| 1 | # Census overlay claims-on-gate-recover (the claims-on update gate and carlos-system-recover's generation census, on main 3d444a1b), loaded LAST, after scan-demand-revival. PROPOSED, not ruled: rev3=PROPOSED-claims-on-gate-recover, to be asked of the census owner on #280 (docs/superpowers/notes/census-proposal-claims-on-gate-recover.md). |
| 2 | # (a) RunSystemApply re-pinned: the gate window follows CARLOS_HOST_CLAIM. The gate itself (systemApplier.gate, gateCheck, gateFailFast) has no root read and no row. |
| 3 | # (b) checkGuardRecovery, Run and checkUnarmedParticipationRecovery re-pinned for the no-journal deferral; generationKernel.absent and .task re-pinned for typed task refusals; generationCensusRetry re-pinned for the bounded backoff; generationServiceReader re-pinned as a binding, its reads moved into three new E2 units at its class; generationServiceEnv.deletedProgram is a new root read at F,J4 like the guard's own image proof. |
| 4 | # Every changed unit is authority: no legacy row, no frozen declaration, so the seal stands. internal/host's envelope is re-pinned. |
| 5 | # Fix round 1 (Astra): checkGuardRecovery, checkUnarmedParticipationRecovery, generationKernel.task, generationCensusRetry, generationServiceReader, generationServiceEnv.reader and .deletedProgram re-pinned; productionGenerationKernelCensus, productionGenerationAbsence, type generationKernel and generationRetiredController re-pinned at main's class (E2); generationServiceEnv.recheck, generationExeIdentity and generationContextReader.Read new at F,J4 with the image proof they serve. Still no legacy row; the seal stands. |
| 6 | # Fix round 2 (Astra round 2): checkGuardRecovery, systemApplier.Run and checkUnarmedParticipationRecovery re-pinned for the post-journal deferral and the acquisition barrier; Ledger.HoldUpdate new at its siblings' class (D); the signed-image proof moves under the census deadline (readRootFloorBinary re-pinned as a no-read wrapper, readRootFloorBinaryContext at its class with p3's reads, generationContextReader.Read moved beside it); generationServiceReader, .reader and .deletedProgram bases corrected (sampled identity checks, not execution exclusion; the deadline's coverage and its gaps). internal/rootparticipation's envelope re-pinned. Still no legacy row; the seal stands. |
| 7 | # Fix round 3 (Astra round 3): systemApplier.Run re-pinned and settleUpdateBegun pinned as a declaration for the legacy marker's settlement through settleWithoutJournal (barrier held, barrier failure fatal); generationKernel.task, type generationKernel, generationServiceEnv.recheck and generationCensusRetry bases qualified (sampled identity checks at observation points; cooperative cancellation at checkpoints, with the uncancelled work named). Still no legacy row; the seal stands. |
| 8 | # Fix round 4 (Astra round 4): settleWithoutJournal classifies a failed ParticipationRequired check as an acquisition-barrier failure (both errors kept), so the legacy marker's settlement cannot log it and exit 0; no row changes (settleWithoutJournal has no read of its own); internal/host envelope re-pinned. The seal stands. |
| 9 | internal/host/guardtransaction.go systemApplier.checkGuardRecovery authority D rev3=PROPOSED-claims-on-gate-recover;identity=root system update/recovery uid 0 (carlos-system-update.service, carlos-system-recover.service);basis=re-pinned at its class and task; its reads are unchanged (activation and marker records). Fix round 1: every no-journal settlement (the controllers census, the completion or withdrawal, and the census again inside EndParticipation, in the marker, no-marker and already-completed branches) goes through settleWithoutJournal, which defers only a result that is a census refusal and nothing else (onlyCensusRefusal), on a census box: Run under --recover then exits 0 with the reservation, marker and update record kept. An image that does not verify, malformed or foreign state, a live or unreadable controller and a failed durable write fail as on main; so do the journal-open branch, the apply and no-census boxes (ruling 6). An unfinished transaction's marker is removed inside the settlement, after its census. Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. TestRecoverDefersACensusRefusalWithNoJournalOpen, TestRecoverDefersACensusRefusalOnlyAtTheEndOfParticipation, TestRecoverDefersACensusRefusalOfAnUnfinishedTransaction, TestRecoverDefersACensusRefusalOfAnAlreadyCompletedTransaction, TestRecoverStillFailsSettlementErrorsThatAreNotCensusRefusals, TestRuling6NoCensusRecoverIsUnchanged. Fix round 2: once the journal is durably removed, closeGuardJournal's settlement (endGuard, clearUpdateBegun) also goes through settleWithoutJournal, forward and backward, guarded and unarmed; before it defers a transaction with no update record, settleWithoutJournal holds acquisitions refused under the transaction lock with Ledger.HoldUpdate (root's update record kept, or written under the transaction's id, with no census of its own); a barrier that cannot be written leaves the refusal fatal; an already-completed transaction with no record left replays at once with no census. TestRecoverDefersARefusalAfterTheJournalIsRemoved, TestRecoverStillFailsANonCensusErrorAfterTheJournalIsRemoved, TestGuardedRollbackCloseDefersARefusalAfterTheJournalIsRemoved, TestRecoverHoldsAcquisitionsWhenNoUpdateRecordWasBegun, TestRecoverReplaysASettledTransactionWithoutACensus, TestRecoverDoesNotDeferWithoutABarrier. file:ReadFile@433,file:ReadFile@660 98821263c0f79caf845c2627e4ee5e0535e7e83b5a6211b32d23c71837ad09e8 |
| 10 | internal/host/systemapply.go systemApplier.Run authority D,F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root apply/recovery uid 0;basis=re-pinned at its class and task; its lock-file read is unchanged. A checkGuardRecovery error wrapping errSettlementDeferred under --recover is logged and not fatal, and the end-of-run settlement is not retried after a deferral; every other refusal returns as before. root-input;kept=D,F;scope=protected-decision-only. TestRecoverDefersACensusRefusalWithNoJournalOpen, TestApplyStillFailsACensusRefusalWithNoJournalOpen. Fix round 2: a deferral that recoverIfNeeded returns after the journal was removed is consumed the same way, with no fatal error kept and no settlement retried. TestRecoverDefersARefusalAfterTheJournalIsRemoved. Fix round 3: the end-of-run marker settlement (settleMarker, settleUpdateBegun) also goes through settleWithoutJournal, so a legacy update-begun marker with no update record and no journal defers a census refusal with the recover-legacy barrier held; a barrier that cannot be written joins the run's error in every mode; every other marker failure is logged as on main. TestRecoverHoldsAcquisitionsForALegacyMarker, TestRecoverFailsALegacyMarkerWhoseBarrierCannotBeWritten. file:OpenFile@483 7d9c6997336322ee4c4a9feacc8312c4c7b6175393a26932246a32ce77fe5c55 |
| 11 | internal/host/systemparticipation.go systemApplier.settleUpdateBegun authority D rev3=PROPOSED-claims-on-gate-recover;identity=root apply/recovery uid 0;basis=pinned as a declaration (no read of its own) for fix round 3: the end-of-run marker settlement on a census box goes through settleWithoutJournal, returning a census refusal as errSettlementDeferred with the recover-legacy barrier held, a barrier that could not be written as errAcquisitionBarrier, and logging everything else as on main; clearUpdateBegun's reads are unchanged. TestRecoverHoldsAcquisitionsForALegacyMarker, TestRecoverFailsALegacyMarkerWhoseBarrierCannotBeWritten. b36cd2040f531d903a50300dd040efc8f2cdc1cadf00626365b539cdd4a47a3f |
| 12 | internal/host/systemapply.go RunSystemApply authority D,F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root apply/recovery uid 0;basis=re-pinned at its class and task, no read of its own: reads CARLOS_HOST_CLAIM from the unit environment through systemApplyGate (hostwrite.Enabled, as the agent does) to pick the update gate window, 120 s with fail-fast claims-on and 20 s unchanged claims-off. Registers local verifier and invokes census-gated release wrapper; absent census executes main apply directly even with leftover release state. TestSystemApplyReadsClaimsModeFromTheUnitEnvironment, TestClaimsOffGateIsUnchangedByAnEdgeThatListensAt22s. d563475f2ac28b1d1bc0bae86fa326ccaae3df1efb71928f7efd69a644a4e960 |
