| 1 | { |
| 2 | "schema_version": 1, |
| 3 | "source_revision": "11a303996d5503d29ede77598243ddc66f735279", |
| 4 | "status": "Design checklist, not implementation or coverage proof. All production functions branching on Hibernate at base classified; additional indirect/serializer/control families listed separately.", |
| 5 | "policy_branch_consumers": [ |
| 6 | { |
| 7 | "file": "cli.go", |
| 8 | "function": "func runInstances(args []string)", |
| 9 | "current_policy_reads_or_writes": [ |
| 10 | { |
| 11 | "line": 340, |
| 12 | "source": "if t.Hibernate {" |
| 13 | } |
| 14 | ], |
| 15 | "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.", |
| 16 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 17 | }, |
| 18 | { |
| 19 | "file": "cli.go", |
| 20 | "function": "func runRouteHibernate(r *registry.Registry, rt registry.Route, on, dryRun bool)", |
| 21 | "current_policy_reads_or_writes": [ |
| 22 | { |
| 23 | "line": 1341, |
| 24 | "source": "if rt.Hibernate == on {" |
| 25 | }, |
| 26 | { |
| 27 | "line": 1346, |
| 28 | "source": "if err := r.SetHibernate(rt.Host, on); err != nil {" |
| 29 | }, |
| 30 | { |
| 31 | "line": 1350, |
| 32 | "source": "fmt.Printf(\"%s%s: hibernate %v -> %v\\n\", prefix, rt.Host, rt.Hibernate, on)" |
| 33 | } |
| 34 | ], |
| 35 | "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.", |
| 36 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 37 | }, |
| 38 | { |
| 39 | "file": "cli.go", |
| 40 | "function": "func replicationRail(rt registry.Route) error", |
| 41 | "current_policy_reads_or_writes": [ |
| 42 | { |
| 43 | "line": 1604, |
| 44 | "source": "if !rt.Hibernate {" |
| 45 | }, |
| 46 | { |
| 47 | "line": 1623, |
| 48 | "source": "return fmt.Errorf(\"route hibernates but its row names no database (db_path is empty) \u2014 box-wide litestream excludes a hibernating route only when it knows WHERE its database is (`r.Hibernate && r.DBPath != \\\"\\\"`, ops.FleetDBs), \"+" |
| 49 | } |
| 50 | ], |
| 51 | "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.", |
| 52 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 53 | }, |
| 54 | { |
| 55 | "file": "internal/activator/activator.go", |
| 56 | "function": "func (a *Service) sweepOnce()", |
| 57 | "current_policy_reads_or_writes": [ |
| 58 | { |
| 59 | "line": 1228, |
| 60 | "source": "if !rt.Hibernate || rt.Status != \"ready\" {" |
| 61 | } |
| 62 | ], |
| 63 | "required_integration": "Shared managed predicate in serve/due admission; idle predicate only for idle stop; proactive desired reconciliation and fence precedence across begin/wake/restart/sweep.", |
| 64 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 65 | }, |
| 66 | { |
| 67 | "file": "internal/activator/activator.go", |
| 68 | "function": "func (a *Service) serve(w http.ResponseWriter, r *http.Request, rt registry.Route, proxy http.Handler, stamp bool) bool", |
| 69 | "current_policy_reads_or_writes": [ |
| 70 | { |
| 71 | "line": 1382, |
| 72 | "source": "if rt.Kind != \"instance\" || !rt.Hibernate {" |
| 73 | } |
| 74 | ], |
| 75 | "required_integration": "Shared managed predicate in serve/due admission; idle predicate only for idle stop; proactive desired reconciliation and fence precedence across begin/wake/restart/sweep.", |
| 76 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 77 | }, |
| 78 | { |
| 79 | "file": "internal/appconfig/sync.go", |
| 80 | "function": "func syncHost(rt registry.Route, m *Manifest, defaultMissing bool, priv *ecdh.PrivateKey, envDir string, restart func(host string) error, ack func(ConfigAck))", |
| 81 | "current_policy_reads_or_writes": [ |
| 82 | { |
| 83 | "line": 472, |
| 84 | "source": "case rt.Hibernate:" |
| 85 | } |
| 86 | ], |
| 87 | "required_integration": "Unit config path keeps ordinary behavior; new mode cannot be mistaken for unit merely because Hibernate=false. Exec config materialization uses its own path and respects active pins.", |
| 88 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 89 | }, |
| 90 | { |
| 91 | "file": "internal/caps/converge.go", |
| 92 | "function": "func Converge(o Ops, p Plan) (Result, error)", |
| 93 | "current_policy_reads_or_writes": [ |
| 94 | { |
| 95 | "line": 221, |
