go:rollbackGroup root-route;kept=B3,E1,E3;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_writers.go ClaimAssembly.WritersStopped C+G linux:internal/host/relocationassembly.go:ClaimAssembly.RelocationEffects root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/movesinstall.go installRun.configured C+E1 linux:internal/host/movesinstall.go:installGeneration Configured landing now validates root-created registration before render and held publication; source recovery keeps existing typed rebind.
plan14_input_inventory_test.go:424: J4 internal/host/relocationreleases.go ReleaseObligation.Queue C linux:internal/host/relocationeffects.go:RelocationEffects.Release Queues exact relocation release retirement obligation and preserves already discharged receipt replay.
plan14_input_inventory_test.go:424: J4 internal/rootstate/live.go LiveHeld A+D linux:internal/hostexec/rootread.go:ReadRoot fix1;basis=Requires the store to implement broker-only liveness holding and a non-acquiring query; unsupported stores fail closed.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests_source.go rootRestartRequestSource.installation E1 linux:internal/host/rootupdates.go:rootUpdateSource.resolve E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/hostguard/rootview.go FenceView.admit G linux:internal/hostguard/guard.go:Guard.With rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=read-only root view applies same predecessor-completion requirement as locked admission
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go prepareStatus E1 linux:internal/historyreadback/workflow.go:PrepareOperation E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go readEffectiveSeedsFloor F linux:internal/host/rootseedsfloor.go:systemApplier.seedsActivationRefusal rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census selects verified signed publication plus capped retained deny; unpublished seeds impose no bound; no census retains legacy reader
plan14_input_inventory_test.go:424: J4 internal/release/pins.go BoxPins E2 linux:internal/release/adopt.go:PassFilter route-and-input
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_census.go rootMigrationCollector.collect G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only
plan14_input_inventory_test.go:424: J4 internal/hostbox/stopinventory_db.go StopInventoryDB.ReadStopInventory C linux:internal/hostbox/empty_census.go:EmptyInstallationCensus.checkLocal root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootinventory.go ClaimRootHTTP.recoverRootInventory C+E1 linux:internal/host/claimretire_transport.go:ClaimRootHTTP.RecoverPending E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go generationInventoryAt E2 linux:internal/host/rootgeneration_inventory.go:readProductionGenerationInventory E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.
plan14_input_inventory_test.go:424: J4 internal/host/claimstop_writers_linux.go installationCoverage C+G linux:internal/host/claimstop_writers_linux.go:rootInstallationCoverage rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=validates stopped-installation data roots against persistent filesystem identity before treating descriptors as covered
plan14_input_inventory_test.go:424: J4 internal/registry/registry.go routeArgs E3 linux:internal/registry/registry.go:Registry.Upsert rev3=census-ruling-seeded-instances;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), wherever a route is inserted: Upsert, the cold handover restore and the import journal's inserts: the bind list from Registry.Upsert's body (and RestoreClaimRows'), with seed_source and import_gate added; E3, the same family as Registry.Upsert, whose body it came from
plan14_input_inventory_test.go:424: J4 internal/hostbox/inventoryscope.go ValidateAgentInventory C linux:internal/hostbox/reconcile_adapter.go:ReconcileAdapter.Retire root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.
plan14_input_inventory_test.go:424: J4 internal/hostrelocate/worker.go Worker.Start C+D Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy.
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_reconstruct.go RootHistory.reconstructionImages E1 linux:internal/release/roothistory_reconstruct.go:RootHistory.Reconstruct E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory_creation.go rootHistoryCreation E1 linux:internal/host/roothistory.go:openRootHistory E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/host/rolloutdeclined.go failureHolds.refusal E1+E3 linux:internal/host/rolloutdeclined.go:failureHolds.gate root-route
plan14_input_inventory_test.go:424: J4 internal/release/pins.go SettingsRefs E2 linux:internal/release/pins.go:BoxPins root-route
plan14_input_inventory_test.go:424: J4 internal/rootstate/shared_linux.go ensurePublicChild A+B4 linux:internal/rootstate/shared_linux.go:EnsurePublicDir fix1;basis=Creates or descriptor-repairs only a root:root 0700/0755 shared directory, without following symlinks or admitting writable/foreign parents.
plan14_input_inventory_test.go:424: J4 internal/hostexec/rootbroker.go RootBroker.Monitor D linux:internal/hostexec/rootbroker.go:RootBroker.Run Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent.
plan14_input_inventory_test.go:424: J4 internal/release/claim_identity.go CheckRouteReleaseIdentity C+E1 linux:internal/host/claimproduction.go:claimInputPolicy root-route;kept=C,E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/provision/rootrecord.go FindRecordByHost B3+C linux:internal/host/rootrecord_claim.go:rootClaimRecord Discovery delegates to the collision-checking index and still reads the selected record afresh.
