| 1 | # Plan 14 Part 1 fix2: controller-required authority changes. Prior freezes remain unchanged. |
| 2 | internal/host/agent.go runAdoptUnderRootRelease authority B3,C Route restart and recovery errors continue through sweep, proof minting and held-stage work. whole:Route@10418,whole:Route@16956,whole:Route@16992,whole:Route@7846 3f2c4079d973759d3ff6af587a3a2fc6d462d73d986f4fcbdd23dd0cea55c461 |
| 3 | internal/host/claimstop_run.go RunInstanceControl authority C,D,G Refuse premature claim activation and continue serving recovery after per-host startup failures. 7b425e2882811cb5ec42eb14e2eaf424995e928ca0c2a63e1a156c4258e7ddb9 |
| 4 | internal/host/proofbinding.go productionProofBindingSource authority B3 Root-owned current and previous pointers replace health history as executable authority; cache only record discovery. file:Open@209,file:Open@379,file:Read@958 a201908eb70c2769e2e7a2f3bb1e672911128370ab5f546b5cb1f80563361a59 |
| 5 | internal/host/proofbinding.go proofBindingSource.binding authority B3 Verified unit identity and checked current/previous release paths bind running or failed units independently of health history. file:EvalSymlinks@2524,file:EvalSymlinks@2787,file:EvalSymlinks@3206,file:EvalSymlinks@3515,registry:Unit@461,registry:Unit@4718,registry:Unit@544,registry:Unit@717,whole:Route@5198,whole:Route@5205 455e47321aad1c671f1d0ec468d0389b2cd2386b24f99cc3dd7c9251e5108bee |
| 6 | internal/host/proofnamed.go proofBindingSource.findRecord authority B3 Cache successful per-pass discovery only; retry partial listings and reread selected record ETags. c7d87c42992654bd5d36ce746c18ff7ab324bfbfeb0c66fed68decbabfd3432e |
| 7 | internal/host/proofnamed.go proofBindingSource.record authority B3 Record key selection uses indexed discovery; local root-managed unit authority is unchanged. 10a99ff4b355907831a904010b7019d480ce93f2f595e99e076d3c702d10ca2b |
| 8 | internal/host/proofobserve.go productionProofObserver authority B3,B4 Reuse per-pass record discovery; continue independent observation and root health writes. whole:Route@301 8818b1bc139c865263e4b30ad506ae4ef1bb6e19e01af4df69dbdde5e7fa8064 |
| 9 | internal/host/proofroot.go proofRoot.around authority B3,B4 Continue minting observations for unaffected routes even when adoption reports a route error. a63c9ff49cfc8a1ee46439008a0eaaff55dbccd7cde9692f9c9f0fc8a179ae72 |
| 10 | internal/host/rootexecution_runtime.go newClaimExecutionRuntime authority D Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility. file:Read@205 8ce18baebc235f8e247018e879b8558855a73d18e6e1c36303ddc439d8fb0968 |
| 11 | internal/host/rootinventory.go ClaimRootHTTP.commitRootInventoryPending authority C Check request age before intent and recover committed inventory using revision, full inventory equality and LastRequest. file:Read@1353,file:Read@3384,registry:Account@4748,registry:Account@4763,registry:App@4784,registry:App@4795,registry:ClaimIncarnation@4254,registry:ClaimOwner@4304,registry:ClaimOwner@5287,registry:ClaimOwnership@4846,registry:ClaimOwnership@4868,registry:ClaimOwnership@5601,registry:ClaimOwnership@7602,registry:ClaimRowID@4468,registry:ClaimRowID@4545,registry:ClaimStamp@4282,registry:DBPath@4812,registry:DBPath@4826,registry:Host@4718,registry:Host@4730,whole:ClaimOwnership@4850,whole:ClaimOwnership@4878,whole:ClaimOwnership@5611,whole:ClaimOwnership@7613,whole:Route@3576,whole:Route@3959,whole:Route@3975,whole:Route@4030,whole:Route@4681,whole:Route@4694,whole:Route@4703,whole:Route@4941,whole:Route@5173,whole:Route@5849,whole:Route@5985,whole:Route@6209,whole:Route@7446,whole:Route@8480,whole:Route@8541 3e3d34311cb6685989689ea445aaa969d270e595d90b97b78dab68f21c1aff1e |