| 96 | "source": "if p.Set.Daemon && p.Hibernate {" |
| 97 | }, |
| 98 | { |
| 99 | "line": 237, |
| 100 | "source": "if p.Hibernate {" |
| 101 | } |
| 102 | ], |
| 103 | "required_integration": "Unit-only capabilities remain excluded from new exec policy; regression proves no unit startup fallback. Explicit ManagedByActivator in Plan; reject Daemon before writes even with Hibernate=false.", |
| 104 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 105 | }, |
| 106 | { |
| 107 | "file": "internal/console/apiinstancemove.go", |
| 108 | "function": "func (s *Server) moveGate(w http.ResponseWriter, r *http.Request) (acct *Account, app, host string, rec *provision.Record, ok bool)", |
| 109 | "current_policy_reads_or_writes": [ |
| 110 | { |
| 111 | "line": 69, |
| 112 | "source": "if !rec.HibernateOrDefault() {" |
| 113 | } |
| 114 | ], |
| 115 | "required_integration": "Opted-in resident exec refuses old move API even though Hibernate=false; it cannot enter unit/external migration.", |
| 116 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 117 | }, |
| 118 | { |
| 119 | "file": "internal/console/apiinstances.go", |
| 120 | "function": "func (s *Server) healthByHost(ctx context.Context, routeFor map[string]registry.Route) map[string]string", |
| 121 | "current_policy_reads_or_writes": [ |
| 122 | { |
| 123 | "line": 296, |
| 124 | "source": "out[h] = healthWord(rt.Kind, status, rt.Hibernate, rep[h]," |
| 125 | } |
| 126 | ], |
| 127 | "required_integration": "New dedicated policy door and field reporting; health reports managed residency correctly; ordinary PATCH preserves policy without bypass.", |
| 128 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 129 | }, |
| 130 | { |
| 131 | "file": "internal/console/apirestartscope.go", |
| 132 | "function": "func restartRouteRows(routes []registry.Route) []apiRestartRoute", |
| 133 | "current_policy_reads_or_writes": [ |
| 134 | { |
| 135 | "line": 385, |
| 136 | "source": "Host: rt.Host, Environment: rt.Environment, Unit: rt.Unit, Hibernate: rt.Hibernate," |
| 137 | } |
| 138 | ], |
| 139 | "required_integration": "Restart UI/API classification identifies activator ownership independently of sleep.", |
| 140 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 141 | }, |
| 142 | { |
| 143 | "file": "internal/console/apiroutes.go", |
| 144 | "function": "func (s *Server) handleAPIRoutes(w http.ResponseWriter, r *http.Request)", |
| 145 | "current_policy_reads_or_writes": [ |
| 146 | { |
| 147 | "line": 152, |
| 148 | "source": "Health: health[rt.Host], Hibernate: rt.Hibernate, Unit: rt.Unit," |
| 149 | } |
| 150 | ], |
| 151 | "required_integration": "Include lifecycle policy in route response; Hibernate remains false.", |
| 152 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 153 | }, |
| 154 | { |
| 155 | "file": "internal/console/instances.go", |
| 156 | "function": "func (f *instanceFetcher) Report(ctx context.Context, routes []RouteView) *InstanceReport", |
| 157 | "current_policy_reads_or_writes": [ |
| 158 | { |
| 159 | "line": 90, |
| 160 | "source": "if rt.Host == \"\" || rt.Kind == \"static\" || rt.Status != \"ready\" || rt.Hibernate {" |
| 161 | } |
| 162 | ], |
| 163 | "required_integration": "Instance status collection includes resident activator instances.", |
| 164 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 165 | }, |
| 166 | { |
| 167 | "file": "internal/console/overview.go", |
| 168 | "function": "func assembleOverview(view *AppView, acct string, metrics []InstanceMetrics, versions []VersionView) OverviewStats", |
| 169 | "current_policy_reads_or_writes": [ |
| 170 | { |
| 171 | "line": 138, |
| 172 | "source": "} else if rt.Hibernate {" |
| 173 | } |
| 174 | ], |
| 175 | "required_integration": "Report desired residency and actual health accurately; do not infer externally owned from Hibernate=false.", |
| 176 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 177 | }, |
| 178 | { |
| 179 | "file": "internal/console/overview.go", |
| 180 | "function": "func assembleInstanceRows(view *AppView, acct *Account, metrics []InstanceMetrics) []InstanceRow", |
| 181 | "current_policy_reads_or_writes": [ |
| 182 | { |
| 183 | "line": 257, |
| 184 | "source": "Hibernate: rt.Hibernate," |