plan14_input_inventory_test.go:424: J4 internal/hostclaim/relocation.go PinAfterRelease C linux:internal/hostrelocate/worker.go:Worker.Step Pin transition verifies source release authority and exact journal phase before removing execution authority.
plan14_input_inventory_test.go:424: J4 internal/historyreadback/completion.go ReadRetirement E1 linux:internal/historyreadback/workflow.go:Operation.Read Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/rootstate/live_linux.go directory.LiveHeld A+D linux:internal/rootstate/live.go:LiveHeld fix1;basis=Retains a trusted private-file descriptor under an OFD write lock; readers query conflicting OFD ownership without locking.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go restartValue E1 linux:internal/release/rootrestart_history.go:RootRestarts.Observe E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/rootrestart_history.go RootRestarts.Bindings E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor.go rootMovesFloors.reconstruct F rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires private root-issued box/generation/nonce token and refuses weakening; no production caller installed
plan14_input_inventory_test.go:424: J4 internal/hostbox/park.go Regional.observe C linux:internal/hostbox/regionalworker.go:RegionalWorker.runHost root-input
plan14_input_inventory_test.go:424: J4 internal/rootstate/file_linux.go Identity A+B3 linux:internal/host/roothistory_launch.go:ClaimLaunchRoot.rootInstalledProgram descriptor-checked root rollback capability identity/removal
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go IsAcquisitionRecovery E2 linux:internal/host/rootlaunchverifier.go:rootLaunchVerifier.verify PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.
plan14_input_inventory_test.go:424: J4 internal/host/claimowners.go claimServingOwners.serving C+G linux:internal/host/claimowners.go:claimServingOwners.Select root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor.go refreshRootSeedsFloor F linux:internal/host/seedsfloor.go:systemApplier.armSeedsFloor rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=merges authoritative store floor with denial-only legacy seeds maxima into durable independent root state
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_kernel_linux.go generationGroupGone E2 linux:internal/host/rootgeneration_kernel_linux.go:productionGenerationAbsence rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=refuses a present cgroup placement from another boot; an absent old placement carries no process identity to compare
plan14_input_inventory_test.go:424: J4 internal/caps/caps.go ValidCapabilities E4 linux:cli.go:readCapabilities root-input
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go openGenerationLaunchInventory E2 linux:internal/host/rootgeneration_retirement.go:productionRetireGenerations E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.
plan14_input_inventory_test.go:424: J4 internal/host/rootgeneration_inventory.go type generationReconciler E2 linux:internal/host/rootlaunchverifier.go:registerProductionLaunchVerifier E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.
plan14_input_inventory_test.go:424: J4 internal/instancectl/claimexec.go ClaimUnits.prepareExecGate C+E2+G linux:internal/instancectl/claimunit.go:ClaimUnits.start root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.
plan14_input_inventory_test.go:424: J4 internal/host/rootrecord_claim.go rootClaimRecord C linux:internal/host/rootinstallation.go:rootInstallationHostApp root installation and fence authority; registration and recovery; agent RPC lock ordering
plan14_input_inventory_test.go:424: J4 internal/host/rootseedsfloor_publication.go acceptRootSeedsPublication F linux:internal/host/rootseedsfloor.go:refreshRootSeedsFloor rev3=PROPOSED-p3;identity=normal carlos adopt and system apply remote floor refresh, uid 0;basis=under stable floor lock, retains only verified nonregressing signed seeds publication; no publisher or activation switch added
plan14_input_inventory_test.go:424: J4 internal/host/bootstrap.go bootstrapWith A+C+G linux:internal/host/bootstrap.go:RunBootstrap root-input;kept=A,C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/hostguard/record_unix.go recordDir.read C linux:internal/hostguard/recoveryfence.go:Guard.PendingFences root installation/fence backend and lock-free agent projection; establishment blocked; draft incomplete
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart.go rollbackUnitRestart B3+E1 linux:internal/host/agent.go:runAdoptUnderRootRelease Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback.
plan14_input_inventory_test.go:424: J4 internal/host/relocationinstall.go relocationInstallAuthority C linux:internal/host/relocationinstall.go:ClaimAssembly.relocationInstall Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation.
plan14_input_inventory_test.go:424: J4 internal/activator/containment.go ExecBackend.startRole E2 linux:internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.
plan14_input_inventory_test.go:424: J4 internal/rootparticipation/ledger.go Ledger.Acquire D linux:internal/host/rootexecution_runtime.go:newClaimExecutionRuntime rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion.
