| 1 | # Reviewed merge delta: controller ruling 2 in plan14-merge.md. Original baseline and moves freezes are retained. |
| 2 | @legacy d110f21aaeb3313fae5b6ecd049b7fbee1ce8b1f29d9f6d0d9fa1c8e0bf8d7b8 cli.go runInstances legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=CLI dispatch adds settings verbs; local administrative listing and dispatch remain outside root authority scope. file:Open@1282,registry:App@3155,registry:Backing@3237,registry:Channel@3170,registry:Environment@3181,registry:Hibernate@3046,registry:Host@3147,registry:Kind@3162,registry:Replication@3222,registry:Status@3196,registry:Unit@3248,registry:Version@3206,whole:Route@3020 affba21523d741fd2455a78bd433d29cbf295b74d312d12a44dc5a9a1c3f26d5 |
| 3 | cli.go runInstances legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=CLI dispatch adds settings verbs; local administrative listing and dispatch remain outside root authority scope. file:Open@1282,registry:App@3155,registry:Backing@3237,registry:Channel@3170,registry:Environment@3181,registry:Hibernate@3046,registry:Host@3147,registry:Kind@3162,registry:Replication@3222,registry:Status@3196,registry:Unit@3248,registry:Version@3206,whole:Route@3020 affba21523d741fd2455a78bd433d29cbf295b74d312d12a44dc5a9a1c3f26d5 |
| 4 | @legacy d5af81a035ce972a1873d6c44c03b0506e65f8095dfdbddf7f7d51ad03f55852 cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console startup adds RegionHA configuration; console service configuration is outside kept root decisions. data-literal@2918,data-literal@4019 f625c6fce1ee6872825116e3300bd6ed3bf2418c370b5e9352425d5ec97c835c |
| 5 | cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console startup adds RegionHA configuration; console service configuration is outside kept root decisions. data-literal@2918,data-literal@4019 f625c6fce1ee6872825116e3300bd6ed3bf2418c370b5e9352425d5ec97c835c |
| 6 | @legacy 8fd8b96ca19f0eb98d3d1a7b07e7180fe27c4ede1c17a3329f8503e94fe33cbe internal/activator/keyadoption.go writeAdoptionRecord legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance-key adoption payload uses shared bounded-read constant; key payload handling remains legacy. file:ReadFile@327 0f76948f4a0e68bbe5a282118b57df3cbf98287b722275b7739695cc7bb2a9b5 |
| 7 | internal/activator/keyadoption.go writeAdoptionRecord legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance-key adoption payload uses shared bounded-read constant; key payload handling remains legacy. file:ReadFile@327 0f76948f4a0e68bbe5a282118b57df3cbf98287b722275b7739695cc7bb2a9b5 |
| 8 | @legacy 9fca20d44320494f20b630bdd8a937bb792e1c278757e2e116fc6c2b1f91b9aa internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent recovery hold clears the fence owner with its own fence; root durable fence authority remains separate. file:Read@207,file:Read@379,registry:Socket@1661,registry:Socket@1822,whole:Route@1614,whole:Route@1663,whole:Route@1824 147e5858e201b3caaf4af1d9e0a2f05e0b012036bde834e9747ec68bb1cf47c0 |
| 9 | internal/activator/recoveryprobe.go Service.reviewRecoveryHold legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent recovery hold clears the fence owner with its own fence; root durable fence authority remains separate. file:Read@207,file:Read@379,registry:Socket@1661,registry:Socket@1822,whole:Route@1614,whole:Route@1663,whole:Route@1824 147e5858e201b3caaf4af1d9e0a2f05e0b012036bde834e9747ec68bb1cf47c0 |
| 10 | @legacy 2b38f9cad1408b800081d6518b671824ad932ee04dcda2f5c2932e20250821c3 internal/console/apiinstancemove.go Server.regionHasLiveBox legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console move detail uses exported edge completeness predicate; display and placement evidence remain legacy. file:Read@401 646d530f799b1d63ec9a2fd791df44e6bd6710a862c6e240b062183be8dc251a |
| 11 | internal/console/apiinstancemove.go Server.regionHasLiveBox legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console move detail uses exported edge completeness predicate; display and placement evidence remain legacy. file:Read@401 646d530f799b1d63ec9a2fd791df44e6bd6710a862c6e240b062183be8dc251a |
| 12 | @legacy abb52cc53fb812625f4939a802299abc4825d2fd9abe4e5c55d9ecaa576e6406 internal/console/apiinstances.go Server.handleAPIInstanceList legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=API listing adds update status and effective-settings display; no root settings decision occurs here. file:Query@1655 558d0b3e7b0f06faa8e5067ff6f8c131eb899f13d08b71218dfb2454c3e319e1 |
| 13 | internal/console/apiinstances.go Server.handleAPIInstanceList legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=API listing adds update status and effective-settings display; no root settings decision occurs here. file:Query@1655 558d0b3e7b0f06faa8e5067ff6f8c131eb899f13d08b71218dfb2454c3e319e1 |
| 14 | @legacy d7c8cade4c96cc9c52396b36dd6f6a7f78081039cbb56233ae5dbdc421276a39 internal/console/claim_runtime.go Server.ConfigureClaimRuntime legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console wires executor chooser for create; placement selection remains legacy. file:Read@1442 d6404c56b2dc340f1e06bfdf27dc66d661473525880733aa1feb4d5a71593253 |
| 15 | internal/console/claim_runtime.go Server.ConfigureClaimRuntime legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console wires executor chooser for create; placement selection remains legacy. file:Read@1442 d6404c56b2dc340f1e06bfdf27dc66d661473525880733aa1feb4d5a71593253 |
| 16 | @legacy e2ceb4ed07321f8d225a97853af594b009e15b2a67c19cc9b6654e63ecfeed07 internal/console/instancepage.go Server.handleAppInstance legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance page adds updates view from rollout join; browser rendering remains legacy. file:Query@2439,registry:Account@2211,registry:Alias@2311,registry:App@2241,registry:Host@2189,whole:RouteAlias@2172 abc4169a7d1d865fa7a31ec858aba7c3f48f15bcd327125320b9dcd772664720 |
| 17 | internal/console/instancepage.go Server.handleAppInstance legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance page adds updates view from rollout join; browser rendering remains legacy. file:Query@2439,registry:Account@2211,registry:Alias@2311,registry:App@2241,registry:Host@2189,whole:RouteAlias@2172 abc4169a7d1d865fa7a31ec858aba7c3f48f15bcd327125320b9dcd772664720 |
| 18 | @legacy 187d1e78bd96c63a3d66866e7e68d8606f10287312596e973816be713dfb05de internal/console/server.go NewServer legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console registers settings routes; console routing remains outside root authority scope. data-literal@8872 c64947bcee0f87734fc362fc61ec065de52bb35c756c10a92d5d2d317d5f1414 |
| 19 | internal/console/server.go NewServer legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Console registers settings routes; console routing remains outside root authority scope. data-literal@8872 c64947bcee0f87734fc362fc61ec065de52bb35c756c10a92d5d2d317d5f1414 |
| 20 | @legacy f0cedd7209150ffece4b3606f91d41b3e40320e6b6ff7574869ad68fc577b31e internal/console/templates/app_instance.html external legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance HTML adds approved update forms; whole embedded template remains frozen as legacy UI input. file:external@0 7c6b076890203a04219a3c0d21a85b3bbe6b2d306e617ec02ea33bdd7dba9e51 |
| 21 | internal/console/templates/app_instance.html external legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Instance HTML adds approved update forms; whole embedded template remains frozen as legacy UI input. file:external@0 7c6b076890203a04219a3c0d21a85b3bbe6b2d306e617ec02ea33bdd7dba9e51 |
| 22 | internal/host/agent.go runAgent authority B,C,D,F Production agent wires C8, relocation and completion passes; root history, guard, participation and floors retain their distinct authority. file:Exec@13447,file:Open@569,registry:App@9838,whole:Route@20744,whole:Route@9830 33980a7afbb22201af355a0e0921add6ac596d1a49ca470488ecb7481da46740 |
| 23 | internal/host/buildstate.go buildStates.beforeExec authority E3 Consumed request is tenant-bound before execution; unread registry refuses before state merge. whole:Route@1052,whole:Route@1085,whole:Route@1120,whole:Route@1148,whole:Route@1461 fbd045945d8717c08a9f93c712ec0ce59d922240d176122b77f609bb48595041 |
| 24 | internal/host/buildstate.go buildStates.carryRequest authority E3 Only the route tenant's consumed request is carried into build state; kept settings and served-history boundary. registry:Status@234,registry:Status@372,whole:Route@204,whole:Route@846,whole:Route@879 035a4a18d096911439c7dcf4af592339b4dbdd2de8f1a3e8847840b9e7652cbf |
| 25 | internal/host/buildstate.go buildStates.heldWakeInput authority E3 Held wake reads tenant-bound consumed decisions, refusal ledger and installed release; no downgrade to diagnostic. registry:BuildState@953,registry:Host@637,registry:Host@735,registry:Host@793,registry:UpdateSettings@145,whole:Route@660 d530868ad87cece077238d552402b2ca3404df25c58cffd650ab0af26363c781 |