| 185 | }, |
| 186 | { |
| 187 | "line": 259, |
| 188 | "source": "HealthWord: healthWord(rt.Kind, status, rt.Hibernate, byHost[rt.Host].Reporting()," |
| 189 | } |
| 190 | ], |
| 191 | "required_integration": "Report desired residency and actual health accurately; do not infer externally owned from Hibernate=false.", |
| 192 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 193 | }, |
| 194 | { |
| 195 | "file": "internal/console/server.go", |
| 196 | "function": "func (s *Server) appResourceMetrics(ctx context.Context, view *AppView, acct *Account) []InstanceMetrics", |
| 197 | "current_policy_reads_or_writes": [ |
| 198 | { |
| 199 | "line": 2643, |
| 200 | "source": "hib[rt.Host] = rt.Hibernate" |
| 201 | }, |
| 202 | { |
| 203 | "line": 2654, |
| 204 | "source": "am[i].Hibernate = hib[am[i].Host]" |
| 205 | } |
| 206 | ], |
| 207 | "required_integration": "Resident exec metrics remain included despite Hibernate=false.", |
| 208 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 209 | }, |
| 210 | { |
| 211 | "file": "internal/console/view.go", |
| 212 | "function": "func Assemble(regPath string, s release.Store, pub ed25519.PublicKey, acct string, apps []string, dns DNSTargets) ([]AppView, error)", |
| 213 | "current_policy_reads_or_writes": [ |
| 214 | { |
| 215 | "line": 609, |
| 216 | "source": "Version: rt.Version, Channel: ch, Hibernate: rt.Hibernate," |
| 217 | } |
| 218 | ], |
| 219 | "required_integration": "Carry lifecycle field into view projections; preserve ownership and health classification.", |
| 220 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 221 | }, |
| 222 | { |
| 223 | "file": "internal/edge/edge.go", |
| 224 | "function": "func (e *Edge) Reload() error", |
| 225 | "current_policy_reads_or_writes": [ |
| 226 | { |
| 227 | "line": 650, |
| 228 | "source": "hib := e.act != nil && t.Kind == \"instance\" && t.Hibernate && !viaTunnel" |
| 229 | }, |
| 230 | { |
| 231 | "line": 677, |
| 232 | "source": "if e.act == nil && t.Kind == \"instance\" && t.Hibernate && !viaTunnel {" |
| 233 | } |
| 234 | ], |
| 235 | "required_integration": "Validated shared management predicate drives proxy/manager choice and RetireExcept set; unsupported policy refuses; canonical alias routes never duplicate process.", |
| 236 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 237 | }, |
| 238 | { |
| 239 | "file": "internal/host/agent.go", |
| 240 | "function": "func makeStartRoute(reg *registry.Registry, startUnit func(unit string) error) func(host string) error", |
| 241 | "current_policy_reads_or_writes": [ |
| 242 | { |
| 243 | "line": 2640, |
| 244 | "source": "if err != nil || rt == nil || rt.Hibernate || rt.Unit == \"\" {" |
| 245 | } |
| 246 | ], |
| 247 | "required_integration": "Boot/fast/serial/adoption integrate resident desired loop; false Hibernate must not invoke unit fallback; durable fence reconstruction precedes startup.", |
| 248 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 249 | }, |
| 250 | { |
| 251 | "file": "internal/host/caps_pass.go", |
| 252 | "function": "func buildPlans(routes []registry.Route, load func(rt registry.Route) (*release.Manifest, error)) ([]caps.Plan, []string)", |
| 253 | "current_policy_reads_or_writes": [ |
| 254 | { |
| 255 | "line": 192, |
| 256 | "source": "p := caps.Plan{Host: rt.Host, App: rt.App, Grants: g, Hibernate: rt.Hibernate}" |
| 257 | } |
| 258 | ], |
| 259 | "required_integration": "Explicit policy rejects unit capability plans; preserve existing unit behavior.", |
| 260 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 261 | }, |
| 262 | { |
| 263 | "file": "internal/host/movespass.go", |
| 264 | "function": "func movesPass(ctx context.Context, s release.Store, w *movesWorker) error", |
| 265 | "current_policy_reads_or_writes": [ |
| 266 | { |
| 267 | "line": 169, |
| 268 | "source": "if rec.Pool != \"\" || !rec.HibernateOrDefault() || (rec.Kind != \"\" && rec.Kind != \"instance\") {" |
| 269 | } |
| 270 | ], |
| 271 | "required_integration": "New policy never enters existing mirror/delete/purge move paths; stale record snapshots must refuse before side effects.", |
| 272 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 273 | }, |
