| 1 | # Claim activation scope, NARROWED (Paul's decision, 2026-10-16). BINDING on every builder. |
| 2 | |
| 3 | Source: `minimal-boundary-result.md` (Astra). Paul chose to narrow the activation gate, and to activate in cohorts: dev and boxes without named units first, the flagship eu-west-1 console box last. This supersedes the parts of the spec rev 6.34 / Plan 14 activation gate listed below as FREEZE or DROP. Those items are finished AFTER activation, not before it. |
| 4 | |
| 5 | ## The boundary that must hold before activation (KEEP) |
| 6 | 1. **Root independently authorizes every enabled claim effect** (launch, stop completion, cold handover, retirement, publication and replay): the host, installation, session, operation and authenticated controller are bound. Fences, retirement decisions and lease uncertainty are held outside agent control and rechecked at execution and receipt replay. |
| 7 | 2. **The whole execution configuration is authorized:** executable bytes, the effective unit plus its drop-ins, privileged arguments and environment, identity, mounts, capabilities and containment. Every restart route uses the same reservation boundary. |
| 8 | 3. **Root derives and revalidates destructive targets.** It stops the recorded containment, retires the recorded installation, and removes only exact root-recorded artifacts. Pending and running generation pins stay independent of registry deletion. (Destructive covers deletion, wrong-target stop, overwrite, rename, chown, mounts and publication.) |
| 9 | 4. **A verified, recoverable migration:** admission exclusion; drain and stop existing work; old-session denies retained; a real installation census; no imported legacy "allow". |
| 10 | 5. **Boxes survive ordinary lifecycle events:** seed, cold wake, stop, second wake, reboot, and signed repair or update. Device numbers are boot-local. Floors keep a usable repair executor. Nothing turns routine operation into a permanent, box-wide trap. |
| 11 | 6. **Proven at the real boundaries,** with hostile service-UID inputs, substitution, durability failures at AUTHORITY TRANSITIONS (fence before effect, reservation before launch, retirement intent before mutation, permission and receipt before success), and permitted positive cases through production constructors. No-census boxes keep exactly main's behaviour. |
| 12 | |
| 13 | ## Per-track decisions |
| 14 | | Work | Decision | |
| 15 | |---|---| |
| 16 | | 4a named units plus console always-running (boot, adoption, restart, recover) | KEEP, but it gates only the eu-west-1 cohort, not the first activation | |
| 17 | | Unit containment compatibility with the REAL console and woodstar services | KEEP (for eu-west-1) | |
| 18 | | Containment population on the selected boxes | KEEP | |
| 19 | | Device audit of active launch, inventory, retirement and unit bindings | KEEP. Other families: FREEZE | |
| 20 | | E3: canonical attribution and the inputs that authorize claim effects; retry and recovery for root denials already shipped | KEEP | |
| 21 | | E3: remaining failure/intent producers; exhaustive served/build/completion history | FREEZE. But sticky root state must never block legitimate operation: either complete its delivery and settlement, or gate the sticky state off | |
| 22 | | E4: protection of claim-bound units on BOTH convergence paths (fixed root configuration, or refusal) | KEEP | |
| 23 | | E4: the full dynamic `route --grant` workflow | FREEZE | |
| 24 | | J4: the five E4 slots as mandatory metadata | DROP | |
| 25 | | J4: exhaustive mapping of about 1,100 authority rows | FREEZE | |
| 26 | | H2: production boundary witnesses for enabled effects and their shared recovery | KEEP | |
| 27 | | H2: the whole matrix as one indivisible gate | FREEZE | |
| 28 | | Floors: enforcement plus a usable boot, update and recovery path | KEEP. Further moves and seeds floor machinery: FREEZE | |
| 29 | | Historical-record conversion for records that cannot exist at first activation | FREEZE (explicit refusal is enough) | |
| 30 | | Files seed: the reboot race (fixed in run 31), FS-R11 (done in run 31), and unverifiable retained parks blocking later retirement | KEEP (the last one is an availability trap) | |
| 31 | | Files seed: full readback, repair, sizing and automatic rehabilitation | FREEZE | |
| 32 | | #250: C8 provider, admitted provenance, Plan 15 writer, scoped root guard, claim-on launch/isolation/two cold wakes, reader→home→enable order, release key, IAM, scoped rollout | KEEP | |
| 33 | | #250: cmd role, workers, sidecars, seeded cold install; moves Plans 4/5; moves secrets; #272 | FREEZE | |
| 34 | | Whole-registry conversion; fixtures for unchanged legacy families | DROP | |
| 35 | |
| 36 | ## Census and J4 under the narrowed gate |
| 37 | - The runtime installation census stays. |
| 38 | - The source-read census test (`TestPlan14RootReadCensus`) stays as it is: it freezes changes. |
| 39 | - J4 (`TestPlan14RootInputInventoryCoverage`) must check ONLY the families of the ENABLED effects listed in KEEP, plus the exemption list. Every other authority row is reported (t.Log, plus a generated report file), not failed. Do not weaken the check for the enabled families. |
| 40 | |
| 41 | ## Risks to resolve before shipping |
| 42 | - No named-unit replacement before always-running startup works on the target box. |
| 43 | - The unit sandbox must be proven against the real console and woodstar services before eu-west-1. |
| 44 | - No sticky E3 state without delivery and settlement. |
| 45 | - Retained parks must not block retirement. |
| 46 | |
amadan