| 26 | internal/host/claimassembly.go ClaimAssembly.Build authority C,G Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory. file:Prepare@3640,file:Prepare@3657,file:Prepare@4369,file:Read@4299 98ec4d8f8a20d64b2280371500555e0751742a3b2106663f05960a7952e60620 |
| 27 | internal/host/claimconstruction.go OpenProductionClaimAssembly authority C,G Production assembly retains root backend and typed rebind while wiring completion handover and relocation holds. file:Read@4059,file:Read@9321,file:ReadFile@3603,registry:Host@9348,whole:Route@9436 ef69e8c4474af53a2c973a48e138967a7d9ca14877c8adc2dd6951693e79fccc |
| 28 | @legacy 2a9ae3d74505c9e90d09a25130c970803fec933be55c88712a04399e0beb2fb2 internal/host/claimfiles.go claimEnvFileFor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent C8 environment payload derives flat or nested path from route layout; unrelated payload selection remains legacy. registry:DBPath@586,registry:DBPath@733,registry:Host@435,whole:Route@422,whole:Route@951 4e5286b04c9546143ace4a6ece7f175860bb0a7771163a645daa402c15e28b74 |
| 29 | internal/host/claimfiles.go claimEnvFileFor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent C8 environment payload derives flat or nested path from route layout; unrelated payload selection remains legacy. registry:DBPath@586,registry:DBPath@733,registry:Host@435,whole:Route@422,whole:Route@951 4e5286b04c9546143ace4a6ece7f175860bb0a7771163a645daa402c15e28b74 |
| 30 | @legacy aefcf7408566937bd1a6a86b6550767eee3e82ccb1524eb29e1a53ace4bc4445 internal/host/claimfiles.go movesFilesSource.Open legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=C8 files source binds verified bucket actor and origin proof; files payload provider remains legacy. file:Open@27 aed9f22f0dac2427af0b6e0519284e689f3daee5e90eb3cfa1d581b13fa868b6 |
| 31 | internal/host/claimfiles.go movesFilesSource.Open legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=C8 files source binds verified bucket actor and origin proof; files payload provider remains legacy. file:Open@27 aed9f22f0dac2427af0b6e0519284e689f3daee5e90eb3cfa1d581b13fa868b6 |
| 32 | @legacy 12ee74a2a31ff401e6060d1fbc9e9b4786bfc14fe06ed3952e5d462f95cfc628 internal/host/claimfiles.go openClaimFilesManifest legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=C8 provider constructor refuses duplicate or missing sources; generic files-provider wiring remains legacy. file:Open@809 465b5f00817a3ce4077c8912f2a8ca7d3ccb616153849338c0b0c981ceb27a1a |
| 33 | internal/host/claimfiles.go openClaimFilesManifest legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=C8 provider constructor refuses duplicate or missing sources; generic files-provider wiring remains legacy. file:Open@809 465b5f00817a3ce4077c8912f2a8ca7d3ccb616153849338c0b0c981ceb27a1a |
| 34 | internal/host/claimhandover_crossbox.go relocationAfter authority C Admission dispatch preserves landing handover and delegates relocating probing to its typed after-admission owner. file:Exec@393 7ea07d20e629340580413f691de629b9cde7742fa5716dbcbe7e3c777fb0ada7 |
| 35 | internal/host/claimhandover_crossbox.go relocationBefore authority C Before-admission dispatch binds relocation executor and probe phase before typed handover. file:Exec@356 b5428a6feba965fd3880b3a6a1ddd0d0a048a2424ffe7882c79d02df71413fb6 |
| 36 | internal/host/claimhandover_crossbox.go wireClaimAdmission authority C,D Admission constructor adds completed-relocation recovery owners while retaining typed root recovery rebind. c8a2f03e2937b72d3e38cea02aa5e49ebfe8a38638d97c64dc65db5ddc9955a0 |
| 37 | internal/host/claimlaunch_production.go claimLaunchFor authority D Production root runtime receives the unit-aware kernel wrapper before startup recovery. data-literal@414,file:CommandContext@605 a283c8ff26452e19323611ae1fbd4ad9a51265f186afdb1ff99de089619e6f9c |
| 38 | internal/host/claimmoveparks.go openProductionClaimMoveWake authority C,G Moves owner construction wraps every bucket request in bound identity check and preserves wake refusal. file:Open@521 bff34938c41a8c054e98744c3262b182437231ac6dc361c1a5ba15a39b8b7505 |
| 39 | internal/host/claimparticipation_completed.go ClaimAssembly.completedRelocationDischarge authority C,D Completed-relocation discharge requires exact claim completion and verified retirement receipt; unread evidence refuses cleanup. file:Read@227 e061f95cf3d974fb253c59540cee70ca942a8d73042679aa7f071ada90f9b69d |
| 40 | internal/host/claimparticipation_relocation.go productionClaimLocal.Acknowledged authority D Relocation acknowledgement waits for bound controller readiness; participates in execution admission. file:Prepare@268 022a1bbe9f6479e37ad7afd4a9b9201915f729953742f3306cd3f01cd79cc1d5 |
| 41 | internal/host/claimparticipation_stale.go productionClaimLocal.clearUntracked authority D Untracked participation cleanup now carries exact controller binding into retirement before stale-state clearing. file:Read@1004 067dcf7f62940af8030315834087853273a039a56e2095ae15c8b2f3342e8fb3 |
| 42 | internal/host/claimproduction.go ProductionClaimOwnerProvider.OpenClaimOwners authority C,G Production owner factory wires bounded C8 and relocation providers and closes partial construction on error. file:Open@4239 4e687295ab57dd736ab6c6d707f88106b732a2870cf97860ac34674d13c4028b |
| 43 | internal/host/claimrelocation.go openClaimRelocationOwners authority C,G Relocation owner constructor receives existing serving sources and verified identity inside feature gate. file:Open@941 03649c80d6c96d398672bac3b0403fcc4fda6b5721f8a35bacb9d459b05acf46 |
| 44 | internal/host/movesfiles.go movesFiles.Establish hint H3 Environment and manifest payload feeds separately selected Work; C8 bytes do not confer root execution authority. 2bdf78495c7f8b5191de4f19870074ac8f5819a205225a4304a21f833f9c6249 |
| 45 | @legacy 2bbda37052436ad39d06dee512d807977fd3459d9d637b59ea219ee722b412d9 internal/host/movesfiles.go readClaimEnvFile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Environment payload reader retains bounded descriptor reads for nested files and existing flat payload behavior. file:ReadFile@81 56f88a87b1ab1249bba4abd0c0173ea6619d6eda185b738d60425fe84315a0e6 |
| 46 | internal/host/movesfiles.go readClaimEnvFile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Environment payload reader retains bounded descriptor reads for nested files and existing flat payload behavior. file:ReadFile@81 56f88a87b1ab1249bba4abd0c0173ea6619d6eda185b738d60425fe84315a0e6 |
| 47 | internal/host/movesfiles.go relocationPreparedManifest authority C Prepared installation manifest is bound to authoritative claim digest, local-install receipt, box and install stamp before use. file:ReadFile@1143 d5e107cc3c156873efc15dc8766115571303fb3d69d8ff5f8aadf53f97fc9248 |
| 48 | internal/host/movesheldrelease_production.go WithProductionMovesHeldRelease authority B2,C,E1 Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. file:Open@1313,file:Read@1554 23d3dc34c7258b00af723ac840869cf380891be83eb8b3ec7396776cf92d4118 |
| 49 | internal/host/movesheldrelease_root.go movesHeldReleaseRoot.authority authority C,E1 Held publication independently binds holder, operation, canonical deployment incarnation and hold; registry is a checked candidate. file:Exec@1464,registry:App@3163,registry:App@3299,registry:HoldOp@3098,registry:HoldOp@3308,whole:Route@3083,whole:Route@3142,whole:Route@3293,whole:Route@3372,whole:Route@3377 cd50ea0c21a17a1acccfe5735e0ab4147341747ec1a080c6113affc1df940901 |
| 50 | internal/host/movesheldrelease_root.go movesHeldReleaseRoot.publishRelease authority C,E1 Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. whole:Route@1913,whole:Route@470 047170f84aec58762a106cf05244d7b9fda203750ffa09d3f94795fb3c74488c |
| 51 | internal/host/movesinstall.go installRun.configured authority C,E1 Configured landing now validates root-created registration before render and held publication; source recovery keeps existing typed rebind. whole:Route@1402 141af93f0b642f3b4066f2e401959ff4702075cc7ba69871a95507dd6370de06 |
| 52 | internal/host/movesland.go landingRun.checking authority C Checking registers through root before reading held row; installation and later guarded work retain exact holder tuple. file:Exec@1118,file:Exec@1845,file:Exec@1960,registry:DBPath@2165,registry:DBPath@2274,registry:HoldOp@2397,registry:HoldOp@2514,registry:Status@2383,registry:Status@2503 bbd9beab5d2f06cb01d283c5d91918fb09454b4504603133e3de50f2bf034778 |
| 53 | internal/host/movespass.go armMovesPass authority B,C Agent moves construction passes registration client and existing guarded publication and park providers. file:Read@2744,registry:Provisioned@1749,whole:Route@1736 78b83e2cdf3850408f429246c754f81661e9e5309b3628afb0b953d206005c9f |
