carlos / platform Public

Sidecar isolation plan: follow spec rev 4 (explicit settings, no ratchet)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude agent, operated by paul@keymail.dev fea6a05e8604b07d6a64e366ee09a6b5692b5247 parent 9f2cd28
1 file changed, +61 −47
  • docs/superpowers/plans/2026-10-24-sidecar-isolation.md +61 −47

CI failed — run details

CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.016s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (18 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (173 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.501s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.764s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.761s
ok  	github.com/carlosframework/platform/internal/activator	57.153s
ok  	github.com/carlosframework/platform/internal/agentsock	0.024s
ok  	github.com/carlosframework/platform/internal/alerting	0.008s
ok  	github.com/carlosframework/platform/internal/analytics	0.047s
ok  	github.com/carlosframework/platform/internal/appconfig	2.896s
ok  	github.com/carlosframework/platform/internal/apperr	0.185s
ok  	github.com/carlosframework/platform/internal/applog	0.233s
ok  	github.com/carlosframework/platform/internal/awsinv	0.007s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.007s
ok  	github.com/carlosframework/platform/internal/boxid	0.688s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.011s
ok  	github.com/carlosframework/platform/internal/caps	0.017s
ok  	github.com/carlosframework/platform/internal/certwarm	0.008s
ok  	github.com/carlosframework/platform/internal/cgroup	0.837s
ok  	github.com/carlosframework/platform/internal/changelog	0.443s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.158s
ok  	github.com/carlosframework/platform/internal/clamd	0.065s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.146s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.022s
ok  	github.com/carlosframework/platform/internal/dbquery	0.013s
ok  	github.com/carlosframework/platform/internal/dbreads	2.241s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.008s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.010s
ok  	github.com/carlosframework/platform/internal/docsite	0.013s
ok  	github.com/carlosframework/platform/internal/domains	2.833s
ok  	github.com/carlosframework/platform/internal/doorkey	0.010s
ok  	github.com/carlosframework/platform/internal/economics	0.005s
ok  	github.com/carlosframework/platform/internal/edge	45.958s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.009s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.137s
ok  	github.com/carlosframework/platform/internal/gate	1.656s
ok  	github.com/carlosframework/platform/internal/genselect	0.024s
ok  	github.com/carlosframework/platform/internal/geo	0.012s
ok  	github.com/carlosframework/platform/internal/geoip	0.034s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.167s
ok  	github.com/carlosframework/platform/internal/host	143.047s
ok  	github.com/carlosframework/platform/internal/hostactors	6.232s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.015s
ok  	github.com/carlosframework/platform/internal/hostbox	2.971s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.755s
ok  	github.com/carlosframework/platform/internal/hostenv	0.015s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.015s
ok  	github.com/carlosframework/platform/internal/hostexec	5.362s
ok  	github.com/carlosframework/platform/internal/hostfence	0.039s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.351s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.022s
ok  	github.com/carlosframework/platform/internal/hostguard	1.079s
ok  	github.com/carlosframework/platform/internal/hostops	2.053s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.014s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.014s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.572s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.218s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.014s
ok  	github.com/carlosframework/platform/internal/infraview	0.015s
ok  	github.com/carlosframework/platform/internal/instancectl	5.245s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.795s
ok  	github.com/carlosframework/platform/internal/instancefs	0.025s
ok  	github.com/carlosframework/platform/internal/instancekey	0.015s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.025s
ok  	github.com/carlosframework/platform/internal/layout	1.715s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.016s
ok  	github.com/carlosframework/platform/internal/lease	10.345s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.580s
ok  	github.com/carlosframework/platform/internal/ledger	0.015s
ok  	github.com/carlosframework/platform/internal/mail	0.228s
ok  	github.com/carlosframework/platform/internal/maintenance	0.097s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.568s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.099s
ok  	github.com/carlosframework/platform/internal/metrics	0.009s
ok  	github.com/carlosframework/platform/internal/moves	22.583s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.971s
ok  	github.com/carlosframework/platform/internal/objstore	0.256s
ok  	github.com/carlosframework/platform/internal/ops	0.335s
ok  	github.com/carlosframework/platform/internal/park	0.299s
ok  	github.com/carlosframework/platform/internal/plans	0.005s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
2026/10/24 20:42:02 provision: listing apps/bab/blog/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:02 provision: listing apps/bab/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:02 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/one.example.com.json: unreadable: read refused
2026/10/24 20:42:02 provision: listing apps/bac/tito/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:02 provision: an app's records could not be listed: they are skipped
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:02 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 20:42:02 provision: remove retired instance route shop.example: provision: claim admission unavailable
2026/10/24 20:42:02 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:42:02 provision: remove retired sidecar route worker.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:42:02 provision: claim install acme.go.tito.io: provision: claim admission unavailable
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:42:02 provision: claim install bot.eleven.bac.sidecar.internal: provision: claim admission unavailable
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:42:02 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 20:42:02 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:42:02 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: no sealed config
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:42:02 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:42:02 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: claim install acme.go.tito.io: registry: claim row ownership changed or unknown
2026/10/24 20:42:02 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["run"])
2026/10/24 20:42:02 provision: claim install bot.eleven.bac.sidecar.internal: registry: claim row ownership changed or unknown
2026/10/24 20:42:02 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:02 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:02 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:02 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/new.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:02 provision: minted instance route ri.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rj.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rg.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rl.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rf.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rh.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rd.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route ra.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rb.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: minted instance route rc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 20:42:02 provision: skipping record apps/bac/tito/instances/rb.go.tito.io.json: read failed: read refused
2026/10/24 20:42:02 provision: minted instance route re.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appa.example (app "appa" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appe.example (app "appe" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appg.example (app "appg" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.apph.example (app "apph" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appb.example (app "appb" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appc.example (app "appc" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appd.example (app "appd" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appf.example (app "appf" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appi.example (app "appi" acct "bac")
2026/10/24 20:42:03 provision: minted instance route x.appj.example (app "appj" acct "bac")
2026/10/24 20:42:03 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:03 provision: minted instance route r0036.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0048.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0079.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0089.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0012.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0067.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0083.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0116.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0053.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0104.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0122.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0004.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0010.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0023.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0034.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0121.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0011.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0062.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0066.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0087.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0115.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0000.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0022.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0049.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0037.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0039.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0043.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0108.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0044.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0046.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0101.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0114.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0052.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0006.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0028.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0069.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0091.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0102.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0105.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0001.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0007.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0009.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0051.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0077.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0110.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0118.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0058.