amadan
docs: zero-downtime roll notes, owed lists as of 2026-10-14 (#272)
"Before Gate E: owed" and "Still owed (code)" now give the current state: readiness rounds 1 to 3, rev 19 (v0.27.2) and #292 (v0.27.3) merged and released; Gates F and G passed and all four flagship boxes armed; dev being armed; the kernel checks closed by the root test runner's 2026-10-14 run; mixed-version retries as run on dev round 4, with the untried case covered by construction; the settings plan 4 items this branch closes, and the consumed/ census item it leaves open; claims-on swaps still a future feature. The subsections below stay as history.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+113
−128
docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md+113 −128
CI failed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 335.689s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.047s
ok github.com/carlosframework/platform/cmd/moveprobe 93.246s
ok github.com/carlosframework/platform/cmd/zddprobe 0.704s
ok github.com/carlosframework/platform/internal/activator 238.394s
ok github.com/carlosframework/platform/internal/agentsock 0.015s
ok github.com/carlosframework/platform/internal/alerting 0.004s
ok github.com/carlosframework/platform/internal/analytics 0.020s
ok github.com/carlosframework/platform/internal/appconfig 2.324s
ok github.com/carlosframework/platform/internal/apperr 0.074s
ok github.com/carlosframework/platform/internal/applog 0.132s
ok github.com/carlosframework/platform/internal/awsinv 0.003s
ok github.com/carlosframework/platform/internal/boxchoice 0.004s
ok github.com/carlosframework/platform/internal/boxid 0.710s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.012s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.696s
ok github.com/carlosframework/platform/internal/changelog 0.321s
ok github.com/carlosframework/platform/internal/clamd 0.054s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 362.453s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.553s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.008s
ok github.com/carlosframework/platform/internal/dbverify 0.005s
ok github.com/carlosframework/platform/internal/dnsrec 0.002s
ok github.com/carlosframework/platform/internal/docsite 0.005s
ok github.com/carlosframework/platform/internal/domains 2.221s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.003s
ok github.com/carlosframework/platform/internal/edge 26.089s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.007s
ok github.com/carlosframework/platform/internal/fleetapi 0.120s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.014s
ok github.com/carlosframework/platform/internal/geo 0.018s
ok github.com/carlosframework/platform/internal/geoip 0.029s
ok github.com/carlosframework/platform/internal/host 125.604s
ok github.com/carlosframework/platform/internal/hostactors 0.387s
ok github.com/carlosframework/platform/internal/hostbox 2.146s
ok github.com/carlosframework/platform/internal/hostclaim 0.522s
ok github.com/carlosframework/platform/internal/hostevidence 0.005s
ok github.com/carlosframework/platform/internal/hostexec 4.863s
ok github.com/carlosframework/platform/internal/hostfence 0.033s
ok github.com/carlosframework/platform/internal/hostfiles 10.547s
ok github.com/carlosframework/platform/internal/hostfloor 0.012s
ok github.com/carlosframework/platform/internal/hostguard 1.013s
ok github.com/carlosframework/platform/internal/hostops 1.441s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.435s
ok github.com/carlosframework/platform/internal/hostresolve 0.137s
ok github.com/carlosframework/platform/internal/hostwrite 0.003s
ok github.com/carlosframework/platform/internal/infraview 0.023s
ok github.com/carlosframework/platform/internal/instancectl 3.505s
ok github.com/carlosframework/platform/internal/instanceexec 2.705s
ok github.com/carlosframework/platform/internal/instancefs 0.024s
ok github.com/carlosframework/platform/internal/instancekey 0.023s
ok github.com/carlosframework/platform/internal/instanceupdates 0.025s
ok github.com/carlosframework/platform/internal/layout 1.422s
ok github.com/carlosframework/platform/internal/lease 9.812s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.007s
ok github.com/carlosframework/platform/internal/ledger 0.014s
ok github.com/carlosframework/platform/internal/mail 0.172s
ok github.com/carlosframework/platform/internal/maintenance 0.077s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.539s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.067s
ok github.com/carlosframework/platform/internal/metrics 0.004s
ok github.com/carlosframework/platform/internal/moves 20.999s