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests.go rootRestartRequests.consume E1 linux:internal/host/rootrestart_requests.go:rootRestartRequests.run E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/host/claimrelocation.go openClaimRelocationOwners C+G linux:internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners Relocation owner constructor receives existing serving sources and verified identity inside feature gate.
plan14_input_inventory_test.go:424: J4 internal/rollout/failures.go var randRead E1+E3 linux:internal/rollout/failures.go:newBookID fix1-merge-review;basis=Names the cryptographic entropy source for failure-book identity; remains retry replay authority.
plan14_input_inventory_test.go:424: J4 internal/host/roothistory.go openRootHistory E1 linux:internal/host/agent.go:runAdoptUnderRootRelease E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.
plan14_input_inventory_test.go:424: J4 internal/hostexec/local_unix.go localDir.write D linux:internal/hostexec/rootmirror.go:ProjectRootClient root-input
plan14_input_inventory_test.go:424: J4 internal/host/restart.go restartCandidates E1+E3 linux:internal/host/restart.go:restartApps root-route
plan14_input_inventory_test.go:424: J4 internal/instancectl/claimlaunch_snapshot_linux.go claimRootDir C+G linux:internal/instancectl/claimlaunch_snapshot.go:ClaimUnits.freezeLaunch root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootrestart_requests_source.go type rootRestartRequestSource E1 linux:internal/host/rootupdates.go:productionRootUpdates E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.
plan14_input_inventory_test.go:424: J4 internal/host/agent.go fastConvergeLoop B3 linux:internal/host/agent.go:runAgent rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the runs worker's boot pass and pass called after reconcile; read sites unchanged, offsets moved; main's B3 authority retained
plan14_input_inventory_test.go:424: J4 internal/host/buildstate.go buildStates.wakeTarget E3 linux:internal/host/agent.go:runAgent root-route
plan14_input_inventory_test.go:424: J4 internal/release/roothistory_reconstruct.go RootHistory.ReconstructionStatus E1 linux:internal/release/roothistory_delivery.go:RootHistory.ReceiveReconstruction Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/release/ratchet.go DigestRatchet.note E1 linux:internal/release/ratchet.go:DigestRatchet.Admit root-input;kept=E1;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/historyreadback/readback.go type Scope E1 linux:history_cli.go:historyCommandWithSave Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.
plan14_input_inventory_test.go:424: J4 internal/host/claimwakestop.go ClaimAssembly.collectCapturedStop C+G linux:internal/host/claimwakestop.go:ClaimAssembly.collectRetirementStop root-input;kept=C,G;scope=protected-decision-only
plan14_input_inventory_test.go:424: J4 internal/host/rootmigration_collect_linux.go recoverMigrationStop G linux:internal/host/rootmigration_production_linux.go:migrateRootClaimAuthority rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation
plan14_input_inventory_test.go:424: J4 internal/host/rootmovesfloor_boot.go rootFloorJudge.permits F linux:internal/host/rootmovesfloor_boot.go:rootFloorPrevVerdict rev3=PROPOSED-p3;identity=root guard-exec apply/recover selection and carlos.prev floor-allows-prev, uid 0;basis=signed current, retained prev and fixed staged candidate determine whether a below-bound candidate must be refused; no available qualifying build preserves recovery
plan14_input_inventory_test.go:424: J4 internal/hostguard/flock_unix.go acquire C linux:internal/hostguard/guard.go:Guard.locked rev3=merge-ruling-4;basis=Descriptor checks classify nonregular or foreign-owner locks as unsafe; honest contention waits with bounded exponential backoff.