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0061.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0119.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0120.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0065.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0070.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0073.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0030.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0032.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0127.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0029.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0057.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0071.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0076.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0090.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0098.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0112.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0031.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0033.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0063.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0074.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0129.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0015.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0050.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0078.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0084.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0088.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0093.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0094.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0124.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0018.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0056.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0113.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0125.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0047.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0068.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0072.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0109.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0025.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0045.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0054.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0055.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0082.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0095.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0096.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0123.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0005.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0013.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0064.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0080.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0081.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0117.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0103.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0126.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0035.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0040.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0085.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0099.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0019.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0092.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0003.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0026.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0008.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0017.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0021.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0024.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0038.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0097.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0111.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0106.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0128.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0042.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0060.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0075.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0002.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0100.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0107.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0027.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0041.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0059.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0020.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0086.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0014.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:03 provision: minted instance route r0016.go.tito.io (app "tito" acct "bac")
--- FAIL: TestPlan9B8RecordWriteCensus (0.73s)
    plan9_b8_census_test.go:372: record-write census rejected 1 site(s); update the explicit inventory only after reviewing the source:
          changed site internal/ops/litestream.go:FleetDBsWithSkipped: source differs from the reviewed digest
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: refusing to mint route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route console.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted service route svc.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route shared.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:42:04 provision: converged acme.go.tito.io channel edge -> canary/rehearsal
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: empty channel
2026/10/24 20:42:04 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io environment "" -> "staging"
2026/10/24 20:42:04 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io steering "" -> "latency"
2026/10/24 20:42:04 provision: converged acme.go.tito.io steering "latency" -> ""
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io hibernate false -> true
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io hibernate true -> false (replication "daily" cleared: only a hibernating route's rung is read)
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged acme.go.tito.io status-named false -> true
2026/10/24 20:42:04 provision: converged acme.go.tito.io status-named true -> false
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted service route ha.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7002" -> "127.0.0.1:7001,127.0.0.1:7003" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:42:04 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7001,127.0.0.1:7003" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:42:04 provision: converged ha.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:7003,127.0.0.1:7001" -> "127.0.0.1:7003,127.0.0.1:7001" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "{\"path\":\"/healthz\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:42:04 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: converged whole.go.tito.io upstreams addr "127.0.0.1:9443" -> "", addrs "" -> "127.0.0.1:9443,127.0.0.1:9444" (probe "" -> "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}")
2026/10/24 20:42:04 provision: converged whole.go.tito.io upstreams addr "" -> "", addrs "127.0.0.1:9443,127.0.0.1:9444" -> "" (probe "{\"path\":\"/\",\"status\":200,\"interval_ms\":2000,\"fail_after\":3,\"rise_after\":2}" -> "")
2026/10/24 20:42:04 provision: whole.go.tito.io: record describes a different route SHAPE than the row (kind "instance"/"service" unit ""/"" socket "/run/carlos/whole.go.tito.io.sock"/"" db "/data/whole.go.tito.io.db"/"") — not converged in place; `carlos remove whole.go.tito.io` purges this route's capability grants (registry.Delete's contract, not a bug) before the next pass re-mints it, so treat that as a last resort, not a routine fix
2026/10/24 20:42:04 provision: minted service route whole.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping accounts/bac/account.json: malformed account manifest: invalid character 'o' in literal null (expecting 'u')
2026/10/24 20:42:04 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: manifest bac/tito: read failed: provision: manifest bac/tito: invalid character 'o' in literal null (expecting 'u')
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: disagrees with its own path (host="wrong-host.go.tito.io" account="bac" app="tito")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/acme$evil.go.tito.io.json: host "acme$evil.go.tito.io" is not a hostname
2026/10/24 20:42:04 provision: not removing acme$evil.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/bad-service.go.tito.io.json: invalid shape: kind service with no addr: the platform only proxies to a service, so the record must name the upstream it proxies to
2026/10/24 20:42:04 provision: not removing bad-service.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/no-channel.go.tito.io.json: empty channel
2026/10/24 20:42:04 provision: not removing no-channel.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: skipping record apps/bac/tito/instances/acme.go.tito.io.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:04 provision: not removing acme.go.tito.io: its record exists but could not be read cleanly this pass
2026/10/24 20:42:04 provision: removed retired instance route ghost.go.tito.io (record gone)
2026/10/24 20:42:04 provision: duplicate host dup.go.tito.io: keeping apps/bac/tito/instances/dup.go.tito.io.json, skipping apps/bad/tito/instances/dup.go.tito.io.json
2026/10/24 20:42:04 provision: minted instance route dup.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:04 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:04 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 20:42:04 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:04 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:04 provision: removed retired static route site.go.tito.io (app in the trash)
2026/10/24 20:42:04 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 20:42:05 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:05 provision: removed retired instance route acme.go.tito.io (app in the trash)
2026/10/24 20:42:05 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:05 provision: trash marker for bac/tito unreadable: release: malformed trash marker for bac/tito: invalid character 'n' looking for beginning of object key string — not minting for this app
2026/10/24 20:42:05 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: converged acme.go.tito.io channel canary/rehearsal -> edge
2026/10/24 20:42:05 provision: converged acme.go.tito.io environment "staging" -> ""
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (backing "unit" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (tunnel "pi-fleet" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (caps "port:25" (box-scoped, not expressible in a record)) — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (platform (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (canary (owned by the domains reconcile pass)) — leaving it alone
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (db "/data/other.db"/"/data/acme.go.tito.io.db") — leaving it alone
2026/10/24 20:42:05 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:42:05 provision: dry-run: would mint instance route acme.go.tito.io (app "tito" acct "bac" channel "stable")
2026/10/24 20:42:05 provision: dry-run: would adopt existing route adopt.go.tito.io (app "tito" acct "bac") — this record would own its channel and environment
2026/10/24 20:42:05 provision: dry-run: would converge adopt.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: dry-run: would converge adopt.go.tito.io environment "" -> "staging"
2026/10/24 20:42:05 provision: dry-run: would converge owned.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: dry-run: would converge owned.go.tito.io environment "" -> "staging"