ok github.com/carlosframework/platform/internal/moves/archive 0.777s
ok github.com/carlosframework/platform/internal/objstore 0.181s
ok github.com/carlosframework/platform/internal/ops 0.161s
ok github.com/carlosframework/platform/internal/park 0.193s
ok github.com/carlosframework/platform/internal/privatefile 0.003s
2026/10/14 22:50:06 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/14 22:50:06 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/14 22:50:06 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/14 22:50:06 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:06 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/14 22:50:06 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/14 22:50:06 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/14 22:50:06 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/14 22:50:06 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/14 22:50:06 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/14 22:50:06 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/14 22:50:06 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/14 22:50:06 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/14 22:50:06 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/14 22:50:06 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/14 22:50:06 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/14 22:50:06 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/14 22:50:06 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/14 22:50:06 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/14 22:50:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:06 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/14 22:50:07 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/14 22:50:07 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/14 22:50:07 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/14 22:50:07 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/14 22:50:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:07 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/14 22:50:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/14 22:50:07 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/14 22:50:07 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/14 22:50:07 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/14 22:50:07 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/14 22:50:07 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/14 22:50:07 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:07 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:07 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan14RootReadCensus (9.79s)
plan14_root_reads_test.go:690: root read census: 10 discrepancies
changed root read internal/activator/activator.go:Service.doWake; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.seedChild; review class, task, sites and digest
changed root read internal/activator/backend_exec.go:ExecBackend.seedUnit; review class, task, sites and digest
changed root read internal/activator/beforeexec.go:Service.settleWakeIdentity; review class, task, sites and digest
changed root source envelope internal/activator
changed root source envelope internal/release
changed legacy declaration internal/activator/activator.go:Service.doWake
changed legacy declaration internal/activator/backend_exec.go:ExecBackend.seedChild
changed legacy declaration internal/activator/backend_exec.go:ExecBackend.seedUnit
changed legacy declaration internal/activator/beforeexec.go:Service.settleWakeIdentity
2026/10/14 22:50:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:17 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:17 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/14 22:50:18 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/14 22:50:18 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/14 22:50:18 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io hibernate false -> true
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io status-named false -> true
2026/10/14 22:50:18 provision: converged acme.go.tito.io status-named true -> false