| 13 | internal/host/systemparticipation.go systemApplier.checkUnarmedParticipationRecovery authority G,F rev3=PROPOSED-claims-on-gate-recover;identity=root system update/recovery uid 0;basis=re-pinned at its class and task, no read of its own: with no journal open a failed controllers settlement goes through settleWithoutJournal, so only a census refusal defers (transaction and update record kept, recover exits 0); with a journal open, and for every other failure, it refuses as before. Pending acquisition triggers production controller settlement even without an update journal; normal ledger admission stays refused until verified recovery clears the marker. TestRecoverDefersACensusRefusalWithoutAnArmedFloor, TestRecoverWithoutAnArmedFloorKeepsALateRefusalNonFatal. Fix round 2: the unarmed path's post-journal settlement defers the same way, and holds acquisitions refused first when no update record exists. 48f3d01af2c4badeff7ba4526304121aa75a2efb37032880f7de8914369d9c6b |
| 14 | internal/host/rootgeneration_kernel_linux.go generationKernel.absent authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task; its reads are unchanged. A task refusal is now typed (generationTaskRefusal, same text: the /proc path and the cause) so the census retry can tell task-level refusals from structural ones; bounded task and persistent generation inspection retains boot and process start checks. file:Readlink@312 b758554c182902d80a255122404d8418ec78a9d49ed32c78b9116493ab137b5a |
| 15 | internal/host/rootgeneration_kernel_linux.go generationKernel.task authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task; its reads are unchanged. A start time that moves during inspection refuses with errGenerationTaskReplaced (still os.ErrPermission). Fix round 1: a task the service lookup trusted is rechecked against the image it was trusted for (sampled identity checks, not execution exclusion) before each use of that trust (the namespace compare, the mount check) and at the end of the inspection: a replacement visible at a recheck refuses; one after the final open, or undone between rechecks, is not seen until the next pass, and a kernel with a lookup but no recheck refuses every trusted task. Every accepted service, including a deleted-exe task, still has exe, cwd, root, descriptors, maps and mounts checked against retired generations and its start rechecked. TestRecoverCensusRefusesATaskThatExecsAfterItsImageWasProven, TestRecoverCensusNeedsABindingForATrustedTask, TestRecoverCensusStillChecksReferencesOfAnAcceptedDeletedExe, TestPlan14GenerationServiceReferences. file:Readlink@1657 a6e618451bb716139bf3c97d01ed82c00e2d1f450937e3bf325c6589942a0c71 |
| 16 | internal/host/rootgeneration_census_linux.go generationCensusRetry authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task, no read of its own: runs whole independent census passes through generationCensusRetryFor. Every pass runs under one 20 s deadline from the census's start, as cooperative cancellation at the implemented checkpoints plus rejection of late results: systemctl show through exec.CommandContext, the deleted-image hash between reads and, since fix round 2, the signed-image proof (readRootFloorBinaryContext: the hash of <opt>/carlos and <opt>/carlos.prev between reads, and the identity-cache scan before each identity). A pass that ends past the deadline refuses even if it succeeded, and none starts after it. Between checkpoints the work is not cancelled: the opens and metadata operations, the identity cache's directory enumeration (Names, a ReadDir), a whole identity record's read (io.ReadAll), a systemctl show already started, one Read of an image, and the versions-tree walk and mount checks before the first pass; the boot-delay figures in the census note are estimates built on this, not bounds. Task-level refusals a later pass can clear (exited, replaced, refused by the service lookup) retry with backoff from 250 ms inside that deadline, then the last refusal is returned unchanged; other missing-process errors retry at most three times as before; reference, namespace, mount and structural refusals refuse immediately; no partial census is accepted. TestRecoverCensusDeadlineCountsInspectionTime, TestRecoverCensusDeadlineReachesTheInspection, TestRecoverCensusRetriesATransientRefusalWithinTheWindow, TestRecoverCensusRetriesOnlyTaskLevelTransients, TestPlan14GenerationCensusRetriesWholeObservation. f779c207011954e9ca7a8c98b83ac11e6d6926b3a480eaf0547b22507a23daf5 |