| 274 | { |
| 275 | "file": "internal/host/restart.go", |
| 276 | "function": "func restartPass(ctx context.Context, routes []registry.Route, store release.Store, marksPath string, restart func(host string) error)", |
| 277 | "current_policy_reads_or_writes": [ |
| 278 | { |
| 279 | "line": 656, |
| 280 | "source": "if rt.Hibernate {" |
| 281 | } |
| 282 | ], |
| 283 | "required_integration": "Ordinary restart routes through managed exec stop then proactive resident restart; never unit fallback.", |
| 284 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 285 | }, |
| 286 | { |
| 287 | "file": "internal/host/restartscope.go", |
| 288 | "function": "func restartScopeLeg(ctx context.Context, routes []registry.Route, store release.Store, apps [][2]string,", |
| 289 | "current_policy_reads_or_writes": [ |
| 290 | { |
| 291 | "line": 256, |
| 292 | "source": "if rt.Hibernate {" |
| 293 | } |
| 294 | ], |
| 295 | "required_integration": "Scoped restart applies same manager distinction and cannot clear maintenance fence.", |
| 296 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 297 | }, |
| 298 | { |
| 299 | "file": "internal/host/socket_advice.go", |
| 300 | "function": "func warnExternalSockets(routes []registry.Route, serving func(socket string) bool, owns func(host string) bool) []registry.Route", |
| 301 | "current_policy_reads_or_writes": [ |
| 302 | { |
| 303 | "line": 38, |
| 304 | "source": "if rt.Hibernate && owns(rt.Host) {" |
| 305 | } |
| 306 | ], |
| 307 | "required_integration": "Resident exec with false Hibernate is owned, not an external socket warning; live owner proof still separate from listening socket.", |
| 308 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 309 | }, |
| 310 | { |
| 311 | "file": "internal/host/socket_advice.go", |
| 312 | "function": "func socketAdvisoryLoop(reg *registry.Registry, svc *activator.Service)", |
| 313 | "current_policy_reads_or_writes": [ |
| 314 | { |
| 315 | "line": 76, |
| 316 | "source": "if rt.Hibernate {" |
| 317 | } |
| 318 | ], |
| 319 | "required_integration": "Resident exec with false Hibernate is owned, not an external socket warning; live owner proof still separate from listening socket.", |
| 320 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 321 | }, |
| 322 | { |
| 323 | "file": "internal/ops/hibernate_verify.go", |
| 324 | "function": "func HibernatingHosts(reg *registry.Registry) ([]HibernatingRoute, error)", |
| 325 | "current_policy_reads_or_writes": [ |
| 326 | { |
| 327 | "line": 58, |
| 328 | "source": "if r.Hibernate && r.DBPath != \"\" {" |
| 329 | } |
| 330 | ], |
| 331 | "required_integration": "Include all activator-owned exec replica paths in lease-backed restore probe; reporting name must not misclassify as sleeping.", |
| 332 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 333 | }, |
| 334 | { |
| 335 | "file": "internal/ops/litestream.go", |
| 336 | "function": "func FleetDBsWithSkipped(reg *registry.Registry, dataDir string) (dbs []string, skipped []string, err error)", |
| 337 | "current_policy_reads_or_writes": [ |
| 338 | { |
| 339 | "line": 349, |
| 340 | "source": "if r.Hibernate && r.DBPath != \"\" {" |
| 341 | } |
| 342 | ], |
| 343 | "required_integration": "Exclude all activator-owned exec DBs from root replicator, not only Hibernate=true; prove no duplicate WAL replicator.", |
| 344 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 345 | }, |
| 346 | { |
| 347 | "file": "internal/provision/provision.go", |
| 348 | "function": "func (r Record) HibernateOrDefault() bool", |
| 349 | "current_policy_reads_or_writes": [ |
| 350 | { |
| 351 | "line": 320, |
| 352 | "source": "func (r Record) HibernateOrDefault() bool {" |
| 353 | }, |
| 354 | { |
| 355 | "line": 321, |
| 356 | "source": "if r.Hibernate != nil {" |
| 357 | }, |
| 358 | { |
| 359 | "line": 322, |
| 360 | "source": "return *r.Hibernate" |
| 361 | } |
| 362 | ], |
| 363 | "required_integration": "Additive field/default/validation; no unknown value fallback; preserve field across all serializers and CAS retry.", |
| 364 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 365 | }, |
| 366 | { |
| 367 | "file": "internal/provision/provision.go", |