| 54 | internal/host/movespass.go armPhase1 authority B2,C Phase-one wiring keeps separate readiness/publication hooks and root proof gate; root relay receives claim-on publications. whole:Route@7932,whole:Route@8051,whole:Route@8393,whole:Route@8521 40a3b4d672f5ecb540db033d033dad67f40d3f8785fdba61d2ec79eb83628f4a |
| 55 | @legacy 62ef2a81a0b839aa2b71c8e43a3eb7ce33ebce2f40c4369e60b07b5af8fa03df internal/host/movesprobeowners.go movesProbeOwners.Materialize legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent landing materialization adds C8 payload establishment and recovery delegation; generic payload rendering remains legacy. registry:DBPath@1041,whole:Route@1214,whole:Route@2099 09b441442d78e865986035a4e36147f8d1a5d23f5d4739efa78ed8988f21dc68 |
| 56 | internal/host/movesprobeowners.go movesProbeOwners.Materialize legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent landing materialization adds C8 payload establishment and recovery delegation; generic payload rendering remains legacy. registry:DBPath@1041,whole:Route@1214,whole:Route@2099 09b441442d78e865986035a4e36147f8d1a5d23f5d4739efa78ed8988f21dc68 |
| 57 | @legacy 43c00883d86c6b56e27ad94a309b9d532cced807e343f0e3852d579c70e56c27 internal/host/movesprobeowners.go movesProbeOwners.materializeCommitted legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Committed landing materialization establishes C8 files before start check; payload delivery remains legacy. registry:DBPath@616,whole:Route@603,whole:Route@699 79cfc6b38bdb9ccefc89f662360530d76ef9088c784c03021f559bb3ee5b9c87 |
| 58 | internal/host/movesprobeowners.go movesProbeOwners.materializeCommitted legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Committed landing materialization establishes C8 files before start check; payload delivery remains legacy. registry:DBPath@616,whole:Route@603,whole:Route@699 79cfc6b38bdb9ccefc89f662360530d76ef9088c784c03021f559bb3ee5b9c87 |
| 59 | @legacy c92c753f48e89a53af956488b0b816a2d96b1ce5aba63576c9c3a3cf85482ce5 internal/host/movesrecoveryprobe.go recoveryProbeAdapter.admits legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Recovery probe adapter cross-checks declared loss and source generation with authoritative claim; probe orchestration remains legacy. file:Exec@248 26b854fa758825a956f70c350b6992698a369e45e04db6dd14fdc35b7453c7fa |
| 60 | internal/host/movesrecoveryprobe.go recoveryProbeAdapter.admits legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Recovery probe adapter cross-checks declared loss and source generation with authoritative claim; probe orchestration remains legacy. file:Exec@248 26b854fa758825a956f70c350b6992698a369e45e04db6dd14fdc35b7453c7fa |
| 61 | @legacy 28189c8154286af1b369e7ce5685a465a51c5465321f2af0cb56a41756f030df internal/host/moveswakesource.go movesProbeRender legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent held-render wrapper forwards typed selected work; unrelated configuration payload rendering remains legacy. whole:Route@447 93bc03944b728990285e7049fa34a2868cd13d3c6945ad883685799bed7f5ce1 |
| 62 | internal/host/moveswakesource.go movesProbeRender legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent held-render wrapper forwards typed selected work; unrelated configuration payload rendering remains legacy. whole:Route@447 93bc03944b728990285e7049fa34a2868cd13d3c6945ad883685799bed7f5ce1 |
| 63 | @legacy 12670422bac05d096333973e6ed1566eeac462940816e5d55b37dd3136cba5ba internal/host/moveswakesource.go movesReadLaunch legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Moves launch-input adapter selects by host through existing read interface; generic launch payload selection remains legacy. registry:Host@230 0c8c9c8acd209e41a9d6ce21576dd5f57bfa3884271d4d1309e79ab321a78269 |
| 64 | internal/host/moveswakesource.go movesReadLaunch legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Moves launch-input adapter selects by host through existing read interface; generic launch payload selection remains legacy. registry:Host@230 0c8c9c8acd209e41a9d6ce21576dd5f57bfa3884271d4d1309e79ab321a78269 |
| 65 | internal/host/moveswakesource.go movesWakeID hint C Cryptographic random read supplies an opaque request identifier; identity grants still require fresh claim and root guard. file:Read@58 c2360ee3e085c88ce880e29ef3d5252c33da7b08c3387534330eeb932b0cf914 |
| 66 | internal/host/moveswakesource.go movesWakeSources.Open authority B2,C Moves owner source wires authenticated root relay and root healthy-history proof gate with verified actor. file:Open@27 73286381943e1dd0dd46e5b312923884a24ace92f91091c6dba159e47f739a18 |
| 67 | internal/host/relocatepass.go NewRelocationRuntime authority C,D Relocation runtime binds verified enrollment, source, participant and typed stop/fence providers; generic placement stays legacy. file:Read@845 5df938e1a7ac837c8dc3e5420683e023f60adfa7c7af4477cc6a6c9177c0778c |
| 68 | internal/host/relocatepass.go RelocationRuntime.finishCompletion authority C,D Completion dispatch requires authoritative completed operation and current executor before discharge. file:Exec@442 24123452b90251f9aa46ffd1823ae87bc540ca6f57ade7705344b9067123f7ab |
| 69 | internal/host/relocatepass.go RelocationRuntime.once authority C,D Agent pass re-reads claims around participant/worker effects and typed completion; unrelated journal sweep remains legacy. file:Read@1147,file:Read@335 b852fe349287d9ed1d45fb00442634114e52a6bfb372cd65f0abace5e4201dd4 |
| 70 | internal/host/relocatepass.go channelRelease hint E1 Candidate install version comes from independently verified signed channel pointer and canonical deployment record; publication still uses proof gate. file:Read@191 fa62539b0c7aaf62c7eed7180fbe1ff6b70e6094a9b6fadfdbb4c663ddb584a3 |
| 71 | internal/host/relocatepass.go newCompletionRuntime authority C,D Completion-only runtime treats registry and journal hostnames as discovery and verifies claim and bound identity before discharge. registry:Host@668,registry:Host@689,registry:Host@728,whole:Route@582,whole:Route@620,whole:Route@649 b848e6cd4eb0b31653766a255cff62dab70b04e7bd445123620af7f4d3cb16ce |
| 72 | @legacy b71bfdd352e26c5b3bf0c4e27f14c3299e5e58f07a02b6a541a0c95b87d1393c internal/host/relocationassembly.go relocationHostPaths legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Source flush payload paths follow its registry row; generic replication payload selection remains legacy. whole:Route@236,whole:Route@318 4d8df654c20574b933e610560f21ddc4189ef567d77d00bba45a00ed35790a20 |
| 73 | internal/host/relocationassembly.go relocationHostPaths legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Source flush payload paths follow its registry row; generic replication payload selection remains legacy. whole:Route@236,whole:Route@318 4d8df654c20574b933e610560f21ddc4189ef567d77d00bba45a00ed35790a20 |
| 74 | @legacy f8c7746f98f0b9e52f21219b7c764e483eed3e8e27fec60bb26d6e03d7d18ea5 internal/host/relocationassembly.go relocationPathsFor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Flat/nested environment and files path helper is generic agent payload handling, outside kept authority. registry:Host@250,registry:Host@315,registry:Host@353,whole:Route@129 c21908da36fa323634912eda209f9233c8b29f0f0f11079ea90a42c6bcc1cba3 |
| 75 | internal/host/relocationassembly.go relocationPathsFor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Flat/nested environment and files path helper is generic agent payload handling, outside kept authority. registry:Host@250,registry:Host@315,registry:Host@353,whole:Route@129 c21908da36fa323634912eda209f9233c8b29f0f0f11079ea90a42c6bcc1cba3 |
| 76 | @legacy b301697c137a1290b5e6f1f0d30143be40d5384e0495aceda8d080b11cc77423 internal/host/relocationattempts.go readRelocationAttempts legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe retry journal loads local attempt history; probe budgeting is outside root execution-lease and fence scope. file:ReadFile@214 9250ccb6eee92ae543736be9aeda7441542a27624804f2939c08482b8ed19d6b |
| 77 | internal/host/relocationattempts.go readRelocationAttempts legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe retry journal loads local attempt history; probe budgeting is outside root execution-lease and fence scope. file:ReadFile@214 9250ccb6eee92ae543736be9aeda7441542a27624804f2939c08482b8ed19d6b |
| 78 | @legacy 9acf17cf29d4fbeb2dde9c033ace8063dfadf51a806f92430507d7e547d0a0e9 internal/host/relocationattempts.go readRelocationAttemptsBeneath legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded descriptor read of relocation probe metadata; preserves reviewed root-launch candidate transport, not root fence or lease provenance. file:ReadAll@906,file:Stat@580 20ea7e020cc39f9de0f26e5f496ad7a3324ed0ea40e468c7f723fe4d0e85645c |