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/14 22:50:18 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/14 22:50:18 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/14 22:50:18 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/14 22:50:18 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/14 22:50:18 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/14 22:50:18 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/14 22:50:18 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/14 22:50:18 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/14 22:50:18 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/14 22:50:18 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/14 22:50:18 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/14 22:50:18 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/14 22:50:18 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:18 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/14 22:50:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:18 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/14 22:50:18 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/14 22:50:18 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:18 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/14 22:50:18 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/14 22:50:18 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/14 22:50:18 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:18 provision: converged acme.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:18 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/14 22:50:18 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/14 22:50:18 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/14 22:50:18 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:18 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/14 22:50:18 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/14 22:50:18 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/14 22:50:18 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/14 22:50:18 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/14 22:50:18 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/14 22:50:18 provision: dry-run: would converge owned.go.tito.io seed
2026/10/14 22:50:18 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/14 22:50:18 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:18 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/14 22:50:18 provision: converged owned.go.tito.io channel stable -> edge
2026/10/14 22:50:18 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/14 22:50:18 provision: converged owned.go.tito.io hibernate false -> true
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/14 22:50:18 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/14 22:50:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: removed retired static route site.go.tito.io (record gone)
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/14 22:50:18 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/14 22:50:18 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/14 22:50:18 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:18 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/14 22:50:19 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/14 22:50:19 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/14 22:50:19 provision: converged acme.go.tito.io channel stable -> edge
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/14 22:50:19 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/14 22:50:19 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/14 22:50:19 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/14 22:50:19 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/14 22:50:19 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/14 22:50:19 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/14 22:50:19 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/14 22:50:19 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/14 22:50:19 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/14 22:50:19 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/14 22:50:19 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/14 22:50:19 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/14 22:50:19 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/14 22:50:19 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/14 22:50:19 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/14 22:50:19 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/14 22:50:19 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/14 22:50:19 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/14 22:50:19 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/14 22:50:19 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/14 22:50:19 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/14 22:50:19 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/14 22:50:19 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/14 22:50:19 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/14 22:50:19 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/14 22:50:19 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/14 22:50:19 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/14 22:50:19 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/14 22:50:19 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/14 22:50:19 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/14 22:50:19 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/14 22:50:19 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/14 22:50:19 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/14 22:50:19 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/14 22:50:19 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