plan14_input_inventory_test.go:431: family E4 missing erasure fixture
plan14_input_inventory_test.go:431: family E4 missing hostile fixture
plan14_input_inventory_test.go:431: family E4 missing positive fixture
plan14_input_inventory_test.go:431: family E4 missing rename fixture
plan14_input_inventory_test.go:431: family E4 missing retry fixture
plan14_input_inventory_test.go:435: authority coverage: 16538 reachable declarations; 95 failures
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 23:31:53 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/15 23:31:53 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/15 23:31:53 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/15 23:31:53 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io hibernate false -> true
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged acme.go.tito.io status-named false -> true
2026/10/15 23:31:53 provision: converged acme.go.tito.io status-named true -> false
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 23:31:53 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 23:31:53 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 23:31:53 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/15 23:31:53 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/15 23:31:53 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/15 23:31:53 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/15 23:31:53 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/15 23:31:53 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/15 23:31:53 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:53 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/15 23:31:53 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/15 23:31:53 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/15 23:31:53 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 23:31:53 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 23:31:53 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 23:31:53 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:53 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 23:31:53 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/15 23:31:53 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 23:31:53 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 23:31:53 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/15 23:31:53 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/15 23:31:53 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/15 23:31:54 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/15 23:31:54 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/15 23:31:54 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 23:31:54 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/15 23:31:54 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/15 23:31:54 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/15 23:31:54 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/15 23:31:54 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/15 23:31:54 provision: dry-run: would converge owned.go.tito.io seed
2026/10/15 23:31:54 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/15 23:31:54 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/15 23:31:54 provision: converged owned.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/15 23:31:54 provision: converged owned.go.tito.io hibernate false -> true
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/15 23:31:54 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: removed retired static route site.go.tito.io (record gone)
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/15 23:31:54 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/15 23:31:54 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:54 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 23:31:54 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/15 23:31:54 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/15 23:31:54 provision: converged acme.go.tito.io channel stable -> edge
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 23:31:54 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/15 23:31:54 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/15 23:31:54 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/15 23:31:54 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/15 23:31:54 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 23:31:54 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/15 23:31:54 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/15 23:31:54 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/15 23:31:54 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/15 23:31:54 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/15 23:31:54 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/15 23:31:54 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/15 23:31:54 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/15 23:31:54 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:54 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/15 23:31:54 provision: a.shop.example.com: swapped for import sd_txb3xiiw5xuhelg7xuye3vi5ti (the original route is journaled)
2026/10/15 23:31:54 provision: a.shop.example.com: import sd_txb3xiiw5xuhelg7xuye3vi5ti committed: its gate is cleared and its journal row dropped
2026/10/15 23:31:54 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_ynlvsz4oshms6y745rr3s6zdmy rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_ynlvsz4oshms6y745rr3s6zdmy: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_ynlvsz4oshms6y745rr3s6zdmy is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_waktldflnitmtmvr3szaqs46me rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_waktldflnitmtmvr3szaqs46me: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_waktldflnitmtmvr3szaqs46me is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_c5pilhfr25vynlt3vipfupn3aq
2026/10/15 23:31:55 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/15 23:31:55 provision: dry-run: would converge a.shop.example.com seed source
2026/10/15 23:31:55 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/15 23:31:55 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/15 23:31:55 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_3x577ant6sdbz2tyacwacslkpu cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_5io6her7fj6despbeg7cgilxia cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_34iq4nd5iaizbadi42mqazjw4a is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_qrmfbacrwd3p2aupyqcoks45wu is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_ky5cepqjldtutw5zsu7jantniu is journaled, but this box cannot act on imports; its row is left alone
2026/10/15 23:31:55 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/15 23:31:55 provision: b.shop.example.com: import sd_xwfk37avpnrw6sgy2obgxdi5i4 left alone this pass: the import journal could not be read
2026/10/15 23:31:55 provision: c.shop.example.com: import sd_ogi2i3zl3epdfmif6sh4dvxdoa left alone this pass: the import journal could not be read
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_knjhurum6flnrtcs63lneqpb5e committed: its gate is cleared and its journal row dropped