2026/10/24 20:42:05 provision: dry-run: would converge owned.go.tito.io hibernate false -> true
2026/10/24 20:42:05 provision: dry-run: would converge owned.go.tito.io seed
2026/10/24 20:42:05 provision: dry-run: would remove retired instance route gone.go.tito.io (record gone)
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: adopted existing route adopt.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: converged adopt.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: converged adopt.go.tito.io environment "" -> "staging"
2026/10/24 20:42:05 provision: converged owned.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: converged owned.go.tito.io environment "" -> "staging"
2026/10/24 20:42:05 provision: converged owned.go.tito.io hibernate false -> true
2026/10/24 20:42:05 provision: removed retired instance route gone.go.tito.io (record gone)
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: adopted existing route story.carlosframework.com (app "story" acct "bad") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: story.carlosframework.com exists but is not the route this record describes (kind "instance"/"static") — leaving it alone
2026/10/24 20:42:05 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted service route pub.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted service route pubs.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted service route named.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted service route priv.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route unit.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route exec.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted service route loop.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted static route pisite.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted static route site.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: removed retired static route site.go.tito.io (record gone)
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: converged acme.go.tito.io replicas "ie,uk" -> "uk"
2026/10/24 20:42:05 provision: converged acme.go.tito.io replicas "uk" -> ""
2026/10/24 20:42:05 provision: minted instance route acme-uk.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: converged acme-uk.go.tito.io replica mark true -> false
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: minted instance route router.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:05 provision: router.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 20:42:05 provision: acme.go.tito.io: not minting this pass: the box's layout intent could not be read: store down
2026/10/24 20:42:05 provision: adopted existing route acme.go.tito.io (app "tito" acct "bac") — this record now owns its channel and environment
2026/10/24 20:42:05 provision: converged acme.go.tito.io channel stable -> edge
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:42:05 provision: not removing acme.go.tito.io (record gone): participant of a running operation
2026/10/24 20:42:05 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:42:05 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:42:05 provision: refusing to mint held route acme.go.tito.io (app "tito" acct "bac"): this box declares CARLOS_INBOUND=none (no-inbound) and cannot serve routed instance traffic
2026/10/24 20:42:05 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 20:42:05 provision: acme.go.tito.io: held restoring by rb_other, not by mv_acme; leaving it
2026/10/24 20:42:05 provision: acme.go.tito.io: the row is not this pass's (app "other" acct ""); not holding it for mv_acme
2026/10/24 20:42:05 provision: acme.go.tito.io exists but is not the route this record describes (app "other"/"tito") — leaving it alone
2026/10/24 20:42:05 provision: dry-run: would mint instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac" channel "stable")
2026/10/24 20:42:05 provision: acme.go.tito.io: not held landing by mv_acme: the row's hold changed under this pass; the next pass judges it afresh
2026/10/24 20:42:05 provision: held acme.go.tito.io landing by mv_acme (was ready)
2026/10/24 20:42:05 provision: minted instance route acme.example.com (app "shop" acct "bac")
2026/10/24 20:42:05 provision: minted instance route plain.example.com (app "shop" acct "bac")
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/liar.shop.example.com.json: disagrees with its own path (host="other.shop.example.com" account="bac" app="shop")
2026/10/24 20:42:05 provision: skipping record apps/bac/shop/instances/garbled.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:05 provision: listing apps/bac/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:06 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:06 provision: removed retired instance route acme.go.tito.io (record gone)
2026/10/24 20:42:06 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:06 provision: bac/tito is in the trash — not minting instance routes for it
2026/10/24 20:42:06 provision: minted sidecar route bot.shop.bac.sidecar.internal (app "shop" acct "bac" args ["run"])
2026/10/24 20:42:06 provision: removed retired sidecar route bot.shop.bac.sidecar.internal (record gone)
2026/10/24 20:42:06 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 20:42:06 provision: minted sidecar route bot.shop.bum.sidecar.internal (app "shop" acct "bum" args ["run"])
2026/10/24 20:42:06 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:06 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:06 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:06 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 20:42:06 provision: sidecar bot.shop.bum.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:06 provision: removed retired sidecar route bot.shop.bum.sidecar.internal (record gone)
2026/10/24 20:42:07 provision: a.shop.example.com: swapped for import sd_a47af5lv6krb3zl2wpw44jbswa (the original route is journaled)
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_a47af5lv6krb3zl2wpw44jbswa committed: its gate is cleared and its journal row dropped
2026/10/24 20:42:07 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_bzy3nigdwuznlhry5hldt5uxou rolled back to its original route
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_bzy3nigdwuznlhry5hldt5uxou: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_bzy3nigdwuznlhry5hldt5uxou is cleaned up and its journal row retired
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_kiuhhjvwznycflgnan6lid5mru rolled back to its original route
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_kiuhhjvwznycflgnan6lid5mru: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_kiuhhjvwznycflgnan6lid5mru is cleaned up and its journal row retired
2026/10/24 20:42:07 provision: dry-run: would redo a.shop.example.com's swap record CAS for import sd_r3g6gkepxo223cj6i5q3ovfpla
2026/10/24 20:42:07 provision: dry-run: would clear a.shop.example.com's import gate
2026/10/24 20:42:07 provision: dry-run: would converge a.shop.example.com seed source
2026/10/24 20:42:07 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (connection reset)
2026/10/24 20:42:07 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (provision: invalid maintenance projection or protected fields)
2026/10/24 20:42:07 provision: a.shop.example.com: the import's record apps/bac/shop/instances/a.shop.example.com.json is not one this pass can use (the record under apps/bac/shop/instances/a.shop.example.com.json is apps/bac/shop/instances/b.shop.example.com.json's)
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_q2zyyhb5jw77uy25lasqq3psn4 cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_knj2puwwzt27m4dfqlbggdpmxe cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_xdxpsbod4tlrgyw7lv7qq2ofw4 is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_illjjby3mwgsbzzihn6a7zykeu is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_ryc7hvx7fgano4r22eaa4fulqa is journaled, but this box cannot act on imports; its row is left alone
2026/10/24 20:42:07 provision: the import journal could not be read: registry: import journal a.shop.example.com: original row: unexpected end of JSON input (no import is acted on and no route is removed this pass)
2026/10/24 20:42:07 provision: b.shop.example.com: import sd_hk25h3mkmax53hllqlhe3p7il4 left alone this pass: the import journal could not be read
2026/10/24 20:42:07 provision: c.shop.example.com: import sd_33fdna4t4zfb5xct6aqv7focca left alone this pass: the import journal could not be read
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_ihpfyiiojwoqn6xe6i6zkfx5y4 committed: its gate is cleared and its journal row dropped
2026/10/24 20:42:07 provision: a.shop.example.com: not converging import sd_2hoityawt6izcyk2dpp7kce5gu: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 20:42:07 provision: a.shop.example.com: not converging import sd_ro3xp7ahx2mwqz2whjpzpshnsm: it is swapped but not committed, and the row on this box has no import gate
2026/10/24 20:42:07 provision: a.shop.example.com: not converging import sd_heestt5mqx72qxjy3xklqxfrvq: it is placed but not committed, and the row on this box has no import gate
2026/10/24 20:42:07 provision: a.shop.example.com: not converging import sd_qgyep4rmep3tvjve3qbwd5ovri: it is placed but not committed, and the row on this box has no import gate
2026/10/24 20:42:07 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: converge seed source on a.shop.example.com: constraint failed: seed_source is read-only here (1811)
2026/10/24 20:42:07 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: a.shop.example.com: import sd_ehxhlo3yzaykg7jba46qons5ea committed: its gate is cleared and its journal row dropped
2026/10/24 20:42:07 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:07 provision: acme.go.tito.io: row is on the nested layout (db "/data/instances/acme.go.tito.io/acme.go.tito.io.db" socket "/run/carlos/instances/acme.go.tito.io/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:07 provision: acme.go.tito.io: not minting a seeded instance: this box does not mint nested (<nil>)
2026/10/24 20:42:07 provision: acme.go.tito.io: not minting a seeded instance: claim control is on for this box
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_efwdaxmtbefhlptkzuazna6wra: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_efwdaxmtbefhlptkzuazna6wra rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: acme.go.tito.io: not minting a seeded instance: its record does not describe a hibernating instance
2026/10/24 20:42:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:08 provision: removed instance route acme.go.tito.io (its seed sd_kavrydzvoqyvpvahrosgcju3fq was aborted); the next pass rolls it back
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_kavrydzvoqyvpvahrosgcju3fq: this box cannot read seed markers, and places no seed; nothing local is removed
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_kavrydzvoqyvpvahrosgcju3fq rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_bmwa44tuz4ydas5t64nothrhau has a row this pass may not remove; leaving the seed aborted
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_ppvqtic2lyrmpjxlw7n3v4zgju rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:08 provision: removed instance route acme.go.tito.io (its seed sd_gzgn2kyegepv4vd6on2hduc3rm was aborted); the next pass rolls it back
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_gzgn2kyegepv4vd6on2hduc3rm has no route on this box: its local data is removed