FAIL
FAIL github.com/carlosframework/platform/internal/provision 13.131s
ok github.com/carlosframework/platform/internal/publicrelease 0.009s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 4.100s
ok github.com/carlosframework/platform/internal/relay 7.233s
ok github.com/carlosframework/platform/internal/release 20.131s
ok github.com/carlosframework/platform/internal/rollout 3.765s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.006s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/s3compat 0.004s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.280s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.492s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.024s
ok github.com/carlosframework/platform/internal/status 0.040s
ok github.com/carlosframework/platform/internal/steering 0.005s
ok github.com/carlosframework/platform/internal/stopevidence 0.195s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.005s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.567s
FAIL
make: *** [Makefile:18: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md| index 48548fc37..ff389ce44 100644 |
| --- a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| +++ b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| @@ -29,21 +29,53 @@ plans 1 to 6, in `platform-design-zero-downtime-deploys`. |
| ## Before Gate E: owed |
| -This is the flag-on precondition. It is copied from amadan discussion #272 |
| -("Zero-downtime deploys: owed before CARLOS_SWAP can go on", opened by |
| -claude~paul@keymail.dev), as read on 2026-10-11, including its replies. |
| -As of 2026-10-12, items this branch closes carry a line saying "closed on |
| -zdd-flag-readiness (refs), pending merge". Those are built and task-reviewed on |
| -the branch, and the whole-branch review's first round (Astra, |
| -`CODEX-FINDINGS-ZDD-READINESS.md`) found gaps in several of them, which its |
| -fix wave closed (the commits cited as "final review round 1"). They are not |
| -merged, not released and not rolled, and only Paul closes them on #272. Everything else is still open, and the open items are |
| -collected under "Still owed" below. **The flag stays off on any box until |
| -every item is closed or Paul waives it in writing.** Gates A to D do not |
| -turn the flag on and can go ahead while this list is open. |
| - |
| -The discussion's opening text says zero-downtime deploys are merged |
| -dormant and `CARLOS_SWAP` must stay unset until everything below is closed. |
| +**Current state, 2026-10-14.** This list is copied from amadan discussion |
| +#272 ("Zero-downtime deploys: owed before CARLOS_SWAP can go on"). Every |
| +item on it that blocked the flag is now closed, or is one of the open items |
| +named below. The subsections after this one are the history of how each |
| +item closed, kept for their commit references. Where they say "pending |
| +merge", read the state here instead. |
| + |
| +- **Merged and released.** Readiness rounds 1 to 3 (`zdd-flag-readiness`, |
| + `zdd-flag-readiness-2` and `zdd-flag-readiness-3`). Rev 19, the generation |
| + socket names, is merged as `ebddcfc` and released in v0.27.2. #292 is |
| + merged as `e15ad6b` and released in v0.27.3. |
| +- **The flag.** Gate F passed on annie-welding, and Gate G armed the other |
| + three flagship boxes. All four flagship boxes are armed as of 2026-10-14. |
| + Dev is being armed on 2026-10-14. |
| +- **Kernel checks: closed.** On 2026-10-14 a root test runner ran them on |
| + Debian 13 arm64, kernel 6.12.96, origin/main `2683f16a`, as `User=carlos` |
| + with `Delegate=yes` and `cpuset cpu io memory pids` in the unit's |
| + `subtree_control`. All passed and none skipped: |
| + - `TestClaimContainmentCleanupRespawn`, all three subtests; |
| + - `TestGenerationStartRefusedBesideADirectParentMember`, with its sibling |
| + and recovery controls; |
| + - the `ensureParent` positive control, which is `internal/cgroup`'s |
| + `TestGenKernelGenerationRefusedBesideAFlatMember` |
| + (`CARLOS_GEN_KERNEL=1`) and `TestGenKernelShimRespawnAfterKill` |