| 368 | "function": "func ValidateShape(rec Record) error", |
| 369 | "current_policy_reads_or_writes": [ |
| 370 | { |
| 371 | "line": 430, |
| 372 | "source": "if rec.Hibernate != nil && *rec.Hibernate {" |
| 373 | }, |
| 374 | { |
| 375 | "line": 444, |
| 376 | "source": "if len(rec.AddrsOrDefault()) > 0 && rec.Hibernate != nil && *rec.Hibernate {" |
| 377 | } |
| 378 | ], |
| 379 | "required_integration": "Additive field/default/validation; no unknown value fallback; preserve field across all serializers and CAS retry.", |
| 380 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 381 | }, |
| 382 | { |
| 383 | "file": "internal/provision/reconcile.go", |
| 384 | "function": "func everywhereClass(rec Record) bool", |
| 385 | "current_policy_reads_or_writes": [ |
| 386 | { |
| 387 | "line": 156, |
| 388 | "source": "if rec.HibernateOrDefault() {" |
| 389 | } |
| 390 | ], |
| 391 | "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.", |
| 392 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 393 | }, |
| 394 | { |
| 395 | "file": "internal/provision/reconcile.go", |
| 396 | "function": "func everywhereRoute(rt registry.Route) bool", |
| 397 | "current_policy_reads_or_writes": [ |
| 398 | { |
| 399 | "line": 200, |
| 400 | "source": "if rt.Unit != \"\" || rt.Hibernate || rt.Backing != \"\" || rt.Tunnel != \"\" || rt.Caps != \"\" {" |
| 401 | } |
| 402 | ], |
| 403 | "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.", |
| 404 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 405 | }, |
| 406 | { |
| 407 | "file": "internal/provision/reconcile.go", |
| 408 | "function": "func routeFor(rec Record, dataDir, seed string) registry.Route", |
| 409 | "current_policy_reads_or_writes": [ |
| 410 | { |
| 411 | "line": 294, |
| 412 | "source": "Hibernate: rec.HibernateOrDefault(), StatusNamed: rec.StatusNamedOrDefault()," |
| 413 | } |
| 414 | ], |
| 415 | "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.", |
| 416 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 417 | }, |
| 418 | { |
| 419 | "file": "internal/provision/reconcile.go", |
| 420 | "function": "func Reconcile(ctx context.Context, s release.Store, reg *registry.Registry, cfg ReconcileConfig) error", |
| 421 | "current_policy_reads_or_writes": [ |
| 422 | { |
| 423 | "line": 828, |
| 424 | "source": "if rec.Hibernate != nil && existing.Hibernate != *rec.Hibernate {" |
| 425 | }, |
| 426 | { |
| 427 | "line": 830, |
| 428 | "source": "if !*rec.Hibernate && existing.Replication != \"\" {" |
| 429 | }, |
| 430 | { |
| 431 | "line": 834, |
| 432 | "source": "log.Printf(\"provision: dry-run: would converge %s hibernate %v -> %v%s\", rec.Host, existing.Hibernate, *rec.Hibernate, dropped)" |
| 433 | }, |
| 434 | { |
| 435 | "line": 835, |
| 436 | "source": "} else if err := reg.SetHibernate(rec.Host, *rec.Hibernate); err != nil {" |
| 437 | }, |
| 438 | { |
| 439 | "line": 838, |
| 440 | "source": "log.Printf(\"provision: converged %s hibernate %v -> %v%s\", rec.Host, existing.Hibernate, *rec.Hibernate, dropped)" |
| 441 | } |
| 442 | ], |
| 443 | "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.", |
| 444 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 445 | }, |
| 446 | { |
| 447 | "file": "internal/registry/registry.go", |
| 448 | "function": "func scanRoute(scan func(...any) error) (Route, error)", |
| 449 | "current_policy_reads_or_writes": [ |
| 450 | { |
| 451 | "line": 709, |
| 452 | "source": "t.Hibernate = hib != 0" |
| 453 | } |
| 454 | ], |
| 455 | "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.", |
| 456 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 457 | }, |
| 458 | { |
| 459 | "file": "internal/registry/registry.go", |
| 460 | "function": "func (r *Registry) Upsert(t Route) error", |
| 461 | "current_policy_reads_or_writes": [ |
| 462 | { |
| 463 | "line": 890, |
| 464 | "source": "if !t.Hibernate {" |
| 465 | }, |
| 466 | { |
| 467 | "line": 926, |
| 468 | "source": "b2i(t.Hibernate), b2i(t.Canary), t.Replication, t.NextDue, t.Backing," |
| 469 | } |
| 470 | ], |
| 471 | "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.", |
| 472 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 473 | }, |
| 474 | { |