| 79 | internal/host/relocationattempts.go readRelocationAttemptsBeneath legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded descriptor read of relocation probe metadata; preserves reviewed root-launch candidate transport, not root fence or lease provenance. file:ReadAll@906,file:Stat@580 20ea7e020cc39f9de0f26e5f496ad7a3324ed0ea40e468c7f723fe4d0e85645c |
| 80 | internal/host/relocationattempts.go relocationAttemptReader.ReadAttempt authority C Root attempt adapter cross-checks operation, executor and holder tuple with fresh claim; agent reservation metadata remains accepted legacy payload within this mixed declaration. file:Exec@1554,file:Exec@953 7f33d90b40222fbb56e6b9cc284aa40714516ebc5ec0575db3169980fd0072ea |
| 81 | @legacy 26575074e45ccb862800823f7ac73598a117b78487f67ed97e66f7265baad665 internal/host/relocationattempts.go relocationPassedProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe-success journal gates relocation progress; operation probe health does not populate root D3 healthy history. file:Exec@1297,file:Exec@461,file:Exec@590,file:ReadFile@822 341bdf04f35d32170fe2bccfa45c01186cfa659a5f65274648157f04a3367933 |
| 82 | internal/host/relocationattempts.go relocationPassedProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe-success journal gates relocation progress; operation probe health does not populate root D3 healthy history. file:Exec@1297,file:Exec@461,file:Exec@590,file:ReadFile@822 341bdf04f35d32170fe2bccfa45c01186cfa659a5f65274648157f04a3367933 |
| 83 | @legacy 309b515c7f21f016e1b5b30ddadf511194093213ae01d0c662b887f3092991ff internal/host/relocationattempts.go relocationProbeAttempts.bound legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent attempt selection binds fresh writer and per-executor counter; probe orchestration remains legacy. file:Exec@863,file:Read@626 12276508ef7a8aca88df19445f7138d2bbc4744255263a15beb2facdf3178e83 |
| 84 | internal/host/relocationattempts.go relocationProbeAttempts.bound legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent attempt selection binds fresh writer and per-executor counter; probe orchestration remains legacy. file:Exec@863,file:Read@626 12276508ef7a8aca88df19445f7138d2bbc4744255263a15beb2facdf3178e83 |
| 85 | internal/host/relocationeffects.go RelocationEffects.EnsureLocal authority C Installation repair compares authoritative local-install receipt, exact box/enrollment/stamp and re-verifies materialization. file:Read@866 46a2ccbfee65b444ce03da0634fbceab91678b521c8a721aa6946ba9e80bb115 |
| 86 | @legacy d1aa2c8e2298d84ae965afd1f66513c66c3a312b9b3fb90f67b48114137aeaf3 internal/host/relocationflush.go ReleaseFlushFiles.Flush legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Stopped source flush exports wake/env/adoption/files payload through descriptor reads; general replicated payload handling remains legacy. file:Open@772 a72453a646fb25b5e8b455639c42ec62ba73e030b2910857b3f1790fbde64107 |
| 87 | internal/host/relocationflush.go ReleaseFlushFiles.Flush legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Stopped source flush exports wake/env/adoption/files payload through descriptor reads; general replicated payload handling remains legacy. file:Open@772 a72453a646fb25b5e8b455639c42ec62ba73e030b2910857b3f1790fbde64107 |
| 88 | internal/host/relocationflush.go ReleasePositionsFile.Recorded authority C Release-position candidate is bound to exact stop request and process identity before receipt construction; unrelated replication positions remain legacy payload. file:ReadFile@202 57707c87fcc3ec56bd9650c991c99a6927567aa523bbcc883af8894d8c306aaf |
| 89 | internal/host/relocationhandover.go relocationCompletedHandover.completedPrior authority C Completed handover binds authoritative completed stop, session, generation and stamp to current serving writer. file:Exec@216 f2b22b038c5b3a9dc14aa9b13a90a7d6e597b9ad07cd18ddcad98684b17dacd6 |
| 90 | internal/host/relocationinstall.go ClaimAssembly.relocationBuildAuthority authority C,D Relocation build revalidates operation, captured install stamp, prepared pin and execution participation before writes. file:Read@334 45bb77d26a0610e510b24a120a72f7c8f799b7296125a4733c53b497c694a4c8 |
| 91 | internal/host/relocationinstall.go ClaimAssembly.relocationInstall authority B2,C Relocation install uses registered root inventory, RPC outside selected work and root healthy-history proof gate; generic file restoration stays legacy. file:Read@5961,registry:DBPath@6240,registry:HoldOp@9622,registry:Status@9609,whole:Route@13362,whole:Route@13487,whole:Route@14216,whole:Route@3338,whole:Route@3387,whole:Route@731,whole:Route@9604,whole:Route@9728 258278aafdd7a2abb1f0c3cf4d7cc2f55b2273e8252252718049eeb825113567 |
| 92 | internal/host/relocationinstall.go ClaimAssembly.relocationReceipt authority C Local-install receipt reader refuses malformed operation materialization; claim receipt digest is checked by its consumers. file:ReadFile@488 ed815d3e2a89b9dccac464f70e3738dfe7a92a65ee41f05af90488beb0765463 |
| 93 | internal/host/relocationinstall.go ClaimAssembly.relocationVerifyLocal authority C Installation verification combines claim-bound receipt, captured stamp, held row and exact prepared files manifest; cannot first-register at installed. registry:HoldOp@863,registry:Status@911,whole:Route@1747,whole:Route@849 fd51aa9f16fd15a3603994635663c7f164e39efa2315fa63e6a7b99a5a4a0d8d |
| 94 | internal/host/relocationinstall.go relocationActivationReader.Read authority C Activation reader obtains a fresh claim and applies typed relocation installation authority before activation. file:Read@118,file:Read@36 fd6187fc00e6906fd919d613d8548f0d85a91930ac42d8c252d9d16e8ad3eee6 |
| 95 | internal/host/relocationinstall.go relocationInstallAuthority authority C Existing relocation install authority binds exact kind/op/phase/executor/install stamp, lost state and unopened prepared generation. file:Exec@187 a523c082729a58e42a508a630caa9117faceae3e7481abab6206d64a7254f7da |
| 96 | internal/host/relocationinstall.go relocationRecord authority C,E3 Canonical relocation record and update policy derive nested installation shape; source account/incarnation is rechecked by root registration. registry:DBPath@920,registry:Socket@976,whole:Route@1351,whole:Route@1358 4271b1a1b0500da0cf1d4c52de1e6f26e7ac9c9bda85a64ff735ab584e9c5ee3 |
| 97 | internal/host/relocationowners.go ClaimAssembly.relocationReleaseHold authority C,D Completion releases hold only after verified participation discharge, then lifts agent-owned probe fence and marks authoritative completion. file:Exec@568,file:Read@384,registry:HoldOp@1327,registry:HoldOp@1347,registry:HoldOp@1456,registry:HoldOp@1974,whole:Route@1220 09909ba1ab6024e3d40a7259c95d126644027d71128504aaa5a905b858fffcc8 |
| 98 | internal/host/relocationowners.go RelocationSource.Open authority C,D Relocation owner wiring binds verified actor, C8 provider and identity-checked requests; admission remains typed. file:Open@27 502fb6436d4eb0ea5c77a2d631d64f73fb738b0fe14fd79d0b5f7bee6b59e4fd |
| 99 | internal/host/relocationowners.go newClaimID hint C Random operation identifier supplies uniqueness only; authorization is separately checked by claim transitions. file:Read@57 6986621ca34a45be06a45e96a527164a4c1b207c68e81753b9c94e3e2239ee4d |
| 100 | @legacy 88bee9d40b72bbe1fb1b0a46d13fc00455afcc23046db1bb2fc1ffab0557c965 internal/host/relocationowners.go passedProbeSession legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent completed-probe selector checks claim probe session; operation probe progress remains outside D3 history scope. file:Exec@246 18a8e397ac77ec2e11f92f5cdf023554d3c456aa738898491061b780ce47fb33 |
| 101 | internal/host/relocationowners.go passedProbeSession legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent completed-probe selector checks claim probe session; operation probe progress remains outside D3 history scope. file:Exec@246 18a8e397ac77ec2e11f92f5cdf023554d3c456aa738898491061b780ce47fb33 |
| 102 | @legacy e9ef3897ee0f8726929be3afb2b9c3faf66ab9bec8f0937e98135102cb6ca83d internal/host/relocationowners.go readRelocationProbeFence legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Reads agent activator-fence ownership marker; this is not root durable hostguard fence authority. file:ReadFile@94 ed3ef76b7045b8bc588c87581ffc3e3bdeea94b3ee9e8b493a0384a2ac945a56 |
| 103 | internal/host/relocationowners.go readRelocationProbeFence legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Reads agent activator-fence ownership marker; this is not root durable hostguard fence authority. file:ReadFile@94 ed3ef76b7045b8bc588c87581ffc3e3bdeea94b3ee9e8b493a0384a2ac945a56 |
| 104 | internal/host/relocationowners.go relocationAfterAdmission authority C After-admission installation binds local journal bytes to authoritative receipt hash and installed stamp. file:Exec@305,file:ReadFile@666 55aece0bdc5dbbffc06ca505600fffc0e06d7100100b48c51f9f06225463da30 |