2026/10/24 20:42:08 provision: acme.go.tito.io: aborted seed sd_gzgn2kyegepv4vd6on2hduc3rm rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_irfbclux6oljcv66sa2qauupuq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_irfbclux6oljcv66sa2qauupuq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_irfbclux6oljcv66sa2qauupuq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_7h3y5zkoaow52mznn4qwqnejve (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_7h3y5zkoaow52mznn4qwqnejve rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_7h3y5zkoaow52mznn4qwqnejve is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_oaxnctye3bstq3i4sp2njho7oy (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_oaxnctye3bstq3i4sp2njho7oy rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_oaxnctye3bstq3i4sp2njho7oy: the host's replica is left alone: its record no longer names this seed
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_oaxnctye3bstq3i4sp2njho7oy is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_e5v64m3yh2h3pbgvacukzbzfmm (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_e5v64m3yh2h3pbgvacukzbzfmm rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_e5v64m3yh2h3pbgvacukzbzfmm rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_e5v64m3yh2h3pbgvacukzbzfmm is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_q5rxdxqzchcfmrb5gxsighlczq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_q5rxdxqzchcfmrb5gxsighlczq rollback deferred: the host is not fenced and stopped yet (stop unproven)
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_nt7m5dr3icxz42qsay3uyclx6u (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_nt7m5dr3icxz42qsay3uyclx6u is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_asmmpcxajuoawp2fuwkbdp4jwe (the original route is journaled)
2026/10/24 20:42:08 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_asmmpcxajuoawp2fuwkbdp4jwe left alone this pass: its record could not be read
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_difdilrrlpfetvxfwaexm3qrm4 (the original route is journaled)
2026/10/24 20:42:08 provision: skipping record apps/bac/shop/instances/a.shop.example.com.json: read failed: connection reset
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_difdilrrlpfetvxfwaexm3qrm4 left alone this pass: its record could not be read
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_koqpofgfvxogfv4ddo4zhm4bzi (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_koqpofgfvxogfv4ddo4zhm4bzi: close the import gate: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_koqpofgfvxogfv4ddo4zhm4bzi rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_koqpofgfvxogfv4ddo4zhm4bzi is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_nb7wjhxsi75cwsphejj5jr3aj4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_nb7wjhxsi75cwsphejj5jr3aj4: close the import gate: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_nb7wjhxsi75cwsphejj5jr3aj4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_nb7wjhxsi75cwsphejj5jr3aj4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_c6bt53h64p64ebhlvpvnlpzm5a (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_c6bt53h64p64ebhlvpvnlpzm5a rollback deferred: the host is not fenced and stopped yet (injected failure at fence)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_c6bt53h64p64ebhlvpvnlpzm5a rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_c6bt53h64p64ebhlvpvnlpzm5a is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_6hzujmvdmdjnkj3jdnxdcd2jiq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_6hzujmvdmdjnkj3jdnxdcd2jiq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_6hzujmvdmdjnkj3jdnxdcd2jiq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_r3re3hi3kwll2h6whld2tqh3ca (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_r3re3hi3kwll2h6whld2tqh3ca: retire its instance key: injected failure at retire-key
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_r3re3hi3kwll2h6whld2tqh3ca rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_r3re3hi3kwll2h6whld2tqh3ca is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_d645xxcwlzusfycwao6ytqrie4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_d645xxcwlzusfycwao6ytqrie4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_d645xxcwlzusfycwao6ytqrie4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_3s7l7tbjc6jnq56nnq6ycssawq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_3s7l7tbjc6jnq56nnq6ycssawq: remove its local data: injected failure at remove-local
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_3s7l7tbjc6jnq56nnq6ycssawq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_3s7l7tbjc6jnq56nnq6ycssawq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_pd3yiwyrga3likqmds5baizye4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_pd3yiwyrga3likqmds5baizye4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_pd3yiwyrga3likqmds5baizye4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_bqzknuvpklqh6tqbytsrmetql4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_bqzknuvpklqh6tqbytsrmetql4: remove its local data: injected failure at remove-local-done
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_bqzknuvpklqh6tqbytsrmetql4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_bqzknuvpklqh6tqbytsrmetql4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_is5yl6uxycoxacxwjojpq4mv2y (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_is5yl6uxycoxacxwjojpq4mv2y rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_is5yl6uxycoxacxwjojpq4mv2y is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_vdv4l35ode23ij5pz336zde2vm (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vdv4l35ode23ij5pz336zde2vm: restore the original route: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vdv4l35ode23ij5pz336zde2vm rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vdv4l35ode23ij5pz336zde2vm is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_blxbmo6eih33thcdhrr52mrayq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_blxbmo6eih33thcdhrr52mrayq: restore the original route: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_blxbmo6eih33thcdhrr52mrayq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_blxbmo6eih33thcdhrr52mrayq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_4dte56t57kclsi6yozhjxdvpfa (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_4dte56t57kclsi6yozhjxdvpfa is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_vnv6wkgzy3vo4uphacrcmwvp2y (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vnv6wkgzy3vo4uphacrcmwvp2y rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vnv6wkgzy3vo4uphacrcmwvp2y: delete its snapshot: injected failure at delete-snapshot
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_vnv6wkgzy3vo4uphacrcmwvp2y is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_snjp5macaaty3ji4ffoabsdyja (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_snjp5macaaty3ji4ffoabsdyja rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_snjp5macaaty3ji4ffoabsdyja is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_dqyfqqathtsdstj5wmyfcs34h4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_dqyfqqathtsdstj5wmyfcs34h4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_dqyfqqathtsdstj5wmyfcs34h4: delete the host's replica: injected failure at delete-replica
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_dqyfqqathtsdstj5wmyfcs34h4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_hdgpq4ql4z7yw3oodi3ji4pigi (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_hdgpq4ql4z7yw3oodi3ji4pigi rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_hdgpq4ql4z7yw3oodi3ji4pigi is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_weqs6v34f3ra6am5cpylsvtd7i (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_weqs6v34f3ra6am5cpylsvtd7i rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_weqs6v34f3ra6am5cpylsvtd7i: retire its journal row: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_weqs6v34f3ra6am5cpylsvtd7i is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_gfcbhnlvarlhj67rrjzi6pxv7q (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_gfcbhnlvarlhj67rrjzi6pxv7q rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_gfcbhnlvarlhj67rrjzi6pxv7q: retire its journal row: constraint failed: injected (1811)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_gfcbhnlvarlhj67rrjzi6pxv7q is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_e7unjngrgvxyvnnfu6dyidrda4 (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_e7unjngrgvxyvnnfu6dyidrda4 rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_e7unjngrgvxyvnnfu6dyidrda4 is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: mark import sd_e7unjngrgvxyvnnfu6dyidrda4 rolled back: injected failure at cas
2026/10/24 20:42:08 provision: a.shop.example.com: aborted seed sd_e7unjngrgvxyvnnfu6dyidrda4 rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_toevjy2h6qqklyo6d37rjdysgq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_toevjy2h6qqklyo6d37rjdysgq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_toevjy2h6qqklyo6d37rjdysgq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: aborted seed sd_toevjy2h6qqklyo6d37rjdysgq rolled back (no box had swapped it)
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_iyu6n5izfd2rpkzmfdoi5ovbwq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_iyu6n5izfd2rpkzmfdoi5ovbwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_iyu6n5izfd2rpkzmfdoi5ovbwq rollback deferred: the host is not fenced and stopped yet (<nil>)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_iyu6n5izfd2rpkzmfdoi5ovbwq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_iyu6n5izfd2rpkzmfdoi5ovbwq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_eibfhbrl6apq45b6lgaxsi3c7m (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_eibfhbrl6apq45b6lgaxsi3c7m rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_eibfhbrl6apq45b6lgaxsi3c7m is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_5qfs6ptp73ohvuhunxmyj4vk4a (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_5qfs6ptp73ohvuhunxmyj4vk4a rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_5qfs6ptp73ohvuhunxmyj4vk4a is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_mussj77ddngm2je2hiqjnnkjhq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_mussj77ddngm2je2hiqjnnkjhq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_mussj77ddngm2je2hiqjnnkjhq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_jw7m2rjdcrprua65p6ac4ftvxy (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_jw7m2rjdcrprua65p6ac4ftvxy rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_jw7m2rjdcrprua65p6ac4ftvxy is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_5p46z3duc3jopmmivwcg6hoziq (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_5p46z3duc3jopmmivwcg6hoziq rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_5p46z3duc3jopmmivwcg6hoziq is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_zf7made4q2qisf2dan5w5txv3a (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_zf7made4q2qisf2dan5w5txv3a rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_zf7made4q2qisf2dan5w5txv3a is cleaned up and its journal row retired
2026/10/24 20:42:08 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:42:08 provision: a.shop.example.com: swapped for import sd_yjaqu5xemo2rdhquy63bg3e7yu (the original route is journaled)
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_yjaqu5xemo2rdhquy63bg3e7yu rolled back to its original route
2026/10/24 20:42:08 provision: a.shop.example.com: import sd_yjaqu5xemo2rdhquy63bg3e7yu is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: minted instance route a.shop.example.com (app "other" acct "bac")
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_qlsppeydwyp3wxpiyjfftfg5vy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_qlsppeydwyp3wxpiyjfftfg5vy has no route on this box: its local data is removed and no route is put back
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_qlsppeydwyp3wxpiyjfftfg5vy is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_sl5lbuajxfrydt76ys6l7odffq (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_vclvqrvbdsny3w45uegvsvf5qy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_n6clqonqjeayebpbfimlb3j3gi (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_n6clqonqjeayebpbfimlb3j3gi cannot roll back on this box: the activator is not wired; it stays journaled and gated