2026/10/15 23:31:55 provision: a.shop.example.com: not converging import sd_klx7xbb26kxnftddkzcsbqhogm: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 23:31:55 provision: a.shop.example.com: not converging import sd_3khzdjivi7m57bv4rvogq2meo4: it is swapped but not committed, and the row on this box has no import gate
2026/10/15 23:31:55 provision: a.shop.example.com: not converging import sd_fct2ajhzd3xvp4hslyymhrmotq: it is placed but not committed, and the row on this box has no import gate
2026/10/15 23:31:55 provision: a.shop.example.com: not converging import sd_ardjhyr3lbeeih4dhegnoyoica: it is placed but not committed, and the row on this box has no import gate
2026/10/15 23:31:55 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/15 23:31:55 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_7tgg2hzni2x3whoi2o7x7sroru committed: its gate is cleared and its journal row dropped
2026/10/15 23:31:55 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:55 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:55 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/15 23:31:55 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_edtqxbitv3vm3dkffoalnuhnii: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_edtqxbitv3vm3dkffoalnuhnii rolled back (no box had swapped it)
2026/10/15 23:31:55 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/15 23:31:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:55 provision: removed instance route acme.go.tito.io (its seed sd_ixhmkvkgq6zgvpbtiiro74av3u was aborted); the next pass rolls it back
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_ixhmkvkgq6zgvpbtiiro74av3u: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_ixhmkvkgq6zgvpbtiiro74av3u rolled back (no box had swapped it)
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_siljih5lswd436v5jpgh64dv7y has a row this pass may not remove; leaving the seed aborted
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_ku6hmphb52im4ucd6xh75itcbq rolled back (no box had swapped it)
2026/10/15 23:31:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:55 provision: removed instance route acme.go.tito.io (its seed sd_4bsquqnnrscjvysy7sntz7hhte was aborted); the next pass rolls it back
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_4bsquqnnrscjvysy7sntz7hhte has no route on this box: its local data is removed
2026/10/15 23:31:55 provision: acme.go.tito.io: aborted seed sd_4bsquqnnrscjvysy7sntz7hhte rolled back (no box had swapped it)
2026/10/15 23:31:55 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_k557xclr6szfkcb5snojkomlba (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_k557xclr6szfkcb5snojkomlba rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_k557xclr6szfkcb5snojkomlba is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_tcemuokgl22m6zlt5mpzynqszm (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_tcemuokgl22m6zlt5mpzynqszm rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_tcemuokgl22m6zlt5mpzynqszm is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_rbi2cbt3rs2tzybbmef5a33ozy (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_rbi2cbt3rs2tzybbmef5a33ozy rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_rbi2cbt3rs2tzybbmef5a33ozy: the host's replica is left alone: its record no longer names this seed
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_rbi2cbt3rs2tzybbmef5a33ozy is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_zuezbxqa6p7y75hw6tdseb2sve (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_zuezbxqa6p7y75hw6tdseb2sve rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_zuezbxqa6p7y75hw6tdseb2sve rolled back to its original route
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_zuezbxqa6p7y75hw6tdseb2sve is cleaned up and its journal row retired
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_ajdjot6tqazxdwpkkyrzgt5yxq (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_ajdjot6tqazxdwpkkyrzgt5yxq rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/15 23:31:55 provision: a.shop.example.com: swapped for import sd_rysmq2hzvx3uzkjsr2kss22p4u (the original route is journaled)
2026/10/15 23:31:55 provision: a.shop.example.com: import sd_rysmq2hzvx3uzkjsr2kss22p4u is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_drnk2ff256xz6swz3hv6bibv3q (the original route is journaled)
2026/10/15 23:31:56 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_drnk2ff256xz6swz3hv6bibv3q left alone this pass: its record could not be read
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_iaegvhzhxye24hmjgbhsige65u (the original route is journaled)
2026/10/15 23:31:56 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_iaegvhzhxye24hmjgbhsige65u left alone this pass: its record could not be read
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_huvuw6otkq5mdfcouqtxluqdda (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_huvuw6otkq5mdfcouqtxluqdda: close the import gate: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_huvuw6otkq5mdfcouqtxluqdda rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_huvuw6otkq5mdfcouqtxluqdda is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_4h5ci7pquyyvt52rvv6szosz6u (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4h5ci7pquyyvt52rvv6szosz6u: close the import gate: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4h5ci7pquyyvt52rvv6szosz6u rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4h5ci7pquyyvt52rvv6szosz6u is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_dskasdtjb52p7zmpetoi2ahsmm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_dskasdtjb52p7zmpetoi2ahsmm rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_dskasdtjb52p7zmpetoi2ahsmm rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_dskasdtjb52p7zmpetoi2ahsmm is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_otvw62w6t3qs62j4lmrntbhetm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_otvw62w6t3qs62j4lmrntbhetm rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_otvw62w6t3qs62j4lmrntbhetm is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_jjg2czvxqeqznqyrzonqjsdzhq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_jjg2czvxqeqznqyrzonqjsdzhq: retire its instance key: injected failure at retire-key
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_jjg2czvxqeqznqyrzonqjsdzhq rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_jjg2czvxqeqznqyrzonqjsdzhq is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_qfjju4weitcm3dnxlos337hnii (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_qfjju4weitcm3dnxlos337hnii rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_qfjju4weitcm3dnxlos337hnii is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_zsf6cos2cx7dshz7wextn6jpfi (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zsf6cos2cx7dshz7wextn6jpfi: remove its local data: injected failure at remove-local