| 12 | internal/host/rootinventory.go ClaimRootHTTP.recoverRootInventory authority C Retry per host; abandon superseded intents under root lock while retaining durable quarantine. file:Read@1373,file:Read@707 10d09b5ab6d07d316437233c9a65bf0bcdfe1083db4d0769fa8303b255dfd0ac |
| 13 | internal/host/rootrecovery_rebind.go ClaimRootHTTP.rebindRecoveryInventory authority C Retain fresh claim and inventory checks and refuse a box listed Lost. file:Exec@2331,file:Read@1225,file:Read@1835,registry:Account@3052,registry:App@3089,registry:ClaimIncarnation@3152,registry:ClaimOwner@3332,registry:ClaimRowID@3354,registry:ClaimStamp@3180,registry:Host@3024,whole:Route@3473 a782cf4233eeeb7063e39a1c699530a88c96755e8105f508b3e745cfd3508c9a |
| 14 | internal/host/rootrestart.go checkedUnitRestart authority B3 Capture root previous binding without history; failed units can reset and restart onto the authorized live build. file:EvalSymlinks@1059,file:EvalSymlinks@1842,registry:Account@1405,registry:Account@2210,registry:App@1437,registry:App@2242,registry:Host@1106,registry:Host@1898,registry:Host@2785,registry:Host@3052,registry:Host@3588,registry:Host@510,registry:Unit@3470,registry:Unit@711,whole:Route@1413,whole:Route@1445,whole:Route@2218,whole:Route@2250,whole:Route@3478,whole:Route@638,whole:Route@719 3a5759fabf75be2f000bdb184d31f82c13672683ab0dcc90b55375106226a609 |
| 15 | internal/host/rootrestart.go productionRootRestartChecks authority B3 One deployment discovery index per resolver/pass; fresh record bodies and root file checks at each use. file:Open@882,whole:Route@1516,whole:Route@1783,whole:Route@715 b0720f80a7c75e94161997706fb5135503163e57e2b113baf631bbd36494d2f6 |
| 16 | internal/host/rootrestart.go restartBoundUnit authority B3 Recheck identity, target digest and readiness; failed units can start and health-write failure cannot roll back a healthy service. file:EvalSymlinks@629,registry:Account@2334,registry:Account@3574,registry:App@2370,registry:App@3614,registry:Host@1614,registry:Host@2236,registry:Host@2728,registry:Host@3345,registry:Host@676,registry:Unit@1097,registry:Unit@1165,registry:Unit@1928,registry:Unit@1996,registry:Unit@2038,registry:Unit@3031,registry:Unit@393,whole:Route@198,whole:Route@2340,whole:Route@2376,whole:Route@316,whole:Route@3582,whole:Route@3622,whole:Route@3832 847d33cf9527f2de215b9e82cfacb006bc4355c08946687bdeedf95768248e6d |
| 17 | internal/host/rootrestart.go restartOrdinaryUnit authority B3 Root-derived unit name, systemd execution path and trusted unit file preserve ordinary unit restarts without registry authority. 383608711571b3255de0422bbe236e6683af9cb6156d5d26e633e4124af11732 |
| 18 | internal/host/rootrestart.go rollbackUnitRestart authority B3 Capability remains a recovery aid; root previous binding or current failed-unit binding permits an independently checked start. file:Read@942,registry:Host@1234,registry:Unit@1336,registry:Unit@1637,whole:Route@1242,whole:Route@1344,whole:Route@1645 f2688aa7e8aa5f2d313c68cb8465c602bc228061862c579a3d64e618f3eb1afa |
| 19 | internal/host/rootrestart.go rootRestartRouteWith authority B3 Retain main ordinary unit try-restart naming and error behavior; registry Unit never selects a named unit. whole:Route@363,whole:Route@491,whole:Route@644 07baa6584881ec41287a349f13a896add7ae54c982c610f67b5ca91913a36b36 |
| 20 | internal/host/rootrollback.go captureRollback authority B3 Capture unit and executable authority without a root health-history prerequisite. file:Read@699,registry:Host@336,registry:Host@818,whole:Route@338,whole:Route@820 c915c20438daff70d792a95ef8c60edd37d276b4f5e0fd5b068c7f44a8949e62 |