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ccqvstru3no7zz4q7ee2htkcza (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ccqvstru3no7zz4q7ee2htkcza is not rolled back: the route changed under the fence, so nothing there is touched
2026/10/24 20:42:09 provision: a.shop.example.com: import "../not-a-seed" names no snapshot and no replica; only its journal row is cleaned up
2026/10/24 20:42:09 provision: a.shop.example.com: import ../not-a-seed is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_5noaxyo3cn4gwf62a4sjtdwgpy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ua5u6uq2utjpab6h7lyqj3y5lq (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ppxao236bwh3cp2qxmihb4pbfm (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_t4i6yyo3aee5no3vzgkk2b4rla (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_dcyc4lpepcq654km62oxvexbeq (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_dcyc4lpepcq654km62oxvexbeq rollback deferred: the host is not fenced and stopped yet (stop evidence unreadable)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_2zxqd54f2ywva47lpiim6mgqe4 (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_2zxqd54f2ywva47lpiim6mgqe4 has no route on this box: its local data is removed and no route is put back
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_2zxqd54f2ywva47lpiim6mgqe4 is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_mvayf54p5np4hrbtp6igjfk7n4 (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_mvayf54p5np4hrbtp6igjfk7n4: remove its local data: injected failure at remove-local
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_mvayf54p5np4hrbtp6igjfk7n4 is not rolled back: the route at the host is not the import's, so nothing there is touched
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_yslak3vf74hb5dcbfpxyxeyel4 (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_yslak3vf74hb5dcbfpxyxeyel4: a route appeared at the host, so its local database is left and the rollback waits
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ehv7sevoh3csvxnsb6xltutjyu (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ehv7sevoh3csvxnsb6xltutjyu rollback deferred: no fence generation: registry busy
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_3ekbhtnmw6rfuh27lezqjj4uym (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_3ekbhtnmw6rfuh27lezqjj4uym rollback deferred: no fence generation: the generation source answered 0
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_qbf7ts3c3x23qz5dvy5ewrfkta (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_qilvdzt4zjqwdercygczxuyf2m (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_w62cklh2spcsre653dyxra5pqy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import deferred: this box cannot read the instance's env file
2026/10/24 20:42:09 provision: a.shop.example.com: import deferred: the instance's env file could not be read: a symlink
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ng3hy2o7il3du5gpd5h6e2dcle (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ng3hy2o7il3du5gpd5h6e2dcle rolled back to its original route
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ng3hy2o7il3du5gpd5h6e2dcle is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_o5qxcvrxmeav2kga46qfgxnac4 (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_o5qxcvrxmeav2kga46qfgxnac4 rolled back to its original route
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_o5qxcvrxmeav2kga46qfgxnac4 is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_5kocruktzfjusylt7q4ezxrqyi (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_5kocruktzfjusylt7q4ezxrqyi rolled back to its original route
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_5kocruktzfjusylt7q4ezxrqyi is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_j5uizql4vsa4jycjfo2gr3p6sy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_j5uizql4vsa4jycjfo2gr3p6sy: retire its instance key: the env file is a symlink
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_j5uizql4vsa4jycjfo2gr3p6sy rolled back to its original route
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_j5uizql4vsa4jycjfo2gr3p6sy is cleaned up and its journal row retired
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_ddihvnn6gqafqpuisnivfutchm (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: row is on the nested layout (db "/data/instances/a.shop.example.com/a.shop.example.com.db" socket "/run/carlos/instances/a.shop.example.com/app.sock"); the record's shared paths are not drift
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_twsd4at2lbcpgr63qox42aawmq (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_d6zj5cck75l4w4hods4fmgsnu4 refused: there is no route at a.shop.example.com to replace
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ziba4vw5lnp36qmvagcdgkfxeq refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_eq4wpncrt3cie2ask5twlhy4wi refused: the route's address is 127.0.0.1:8401,127.0.0.1:8402, not 127.0.0.1:8401
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_4fxws6ardzsflkoyntvkwvqzii refused: the route's address is 127.0.0.1:9, not 127.0.0.1:8401
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_piyzk5matvf3nd2lnvlxvcqgp4 refused: the route belongs to app other
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_sn3fuaggeh7ruyuq4tor6wmu5q refused: the route is filed under another account
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ql3xp5nlwhvkcm3uwdl5kiq3la refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_kau5c7jujbnhhib4zeouljid2u refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_dwpffcufqglvapvlchxpadjhpu refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_h74paua35ft2o52wgvf6r73lry refused: the route is filed under the operator account, and no assignment maps shop to this app
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_hyzhgbfadczjqasgqhxj6754oe refused: the route is not an address route this import can take over (socket)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_z4spkrp3kiaakvoynmntzmvo3m refused: the route is not an address route this import can take over (no address)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_vmfvxg6iavotpa7iundh7f7we4 refused: the route is not an address route this import can take over (provisioned)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_lsabjeeczv35e4yojwj4owcewm refused: the route is not an address route this import can take over (kind static)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_6opnfpzzi74gnrzw7s7igrrkga refused: the route is not an address route this import can take over (backing)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_qfeks656kkvrv3fsnnjumzsnti refused: the route is not an address route this import can take over (tunnel)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_t35oeyld4g4zwl6afbhcsitd5y refused: the route is not an address route this import can take over (caps)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_rxoqxt6ngycuj36qr4kzu767dq refused: the route is not an address route this import can take over (platform)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_cgfiwfjbvqflffmmlsrxchrabm refused: the route is not an address route this import can take over (canary)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_ydwdinlsfhe3omtcouhjp4mb6i refused: the route is not an address route this import can take over (kind sidecar)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_3qpfudllwb7lj4wdfh5ff5utqy refused: the route is not an address route this import can take over (region)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_rmkjfi27dgajedifx5xwkoct64 refused: the route is not an address route this import can take over (fleet_box)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_zcflpwe6qbxn7nzuizwb5v5zre refused: the route is not an address route this import can take over (hibernate)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_xbeq25hdi5j23iybb4eyosq6w4 refused: the route is not an address route this import can take over (claim_owner)
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_pm3yglhmevhvwjwgseo3ichqpy refused: this box does not run instances nested
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_iqu3xakaywmtq7i7dpcigeoccm refused: this box does not run instances nested
2026/10/24 20:42:09 provision: a.shop.example.com: import sd_kgxj2xs4bfbhzi3zqhfa7ksbve refused: claim control is on for this box
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_w4fjal6ptohuhn4wksiuxbumgy (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: swapped for import sd_o5wvaatvt7hhtab5d7r5a7o5ve (the original route is journaled)
2026/10/24 20:42:09 provision: a.shop.example.com: import deferred: this box cannot read the legacy route assignments
2026/10/24 20:42:09 provision: a.shop.example.com: import deferred: the legacy route assignments could not be read: store down
2026/10/24 20:42:09 provision: a.shop.example.com: not swapping for import sd_2jm4voqehfqt6rs5x7p2d4r4ae: its verify hash is not a sha256
2026/10/24 20:42:09 provision: a.shop.example.com: not swapping for import sd_f47v4iijgjojcdrh3oyb65x5fe: its verify hash is not a sha256
2026/10/24 20:42:09 provision: a.shop.example.com: not swapping for import sd_2fkzlvjsd5jote2j4siougf2pu: its verify hash is not a sha256
2026/10/24 20:42:10 provision: a.shop.example.com: not swapping for import sd_../../x: its host or seed id is malformed (seeds: not a seed id)
2026/10/24 20:42:10 provision: A.shop.example.com/..: not swapping for import sd_gaqslbl3nzvt7ohykegxx2tbiq: its host or seed id is malformed (seeds: not a host)
2026/10/24 20:42:10 provision: a.shop.example.com: not swapping for import sd_emgnz5p75lf2hqazye2tfzu7wq: its record does not describe a nested, hibernating instance
2026/10/24 20:42:10 provision: a.shop.example.com: not swapping for import sd_xdbah7zzt4zkmr6u6opnedrkuy: its record does not describe a nested, hibernating instance
2026/10/24 20:42:10 provision: a.shop.example.com: not swapping for import sd_ul5paftxdedpih3glaw6v7nsuy: its record does not describe a nested, hibernating instance
2026/10/24 20:42:10 provision: a.shop.example.com: not swapping for import sd_k5eu7rivh2adbg2lqyoltke5hm: its record does not describe a nested, hibernating instance
2026/10/24 20:42:10 provision: a.shop.example.com: import deferred: the box's layout intent could not be read: store down
2026/10/24 20:42:10 provision: a.shop.example.com: swapped for import sd_xj5mi4natzbstubreyxrdnezni (the original route is journaled)
2026/10/24 20:42:10 provision: a.shop.example.com: import deferred: the box's nested probe did not answer: ready probe timed out
2026/10/24 20:42:10 provision: a.shop.example.com: swapped for import sd_g4tvhbjzxrkr2l7bqste53e6hm (the original route is journaled)
2026/10/24 20:42:10 provision: a.shop.example.com: swapped for import sd_n773wxkimga3kkui6uckfcahfy (the original route is journaled)
2026/10/24 20:42:10 provision: a.shop.example.com: import deferred: the route is held by operation op_1
2026/10/24 20:42:10 provision: dry-run: would consider swapping a.shop.example.com for import sd_soffcxs5cy5cbq32xwa5tzazte
2026/10/24 20:42:10 provision: a.shop.example.com: import sd_ovcscztvpfamibftdmfcymze4m rolled back to its original route
2026/10/24 20:42:10 provision: a.shop.example.com: import sd_ovcscztvpfamibftdmfcymze4m: the host's replica is left alone: the record apps/bac/shop/instances/a.shop.example.com.json holds the host
2026/10/24 20:42:10 provision: a.shop.example.com: import sd_ovcscztvpfamibftdmfcymze4m is cleaned up and its journal row retired
2026/10/24 20:42:10 provision: a.shop.example.com: import sd_eij4sm6udw4xi7g33px5mcxcrq left alone: the import journal holds seed sd_y4oznpqscljwhkk7yj3dqchmrm at swapped