| 105 | internal/host/relocationowners.go relocationBeforeAdmission authority C Before-admission requires certified release or explicitly lost and fenced source; preserves independent claim evidence. file:Exec@294 4d849959f117b3841d9a079fbe0f8615a5dfb65005a906004904874c3faaf24a |
| 106 | @legacy be0b2b8279b476718bd2f2337aa47929b496de669565633e0d13a47d54884a30 internal/host/relocationowners.go relocationProbeFenceOwner legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Creates and replays agent activator-fence owner marker; never clears root durable fences. file:Read@438 01f22213faba2996425db44c49d0594166ef49014755304d5d90300723bb2bb6 |
| 107 | internal/host/relocationowners.go relocationProbeFenceOwner legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Creates and replays agent activator-fence owner marker; never clears root durable fences. file:Read@438 01f22213faba2996425db44c49d0594166ef49014755304d5d90300723bb2bb6 |
| 108 | internal/host/relocationreleases.go ReleaseObligation.Complete authority C Release obligation completion reads fresh claim before verifying and recording root stop receipt. file:Read@234 55b25cf83ab44eaf97254291919a700594ca33916e20032b86c42647e5b9fb3b |
| 109 | internal/host/relocationreleases.go ReleaseObligation.Queue authority C Queues exact relocation release retirement obligation and preserves already discharged receipt replay. file:Exec@459 1b54ddf51f68ce28b8c0a454705621449355e823b7bbfce7729f7dfa790a2ef9 |
| 110 | @legacy e63d6fafd796ee53c6884eecc66dce1891826bd6791786daa3757b3aef599ff7 internal/host/relocationsweep.go buildScratchDirHost legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent scratch sweep infers scratch host and emptiness for generic build-directory cleanup; not root installation absence. file:ReadDir@76 61f24531bcff5ee1398393aa0c5f588d367088e18480af5ba361436d7a61bdad |
| 111 | internal/host/relocationsweep.go buildScratchDirHost legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent scratch sweep infers scratch host and emptiness for generic build-directory cleanup; not root installation absence. file:ReadDir@76 61f24531bcff5ee1398393aa0c5f588d367088e18480af5ba361436d7a61bdad |
| 112 | internal/host/relocationsweep.go relocationJournalHost hint C Journal host is discovery only; completion re-reads authoritative claim and exact receipt before effects. file:ReadFile@71 91d2eb766d2b17f3f83721593272c2a91d356f18935cb6f5e24f353b61f7ff17 |
| 113 | internal/host/relocationsweep.go relocationJournalHosts hint C Agent journal enumeration adds candidate hosts; missing journals cannot discharge root participation or fences. file:ReadDir@77 bb4b3efccf7d0c227ea7662cb21f4b895e2cc9ecc65525d7d0b1fd470a5d2dd0 |
| 114 | @legacy 14f470adecbb98f5310df0a78055c6d908d719267deb04f5124e6f1457e854bb internal/host/relocationsweep.go sweepRelocationJournals legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent relocation-journal retention checks claim completion and serializes local writes; unrelated journal cleanup remains legacy. file:Lstat@4531,file:Read@219,file:ReadDir@1228,file:ReadDir@2345,file:ReadDir@3461 ac303acaeed159102469d627de12205fa9891ca2237edd3fb0e8bdf76555dbb6 |
| 115 | internal/host/relocationsweep.go sweepRelocationJournals legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent relocation-journal retention checks claim completion and serializes local writes; unrelated journal cleanup remains legacy. file:Lstat@4531,file:Read@219,file:ReadDir@1228,file:ReadDir@2345,file:ReadDir@3461 ac303acaeed159102469d627de12205fa9891ca2237edd3fb0e8bdf76555dbb6 |
| 116 | internal/host/relocationwake.go RelocationWakeInputs.Select authority C Relocation wake binds prepared generation, release receipt and install stamp before admission; launch payload selection remains legacy. registry:DBPath@1130,registry:DBPath@307,registry:Host@267,whole:Route@406 1570672bcc6fd83cbd3f134f4a60474d6dce3b1c41da112794c175dc002a87e1 |
| 117 | @legacy f29ef757ddf3d0f8b8c707dcf3d50aa8a9bdc76ad6eaaae03bb362e87ebd710f internal/host/relocationwake.go RelocationWakeInputs.probe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe-kind precondition controls operation progress; root launch and participation independently recheck authority. file:Exec@298 1f3296cfac33dc2f37f7d2dc6253372fd05fbb485f030667e9d0c598c8c34194 |
| 118 | internal/host/relocationwake.go RelocationWakeInputs.probe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Agent probe-kind precondition controls operation progress; root launch and participation independently recheck authority. file:Exec@298 1f3296cfac33dc2f37f7d2dc6253372fd05fbb485f030667e9d0c598c8c34194 |
| 119 | internal/host/rootinventory.go ClaimRootHTTP.commitRootInventoryPending authority C Root inventory transaction binds fresh claim, canonical record, enrollment and root-created landing row; exact pending intent protects crash replay. file:Read@1038,file:Read@2852,registry:Account@4204,registry:Account@4219,registry:App@4240,registry:App@4251,registry:ClaimIncarnation@3710,registry:ClaimOwner@3760,registry:ClaimOwner@4743,registry:ClaimOwnership@4302,registry:ClaimOwnership@4324,registry:ClaimOwnership@5057,registry:ClaimOwnership@6945,registry:ClaimRowID@3924,registry:ClaimRowID@4001,registry:ClaimStamp@3738,registry:DBPath@4268,registry:DBPath@4282,registry:Host@4174,registry:Host@4186,whole:ClaimOwnership@4306,whole:ClaimOwnership@4334,whole:ClaimOwnership@5067,whole:ClaimOwnership@6956,whole:Route@3032,whole:Route@3415,whole:Route@3431,whole:Route@3486,whole:Route@4137,whole:Route@4150,whole:Route@4159,whole:Route@4397,whole:Route@4629,whole:Route@5305,whole:Route@5441,whole:Route@5665,whole:Route@6789,whole:Route@7823,whole:Route@7884 8035738e2f200bd436be8b06b41c3e1c1cebe1cce2aed1f87cce635da56b2210 |
| 120 | internal/host/rootinventory_install.go ClaimRootHTTP.rootLandingRoute authority C,E3 Root derives flat landing row and settings from authoritative record and app policy after target/phase binding. registry:HoldOp@910,registry:Status@899,whole:Route@949 a448d8536bfec5c5e1889dd5c62d5beeb765d28aa0fb15d6f4ab021bdc027faa |
| 121 | internal/host/rootinventory_install.go landingRegistrationMatches authority C Root landing metadata binds the original op and minted row; checking/configured require the registration session, while later session phases use the freshly bound authoritative current session. registry:ClaimRowID@347,registry:HoldOp@376,registry:Status@414,whole:Route@333 4eec109f01c62aba72b4b1e28611ef7ec558d0c24e1485e5e39a493d2b90f95c |
| 122 | internal/host/rootinventory_install.go rootLandingIdentity authority C Landing target identity binds executor, participants, enrollment and region before first root registration. file:Exec@111 d4d2a5b2c59cf7c008eca7ed34bd835345b7ac1964b8e775f86a78cc6a368302 |
| 123 | internal/host/updatesreport.go updatesReader diagnostic H3 Control-socket updates report adds only tenant-matched consumed decision; it grants no effect. whole:Route@322,whole:Route@468 c83d8a1851e2ed1021f266598010ae9b2a869cc520885d475b4f071891717aeb |
| 124 | internal/host/updatesreport.go updatesReport diagnostic H3 Status report suppresses foreign consumed state and identifies tenant; no effect authority. registry:App@1166,registry:BuildState@900,registry:Host@1507,registry:Host@2320,registry:Host@325,registry:UpdateSettings@267,whole:Route@1156,whole:Route@210,whole:Route@718 79ef627a6d169d06066f87dca67e1ba6921650e79a12815e67c85cbadd905a5f |
| 125 | internal/hostbox/empty_census.go EmptyInstallationCensus.CheckHeld authority C Hold-only source checks its own row-owned installation inventory rather than the target holder stamp. registry:ClaimIncarnation@634,registry:ClaimIncarnation@772,registry:ClaimOwnership@595,registry:ClaimStamp@794,whole:ClaimOwnership@599,whole:ClaimOwnership@948,whole:Route@551 e9ceb6bc30cb39a3ab487bbf457d683df9d19d8d9c95eb3e9711ef9ea6b866e7 |
| 126 | internal/hostbox/empty_census.go EmptyInstallationCensus.CheckLocal authority C Delegates strict empty census with no allowed row; only root registered-row recovery supplies a specific ownership exception. a88fe35cee7ae7fc1f563d0493c884d2ecc39762a19fd0a878b8ac8eb2135c47 |
| 127 | internal/hostbox/empty_census.go EmptyInstallationCensus.CheckRootRegisteredRow authority C Crash census exception admits only the row named by root pending registration; all other census checks remain required. whole:ClaimOwnership@258 45d3fde6e83ab7c50dbe3ec152c2b2995619df1f67bcde3963bd84ee5e52912d |
| 128 | internal/hostbox/empty_census.go EmptyInstallationCensus.checkHeldInventory authority C Held-inventory validator requires exact box/enrollment, ownership and single materialized route. registry:ClaimIncarnation@199,registry:ClaimOwner@498,registry:ClaimRowID@533,registry:ClaimStamp@247 38b2cd6eb0c000143136f9a364f3f0ad952e9379956762fe767315e6a1b4e35c |