| 21 | internal/host/rootrollback.go settleRollbackAttempt authority B3 Do not rewrite settled journals; capability cleanup remains idempotent. 374524f9110f0cd9a9ade95a85d87880cdc1878275384a0e9c2b33f533ed0f99 |
| 22 | internal/host/rootrollback_resume.go recoverRootRestarts authority B3 Recover every attempt independently, skip settled writes and remove leftover capabilities. file:Read@519 aa7aede682a8748e427f8c34e2f99dedb3e5bf206a1e465609fa7b1bb433cdbb |
| 23 | internal/host/rootrollback_resume.go resumeRootRestart authority B3 Finish verification after a successful forward restart interrupted before settlement without restarting it again. file:EvalSymlinks@1238,registry:Account@1331,registry:Account@2037,registry:App@1359,registry:App@2065,registry:Unit@1109,whole:Route@1111,whole:Route@1333,whole:Route@1361,whole:Route@2039,whole:Route@2067 6181fd6e04a3f2be0707eb188168f60a2c0f50a8f2320f06af1dd3df9baeda1a |
| 24 | internal/host/rootroute.go proofBindingSource.needsRestart authority B3 Named units use authoritative deployment or root-owned local sources; ordinary recordless routes retain derived-unit dispatch. registry:Host@137,registry:Host@352,registry:Unit@209,registry:Unit@685,whole:Route@614,whole:Route@625 461e89f36f05073df34a887ec86fad0e8c6652f69d82e5a916145cda72842398 |
| 25 | internal/hostbox/coldhandover.go ColdHandover.Recover authority C A provably superseded cold admission can abandon its barrier without discarding its receipt. 6e37cd73c5a42d84e464f86d5c040b69250fbabf59de5929b1ac4ceae07438d4 |
| 26 | internal/hostbox/inventory_expected.go StopInventoryDB.SnapshotRequest authority C Expose inventory revision and LastRequest for exact root commit recovery after receipt pruning. 9ca5b0b60dbf3b0c148a0e0eb3ff1df44e0082a8e7a30b5878e9431c9d31871e |
| 27 | internal/hostexec/rootbroker.go RootBroker.Execute authority D Retry transient authority reads within existing admission slack; bounded replay and permanent mismatches remain enforced. file:Read@3480,file:Read@5063 2dc3cdebdedbe96bb14733baf2219f6f4fda528b86baf8691077e0da0c9faaf9 |
| 28 | internal/hostexec/rootbroker.go RootBroker.Monitor authority D Exponentially back off lost-record settlement retries; active cutoff monitoring remains independent. 2e5be8edbafbf1885833ca7d639fe98546c5ffe3b3cc23f1e5cba7b1cff8e43f |
| 29 | internal/hostexec/rootbroker.go RootBroker.acquire authority D Retry conditional writes and authority reads within original monotonic cutoff; reconcile uncertain writes by exact bytes. file:Read@808 63226d41e26fb28dfc0fd2168386cde8191c02391d07d5d449aa5f963f498147 |
| 30 | internal/hostexec/rootbroker.go RootBroker.retry authority D Bound transport retries by original monotonic slack and context; never extend a permit. 79c2cf3bbe1cc13525b985aff5a1c21f8ba10d5f58cbdd7eaa15d90487f5305d |
| 31 | internal/hostexec/rootbroker.go RootBroker.settle authority D On uncertain ETag or delete conflict require both root and remote expiry, then conditionally delete the current ETag. 8151e8fbac0881adac4981eed10dad413780867f31f4c401f14746b06370b3f4 |
| 32 | internal/hostguard/coldhandover.go Guard.AbandonColdHandover authority C Fresh successor claim permits abandonment; retire barrier stamp and retain predecessor receipt. 02759e0dac6a4e0c9f0f8f361f315a188881c94c4962c49f362993057dbfbaf3 |
| 33 | internal/hostguard/guard.go Guard.Activate authority C Pending intent and durable quarantine remain denial conditions. file:Exec@723 05d728a1ef7c9a25245e7782148f5678f90928d4c804d9e83994c591619fadd1 |