| + (`CARLOS_SHIM_KERNEL=1`). |
| + |
| + The details are on #272. |
| +- **Mixed-version retries.** Dev round 4 passed three cases: a new box with |
| + a new console, a book that had not saved, and an old box with a new |
| + console. A new box with an old console was not run. That case is covered |
| + by construction. An old console can only write an unsigned retry, and |
| + every new box ignores an unsigned retry, so the worst it can do is a retry |
| + that does nothing. |
| +- **Owed items from settings plan 4** (branch `zdd-owed-items`): |
| + - Closed: a cold wake's build-state record is now written at the exec, |
| + after the replica-key gate and the cgroup refusals, so a refused launch |
| + leaves no record. This was owed before O8 (replica keys) is switched on. |
| + - Closed: `release.ResolveLivePath` now calls `release.ResolveLiveLink`. |
| + The two had identical bodies. |
| + - Open: leftover `consumed/` files refuse the claims census. It is owed |
| + before host claims are switched on, and does not block the flag. See |
| + "Still owed (code)". |
| +- **Claims-on swaps** remain a future feature. A box with host claims on |
| + declines the flag with the reason code `host-claims-on`. |
| + |
| +The flag stays off on any box that has not passed its gate, and only Paul |
| +closes items on #272. |
| ### Correctness, from Astra's plan 5 review (`CODEX-FINDINGS-ZDD-IMPL-5*.md`) |
| @@ -140,18 +172,15 @@ dormant and `CARLOS_SWAP` must stay unset until everything below is closed. |
| #### Dev-box flag blockers |
| -Two defects blocked the flag on the dev box. Both are fixed in code on |
| -zdd-flag-readiness, pending merge. Their tests are kernel-gated and skip on |
| -the build machine, so neither fix has been seen working on a real kernel. |
| -The dev-box rerun is owed. Both kernel tests now start through the shim, and |
| -zdd-flag-readiness-3 notes that they cannot run on DOCS-T1 (see "Roll notes |
| -from zdd-flag-readiness-3", dev re-check step 7). |
| +Two defects blocked the flag on the dev box. Both are fixed, merged and |
| +released, and both kernel tests passed on a real kernel on 2026-10-14 (see |
| +"Kernel checks" at the top of this section). |
| -- The legacy-parent guard (2c5adbe8). Code fixed. Its kernel test |
| - `TestGenerationStartRefusedBesideADirectParentMember` needs the rerun. |
| -- The `cgroup.kill` respawn (c76a1d44, 66c92efe). Code fixed: a cgroup that |
| - took `cgroup.kill` is recreated, and KillHost and KillSidecar respawn. |
| - Its kernel test `TestClaimContainmentCleanupRespawn` needs the rerun. |
| +- The legacy-parent guard (2c5adbe8). Its kernel test is |
| + `TestGenerationStartRefusedBesideADirectParentMember`. |
| +- The `cgroup.kill` respawn (c76a1d44, 66c92efe). A cgroup that took |
| + `cgroup.kill` is recreated, and KillHost and KillSidecar respawn. Its |
| + kernel test is `TestClaimContainmentCleanupRespawn`. |
| ### Surfaces (plan 6) |
| @@ -241,109 +270,65 @@ two builds side by side, so it restarts instances the old way". The code |
| `host-claims-on` is in the instance's JSON record (`rollout.unavailable`) and |
| in the agent log line `REFUSING CARLOS_SWAP=overlap (host-claims-on)`. |
| -### Still owed (code), after zdd-flag-readiness |
| - |
| -These stay open after the branch, and each one still blocks the flag |
| -unless Paul waives it. Astra's whole-branch review, round 1 |
| -(`CODEX-FINDINGS-ZDD-READINESS.md`), classes each of them as a flag |
| -blocker, and the fix wave for that round did not close them. |
| - |
| -Readiness round 2 (branch `zdd-flag-readiness-2`, from `650e6152`, pending |
| -merge) closes most of them. A closed item below says "Closed on |
| -zdd-flag-readiness-2 (<commit>), pending merge". That means built and |
| -task-reviewed on the branch: not merged, not released, not rolled, and only |
| -Paul closes it on #272. The branch's whole-branch review (Astra) and the |
| -3000-seed rollout-simulation sweep come after these notes. Still open or |
| -still owed after the branch: claims-on swaps (a future feature); the |
| -`ensureParent` kernel positive control; and the dev mixed-version check (see |
| -"Real-box checks"). Paul approved the spec amendment (rev 18) and the seven |
| -declined-box and old-box strings, unchanged, on 2026-10-13 (the copy-apply |
| -commit on the branch, "copy: readiness round 2's seven strings, approved by |
| -Paul unchanged; rev-18 amendment approved"). The code for the other items |
| -is closed on the branch, pending merge. |
| - |
| -Readiness round 2's dev check (2026-10-13) then found four blockers, and a |
| -fifth defect that was only untidy. All of them are closed in code on |