| 17 | internal/host/rootgeneration_services_linux.go generationServiceReader authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=re-pinned at its class and task, no read of its own: binds the production generationServiceEnv (/proc, /opt/carlos, owner uid 0, systemctl show, trusted unit files, readRootFloorBinaryContext, the signed-image proof under the census deadline since fix round 2) and returns its lookup, classify and recheck; the reads moved into generationServiceEnv.reader, generationServiceShow and generationServiceTrust unchanged. ad2cc68e7792e9c0af9242531a5cfc642d59d9436a46588ebc91eba27635f0f9 |
| 18 | internal/host/rootgeneration_services_linux.go generationServiceEnv.reader authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=new unit, generationServiceReader's body at its class: classifies independently verified platform and system services by trusted unit files, systemd main PID, cgroup and protected executable; only edge main threads may use its delegated supervise subgroup; exact guard-exec edge verifies guard and selected current against signed protected identities. The exe Readlink moves before the cgroup checks for diagnostics only (a failure still refuses at its old place); every refusal names check, unit, cgroup and exe and wraps its cause. A non-root task, or a root task of a unit with a selected image (the guarded edge), whose exe reads <path> (deleted) goes to deletedProgram instead of the path walk; root tasks of units with no selected image keep the walk. Fix round 1: a task accepted on a proven deleted image keeps the hashed descriptor open, with its device, inode, mount ID and file handle recorded, and is rechecked against it by sampled identity checks at observation points (before each use of the trust and at the end of the inspection): a replacement visible at a recheck refuses; an exec after the final /proc/<pid>/exe open is not seen until the next pass, the race main's live-exe path (selected-program and non-root services) already has, so this is not execution exclusion. The binding applies only to deleted-image acceptance; live-image rechecks return at once. The lookup is built on each census pass's deadline context, which systemctl show, the image hash and (fix round 2) the signed-image proof obey. TestRecoverCensusRefusalsNameCheckUnitCgroupAndExe, TestRecoverCensusAcceptsTheEdgesDeletedExeInSupervise. file:Readlink@1270 96a04fe5667537f9193daef824964e9b4823266c5dd8ced3cf657b2b4b9014e3 |
| 19 | internal/host/rootgeneration_services_linux.go generationServiceShow authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=new unit, the systemctl show of ControlGroup, MainPID, ExecStart, FragmentPath and DropInPaths moved out of generationServiceReader unchanged, at its class. file:CommandContext@103 26d82849d8e6d22eb35b0d9befd0b5c02d81cec9dc3bfaf4b684504c16c4d0cd |
| 20 | internal/host/rootgeneration_services_linux.go generationServiceTrust authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=new unit, the unit-file EvalSymlinks and rootstate.OpenTrustedFile check moved out of generationServiceReader unchanged, at its class. file:EvalSymlinks@63 07fe0cf4c6a8b17eaa223ec37b44818152ac1e70c8fe3832bedcb99c61cf24a1 |
| 21 | internal/host/rootgeneration_services_linux.go generationServiceEnv.deletedProgram authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0 (carlos-system-recover, carlos-system-update, instance-control start, guard-exec prelude);basis=NEW root read, classified as guard-exec's equivalent (hostfloor OpenProtected, Disk.VerifyFile and ExecutingHash, F,J4 root-input) because it is the same proof on the same kind of input: it opens a service task's running image through /proc/<pid>/exe, requires a regular file owned by root with no links left and no group or other write, hashes its bytes (at most 512 MiB) and accepts only a digest equal to the signed router build of <opt>/carlos or <opt>/carlos.prev as readRootFloorBinaryContext proves it from the local identity cache, under the census deadline (fix round 