| 475 | "file": "internal/registry/registry.go", |
| 476 | "function": "func (r *Registry) SetHibernate(host string, on bool) error", |
| 477 | "current_policy_reads_or_writes": [ |
| 478 | { |
| 479 | "line": 1565, |
| 480 | "source": "func (r *Registry) SetHibernate(host string, on bool) error {" |
| 481 | } |
| 482 | ], |
| 483 | "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.", |
| 484 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 485 | }, |
| 486 | { |
| 487 | "file": "internal/release/adopt.go", |
| 488 | "function": "func PassFilter(ctx context.Context, reg *registry.Registry, s Store, pub ed25519.PublicKey, optDir string, restart func(host string) error, extra func(registry.Route) bool, opts ...PassOption) error", |
| 489 | "current_policy_reads_or_writes": [ |
| 490 | { |
| 491 | "line": 772, |
| 492 | "source": "if rt.Hibernate {" |
| 493 | } |
| 494 | ], |
| 495 | "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.", |
| 496 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 497 | }, |
| 498 | { |
| 499 | "file": "internal/release/adopt.go", |
| 500 | "function": "func adoptHost(ctx context.Context, reg *registry.Registry, s Store, optDir string, bake *FirstSeen, poisoned map[string]bool, rt registry.Route, ptr *ChannelPointer, restart func(host string) error, now time.Time, cfg passConfig, holds map[string]time.Duration, ignore bool)", |
| 501 | "current_policy_reads_or_writes": [ |
| 502 | { |
| 503 | "line": 1207, |
| 504 | "source": "if rt.Hibernate {" |
| 505 | } |
| 506 | ], |
| 507 | "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.", |
| 508 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 509 | }, |
| 510 | { |
| 511 | "file": "internal/release/adopt.go", |
| 512 | "function": "func capabilityPlan(rt registry.Route, m *Manifest, canRestart bool) (caps.Plan, error)", |
| 513 | "current_policy_reads_or_writes": [ |
| 514 | { |
| 515 | "line": 1276, |
| 516 | "source": "Hibernate: rt.Hibernate," |
| 517 | } |
| 518 | ], |
| 519 | "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.", |
| 520 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 521 | }, |
| 522 | { |
| 523 | "file": "internal/schedule/converge.go", |
| 524 | "function": "func StatusFor(reg *registry.Registry, rt registry.Route, box string, now time.Time, idle time.Duration) (Status, error)", |
| 525 | "current_policy_reads_or_writes": [ |
| 526 | { |
| 527 | "line": 329, |
| 528 | "source": "if !rt.Hibernate {" |
| 529 | } |
| 530 | ], |
| 531 | "required_integration": "Status describes no idle sleep while retaining actual scheduled-work behavior; timer frequency is never the residency mechanism.", |
| 532 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 533 | }, |
| 534 | { |
| 535 | "file": "internal/status/snapshot.go", |
| 536 | "function": "func CollectBox(routes []registry.Route, p Probes, now time.Time) Box", |
| 537 | "current_policy_reads_or_writes": [ |
| 538 | { |
| 539 | "line": 481, |
| 540 | "source": "case r.Hibernate:" |
| 541 | } |
| 542 | ], |
| 543 | "required_integration": "Report actual resident process/health/version; false Hibernate does not imply absence of activator-managed status.", |
| 544 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 545 | }, |
| 546 | { |
| 547 | "file": "restart.go", |
| 548 | "function": "func runRestartScoped(sess *apiSession, acct apiAcct, app, host, environment string, dryRun bool)", |
| 549 | "current_policy_reads_or_writes": [ |
| 550 | { |
| 551 | "line": 173, |
| 552 | "source": "if rt.Hibernate {" |
| 553 | } |
| 554 | ], |
| 555 | "required_integration": "CLI restart output correctly distinguishes resident managed lifecycle and does not promise unit start.", |
| 556 | "classification": "production consumer; requires regression or explicit unchanged-behavior assertion" |
| 557 | } |
| 558 | ], |
| 559 | "additional_consumers": [ |
| 560 | { |
| 561 | "file_or_family": "internal/provision/provision.go", |
| 562 | "functions": "GetRecordETag/ListRecords/CreateRecord/UpdateRecord/updateRecord", |
| 563 | "required_integration": "All Record JSON serialization and decode preserves/validates lifecycle; record identity/projection stable." |
| 564 | }, |