| -zdd-flag-readiness-3 (`ff4b814a` to `496fb6ed`), pending merge, and they still |
| -block the flag until Paul's dev re-check passes. They are: the edge unit's |
| -`RestrictNamespaces=yes` made every generation placement fail (the exec-shim); |
| -arming did not check placement (`cgroup-placement-failed`); the probe app |
| -rejected `--db` (`cmd/zddprobe`); and `TestStrictKernel` had a defect. The |
| -untidy one is failed generation units lingering in `systemctl --failed`. |
| -Commits and the re-check are in "Roll notes from zdd-flag-readiness-3". |
| - |
| -- Nested live-link race on a declined box: needs an expected identity on |
| - `Control.Start`, root-side (task 9). Closed on zdd-flag-readiness-2 |
| - (`903ed7ca`, `c910d020`), pending merge: a declined box pins the live link |
| - once (its identity and the exec gate's verdict) and nested starts and |
| - seeds exec the pinned build. |
| -- Seeds exec the live link ungated on a declined box (task 9). A failed |
| - seed's descendants are not proven (flag off and on), and `removeSeedDB` |
| - can delete a DB a descendant still writes (task 15). Closed on |
| - zdd-flag-readiness-2 (`903ed7ca` for the gate; `4c5e43b5`, `5e51c008`, |
| - `4771d147` for the proof), pending merge: a seed's processes are proven |
| - gone before its database goes, nested seeds included, and an unproven seed |
| - leaves a durable obligation (see the roll note on `.seed-unproven`). |
| -- A legacy sidecar left stranded beside a retained incumbent has no |
| - recovery path yet (task 9). Closed on zdd-flag-readiness-2 (`c910d020`), |
| - pending merge: a refused sidecar restarts on the instance's own build. |
| -- A clean one-shot's good build is published without checking that the |
| - activator still owns the host and that no fence or lost lease came first, |
| - and a WakeWorker can still start a duplicate wake in a narrow window |
| - (task 12). Closed on zdd-flag-readiness-2 (`deb4c811`), pending merge: a |
| - one-shot is recorded good only after a clean park, and a waiting wake |
| - never starts a second. |
| -- The flag-off normal-stop half of F6: a normal stop still proves only the |
| - leader (task 15). Closed on zdd-flag-readiness-2 (`d6996537`, `ac9f3fef`, |
| - `097ca930`, `79032948`), pending merge: seeds and flag-off stops prove |
| - their processes gone before the lease goes, and a flag-off wake proves its |
| - host cgroup empty before it restores. This is an authorized flag-off |
| - change: one `cgroup.events` read per flag-off stop. |
| -- `ensureParent`'s other failures still run a generation uncapped: no |
| - `+memory`, EBUSY or EACCES on `subtree_control`, the mkdir fallback, and |
| - `applyLimit` on `g<n>`. The kernel positive control (a real cgroupfs |
| - showing the populated-parent refusal and the respawn work) is also owed |
| - (task 14). The code is closed on zdd-flag-readiness-2 (`98593909`, |
| - `8530210e`), pending merge: a generation whose limits cannot be applied |
| - does not start (`cgroup.ErrLimitNotApplied`). The kernel positive control |
| - is still owed (see "Real-box checks"). |
| -- The console instance page shows no hold row or Retry button for a declined |
| - box's hold. This needs copy. Closed on zdd-flag-readiness-2 (`6e6ad000`, |
| - `65d4e135`), pending merge. Paul approved the seven new strings |
| - unchanged on 2026-10-13 (the copy-apply commit; record |
| - `docs/superpowers/plans/2026-10-12-zero-downtime-flag-readiness-2-copy.json`). |
| +### Still owed (code) |
| + |
| +**Current state, 2026-10-14.** Readiness rounds 1 to 3 are merged and |
| +released, so every item this section listed after zdd-flag-readiness is |
| +closed on main. Rev 19 (`ebddcfc`, v0.27.2) and #292 (`e15ad6b`, v0.27.3) |
| +are merged and released too. The kernel checks that were owed here are |
| +closed (see "Kernel checks" at the top of "Before Gate E: owed"). |
| + |
| +Closed, with the commits that closed them: |
| + |
| +- The nested live-link race on a declined box (`903ed7ca`, `c910d020`). A |
| + declined box pins the live link once, and nested starts and seeds exec the |
| + pinned build. |
| +- Seeds that exec'd the live link ungated, and the failed seed's proof |
| + (`903ed7ca`; `4c5e43b5`, `5e51c008`, `4771d147`). A seed's processes are |
| + proven gone before its database goes, and an unproven seed leaves a |
| + durable obligation. |
| +- The stranded legacy sidecar (`c910d020`). A refused sidecar restarts on the |
| + instance's own build. |
| +- The one-shot's good build and WakeWorker's duplicate wake (`deb4c811`). |
| +- The flag-off normal-stop half of F6 (`d6996537`, `ac9f3fef`, `097ca930`, |