2). It applies to a non-root task, and to a root task of a unit with a selected image (the guarded edge, whose selected program is <opt>/carlos), when the unit selects <opt>/carlos and the exe link reads <opt>/carlos (deleted); a root task of a unit with no selected image keeps main's path walk, and anything else refuses as before. The hashed descriptor stays open and the task is rechecked against it at observation points (generationServiceEnv.recheck): sampled identity checks, not execution exclusion; an exec after the final open shares main's live-exe race. Acceptance only lets the census reach the reference checks. Fix round 1: on success it returns the hashed descriptor, open, to bind the task to it (recheck), and the hash stops when the census deadline passes (generationContextReader, now in rootmovesfloor_refresh.go with the proof). TestRecoverCensusAcceptsADeletedExeOfTheCurrentOrPreviousBuild, TestRecoverCensusRefusesOtherDeletedExes, TestRecoverCensusRefusesADeletedExeNotOwnedByRoot. file:Fstat@481,file:Open@323 9b912bec1e9cecf3caff27e8742b84501b82d4b7c0b29f6aa96843d8c43952b7 |
| 22 | internal/host/rootgeneration_census_linux.go productionGenerationKernelCensus authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task, no read of its own changed: every refusal is now typed generationCensusRefusal, so a no-journal recovery can defer it and nothing else, and each pass builds the service lookup on the census deadline context and wires its recheck. Checks protected staged tree and hardlink policy; actual systemd services pass only through unit, cgroup and executable verification while recorded live tenants use independent containment. TestProductionGenerationCensusRefusalsAreTyped. 0da7bd4e8f5c68bd7f30c3c8b3650eb32db5ff54995be293b0f0469d27cc515b |
| 23 | internal/host/rootgeneration_kernel_linux.go productionGenerationAbsence authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task, no read of its own: wires the service lookup's recheck beside its classify. Checks recorded launch targets and controller absence then inspects all tasks with independently verified service classification. 189c4b2c5d7d47c91814d2788fc04150eb6c0145ca7b76b7fcb7ecde81028ffb |
| 24 | internal/host/rootgeneration_kernel_linux.go type generationKernel authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task: gains the recheck field that rechecks a trusted task against its proven image at observation points (sampled identity checks). Root kernel generation verifier carries service classification and exact retained containment; all observations are independently checked before certification. 40aa7e14fbbc5da15d951f0de1bd93e2f1f2fb3b60591592e264b211a1029e6f |
| 25 | internal/host/rootgeneration_retired_linux.go generationRetiredController authority E2 rev3=PROPOSED-claims-on-gate-recover;identity=root claim/adopt/update controller uid 0;basis=re-pinned at its class and task, no read of its own: wires the service lookup's recheck beside its classify. For an exact retired isolated installation, an old controller may still serve another host only after its boot/start identity and all thread references to this target generation are independently checked. d074043a9cfcfb1d4317388dab298915c38fd5b3b7ffcc8dedf4824c206bce0d |
| 26 | internal/host/rootgeneration_services_linux.go generationServiceEnv.recheck authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=new root read at its caller deletedProgram's class (the guard's image proof, F,J4): re-opens a trusted task's /proc/<pid>/exe at each use of the trust and at the end of its inspection, and requires the very inode that was hashed (generationExeIdentity: device, inode, mount ID, file handle), still root-owned, unlinked and not group or other writable; it does not hash again, the hashed descriptor stays open and the kernel refuses writes to an executing image (ETXTBSY). A replacement visible at an observation point refuses, transient; a replacement after the final open, or one undone between observations, is not seen until the next pass, the race main's live-exe path shares. Final releases the descriptor. TestRecoverCensusRefusesATaskThatExecsAfterItsImageWasProven, TestRecoverCensusDeletedExeOfARootTask. file:Fstat@589,file:Open@399 3fa2ccce10f6389a4d177aa0420f9b8c86aa25b2068934aa2e5059318a1edcfd |