| 565 | { |
| 566 | "file_or_family": "internal/provision/reconcile.go", |
| 567 | "functions": "ListAllRecords/convergeOwned/routeFor", |
| 568 | "required_integration": "Raw listed records and projected Routes include same validated lifecycle; no hand-built second default." |
| 569 | }, |
| 570 | { |
| 571 | "file_or_family": "internal/host/steering_loop.go", |
| 572 | "functions": "steeredRoutesFromRecords/steeringPass", |
| 573 | "required_integration": "Nonlocal owners do not start residents; record-to-route projections preserve lifecycle; empty region is not single-owner proof." |
| 574 | }, |
| 575 | { |
| 576 | "file_or_family": "internal/appconfig/syncexec.go", |
| 577 | "functions": "SyncExec/syncExecHost/reapConfigEnv", |
| 578 | "required_integration": "Existing socket-based sync remains applicable; pin/fence checks prevent writes/reap while maintenance owns environment." |
| 579 | }, |
| 580 | { |
| 581 | "file_or_family": "internal/host/schedule_wiring.go", |
| 582 | "functions": "newScheduleDeps/scheduleToken/activatorDeliverer", |
| 583 | "required_integration": "Preserve actual scheduling; local token preparation synchronized with fence from b6e5c2f; no frequency workaround." |
| 584 | }, |
| 585 | { |
| 586 | "file_or_family": "internal/activator/backend_exec.go", |
| 587 | "functions": "Acquire/Restore/Seed/Start/instanceEnv", |
| 588 | "required_integration": "Preserve process user, DB/socket/lease/replica paths; resident recovery never calls Seed; handle returned resources on errors." |
| 589 | }, |
| 590 | { |
| 591 | "file_or_family": "internal/activator/backend_unit.go", |
| 592 | "functions": "SplitBackend.pick/UnitBackend", |
| 593 | "required_integration": "New policy must select exec; unit Lease/Rep are inert and never satisfy exec maintenance proof." |
| 594 | }, |
| 595 | { |
| 596 | "file_or_family": "internal/registry/registry.go", |
| 597 | "functions": "Fingerprint/SnapshotFingerprint/routeColumns", |
| 598 | "required_integration": "Field must reach fingerprints, persistent snapshots, SQL column order and migration; unknown policy fails closed." |
| 599 | }, |
| 600 | { |
| 601 | "file_or_family": "internal/console/channelmove.go", |
| 602 | "functions": "executePendingRouteChannel", |
| 603 | "required_integration": "Delayed writes preserve field; active maintenance rechecked at execution." |
| 604 | }, |
| 605 | { |
| 606 | "file_or_family": "internal/console/fleets.go", |
| 607 | "functions": "placeAppTarget", |
| 608 | "required_integration": "Refuse conflicting placement before console SQL/registry mutations, not only final record CAS." |
| 609 | }, |
| 610 | { |
| 611 | "file_or_family": "internal/console/domainattach.go", |
| 612 | "functions": "attachDomain/detachDomain/rollbackAttach", |
| 613 | "required_integration": "Lifecycle/guard identity continuity survives aliases and failed cleanup; no host reuse bypass." |
| 614 | }, |
| 615 | { |
| 616 | "file_or_family": "internal/release/trash.go", |
| 617 | "functions": "TrashApp/RestoreApp/PurgeApp", |
| 618 | "required_integration": "Reviewed lifecycle claims and guarded deletion remain mandatory; this mode adds no general claim kind." |
| 619 | }, |
| 620 | { |
| 621 | "file_or_family": "internal/host/systemapply.go", |
| 622 | "functions": "systemApplier.Run and rollback paths", |
| 623 | "required_integration": "Enforced policy-aware binary floor before activation; signed-floor design is a separate review dependency." |
| 624 | }, |
| 625 | { |
| 626 | "file_or_family": "internal/edge/storedoor.go", |
| 627 | "functions": "aclWrite", |
| 628 | "required_integration": "Keep policy records and control guards unwritable through app/fleet arbitrary store door." |
| 629 | }, |
| 630 | { |
| 631 | "file_or_family": "instances_cli.go / apimode.go", |
| 632 | "functions": "new lifecycle command/API DTO and instance record response DTO", |
| 633 | "required_integration": "Supported proposed human-owner lifecycle operation; no raw box instructions. Clean-install mode remains separate." |
| 634 | }, |
| 635 | { |
| 636 | "file_or_family": "internal/maintenanceguard / internal/activator/maintenance.go", |
| 637 | "functions": "guard reconstruction/FenceAndStop/resume integration", |