| + `79032948`). |
| +- `ensureParent`'s uncapped paths (`98593909`, `8530210e`). A generation |
| + whose limits cannot be applied does not start (`cgroup.ErrLimitNotApplied`). |
| + Its kernel positive control passed on 2026-10-14. |
| +- The declined box's hold row and Retry button (`6e6ad000`, `65d4e135`). Paul |
| + approved the seven strings on 2026-10-13. |
| +- The rev-18 spec amendment for console-signed host retries, approved by |
| + Paul on 2026-10-13. The design branch's spec still has to be raised to rev |
| + 18 there. |
| +- The reopen epoch, now the hard rule (`7c7c6141`, `191c12b9`, `692d1533`, |
| + `a6eb8b35`). The proof and its two assumptions are on `FailureBook` |
| + (`internal/rollout/failures.go`). |
| +- Mixed-version retry sequencing (`6e9e84bd`, `9f27cdfa`, `4d8957c1`, |
| + `18bde560`). Grants ride their own object. Dev round 4 checked the |
| + transitions; the one not run is covered by construction (see "Mixed-version |
| + retries" at the top of "Before Gate E: owed"). |
| +- Readiness round 2's dev blockers, closed by readiness round 3: the |
| + exec-shim for `RestrictNamespaces=yes`, the `cgroup-placement-failed` arming |
| + check, `cmd/zddprobe` and the `TestStrictKernel` fix. |
| +- Task 10's grant consumed while the row is moving or landing (`076bd9c0`). |
| +- From settings plan 4, on branch `zdd-owed-items`: a cold wake's build-state |
| + record is written at the exec, after the replica-key gate and the cgroup |
| + refusals, so a refused launch leaves no record (owed before O8); and |
| + `release.ResolveLivePath` calls `release.ResolveLiveLink`. |
| + |
| +Still open: |
| + |
| - Claims-on swaps (the four gaps from `CODEX-FINDINGS-ZDD-IMPL-5-MERGE.md`). |
| - A future feature. Still open and not scheduled. |
| -- Spec section 11 still says a retry is a re-signed pointer. The spec needs a |
| - revision for console-signed host-retry grants. Drafted on |
| - zdd-flag-readiness-2 as |
| - `docs/superpowers/specs/2026-10-12-zero-downtime-deploys-rev18-amendment.md` |
| - (this commit), approved by Paul 2026-10-13 (the copy-apply commit). The |
| - design branch's spec is not edited from this branch: the copy step that |
| - raises it to rev 18 is still to do there. |
| -- The reopen epoch bound (c12c35c3), now the hard rule. Paul's ruling |
| - (2026-10-12): a stale grant must never clear a later failure, including |
| - across a crash. Closed on zdd-flag-readiness-2 (`7c7c6141`, `191c12b9`), |
| - pending merge. The rule: the box keeps one restriction generation per app, |
| - moved by every change to any of the app's restrictions; the book is saved |
| - before a generation is published, a save that fails leaves it unpublished |
| - (epoch 0, so no Retry is offered) and is retried on its own; a reopen |
| - starts past every saved value; and a failure book written by an earlier |
| - agent is given a new identity when adopted, so earlier grants name the old |
| - one. The 2^20 advance on every open is gone. The proof sketch and its two |
| - assumptions are in the doc comment on `FailureBook` |
| - (`internal/rollout/failures.go`). The cost if the ruling is wrong: a box |
| - with a failing disk shows holds with no Retry until a save lands. |
| -- Mixed-version retry sequencing: the order in which boxes and consoles take |
| - the signed, book-bound grants needs writing down and checking on dev before |
| - the flag goes on (see "Retries: supported transitions" below). Closed on |
| - zdd-flag-readiness-2 (`6e9e84bd`, `9f27cdfa`, `4d8957c1`, `18bde560`), |
| - pending merge, by construction: grants ride their own object, so no |
| - ordering of box and console rolls applies one unsafely. The dev-box check |
| - across a mixed-version roll is still owed (see "Real-box checks"). |
| - |
| -Task 10's "a grant consumed while the row is moving or landing" is closed |
| -by 076bd9c0 (final review round 1), pending merge. |
| + A future feature, not scheduled. A box with host claims on declines the |
| + flag. |
| +- Leftover `consumed/` files refuse the claims census. Root's request record |
| + `/opt/carlos/consumed/<host>` and its fence lock `.<host>.lock` outlive the |
| + installation, and the empty-installation census refuses both. It also |
| + refuses another host's record, which is an unclassified file. The claims |
| + design keeps the census as it is (instance-key ruling 24): the record has |
| + to be retired with the installation. Only root can remove it, so the fix |
| + belongs to root's claim lifecycle. Owed before host claims are switched on. |
| + It does not block the flag. |
| ### Roll notes from zdd-flag-readiness |