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zsf6cos2cx7dshz7wextn6jpfi rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zsf6cos2cx7dshz7wextn6jpfi is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_5mqtssgn24tghyl2437opc6zzq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_5mqtssgn24tghyl2437opc6zzq rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_5mqtssgn24tghyl2437opc6zzq is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_gclopagxuoea7id2bggas54lmi (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_gclopagxuoea7id2bggas54lmi: remove its local data: injected failure at remove-local-done
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_gclopagxuoea7id2bggas54lmi rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_gclopagxuoea7id2bggas54lmi is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_lgyulx3eqtdddfrozkakfe7hce (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_lgyulx3eqtdddfrozkakfe7hce rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_lgyulx3eqtdddfrozkakfe7hce is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_i4ypxntuiimfcy3ya3ybfvmyvi (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_i4ypxntuiimfcy3ya3ybfvmyvi: restore the original route: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_i4ypxntuiimfcy3ya3ybfvmyvi rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_i4ypxntuiimfcy3ya3ybfvmyvi is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_7i355encdkixu2y6flwsnr3tse (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_7i355encdkixu2y6flwsnr3tse: restore the original route: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_7i355encdkixu2y6flwsnr3tse rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_7i355encdkixu2y6flwsnr3tse is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_tnfiszvga2mh6o7sjdzpl74xyy (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_tnfiszvga2mh6o7sjdzpl74xyy is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_kbzmt6eursgqcko47rgmq4gabq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_kbzmt6eursgqcko47rgmq4gabq rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_kbzmt6eursgqcko47rgmq4gabq: delete its snapshot: injected failure at delete-snapshot
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_kbzmt6eursgqcko47rgmq4gabq is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_zrc5se4ce253uchua2nunratim (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zrc5se4ce253uchua2nunratim rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zrc5se4ce253uchua2nunratim is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_iqaqjsl33hsrstla3ivwfozy24 (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_iqaqjsl33hsrstla3ivwfozy24 rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_iqaqjsl33hsrstla3ivwfozy24: delete the host's replica: injected failure at delete-replica
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_iqaqjsl33hsrstla3ivwfozy24 is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_i6u2qtkmjrwweuvhlfcorjdsye (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_i6u2qtkmjrwweuvhlfcorjdsye rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_i6u2qtkmjrwweuvhlfcorjdsye is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_xvcmt2dxpvmu35kklfm47cxehq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xvcmt2dxpvmu35kklfm47cxehq rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xvcmt2dxpvmu35kklfm47cxehq: retire its journal row: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xvcmt2dxpvmu35kklfm47cxehq is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_wl6m6qnucz2gz6srq7palrluxy (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_wl6m6qnucz2gz6srq7palrluxy rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_wl6m6qnucz2gz6srq7palrluxy: retire its journal row: constraint failed: injected (1811)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_wl6m6qnucz2gz6srq7palrluxy is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_yurrhyj726jpy2svpqnlmwfg7y (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_yurrhyj726jpy2svpqnlmwfg7y rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_yurrhyj726jpy2svpqnlmwfg7y is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: mark import sd_yurrhyj726jpy2svpqnlmwfg7y rolled back: injected failure at cas
2026/10/15 23:31:56 provision: a.shop.example.com: aborted seed sd_yurrhyj726jpy2svpqnlmwfg7y rolled back (no box had swapped it)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_t2qutwmskvaewezstdmolv5wtm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_t2qutwmskvaewezstdmolv5wtm rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_t2qutwmskvaewezstdmolv5wtm is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: aborted seed sd_t2qutwmskvaewezstdmolv5wtm rolled back (no box had swapped it)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_bkofqoio3u362da4jzw5x6r6ci (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_bkofqoio3u362da4jzw5x6r6ci rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_bkofqoio3u362da4jzw5x6r6ci rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_bkofqoio3u362da4jzw5x6r6ci rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_bkofqoio3u362da4jzw5x6r6ci is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_fy6pfldbktjr26rold7yznv6s4 (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_fy6pfldbktjr26rold7yznv6s4 rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_fy6pfldbktjr26rold7yznv6s4 is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_vgc6dkjmrhnux6e4dvl4gczh7e (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_vgc6dkjmrhnux6e4dvl4gczh7e rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_vgc6dkjmrhnux6e4dvl4gczh7e is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_z3mtvgxompmqekfyh5bi2tafyi (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_z3mtvgxompmqekfyh5bi2tafyi rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_z3mtvgxompmqekfyh5bi2tafyi is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_4dggbwm6nulttjm2rhxetmwgra (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4dggbwm6nulttjm2rhxetmwgra rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4dggbwm6nulttjm2rhxetmwgra is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_xtojekauit5lkepcwl4fyu23am (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xtojekauit5lkepcwl4fyu23am rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xtojekauit5lkepcwl4fyu23am is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_3ycsz22ikewa537p23red3cboe (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_3ycsz22ikewa537p23red3cboe rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_3ycsz22ikewa537p23red3cboe is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_hbumifxkfhe2calmtt5bx7efxm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_hbumifxkfhe2calmtt5bx7efxm rolled back to its original route
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_hbumifxkfhe2calmtt5bx7efxm is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_hbskzbfzrfgimozyvoiqer5jkq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_hbskzbfzrfgimozyvoiqer5jkq has no route on this box: its local data is removed and no route is put back