2026/10/24 20:42:10 provision: a.shop.example.com: not minting import sd_7s446usesgmfkitlqipe6pgyge: it is swapped but not committed, and only its swap makes its row
2026/10/24 20:42:10 provision: a.shop.example.com: not minting import sd_27prjdpn2wy6u5slzwg3y6x2au: it is placed but not committed, and only its swap makes its row
2026/10/24 20:42:10 provision: a.shop.example.com: swapped for import sd_6tko6ka6kvfxaj2wyp6r443lh4 (the original route is journaled)
2026/10/24 20:42:10 provision: a.shop.example.com: not minting import sd_6tko6ka6kvfxaj2wyp6r443lh4: it is swapped but not committed, and only its swap makes its row
2026/10/24 20:42:10 provision: a.shop.example.com: not minting import sd_6tko6ka6kvfxaj2wyp6r443lh4: it is placed but not committed, and only its swap makes its row
2026/10/24 20:42:10 provision: minted instance route a.shop.example.com (app "shop" acct "bac")
2026/10/24 20:42:10 provision: removed retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: converged sidecar bot.eleven.bac.sidecar.internal args ["sidecar","run"] -> ["worker","run"]
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: converged sidecar bot.eleven.bac.sidecar.internal ceilings 300/3600 -> 60/120
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: converged sidecar bot.eleven.bac.sidecar.internal channel stable -> canary/eleven
2026/10/24 20:42:10 provision: converged sidecar bot.eleven.bac.sidecar.internal environment "other" -> "relay"
2026/10/24 20:42:10 provision: converged sidecar bot.eleven.bac.sidecar.internal hibernate true -> false
2026/10/24 20:42:10 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: read failed: failStore: reads disabled under apps/bac/eleven/sidecars/
2026/10/24 20:42:10 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: malformed: invalid character 'n' looking for beginning of object key string
2026/10/24 20:42:10 provision: not removing sidecar bot.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 20:42:10 provision: skipping sidecar record apps/bac/eleven/sidecars/bot.json: empty channel
2026/10/24 20:42:10 provision: skipping sidecar record apps/bac/eleven/sidecars/held.json: empty channel
2026/10/24 20:42:10 provision: not removing sidecar held.eleven.bac.sidecar.internal: its record exists but could not be read cleanly this pass
2026/10/24 20:42:10 provision: removed retired sidecar route old.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:42:10 provision: bac/eleven has sidecar records but no sidecars manifest — not minting
2026/10/24 20:42:10 provision: bac/eleven is in the trash — not minting sidecar routes for it
2026/10/24 20:42:10 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: sidecar hub.relay.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: minted sidecar route hub.relay.bac.sidecar.internal (app "relay" acct "bac" args ["relay"])
2026/10/24 20:42:10 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: removed retired sidecar route bot.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: sidecar bot.eleven.bac.sidecar.internal is not placeable here: it asks for "no-inbound" placement and this box accepts inbound work (CARLOS_INBOUND="")
2026/10/24 20:42:10 provision: skipping sidecar record apps/bac/relay/sidecars/hub.json: read failed: failStore: reads disabled under apps/bac/relay/sidecars/
2026/10/24 20:42:10 provision: REFUSING to mint sidecar bot.eleven.bac.sidecar.internal: bot.eleven.bac.sidecar.internal-sidecar.env is staged on this box — the legacy file co-spawn and a native sidecar row are two mechanisms for one host; remove the file to migrate this host onto sidecar records
2026/10/24 20:42:10 provision: minted sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" args ["sidecar","run"])
2026/10/24 20:42:10 provision: dry-run: would mint sidecar route bot.eleven.bac.sidecar.internal (app "eleven" acct "bac" channel "stable" args ["sidecar","run"])
2026/10/24 20:42:10 provision: dry-run: would remove retired sidecar route gone.eleven.bac.sidecar.internal (record gone)
2026/10/24 20:42:10 provision: bot.eleven.bac.sidecar.internal exists but is not a sidecar row this pass owns (kind "sidecar" provisioned false app "eleven" acct "bac") — leaving it alone
2026/10/24 20:42:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:10 provision: converged acme.go.tito.io update settings "{\"updates\":\"manual\",\"channel\":\"stable\"}" -> ""
2026/10/24 20:42:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:10 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:42:10 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:42:10 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 20:42:10 provision: minted instance route acme.go.tito.io (app "tito" acct "bac")
2026/10/24 20:42:10 provision: manifest bac/tito: read failed: provision: manifest bac/tito: unexpected end of JSON input
2026/10/24 20:42:10 provision: acme.go.tito.io: not minted this pass: the app's update policy could not be read
2026/10/24 20:42:10 provision: minted instance route acme.go.tito.io held landing by mv_acme (app "tito" acct "bac")
2026/10/24 20:42:10 provision: record view: change index unusable (release: change index unreadable: store has no conditional read: unsupported operation): the walk records no generations
2026/10/24 20:42:10 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:10 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:10 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:10 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 20:42:10 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:10 provision: listing apps/bqc/shop/instances/: list refused — its records are unseen this pass
2026/10/24 20:42:10 provision: an app's records could not be listed: they are skipped
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: record view: re-reading apps/bqc/shop failed: retrying on the next refresh
2026/10/24 20:42:10 provision: listing apps/bqc/shop/instances/: context canceled — its records are unseen this pass
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: listing apps/bqd/: listdirs refused — its records are unseen this pass
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: record view: change index unusable (get refused): walking
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: record view: change index unusable (release: change index malformed: invalid character 'n' looking for beginning of object key string): walking
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:42:10 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:42:10 provision: skipping accounts/bqd/account.json: malformed account manifest: invalid character 'n' looking for beginning of object key string
2026/10/24 20:42:10 provision: record view: re-reading accounts/bqd failed: retrying on the next refresh
2026/10/24 20:42:10 provision: skipping accounts/bqd/account.json: read failed: list refused
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:42:10 provision: removed retired instance route one.example.com (record gone)
2026/10/24 20:42:10 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:42:10 provision: minted instance route one.example.com (app "shop" acct "bum")
2026/10/24 20:42:10 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 20:42:10 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 20:42:10 provision: skipping record apps/bum/shop/instances/one.example.com.json: empty channel
2026/10/24 20:42:10 provision: not removing one.example.com: its record exists but could not be read cleanly this pass
2026/10/24 20:42:10 provision: removed retired instance route one.example.com (record gone)
2026/10/24 20:42:10 provision: record view: change index unusable (context deadline exceeded): walking
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
2026/10/24 20:42:10 provision: record view: change index unusable (context deadline exceeded): the walk records no generations
2026/10/24 20:42:10 provision: skipping record apps/bqe/store/instances/bad.store.example.com.json: malformed: provision: invalid maintenance projection or protected fields
--- FAIL: TestPlan14RootReadCensus (15.30s)
    plan14_root_reads_test.go:600: root read census: 9 discrepancies
        changed root read internal/ops/hibernate_verify.go:HibernatingHosts; review class, task, sites and digest
        changed root read internal/ops/litestream.go:FleetDBsWithSkipped; review class, task, sites and digest
        changed root read internal/ops/ops.go:runLitestream; review class, task, sites and digest
        changed root source envelope internal/ops
        unclassified root read internal/ops/litestream.go:ActivatorReplicated registry:Backing@59,registry:DBPath@97,registry:Hibernate@117
        unclassified root read internal/ops/litestream.go:ActivatorReplicatedPaths registry:DBPath@257,whole:Route@178,whole:Route@212
        changed legacy declaration internal/ops/hibernate_verify.go:HibernatingHosts
        changed legacy declaration internal/ops/litestream.go:FleetDBsWithSkipped
        changed legacy declaration internal/ops/ops.go:runLitestream
        
        make census-card shows what changed; make census-propose NAME=<branch> CLAIMS=<file> writes the overlay and its approval card (AGENTS.md, The census)
FAIL
FAIL	github.com/carlosframework/platform/internal/provision	23.974s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.016s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.583s
ok  	github.com/carlosframework/platform/internal/relay	7.233s
ok  	github.com/carlosframework/platform/internal/release	26.203s
ok  	github.com/carlosframework/platform/internal/rollout	3.788s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.005s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.058s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/runs	0.606s
ok  	github.com/carlosframework/platform/internal/s3compat	0.006s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	2.715s
ok  	github.com/carlosframework/platform/internal/seeds	0.015s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.501s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	11.182s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.401s
ok  	github.com/carlosframework/platform/internal/status	0.094s
ok  	github.com/carlosframework/platform/internal/steering	0.007s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.322s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.006s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.004s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.003s
ok  	github.com/carlosframework/platform/internal/vet	1.657s
FAIL
=== internal_console@0 (87 s)
ok  	github.com/carlosframework/platform/internal/console	84.531s
=== internal_console@1 (44 s)
ok  	github.com/carlosframework/platform/internal/console	42.042s
=== internal_console@2 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.087s
=== internal_console@3 (42 s)
ok  	github.com/carlosframework/platform/internal/console	39.647s
=== internal_console@4 (43 s)
ok  	github.com/carlosframework/platform/internal/console	40.846s
=== internal_console@5 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.174s
=== internal_console@6 (38 s)
ok  	github.com/carlosframework/platform/internal/console	36.052s
=== internal_console@7 (46 s)
ok  	github.com/carlosframework/platform/internal/console	43.942s
=== root@0 (110 s)
ok  	github.com/carlosframework/platform	107.890s
=== root@1 (84 s)
ok  	github.com/carlosframework/platform	82.408s
=== root@2 (93 s)
ok  	github.com/carlosframework/platform	90.859s

FAILED: rest
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/plans/2026-10-24-sidecar-isolation.md b/docs/superpowers/plans/2026-10-24-sidecar-isolation.md
index af998ccb9..4034f455d 100644
--- a/docs/superpowers/plans/2026-10-24-sidecar-isolation.md
+++ b/docs/superpowers/plans/2026-10-24-sidecar-isolation.md
@@ -9,17 +9,17 @@ finding B1 in release N and its patch N.1.