| 34 | internal/hostguard/guard.go Guard.With authority C Recheck remote root denial immediately before the protected effect. ff8d2220879047a430940ffad88de5c0319213f33f0ad33c2f58bf7964914aef |
| 35 | internal/hostguard/guard.go Guard.locked authority C Root host lock precedes bounded legacy-lock wait; failure durably quarantines the existing installation. 12e3484626a1177e0237ba76839eb1ac1b5cdb006f6329a246ec4d23f52a9a86 |
| 36 | internal/hostguard/guard.go Guard.readLocked authority C Read-only access takes only the root host lock. 5084d4441fb431d24703d1a1875a6dd8b3c878f6be3bf5f329d4c5a3e24fcddc |
| 37 | internal/hostguard/recoveryfence.go Guard.PendingFences authority C Root-only read lock avoids an agent-held legacy lock at startup. cb28fae024ac90e8b0dc61a6bade6900be8515ada5da8a2b0e92b76dc7e92060 |
| 38 | internal/hostguard/retirement.go Guard.WithNoInstallation authority C Use the already-held root host lock for empty-installation authority checks. 4a6f2bd3ed932b35a551f86acaa423f5d3e72d7651afc5531744f64ce84b98b9 |
| 39 | internal/hostguard/root.go Guard.AbandonRootInventory authority C Clear only an exact pending intent proved superseded, retaining quarantine and all prior denials. 189b68eb13d8e9549ad410a46a4c3a285b7c50cfbc49492a7b3efaff0f19036b |
| 40 | internal/hostguard/root.go Guard.CommitRootInventory authority C Write coherent pending identity; retire old stamp only at commit and clear quarantine only after authorization. 662d753b26b3a45372435e2425231d0ee4a2098c2a89feef484e8c1f797f8b24 |
| 41 | internal/hostguard/root.go RootAuthority.read authority C Read additive root-owned quarantine state together with installation and retained denials. file:Read@175 716dc51839dc602064aeb0ab3e975a49b122d55b4882dbc79b9c85207a5dd11d |
| 42 | internal/hostguard/rootrebind.go Guard.RebindRootInventory authority C Clear quarantine only on a fresh fully verified committed rebind. 90f9415f47af01755418101139d9be27ee91ce5ff2cc52212ac13dfcd18a69ea |
| 43 | internal/hostguard/rootview.go RootAuthority.View authority C Root host lock serializes views; quarantine and pending intent deny admission. 05e48dfee1fe85bac1e2876b48eabc20447c61952ee14fce74a281af483aa8f6 |
| 44 | internal/hostguard/rootview.go RootAuthority.viewLocked authority C Read the root view only with the caller already holding the root host lock; avoid nested acquisition. 3adc7fa8c0a52ebd1e4de9e2ec6d7166549b4dc1b5dd43f6c9a37c01508ff7c1 |
| 45 | internal/provision/rootrecord.go FindRecordByHost authority B3,C Discovery delegates to the collision-checking index and still reads the selected record afresh. 7bb3556a3818ab57cb94b5c4104de708afc7c0b6ac4d88e476509903b23793b0 |
| 46 | internal/provision/rootrecord.go IndexRecords authority B3,C Discover hosts once, reject duplicate keys, and classify partial discovery as retry rather than permission refusal. 2e45f3c659a61943727ac1413d431c8320dbc1d4e89cb4f43df60c819764abf9 |
| 47 | internal/provision/rootrecord.go RecordIndex.Find authority B3,C Use cached key identity but read and validate current record body and ETag. 57369bc683b52f238bae08c56eb54fd65b1617c104e93f0787ba7b4260a41f93 |