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_hbskzbfzrfgimozyvoiqer5jkq is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_3sie2zkfcrk6slplnztztutvqa (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_a3uj774cjro4vpamlzgy7ciqca (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_c2oy7qnsuelsrbibez3qu5yaly (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_c2oy7qnsuelsrbibez3qu5yaly cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_4mnmbkhr3wvs5o2hssyhvs6tq4 (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_4mnmbkhr3wvs5o2hssyhvs6tq4 is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/15 23:31:56 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/15 23:31:56 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_ktqmaq25thdhwklbnq44m6xksm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_fid64keq34rwoeij2gaivilzye (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_6hw727277gosrrdzfdbkc2zppy (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_bmqenhcev6zg7n2wn2eokjc7qm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_baaj4uspmyyngl7nm52xltblyq (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_baaj4uspmyyngl7nm52xltblyq rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_zvjexstgulz3rfsh7sm3op55zm (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zvjexstgulz3rfsh7sm3op55zm has no route on this box: its local data is removed and no route is put back
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_zvjexstgulz3rfsh7sm3op55zm is cleaned up and its journal row retired
2026/10/15 23:31:56 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_qxr7ifk5szadx4akfay3lo5wri (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_qxr7ifk5szadx4akfay3lo5wri: remove its local data: injected failure at remove-local
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_qxr7ifk5szadx4akfay3lo5wri is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_xqaulejkqbdtso6om5fhl5sv5q (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_xqaulejkqbdtso6om5fhl5sv5q: a route appeared at the host, so its local database is left and the rollback waits
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_y6q62haccddxgr7h7ebrpphzzi (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_y6q62haccddxgr7h7ebrpphzzi rollback deferred: no fence generation: registry busy
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_srvwfr3it55un3bm5574pnmrdu (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import sd_srvwfr3it55un3bm5574pnmrdu rollback deferred: no fence generation: the generation source answered 0
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_54axda3spnhrxmoevd5zan6mc4 (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_ls5pw3ormyi327zgegovsjn5ri (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: swapped for import sd_z3bwxtk2lo3pwcqskbft3e5qua (the original route is journaled)
2026/10/15 23:31:56 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/15 23:31:56 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_if4ku6ru4rxo3jpk2hchqpn3e4 (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_if4ku6ru4rxo3jpk2hchqpn3e4 rolled back to its original route
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_if4ku6ru4rxo3jpk2hchqpn3e4 is cleaned up and its journal row retired
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_on5jhvn7bx6yxk4zgtkh2zzekm (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_on5jhvn7bx6yxk4zgtkh2zzekm rolled back to its original route
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_on5jhvn7bx6yxk4zgtkh2zzekm is cleaned up and its journal row retired
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_smz6smfsdhjidxhjhbpgoibvum (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_smz6smfsdhjidxhjhbpgoibvum rolled back to its original route
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_smz6smfsdhjidxhjhbpgoibvum is cleaned up and its journal row retired
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_yybm3fzvwmcriuijwb3wcrhzay (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_yybm3fzvwmcriuijwb3wcrhzay: retire its instance key: the env file is a symlink
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_yybm3fzvwmcriuijwb3wcrhzay rolled back to its original route
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_yybm3fzvwmcriuijwb3wcrhzay is cleaned up and its journal row retired
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_2junllezsc7n5borprxxvdduay (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_n5johg2b5qqkfe3jtb3oywyreq (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_khyh3rq4cikf3jefz6xocsenwa refused: there is no route at a.shop.example.com to replace
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_emmzc5y22xpti4hvgskfcahi5a refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_sfzs42e2bvlpfybdh4xjabdc4e refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_f4chpqt4jkdyxnjt32nmfpfwzy refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_hp4zbqkkrvmpy2lxcygr6pfpo4 refused: the route belongs to app other
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_u5hj64sexpjmrujv6xr65i46hy refused: the route is filed under another account
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_tckthjg6yjbyaatqlunp77oc7y refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_dbh5gir2cxbo2ownza5xhy3bxi refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_nda5djbscmvmslril566tu4bsa refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_plddnfdcka7lqzw775sgxc7k4a refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_6hm4zspvrrph2qur2a5uowzc5a refused: the route is not an address route this import can take over (socket)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_krkug7jdtehocmlkhamtyxnrw4 refused: the route is not an address route this import can take over (no address)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_6jl5welj7elk644trarbl537iq refused: the route is not an address route this import can take over (provisioned)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_rnjagurlknqsscsbxjnyohvjem refused: the route is not an address route this import can take over (kind static)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_bujbeh6r3l7wf7srwllvi6bskm refused: the route is not an address route this import can take over (backing)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_k77kb6hc675yqjrztre2vtjmcy refused: the route is not an address route this import can take over (tunnel)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_st4p5nqu7ctedevudl2q2iv4fe refused: the route is not an address route this import can take over (caps)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_z4yxovsg77w2s3liz3r7wlhzje refused: the route is not an address route this import can take over (platform)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_pf5y6sugkeurjdmubzknzwrssi refused: the route is not an address route this import can take over (canary)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_vquentswitvgkki4csdiomfo4m refused: the route is not an address route this import can take over (kind sidecar)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_rzcu4mmfz3wfqkx3etoyg27may refused: the route is not an address route this import can take over (region)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_qlv6cm2cpulduxtch7e63iw7kq refused: the route is not an address route this import can take over (fleet_box)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_j42ctwrimwsd7izarssvqs6tfe refused: the route is not an address route this import can take over (hibernate)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_nkt46a7xpuoqlhwqelj26cz5di refused: the route is not an address route this import can take over (claim_owner)