| 27 | internal/host/rootgeneration_services_linux.go generationExeIdentity authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=new unit at its callers' class (deletedProgram's binding and recheck, F,J4): Fstat, Statx(STATX_MNT_ID) and name_to_handle_at of an already open image descriptor, giving the device, inode, mount ID and file handle that bind a task to its proven image; a filesystem without handles gives none (EOPNOTSUPP). rootstate.ObjectIdentity is not used because it resolves the mount in root's own mount table, which a service in a private mount namespace does not share. file:Fstat@97,file:Statx@207 90589ce72ed160c94a5d155157d3f93ea1e9b4850992f2aacfc63dd88e29a828 |
| 28 | internal/host/rootmovesfloor_refresh.go generationContextReader.Read authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root generation kernel reader uid 0;basis=moved beside the signed-image proof in fix round 2, same class as its callers deletedProgram and readRootFloorBinaryContext (F,J4): the hash's reader over an already open, already checked image (the deleted image, <opt>/carlos or <opt>/carlos.prev); it stops once the census deadline passes and opens nothing. TestRecoverCensusDeadlineReachesTheInspection. file:Read@127,file:Read@33 d20afc659f08ab69244381b3b677a44e51467ad813b188aeaad1d00c278cf53b |
| 29 | internal/host/rootmovesfloor_refresh.go readRootFloorBinary authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=re-pinned at its class and task, no read of its own since fix round 2: readRootFloorBinaryContext under context.Background(), for the callers that have no deadline; behaviour unchanged. 8ac4df055cc5f91436f65929bea964152009d120d98e6ee5069a63ed406242e6 |
| 30 | internal/host/rootmovesfloor_refresh.go readRootFloorBinaryContext authority F,J4 rev3=PROPOSED-claims-on-gate-recover;identity=root adopt refresh, root system update/recovery, root guard floor readers and the root generation kernel reader, uid 0;basis=readRootFloorBinary's body at its class (p3: verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar), now under a context: the image hash stops between reads (generationContextReader) and the identity-cache scan stops before each identity (rootFloorSignedIdentity) once the context ends; the reads are p3's. Fix round 2, for the census deadline. TestSignedBinaryProofStopsWhenTheCensusDeadlineEnds (the two helpers), TestRecoverCensusDeadlineReachesTheSignedBinaryProof (the lookup hands the deadline to the proof; the production plumbing from this function into the helpers is not witnessed by a non-root test). After CI: rootFloorDigest returns the raw sum and the hex encode is one single-valued write to Digest again, so the moves copy gate can derive the digest that reaches a seal's Reason (TestMovesSinksAreSentences, TestMovesStringsAreRecorded). file:Open@846,file:Read@1111,file:Stat@304 92c74898bfc43ac45d774ca766c5b4be474e58ffe60a8ac2737a32655240a304 |
| 31 | internal/rootparticipation/ledger.go Ledger.HoldUpdate authority D rev3=PROPOSED-claims-on-gate-recover;identity=root system recover uid 0 (settleWithoutJournal, under the transaction lock);basis=new unit at its siblings' class (Ledger.BeginUpdateWith, Ledger.EndUpdateWith, D): the recovery acquisition barrier. Under the same-ledger transaction exclusion it reads the recovery census and update.json and, when no acquisition is pending and no update record exists, writes root's update record under the deferring transaction's id, so Acquire stays refused while recover defers a census refusal; it runs no census of its own (EndUpdateWith, with its census, still removes the record). Fix round 2 (Astra finding 1b). TestHoldUpdateRefusesAcquisitionsWithoutACensus, TestHoldUpdateLeavesAPendingAcquisitionCensusAlone, TestRecoverHoldsAcquisitionsWhenNoUpdateRecordWasBegun, TestRecoverDoesNotDeferWithoutABarrier. file:Read@319 e5cfaa26ccf5241507b41920d64e1ccf7db2e6435d071a9226246fac1a346645 |
| 32 | @coverage internal/host d92e492a30973333e8c6df8a939a347dbb96a30a0e404327737f502232376268 |
| 33 | @coverage internal/rootparticipation 6c6d03dec45fe2fca86efc0fcb7615a4ab531c1da0a3a10adab36932d9d81a5a |
| 34 | |
amadan