| 129 | internal/hostbox/empty_census.go EmptyInstallationCensus.checkLocal authority C,G Complete local census retains absence checks and only excludes explicitly root-registered row during crash recovery. file:Lstat@2576,file:WalkDir@2823,registry:ClaimOwnership@1835,registry:Host@1782,whole:ClaimOwnership@1839,whole:ClaimOwnership@1857,whole:Route@1770,whole:Timer@1999 a187db8c5f4cf1cc11ccf3359a1b43e51045464e21d60e93abe308426c3a022d |
| 130 | internal/hostbox/inventory_registration.go ReconcileAdapter.RegisterLanding authority C Landing client snapshots and registers outside host lock, then revalidates record/claim/revision before activation. file:Exec@275 993b463877d755918417c9295852854cf9968d6c3b053d3fdcb0149184e8a2d2 |
| 131 | internal/hostbox/inventory_registration.go ReconcileAdapter.installRemote authority C Remote install snapshots old source inventory outside host lock and rechecks revision in hold-only path. registry:ClaimIncarnation@362,registry:ClaimOwnership@1134,registry:ClaimOwnership@286,registry:ClaimOwnership@899,registry:ClaimOwnership@925,registry:ClaimStamp@391,whole:ClaimOwnership@1138,whole:ClaimOwnership@290,whole:ClaimOwnership@907,whole:ClaimOwnership@929,whole:Route@272,whole:Route@881 b4fdb86e212751ec7f06edcec5ecf6a9083b7b0fa6443aa753225b991f7faf78 |
| 132 | internal/hostbox/journalservice.go JournalService.execute authority C,D Delegates journal transaction with original request hashing; root-generated inventory substitution uses the separate internal entry point. 596b38bdf87ca5ff7ba05eedb8ebc6a731aa867e973bd2ee8f1634a56d8668c4 |
| 133 | internal/hostbox/journalservice.go JournalService.executeWithInventory authority C Journal transaction preserves original request hash while persisting independently derived root inventory and durable replay receipt. file:Create@2671,file:QueryRowContext@1684,file:QueryRowContext@672 832a2843c21da75fec4afd31f60aa5914b23c0712be54decc63ab8e6bb31fb8f |
| 134 | internal/hostbox/reconcile.go Reconciler.completedHold authority C Completed relocation catch-up can hold only its recorded old source row and creates no installation authority. file:Exec@195 bb465dd9808210b5adafd632fab96398397f07b7999e2f9d62164944489eca7d |
| 135 | internal/hostbox/reconcile.go Reconciler.holdOnly authority C Hold-only write rechecks claim, record and source inventory under local lock without root RPC there. file:Read@226 34f8c4d766fb96c45f76bbc03e3928931c1d936a4aa0c421a2d6e4e243ba15a3 |
| 136 | internal/hostbox/reconcile.go Reconciler.installWithWork authority C Install dispatch preserves serving registration and distinguishes hold-only relocation from installation. file:Exec@1240,file:Read@392 33b572dc3d074dca32de02eef054cf5b5d598cdbd7019882dd71490b46dbf9d9 |
| 137 | internal/hostbox/reconcile_adapter.go ReconcileAdapter.Install authority C Reconcile adapter binds record and routes landing mint through root registration while preserving existing typed ownership paths. file:Read@1846,registry:Status@1764,whole:Route@1768,whole:Route@988 85159551758a6ff462c23900bf91d6f8ba909df15d0cef7df88205ffd1c4a59d |
| 138 | internal/hostbox/reconcile_adapter.go ReconcileAdapter.MintHeld authority C Local held-row mint requires matching nested installation ownership and operation; production remote path uses separate registration. registry:ClaimOwnership@1058,registry:ClaimOwnership@895,registry:HoldOp@1088,registry:HoldOp@926,registry:Status@1077,registry:Status@963,whole:ClaimOwnership@1061,whole:ClaimOwnership@1100,whole:ClaimOwnership@899,whole:ClaimOwnership@917,whole:Route@1050,whole:Route@1145,whole:Route@551,whole:Route@876 9cd891a04a25fe2df9308a4cf67b536796d3329d4ebfca5b945778d86e8fbfb6 |
| 139 | internal/hostbox/reconcile_adapter.go ReconcileAdapter.MintHeldUnder authority C Remote held mint registers outside selected work, revalidates under work and checks exact held-row ownership. registry:ClaimOwnership@1581,registry:ClaimOwnership@1744,registry:HoldOp@1612,registry:HoldOp@1774,registry:Status@1649,registry:Status@1763,whole:ClaimOwnership@1585,whole:ClaimOwnership@1603,whole:ClaimOwnership@1747,whole:ClaimOwnership@1786,whole:Route@1562,whole:Route@1736,whole:Route@1831,whole:Route@821 27240c4e61e96556faf260722f87a208b0e1261f47103692367b704fb1e0b262 |
| 140 | internal/hostbox/reconcile_adapter.go ReconcileAdapter.ownedRow authority C Extracted row writer retains complete typed inventory and immutable route identity around guarded write. file:Read@1570,file:Read@386,registry:ClaimOwner@1390,registry:ClaimOwner@1881,registry:ClaimOwnership@2206,registry:ClaimOwnership@2416,registry:ClaimRowID@1482,registry:ClaimRowID@1621,registry:ClaimRowID@1772,registry:ClaimRowID@1852,whole:ClaimOwnership@2210,whole:ClaimOwnership@2228,whole:ClaimOwnership@2291,whole:ClaimOwnership@2420,whole:ClaimOwnership@2438,whole:Route@2090,whole:Route@2192,whole:Route@2329,whole:Route@2402 4c7bb0f04b76406b4695dd157d80f7c9529a2fe7a29a328cf4f00464780ff164 |
| 141 | internal/hostbox/relocationrows.go RelocationRow authority C Relocation row decision consumes root admission-fence view and exact claim participation; grants no first registration itself. file:Exec@360 57c03db853eddee3f8e55a90b0b4b426047bcbd2f16765af4328e01cb7394b16 |
| 142 | @legacy 93559c3c6813b66927e13f5f8e467c86f7eaca05a96add686f9a5a41f199aa20 internal/hostbox/relocationsource.go RegistryHoldRow legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Conditional agent registry hold preserves existing operation ownership and never creates or releases a row. registry:HoldOp@457,registry:HoldOp@527,registry:HoldOp@622,registry:Status@493,whole:Route@359 58297e213e8114802b6044552a6b56b52b18c343b19df3d8288b381515dc7f6a |
| 143 | internal/hostbox/relocationsource.go RegistryHoldRow legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Conditional agent registry hold preserves existing operation ownership and never creates or releases a row. registry:HoldOp@457,registry:HoldOp@527,registry:HoldOp@622,registry:Status@493,whole:Route@359 58297e213e8114802b6044552a6b56b52b18c343b19df3d8288b381515dc7f6a |
| 144 | @legacy f90594be87be292d38a95e3cf8d087dffffdded5a759c4c3892d9592382ee4e8 internal/hostclaim/delete.go BeginDelete legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Delete transition now carries verified completion-fence exception; general console lifecycle transition remains legacy. file:Exec@460,file:Exec@599 16df43063ca3db94afa3de1e8599b8c8ea2b7d171d888697ca521db5588a0192 |
| 145 | internal/hostclaim/delete.go BeginDelete legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Delete transition now carries verified completion-fence exception; general console lifecycle transition remains legacy. file:Exec@460,file:Exec@599 16df43063ca3db94afa3de1e8599b8c8ea2b7d171d888697ca521db5588a0192 |
| 146 | @legacy 7c0deb8792eb236708998d4e7f0cfaac98ed9933348787a38fdcdc030c9a4d5e internal/hostclaim/generation.go AdmitWriter legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Writer admission adds relocation prepared-opening and origin-chain commit; authoritative control-store state machine is preserved, outside local-root trust rewrite. file:Exec@207,file:Exec@226 cd3a453584d64627a8641548634dc9087cb941eade5d894e22b7747c799929a6 |
| 147 | internal/hostclaim/generation.go AdmitWriter legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Writer admission adds relocation prepared-opening and origin-chain commit; authoritative control-store state machine is preserved, outside local-root trust rewrite. file:Exec@207,file:Exec@226 cd3a453584d64627a8641548634dc9087cb941eade5d894e22b7747c799929a6 |
| 148 | @legacy d791e8a8f59cc90ca130dc7d7bf3ebcc02a4c31826831468e31106af1f0b67f2 internal/hostclaim/move.go BeginMove legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Move start explicitly supplies no completion-fence exception; general operation transition remains legacy. file:Exec@424,file:Exec@528,file:Exec@644 276313b8e7322fca41563edd76426e2967b71a3e5e103159b460c987413d63d5 |
| 149 | internal/hostclaim/move.go BeginMove legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Move start explicitly supplies no completion-fence exception; general operation transition remains legacy. file:Exec@424,file:Exec@528,file:Exec@644 276313b8e7322fca41563edd76426e2967b71a3e5e103159b460c987413d63d5 |
| 150 | @legacy b89ec1548d50a21a5de2650d1414195379ea273608960bcf4d76b54c232f05bb internal/hostclaim/origins.go OriginProofCache.Proven legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Plan 15 origin proof authenticates exact tuple set against fresh claim and bounded chain; separate reviewed origin-proof scope is preserved. file:Read@703 aaed67984028cc532f32fdc8d2fd9fa9cbec528b186e40702013e0893f84d663 |