**Architecture:** A fifth nested role, `worker`, with its own unit template,
started through the existing root control channel; the layout pass moves
worker rows the way it moves instance rows; one policy check in the two
-spawn seams refuses flat and foreign launches, with an unset policy that
-ratchets to `refuse` per box. D9 fixes double replication of always-on
+spawn seams refuses flat and foreign launches once an operator sets
+`CARLOS_FLAT_EXEC=refuse` in a box's root-owned `host.env`. D9 fixes double replication of always-on
workers. Nothing in `host.env` changes on any box.
**Tech Stack:** Go (module `github.com/carlosframework/platform`), systemd
units embedded in `internal/host/units`, cgroup v2, litestream.
**Spec:** `docs/superpowers/specs/2026-10-24-sidecar-isolation-design.md`,
-revision 3 (99017de5). Read §0, §3, §4, §8, §13 before any task. Decisions
-are cited as D-numbers; this plan implements D1 to D14, D16, D19 and D11/D15
-as revised in rev 3. D17 and D18 are follow-ups and are NOT built here.
+revision 4 (9f2cd284). Read §0, §3, §4, §8, §13 before any task. Decisions
+are cited as D-numbers; this plan implements D1 to D14, D16, D19 and D9/D11/D15
+as revised in rev 4. D17 and D18 are follow-ups and are NOT built here.
## Global Constraints
@@ -44,17 +44,15 @@ as revised in rev 3. D17 and D18 are follow-ups and are NOT built here.
fragments, log lines and JSON keys are not copy.
- Closed status words, exactly: flat-exec reasons `flat_refused`,
`foreign_refused`, `flat_reported`, `foreign_reported`; intent sources
- `nested`, `flat_choice`, `flat_fallback`, `unknown`; ratchet states
- `report`, `refuse`; workers readiness `nested`, `off`,
+ `nested`, `flat_choice`, `flat_fallback`, `unknown`; workers readiness `nested`, `off`,
`waiting_for_prev`, `blocked`.
-- Env names, exactly: `CARLOS_NESTED_WORKERS` (`on`|`off`, unset = on),
- `CARLOS_FLAT_EXEC` (`refuse`|`report`, unset = ratchet, unknown =
+- Env names, exactly: `CARLOS_NESTED_WORKERS` (`on`|`off`, unset = off),
+ `CARLOS_FLAT_EXEC` (`refuse`|`report`, unset = report, unknown =
refuse), `CARLOS_FLAT_EXEC_ALLOW` (comma-separated exact hosts,
`provision.ValidHostShape`), `CARLOS_SIDECAR_DB` (agent-owned, always set
for a worker).
-- Ratchet file: `<DataDir>/.carlos/flat-exec-refuse`, mode 0600, content
- the RFC 3339 time it turned, written with write-temp-then-rename, never
- removed by code.
+- Both settings are read once at agent start from the environment
+ (`host.env`). No file under `/data` decides any policy (spec rev 4 D15).
- Use `registry.Route.IsSidecar()`, never the `"sidecar"` literal.
- Wire changes are additive (status snapshot fields `omitempty`).
- Tests go through production wiring where the package already does
@@ -72,9 +70,9 @@ as revised in rev 3. D17 and D18 are follow-ups and are NOT built here.
crashes.** It must read as a crash (D6), restart with backoff, and say
in `carlos sidecars logs` that the database open failed. Pinned in
Task 6's crash test with a stub that opens the flat path.
-2. **A box with a foreign row (`carlos add --db`) never turns its
- ratchet.** Status must name the row and the reason. Pinned in Task 9's
- status test.
+2. **A box with a foreign row (`carlos add --db`) before `refuse`.**
+ Status must list it in the inventory with its reason, so the operator
+ sees it before setting `refuse`. Pinned in Task 9's status test.
3. **Agent restart mid-move of an always-on worker.** The journal recovery
must finish or revert the move, and no wake source may start the
worker while fenced. Pinned in Task 8 (fenced wake-source tests, boot
@@ -297,10 +295,12 @@ The largest task; one implementer, Fable-tier.
**Interfaces:**
- Produces: `release.WorkerLayoutFloor = SemVer{0, 29, 0}`.
- Produces: `func WorkersReady(getenv func(string) string, optDir string, running string) (ready bool, word string, reason string)`
- in `internal/host`: `CARLOS_NESTED_WORKERS` unset or `on` (`off` →
+ in `internal/host`, **evaluated once at agent start and cached** (spec
+ rev 4 D11): `CARLOS_NESTED_WORKERS` exactly `on` (unset or `off` →
`off`); `running` and the content of `<optDir>/carlos.prev.version` both
parse at or above `WorkerLayoutFloor` (otherwise `waiting_for_prev`,
- including missing/unreadable/unparseable — Review Focus 5). Effective
+ including missing/unreadable/unparseable — Review Focus 5). A later
+ change to the file never changes the cached answer. Effective
intent and gate are checked by callers. Exposed to the reconciler and
the pass through their existing layout-reader seams (`mintLayoutReader`,
`reconcile.go:471-490`, gains a `workers bool`).
@@ -308,8 +308,10 @@ The largest task; one implementer, Fable-tier.
would mint nested **and** `WorkersReady`; `convergeSidecar` accepts the
flat or nested path for the row's host.
-- [ ] Tests: `TestWorkersReadyTable` (unset, on, off, prev missing, prev
+- [ ] Tests: `TestWorkersReadyTable` (unset → off, on, off, prev missing, prev
below, prev unparseable, running below, both at floor);
+ `TestWorkersReadyFixedAtStart` (rewriting `carlos.prev.version` after
+ the agent started does not make it eligible);
`TestSidecarMintNestedOnlyWhenWorkersReady`;
`TestConvergeSidecarAcceptsBothPaths`; co-spawn check unchanged.
- [ ] Commit.
@@ -331,10 +333,14 @@ The largest task; one implementer, Fable-tier.
**Interfaces:**
- Consumes: Task 4's `WorkerManaged`, Task 7's readiness (passed into
`layout.Pass` as `WorkersReady func() bool`; nil = false).
-- Produces: `func boxReplicatorHolds(dbPath string, show func(unit, prop string) (string, error), configPath string) (bool, string)`:
- true (hold, with reason) when `carlos-litestream` is active and
- (its `ActiveEnterTimestamp` is before the config's mtime, or the config
- names `dbPath`). Applied to always-on worker rows only.
+- Produces: `func boxReplicatorHolds(dbPath string, show func(unit, prop string) (string, error), cgroupEmpty func(unit string) (bool, error), configPath string) (bool, string)`:
+ false (safe to move) only when the config does not exist or does not
+ name `dbPath`, AND `carlos-litestream` is exactly `ActiveState=active`
+ `SubState=running` with `ExecMainStartTimestamp` after the config's
+ mtime, or exactly `inactive`/`failed` with `MainPID=0` and an empty
+ cgroup. Any other state or any failed observation holds (spec rev 4 D9,
+ R3-3). Applied to always-on worker rows, read under the fence right
+ before the first rename.