| 48 | internal/release/adopt.go adoptHost authority B3,E1 Incomplete record discovery is retryable and does not poison the build for other hosts in the pass. registry:App@10271,registry:App@10431,registry:App@11460,registry:App@11917,registry:App@13283,registry:App@17583,registry:App@22862,registry:App@30469,registry:App@3114,registry:App@6423,registry:App@7697,registry:App@7891,registry:Hibernate@31148,registry:Host@10151,registry:Host@10184,registry:Host@10284,registry:Host@10444,registry:Host@10546,registry:Host@10578,registry:Host@10643,registry:Host@11093,registry:Host@11226,registry:Host@11546,registry:Host@12007,registry:Host@12755,registry:Host@13056,registry:Host@13269,registry:Host@13585,registry:Host@17305,registry:Host@17413,registry:Host@17551,registry:Host@18250,registry:Host@18408,registry:Host@18870,registry:Host@18922,registry:Host@19042,registry:Host@19129,registry:Host@20235,registry:Host@20430,registry:Host@2075,registry:Host@21090,registry:Host@21475,registry:Host@21616,registry:Host@2264,registry:Host@22830,registry:Host@22957,registry:Host@2345,registry:Host@24299,registry:Host@24949,registry:Host@28182,registry:Host@28800,registry:Host@29125,registry:Host@29199,registry:Host@29452,registry:Host@30626,registry:Host@30733,registry:Host@30961,registry:Host@31104,registry:Host@3127,registry:Host@31849,registry:Host@31975,registry:Host@32063,registry:Host@4248,registry:Host@5211,registry:Host@5316,registry:Host@6535,registry:Host@6583,registry:Host@6700,registry:Host@6732,registry:Host@7583,registry:Host@7751,registry:Host@7877,registry:Host@7996,registry:Host@8474,registry:Host@8861,registry:Host@9087,registry:Host@9183,registry:Kind@552,registry:Unit@577,whole:Route@10266,whole:Route@10426,whole:Route@11450,whole:Route@11907,whole:Route@13786,whole:Route@14878,whole:Route@15181,whole:Route@17573,whole:Route@19964,whole:Route@2176,whole:Route@22852,whole:Route@27753,whole:Route@3109,whole:Route@3554,whole:Route@6418,whole:Route@9408 01ddb201c381aad5cffc92b215949e6934df31677ecd1e3803c4d248a408448d |
| 49 | internal/release/sweep.go LivePins authority B3,E2 Pin root previous pointers as well as current pointers so rollback artifacts survive sweeping. file:ReadDir@100,file:ReadDir@499,file:Readlink@652 79dee4be204bc6c3a4a67ece14f3101e9712b940b4662232b07dfcbcd65f158b |
| 50 | internal/release/versions.go PointLive authority B3,E2 Controller fix2 reclassifies this legacy primitive: durably retain the old root release pointer before swapping current. file:Open@798,file:Readlink@362,file:Stat@121 599ab4719cb0a340395b73a02171249b046738e8addbd7377f67c7f2b16ad749 |
| 51 | internal/rootparticipation/ledger.go Ledger.Acquire authority D Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion. file:Read@345 990f117b72da3fca7705d7aeb80d0c54a79a63132011f8c49fc0c38a3b599cdc |
| 52 | internal/rootparticipation/production.go ActivationReady authority D,G Refuse claims activation without complete census and registered verifier; Part 3 G remains mandatory. file:Open@61 d2b720a29f82edfa4bf744a3c07bf7726a9335ef1772165a438aa6f76008bef3 |
| 53 | internal/rootparticipation/production.go OpenForUpdate authority D Unactivated absent census does not block update or recovery; retained census remains authoritative. file:Open@56,file:Read@193 08e361dedc72eecb20902435c9c532316a971d223466990ff758ef92b60b0b53 |
| 54 | @coverage internal/host 8afb6c437cb0315157792d28f86645c75663ce15286af1104c891cee31e62bf7 |
| 55 | @coverage internal/hostbox 74453bbc80561f91e84ccc2cb1b31239c0a1fe232b40d3a6892dbe242303ada5 |
| 56 | @coverage internal/hostexec 5c9f06a0d7bc9441f8357409b3b999467fd904287aee20e479255a2f2c81f614 |
| 57 | @coverage internal/hostguard 9847d32d54210b93592e5426c6023a88c4ebbec9543f49611fb407866dfe052d |
| 58 | @coverage internal/provision 88c7b3001bc9829d9baeaefb67d3c8a20a6a074eab71ab403d653150ca6e3b1f |
| 59 | @coverage internal/release 83b2be809f0ec1d02e57708db1bb64e9c814393effe06b6ad649999c41683f10 |
| 60 | @coverage internal/rootparticipation 7c88084fa906ffb0e57e23b717ea176bf6f7cabd292151e93acf680e3905bd28 |
| 61 | |
amadan