| 151 | internal/hostclaim/origins.go OriginProofCache.Proven legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Plan 15 origin proof authenticates exact tuple set against fresh claim and bounded chain; separate reviewed origin-proof scope is preserved. file:Read@703 aaed67984028cc532f32fdc8d2fd9fa9cbec528b186e40702013e0893f84d663 |
| 152 | @legacy 01d84bed40038c978a869e5302b24b0ad9691bfb96713caf5d5e69bde7ad3c8e internal/hostclaim/origins.go commitOrigins legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Origin-chain commit binds stored admission and content-addressed node before CAS; separate Plan 15 protocol remains legacy here. file:Read@884 2d3a27e56510db9ec2d54d85b354f72b72da1080c7b4182535040f2d30e36888 |
| 153 | internal/hostclaim/origins.go commitOrigins legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Origin-chain commit binds stored admission and content-addressed node before CAS; separate Plan 15 protocol remains legacy here. file:Read@884 2d3a27e56510db9ec2d54d85b354f72b72da1080c7b4182535040f2d30e36888 |
| 154 | @legacy c53abee56a0abcfe58e62e38493d9b2f6d53afc568a521041787bc485b348183 internal/hostclaim/origins.go readOriginBytes legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded streaming origin-node read supports Plan 15 proof; unrelated remote payload transport remains legacy. file:ReadAll@401 89b51dae079634c3e5dc381d37243eb88b9543049dcd53badd35c95328c8d210 |
| 155 | internal/hostclaim/origins.go readOriginBytes legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded streaming origin-node read supports Plan 15 proof; unrelated remote payload transport remains legacy. file:ReadAll@401 89b51dae079634c3e5dc381d37243eb88b9543049dcd53badd35c95328c8d210 |
| 156 | internal/hostclaim/relocating.go ConvertCommittedLanding authority C Committed landing conversion verifies exact target termination fence and record commit before transferring installation authority. file:Exec@2521,file:Exec@4369,file:Exec@919 7a2fb9a5ceefa614440a208d78806cf031aaa49d125962b089c545a5ad55b573 |
| 157 | @legacy 48a2feb65ac5107e61bdc8902716d1e5393efbce131d057a136f02ffd4f335ec internal/hostclaim/relocation.go BeginProbeAttempt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim transition counts bounded per-executor probe attempts; operation retry budget is outside root lease/history scope. file:Exec@213 502bbaa5ca758b45d15bd8719d16734b29d0ca612401200966f8bd47180490b5 |
| 158 | internal/hostclaim/relocation.go BeginProbeAttempt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim transition counts bounded per-executor probe attempts; operation retry budget is outside root lease/history scope. file:Exec@213 502bbaa5ca758b45d15bd8719d16734b29d0ca612401200966f8bd47180490b5 |
| 159 | internal/hostclaim/relocation.go CompleteRelocation authority C Completion requires stopped probe and retains exact stop reference for successor cold handover while queuing prior installations for retirement. file:Exec@2587,file:Exec@268,file:Exec@676 6c92362569ee7ea89c3c35ae6fdaac781a0119d33f5345876d6d58ad2deb56a2 |
| 160 | internal/hostclaim/relocation.go FenceSource authority C Source-loss transition independently verifies termination fence and enrollment before revoking its participation. file:Exec@1171 4e110507dc4d3476e237826b0557b14785a6ca306714e95a0df84e1bc4637596 |
| 161 | internal/hostclaim/relocation.go JournalRelease authority C Release transition binds executor session, enrollment and immutable stop receipt reference; replication position payload remains legacy. file:Exec@362 ee14233f2530932761e8075a73ee51d7c1fecd51be7561151e0168de4c661e89 |
| 162 | @legacy 8710f696793184183b4d82d886fd67f0d463102bcc74731d4b7a6612d9ad284a internal/hostclaim/relocation.go NameTarget legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Target choice transition preserves placement and replacement limits; target eligibility remains outside scoped root trust work. file:Exec@247 09bd972b38167dcc819b9da540a6089d1f39d93dd5ccf3d75a3cf10515f122f0 |
| 163 | internal/hostclaim/relocation.go NameTarget legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Target choice transition preserves placement and replacement limits; target eligibility remains outside scoped root trust work. file:Exec@247 09bd972b38167dcc819b9da540a6089d1f39d93dd5ccf3d75a3cf10515f122f0 |
| 164 | internal/hostclaim/relocation.go PinAfterRelease authority C Pin transition verifies source release authority and exact journal phase before removing execution authority. file:Exec@1456,file:Exec@804 bd1bc839ba913371b1c65b2dacbbd6f0e1c8aacfc850c2184509e5a566a44d67 |
| 165 | internal/hostclaim/relocation.go PinFailover authority C Failover pinning requires recorded source fence and completed acknowledgement barrier. file:Exec@250 c74fb03217235b144ee114a32015e448f2e267e72b29f4e22541089beebbebde |
| 166 | @legacy 81f876e6f1bcbf6c50a9fd5368e9d3d67b270d2094c66f4e4de70b2d61d8d512 internal/hostclaim/relocation.go RecordProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Operation probe result records exact executor session; does not write root D3 health history. file:Exec@287 f74252ec34fb712db80df0d232c0c462ba6d2a0a1ac75381e98c718d35f0e213 |
| 167 | internal/hostclaim/relocation.go RecordProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Operation probe result records exact executor session; does not write root D3 health history. file:Exec@287 f74252ec34fb712db80df0d232c0c462ba6d2a0a1ac75381e98c718d35f0e213 |
| 168 | internal/hostclaim/relocation.go ReplaceTarget authority C Replacement verifies target termination fence and allocates a new install stamp, preserving unopened prepared build reuse. file:Exec@1997 31150667b62f371885603375fdee9b1fad2db9829954c1b628e27a8b42065a90 |
| 169 | internal/hostclaim/relocation.go StartRelocation authority C Relocation start binds verified failover fence, source/target enrollments and authoritative operation tuple; placement choice remains legacy. file:Exec@1646,file:Exec@2220 ea91a0180df0eabfcc3a25808e9940a44932e899c61cd95c3f2d590266750ee4 |
| 170 | internal/hostclaim/relocation.go ToProbing authority C Probe transition requires exact local-install receipt at target enrollment and install stamp before admission. file:Exec@347 fb71913551aef5ae0ee9599c7b98191292dfdb7ece52354f65010c6251456e12 |
| 171 | internal/hostclaim/relocation.go fenceTargetStuck authority C Exhausted-target transition verifies fence and revokes only dead target execution, preserving another live source. file:Exec@1397,file:Exec@1417,file:Exec@1834 7faed2f82e1becdda0a464599f42dd9afdd3ad295264ec9f219f0056da56a467 |
| 172 | internal/hostclaim/relocation.go install authority C Install transition allocates authoritative stamp and pinned release, records target before effects and removes prior local receipt. file:Exec@416 ff1edbe113cf4925e2a2dca14e122e8d55c7f956ce6129be22b1572fa27a5bac |
| 173 | internal/hostclaim/relocation.go requireReceiptOfInstallation authority C Receipt guard binds target, enrollment, install stamp and digest and refuses remaking opened prepared generation. file:Exec@164 135df8ec21e8617af76049bc5e31e5def11034964f5795dfc161c301644d5bf3 |
| 174 | internal/hostclaim/relocation_probestop.go RecordProbeStop authority C Probe-stop transition binds exact passed session and immutable receipt reference for later root handover verification. file:Exec@257 0cf617acd126add57ea1c8cff5e201b2ca270d141af1f57b2b33eacc1a24cba0 |
| 175 | @legacy 8d24cd3563249f4db28b4fd407c0a3dd66ca049313e807494e4cf593a9961e4b internal/hostclaim/store.go Update legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim CAS adds Plan 15 origin commit and fresh-head validation; general authoritative store writer remains preserved legacy scope. file:Read@816 083ddd3e076a07db2b5fca70a9b56fa022782deafb9ad56c77f8f32515633906 |
| 176 | internal/hostclaim/store.go Update legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim CAS adds Plan 15 origin commit and fresh-head validation; general authoritative store writer remains preserved legacy scope. file:Read@816 083ddd3e076a07db2b5fca70a9b56fa022782deafb9ad56c77f8f32515633906 |
| 177 | @legacy 72029b11bea403e9e9b1a09b148305eed3b3a885c368b3a301062d50f6fcc8b0 internal/hostfiles/dir_unix.go handleOf legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Descriptor-to-directory helper validates payload sync root; generic file replication handling remains legacy. file:Stat@143 6c597c29a0f41e2f82f402197e2c5cb124cd3333173ab46fa95fefbdbe2882d2 |
| 178 | internal/hostfiles/dir_unix.go handleOf legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Descriptor-to-directory helper validates payload sync root; generic file replication handling remains legacy. file:Stat@143 6c597c29a0f41e2f82f402197e2c5cb124cd3333173ab46fa95fefbdbe2882d2 |