- Missing-database rule: `db` not required when `db`, `db-wal`, `db-shm`,
`litestream-shadow`, `corrupt` and `<db>-litestream` are all absent at
both endpoints; then the journal records it absent and the rest moves.
@@ -352,13 +358,16 @@ The largest task; one implementer, Fable-tier.
`TestCompanionWithoutDatabaseRefused`;
`TestTwoBoxFailoverAfterConfigOnlyMove`;
`TestRevertWorkerByteForByte`;
- `TestAlwaysOnMoveHeldWhileReplicatorNamesFile` and
- `...HeldWhileReplicatorStartedBeforeConfig`, `...ProceedsWhenInactive`;
+ `TestAlwaysOnMoveHeldWhileReplicatorNamesFile` (also when inactive),
+ `...HeldWhileReplicatorStartedBeforeConfig`, `...HeldWhileDeactivating`,
+ `...HeldWhileActivating`, `...HeldOnUnreadableProperty`,
+ `...ProceedsWhenInactiveEmptyAndConfigExcludes`,
+ `...ProceedsWhenRunningAfterConfigWithout`;
`TestWorkersNotEligibleWithoutReadiness` (Review Focus 5);
`TestConfigEnvPathNestedWorker`; `TestLayoutReportListsWorkerRows`.
- [ ] Commit.
-### Task 9: the flat-exec policy, inventory and ratchet (D12 to D16)
+### Task 9: the flat-exec policy and inventory (D12 to D14, D16)
**Files:**
- Create: `internal/activator/flatexec.go` (`FlatExecPolicy`, `Admit`,
@@ -368,8 +377,8 @@ The largest task; one implementer, Fable-tier.
(`spawnInCgroupAtTier`): the check after the claim refusal
- Modify: `internal/activator/swap.go:225-245`, `activator.go:3474-3479`
(classify the new error)
-- Create: `internal/host/flatexec.go` (env reading, the ratchet, the
- inventory, wiring into the agent and the status snapshot)
+- Create: `internal/host/flatexec.go` (env reading, the inventory, wiring
+ into the agent and the status snapshot)
- Modify: `internal/status/snapshot.go` (additive `Metrics.FlatExec`,
`Metrics.Layout.Workers`) and its contract test
- Modify: `internal/host/layoutleg.go` (D16: a refused managed or worker
@@ -378,16 +387,18 @@ The largest task; one implementer, Fable-tier.
`internal/activator/spawn_enumeration_test.go`
**Interfaces:**
-- Produces in `activator`: `type FlatExecPolicy struct{ Mode atomic.Value /* "refuse"|"report" */; Allow map[string]bool; Record func(host, reason string) }`;
+- Produces in `activator`: `type FlatExecPolicy struct{ Refuse bool; Allow map[string]bool; Record func(host, reason string) }`
+ (fixed at agent start);
`func (p *FlatExecPolicy) Admit(rt registry.Route, layout Layout) error`
(nil policy = today's behaviour); `var ErrFlatExecRefused` wrapping
`hostbox.ErrUnsupported`. `ExecBackend.FlatExec *FlatExecPolicy`.
-- Produces in `host`: `func flatExecFromEnv(getenv func(string) string) (mode string, explicit bool, allow []string, dropped []string)`;
- `type flatExecRatchet struct{ path string }` with `Turned() (bool, time.Time)`
- and `Turn(now time.Time) error`; `func flatExecInventory(routes []registry.Route, classify func(registry.Route) activator.Layout, allow map[string]bool) []InventoryRow`.
- The agent evaluates on every layout pass: if not explicit, intent nested,
- inventory empty and not turned → `Turn`, then `Mode` = `refuse`.
- Flat-by-choice intent never turns. Explicit always wins.
+- Produces in `host`: `func flatExecFromEnv(getenv func(string) string) (mode string, allow []string, dropped []string)`
+ (unset → `report`, unknown → `refuse`); `func flatExecInventory(routes []registry.Route, classify func(registry.Route) activator.Layout, allow map[string]bool) []InventoryRow`
+ (rows that would be refused: managed, worker and foreign exec rows
+ classifying `flat`/`foreign`, not allowlisted, awake or asleep),
+ refreshed on every layout pass into status. Status also carries spec rev
+ 4 D15's closure check: `refuse` in force, empty allowlist, no worker row
+ `flat` or `foreign`.
- [ ] Tests: `TestFlatExecEnvTable` (each value, unset, unknown → refuse,
invalid allowlist entry dropped and reported, wildcards rejected);
@@ -395,11 +406,12 @@ The largest task; one implementer, Fable-tier.
before `Cgroups` is touched (including nil manager);
`TestEveryExecCommandReachesASeam` (enumerates `exec.Command` in
`internal/activator`, four today); swap gate and respawn veto classify
- `ErrFlatExecRefused`; `TestRatchetTurnsOnFirstEmptyInventory`,
- `...StaysAcrossRestartAndLaterRow`, `...NeverUnderFlatChoice`,
- `...ExplicitWinsAndKeepsFile`, `...RecordedFlatIntentIsChoice`,
- `...GateFallbackIsNotChoice`; `TestInventoryIncludesDormantRow`;
- `TestStatusNamesForeignRowHoldingRatchet` (Review Focus 2);
+ `ErrFlatExecRefused`; `TestInventoryIncludesDormantRow`;
+ `TestRefuseRefusesTenantMadeForeignWorkerRow` (R3-2: a sidecar row
+ whose `DBPath` was edited elsewhere is refused under `refuse`);
+ `TestClosureCheck` (true only with refuse, empty allowlist, no flat or
+ foreign worker row);
+ `TestStatusListsForeignRowInInventory` (Review Focus 2);
`TestRefusedManagedRowNudgesPass` and not for foreign; status contract
test passes with the new fields and they never reach `fleet.json`.
- [ ] Commit.
@@ -415,13 +427,15 @@ The largest task; one implementer, Fable-tier.
**Interfaces:**
- Consumes: Task 7's `release.WorkerLayoutFloor`.
- Install refuses (before the journal) a candidate whose version parses
- below `WorkerLayoutFloor`, or whose staged unit set lacks
- `carlos-instance-worker@.service`, while `layoutReversalIncomplete`
- names a worker host (host has `provision.SidecarSuffix`). Reason text is
- copy (Task 12). `layoutDowngradeBlocked` gains the same floor over
- observed worker hosts.
-
-- [ ] Tests: `TestInstallRefusesPreWorkerCandidateWithNestedWorker`,
+ below `WorkerLayoutFloor`, or (unparseable version) whose staged unit set
+ lacks `carlos-instance-worker@.service`, when `/etc/carlos/host.env`
+ says `CARLOS_NESTED_WORKERS=on` **or** `layoutReversalIncomplete` names a
+ worker host (host has `provision.SidecarSuffix`); spec rev 4 D11, R3-1.
+ Reason text is copy (Task 12). `layoutDowngradeBlocked` gains the same
+ floor over observed worker hosts.
+
+- [ ] Tests: `TestInstallRefusesPreWorkerCandidateWhenHostEnvOptsIn`
+ (no worker rows at all), `TestInstallRefusesPreWorkerCandidateWithNestedWorker`,
`...WithWorkerJournalOnly`, `...AcceptsWhenNoWorkerHost`,
`...UnparseableVersionJudgedByUnitSet`; console
`TestDowngradeBlockedBelowWorkerFloor`.
@@ -448,7 +462,7 @@ classifies flat or foreign"; `internal/hostbox/inventoryscope.go:48`
- [ ] Collect every `*_copy.go` placeholder and the docs paragraphs
(`docs/site/cli.md`: sidecar section with `CARLOS_SIDECAR_DB` and
`CARLOS_AGENT_SOCKET` as the contract, `carlos status --layout`'s new
- lines, the three box settings and the ratchet; README box-settings list)
+ lines, the three box settings (explicit, per box); README box-settings list)
into one deck; run it through a Luna pass on the house rules
(`large-copy-decks-delegated`), apply verbatim.
- [ ] `make census-propose NAME=sidecar-isolation CLAIMS=implementation/census-claims-sidecar-isolation.txt`; the card goes to Paul for approval.