| 638 | "required_integration": "Guard/claim/fence primitives are merged in base11a; worker/resume integration remains unimplemented. Resident loop cannot override denial or synthesize resume." |
| 639 | }, |
| 640 | { |
| 641 | "file_or_family": "internal/activator/activator.go", |
| 642 | "functions": "Shutdown/actWaking/wake publication", |
| 643 | "required_integration": "Close admission, cancel/join wake, checked cleanup of late Start resources, replica close before lease close; deadline means uncertainty, never acceptable orphan." |
| 644 | }, |
| 645 | { |
| 646 | "file_or_family": "cli.go", |
| 647 | "functions": "runAdd/replicationRail", |
| 648 | "required_integration": "Use OwnsExecReplication including nonempty DBPath; retain legacy refusal/default behavior elsewhere." |
| 649 | } |
| 650 | ], |
| 651 | "source_hashes": { |
| 652 | "cli.go": "1b35d1d2f6cc61443a15221f5d70fc37e6d52c73faa8af3f9a141f52cb51b124", |
| 653 | "internal/activator/activator.go": "9848bb1b316449ca84ba846b2b41a2a1e5ba6b72f2c8e1c0d475d97d2b9fb1d4", |
| 654 | "internal/appconfig/sync.go": "a1641154ca3bbecf04165fc2108c758ec34c551d50bafe3eacbc640a59e3f08a", |
| 655 | "internal/caps/converge.go": "553b01bb2c152f5775eb3651718524b5bfef988ee96ca44655192f71feb36579", |
| 656 | "internal/console/apiinstancemove.go": "a8ffa0a75d5a12e53687157de95218cef483b7ee701789b9d56fe6a5bc8c102b", |
| 657 | "internal/console/apiinstances.go": "58f44f23b6395e40d156556c1105df7d7b26fc940f3ada4700ec4d4f95442159", |
| 658 | "internal/console/apirestartscope.go": "35547f8eb23c29956ce9ca09d60fbbc5548a686ce0d6a5a3cce80c2ece0e8031", |
| 659 | "internal/console/apiroutes.go": "153f6fd2e2134e7ee60beed4019513c5aa10340c99dc26fd8e9ae0e530475114", |
| 660 | "internal/console/instances.go": "d45c3b846b1f6764570c8fa3650d8d2297221045e9213359937b661a0ebe1ede", |
| 661 | "internal/console/overview.go": "e6fcf46d481660f9196f602596825bfbcd11fd0e8c835d26dc4c09ae73de03aa", |
| 662 | "internal/console/server.go": "107e5f4a7d287e689f3e88a2f5e5373f9613439f2018ed865ca105b4b6a586e8", |
| 663 | "internal/console/view.go": "715c3a0889c3437404ec81d3a80db7d780302baf6f6bc0f366d6854a132d37a9", |
| 664 | "internal/edge/edge.go": "f16eaf5ca39ed4994c323154f407f772eec09e817d6b95b804ef5191cb7c40eb", |
| 665 | "internal/host/agent.go": "e2f60e1b9e13be7a56a60b49ec8c596ee1b9f53a2e346d4a9623dc630336f290", |
| 666 | "internal/host/caps_pass.go": "24911bef47f0284da4c4702936c908ceafc0c4d118349453a2b15801602a1f32", |
| 667 | "internal/host/movespass.go": "9e55d771299270b5f1ef99fe783ffc10385661dd5c5047e0d14441ea846646bb", |
| 668 | "internal/host/restart.go": "b452c93bd3782555e572aeb000d92347d71d6322dbf8b784caf60e85c1e31e45", |
| 669 | "internal/host/restartscope.go": "27131be84fe7390ac6fcc9f248fcc212cf66ba6e101b6d176f3db70ca7d6a522", |
| 670 | "internal/host/socket_advice.go": "2d7c48b2990414552dec032efdbdad5aade83b3d731d6553224c36042bff307b", |
| 671 | "internal/ops/hibernate_verify.go": "47cf2718eea93528666ec52620c2999cd4e1d142aab85bae168a4d5d339b4178", |
| 672 | "internal/ops/litestream.go": "860481a660b07d64307611f0770ab350af8cf92eaf8fa6fe3600b36986ba5534", |
| 673 | "internal/provision/provision.go": "81f55646a25ec95428123bbc6b3ddb1a64fe333ba6f390ade90e52e7f5420d55", |
| 674 | "internal/provision/reconcile.go": "4bcd285f0096136a8f8d903b47d0aadc15a66d28e0139e63b44e786300ed39b1", |
| 675 | "internal/registry/registry.go": "e00d18720b8fcb93e23ec63cfa8be87cb2357ec76e891d1cd1b725f25272b824", |
| 676 | "internal/release/adopt.go": "c8baa3a48780125e6961d82b76457ddeb4c38819e097a9bac2ab34db8ebb9f74", |
| 677 | "internal/schedule/converge.go": "7f98ff1a89e733fd4766107a16776c4a5934075a7992e876cf264e96cfc7e4dd", |
| 678 | "internal/status/snapshot.go": "b0fa884b322025a6b7f78d135841647d9f7d9932d3d52d28e3ec948f4c087dcd", |
| 679 | "restart.go": "b75bacbc12ae85e48ceca42d890d0364de9455d2a0e5175cb74c2568bd445247" |
| 680 | }, |
| 681 | "test_requirement": "Each family must have behavioral regression or explicit unchanged-case test. Mutation controls target manager-vs-idle, root replication exclusion, rung preservation, startup coalescing, no seed, and maintenance retry refusal." |
| 682 | } |
| 683 | |
amadan