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_2ncppua7dsqhmhwnj5uulbel7m refused: this box does not run instances nested
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_5ktegpi3qnbdiavnstychm2gm4 refused: this box does not run instances nested
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_rycpa57ej7dgmrd4j762nf4n3m refused: claim control is on for this box
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_5qdcmp3wkp5h4ddreq72ntgplq (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_jxvwkz6egdqf3hhkmov6uytlyq (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/15 23:31:57 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_sp4qw4yc7drvyhcmqhpakvqozi: its verify hash is not a sha256
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_kcysfkdptalnnt4f3vekf63xiu: its verify hash is not a sha256
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_zt74rfn6wjnjuxg4ppzvexuidm: its verify hash is not a sha256
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/15 23:31:57 provision: A.shop.example.com/..: not swapping for import sd_q6qbwl2vvuzkeoon6bijuzneo4: its host or seed id is malformed (seeds: not a host)
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_sjr63cptrpqjvai5xc2w3rpcji: its record does not describe a nested, hibernating instance
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_pgsahhctsdocwj24etyw2ukgca: its record does not describe a nested, hibernating instance
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_7z7ntcgmwtayxu5iwfbzal5fie: its record does not describe a nested, hibernating instance
2026/10/15 23:31:57 provision: a.shop.example.com: not swapping for import sd_k7hpw5nvujxk77dueqx5abbr6m: its record does not describe a nested, hibernating instance
2026/10/15 23:31:57 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_uq6kuctetpvdcflkbevyybd53m (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_fgaanhbrogebah3akx5tuctvfe (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_mrrrymg56xee5j3y5n7kokpnhq (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/15 23:31:57 provision: dry-run: would consider swapping a.shop.example.com for import sd_vxwsmlzaoqimivxcezmzh5a4cy
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_76fx5zztux6ayx5hieg53eykle rolled back to its original route
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_76fx5zztux6ayx5hieg53eykle: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_76fx5zztux6ayx5hieg53eykle is cleaned up and its journal row retired
2026/10/15 23:31:57 provision: a.shop.example.com: import sd_sjes3maqw6grwm2jwifwub6haa left alone: the import journal holds seed sd_afe6ku2e2x6oqv3pzsfvxhvlru at swapped
2026/10/15 23:31:57 provision: a.shop.example.com: not minting import sd_cs7qrmbfnzcq6rnh5vijvjogm4: it is swapped but not committed, and only its swap makes its row
2026/10/15 23:31:57 provision: a.shop.example.com: not minting import sd_zcil2ltw4uqgwanldm3ehdg64a: it is placed but not committed, and only its swap makes its row
2026/10/15 23:31:57 provision: a.shop.example.com: swapped for import sd_dwkoej4klnwwqqh4avsxjlezf4 (the original route is journaled)
2026/10/15 23:31:57 provision: a.shop.example.com: not minting import sd_dwkoej4klnwwqqh4avsxjlezf4: it is swapped but not committed, and only its swap makes its row
2026/10/15 23:31:57 provision: a.shop.example.com: not minting import sd_dwkoej4klnwwqqh4avsxjlezf4: it is placed but not committed, and only its swap makes its row
2026/10/15 23:31:57 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/15 23:31:57 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 23:31:57 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:57 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:57 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/15 23:31:57 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:57 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/15 23:31:57 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:57 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/15 23:31:57 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/15 23:31:57 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/15 23:31:57 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/15 23:31:57 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/15 23:31:57 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 23:31:57 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/15 23:31:57 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/15 23:31:57 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/15 23:31:57 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/15 23:31:58 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/15 23:31:58 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/15 23:31:58 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/15 23:31:58 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/15 23:31:58 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/15 23:31:58 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/15 23:31:58 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/15 23:31:58 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/15 23:31:58 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/15 23:31:58 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/15 23:31:58 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:58 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/15 23:31:58 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:58 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:58 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 23:31:58 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 23:31:58 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 23:31:58 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/15 23:31:58 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/15 23:31:58 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/15 23:31:58 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL github.com/carlosframework/platform/internal/provision 34.796s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.415s
ok github.com/carlosframework/platform/internal/relay 7.230s
ok github.com/carlosframework/platform/internal/release 22.372s
ok github.com/carlosframework/platform/internal/rollout 3.732s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.573s
ok github.com/carlosframework/platform/internal/s3compat 0.004s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.483s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.569s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.951s
ok github.com/carlosframework/platform/internal/status 0.037s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.197s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.005s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.533s
FAIL
make: *** [Makefile:18: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
amadan