| 179 | @legacy 9c7ae33e014d98fb0a2e72c4196d587e3031c052aa33ecc5dbabc4d9c663e127 internal/hostfiles/present.go presentFile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Payload presence hashes bounded descriptor bytes against manifest; it does not establish root installation absence. file:Stat@493 94002247a4d440c159d7c0772e8127cf2d337e968fdcdca3c9889f8e2be1ecec |
| 180 | internal/hostfiles/present.go presentFile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Payload presence hashes bounded descriptor bytes against manifest; it does not establish root installation absence. file:Stat@493 94002247a4d440c159d7c0772e8127cf2d337e968fdcdca3c9889f8e2be1ecec |
| 181 | @legacy 1dc1cb5911e8bdc702f524137be2e9ea7af9043f1b15dbb6409361dc15e5a5cf internal/hostfiles/publisher.go Open legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=File publisher refuses manifests above path cap; generic remote files publishing remains legacy. file:Open@5 6aa7d313ab0ca6c9bf4090c7a7895e5d704b802b62f88fa45899b73b6452b688 |
| 182 | internal/hostfiles/publisher.go Open legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=File publisher refuses manifests above path cap; generic remote files publishing remains legacy. file:Open@5 6aa7d313ab0ca6c9bf4090c7a7895e5d704b802b62f88fa45899b73b6452b688 |
| 183 | @legacy e1e38d9e7b4b1e5af1259c616f2237c5b9542fa418ed89163c884a9fc68f6a9b internal/hostfiles/restore.go Restore legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Restore delegates to shared descriptor-root implementation; generic payload restoration remains legacy. file:OpenRoot@214 d9db5a20ded793a177c64371612379c4c5fde9cd517e2a9ae5c411800a1e1ecb |
| 184 | internal/hostfiles/restore.go Restore legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Restore delegates to shared descriptor-root implementation; generic payload restoration remains legacy. file:OpenRoot@214 d9db5a20ded793a177c64371612379c4c5fde9cd517e2a9ae5c411800a1e1ecb |
| 185 | @legacy 4f2acc7bb7b2c481c15b9e44eca0e9b62260eeb148a21606cc1cc7aa9b13e009 internal/hostfiles/restore.go var syncDir legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Restore directory sync uses nonblocking no-follow directory flags; generic payload durability remains legacy. file:OpenFile@65 12c83fbec42baa20664afdfdaafb01779d7f65c396f97c1ab8af9d3fae45ca13 |
| 186 | internal/hostfiles/restore.go var syncDir legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Restore directory sync uses nonblocking no-follow directory flags; generic payload durability remains legacy. file:OpenFile@65 12c83fbec42baa20664afdfdaafb01779d7f65c396f97c1ab8af9d3fae45ca13 |
| 187 | internal/hostguard/guard.go Guard.With authority C,G Shared guarded selection delegates root or agent fence authority and preserves lock ordering. c1c71072b906a23fa9ef45a1e106c87dbbac6e548dbe19d2acefd44ddfb7a9cc |
| 188 | internal/hostops/completion_fence.go ProductionAuthority.completionFence authority C Completion-fence exception independently verifies enrolled box termination before bypassing completion barrier for deletion. file:Read@340 7e27c2647de02c9bfab17f86c2929bb04b85e7b4ea770fe2dfcd8d0538690a3a |
| 189 | @legacy 4415ae6d5934b4d29b16f7795ad3e14e918665c042879fd6b5de8af418215b6d internal/hostops/executor.go ExecutorChooser.eligible legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Executor eligibility combines verified roster, termination fences, load and scope; generic placement remains legacy. file:Read@777 d45c8841cabf23fbf7fac3159cdf904509176ceac4d5b867f8620a999eb05ea0 |
| 190 | internal/hostops/executor.go ExecutorChooser.eligible legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Executor eligibility combines verified roster, termination fences, load and scope; generic placement remains legacy. file:Read@777 d45c8841cabf23fbf7fac3159cdf904509176ceac4d5b867f8620a999eb05ea0 |
| 191 | @legacy 3be04210d0e009d58ab40ff64a9c86a1bb30bf33f423c021d5cce8cde4182de5 internal/hostops/loads.go ClaimLoads legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim load aggregation feeds placement balance; unread hosts are logged and skipped without root authority effects. file:Exec@409,file:Exec@436,file:Exec@494,file:Read@243 b5997b9871e131cd430ea78bf642af946705a5eade49a71de6c46f66c18d73bf |
| 192 | internal/hostops/loads.go ClaimLoads legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Claim load aggregation feeds placement balance; unread hosts are logged and skipped without root authority effects. file:Exec@409,file:Exec@436,file:Exec@494,file:Read@243 b5997b9871e131cd430ea78bf642af946705a5eade49a71de6c46f66c18d73bf |
| 193 | internal/hostops/move_fence_release.go MoveRecoveryGrant.ReleaseFencedTarget authority C,D Public release wrapper delegates verified target-fence release and returns its typed outcome; record-first close remains in the reviewed implementation. e9dde5e0751bc835f0368616d46fffebe77ec2a84149717b403b2733dbe4f28f |
| 194 | @legacy d123481dce1b289d4b4ed616b0cb75b65e2aeff2d630919100e74b17a2e9141f internal/hostops/operations.go Controller.Attempt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Create controller records one executor choice before CAS; generic console creation remains legacy. file:Create@899 518d0f8375c7f414c34250de05e4db93683ee04b9251b8075c729982d801425b |
| 195 | internal/hostops/operations.go Controller.Attempt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Create controller records one executor choice before CAS; generic console creation remains legacy. file:Create@899 518d0f8375c7f414c34250de05e4db93683ee04b9251b8075c729982d801425b |
| 196 | @legacy 538d217e2fafbe842a308309c9817294bb3edcb7241c520aa8073c8f39cb65f7 internal/hostops/operations.go Controller.BeginRetire legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Nonproduction delete dispatch supplies no completion-fence exception; unchanged lifecycle authority remains legacy. file:Read@473 7ba749e93ef83f99e3fd02433305a71ba75770f686d6ac39bf60a37cecae48d1 |
| 197 | internal/hostops/operations.go Controller.BeginRetire legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Nonproduction delete dispatch supplies no completion-fence exception; unchanged lifecycle authority remains legacy. file:Read@473 7ba749e93ef83f99e3fd02433305a71ba75770f686d6ac39bf60a37cecae48d1 |
| 198 | internal/hostops/operations.go type Authority diagnostic H3 Interface declaration adds executor selection contract; schema only, no read executes here. file:Create@603 69b7a8329655d091d6ce1b31a1e870b892607382cb0468e71d0572d4ce14da7c |
| 199 | @legacy be84c56472b5d6318b86b620b1dbfa16c000e66827b51d2920edc27a1a327c1f internal/hostops/production_create.go ProductionAuthority.StartCreate legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Production create passes claim observation into executor choice; console placement remains legacy. file:Create@1276,file:Create@771 192bdf6cc5cf524b09ed437d9ed825c99128eb184815e3b1f07198355c6b247e |
| 200 | internal/hostops/production_create.go ProductionAuthority.StartCreate legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Production create passes claim observation into executor choice; console placement remains legacy. file:Create@1276,file:Create@771 192bdf6cc5cf524b09ed437d9ed825c99128eb184815e3b1f07198355c6b247e |
| 201 | @legacy 5e9a624e39d2127d7a21c9d7ca3571a479e72a21b0f090ad45599c8b098c966f internal/hostops/production_create.go ProductionAuthority.selectExecutor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Chosen executor is checked against namespace/pool/enrollment candidates; generic placement remains legacy. file:Exec@2237,file:Read@2084,file:Read@675 0d9ec59be2911c8de3036d2fbcbb8c787fce9ed06527039eb1fdaf37d2652dd3 |
| 202 | internal/hostops/production_create.go ProductionAuthority.selectExecutor legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Chosen executor is checked against namespace/pool/enrollment candidates; generic placement remains legacy. file:Exec@2237,file:Read@2084,file:Read@675 0d9ec59be2911c8de3036d2fbcbb8c787fce9ed06527039eb1fdaf37d2652dd3 |
| 203 | internal/hostops/production_delete.go ProductionAuthority.StartDeleteClaim authority C Production delete obtains verified completed-box fence before permitting claim transition across completion barrier. file:Read@683 c63571065559a1d09ef6c5e660043ea158818ae4c44d39a88263e995e4b3c57c |
| 204 | @legacy fdcc11b3c0aee294dbaff1c1e0d672249364cebf5af9c56a9b4df03db38dd0f7 internal/hostops/purge.go BeginPlacement legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Placement explicitly refuses completion-fence exception; generic placement transition remains legacy. file:Exec@390,file:Exec@396 4e71e55ed138d5cecd4fa8e27eef79fa9fd2138f029ee3d80dd1251610d5b825 |
| 205 | internal/hostops/purge.go BeginPlacement legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Placement explicitly refuses completion-fence exception; generic placement transition remains legacy. file:Exec@390,file:Exec@396 4e71e55ed138d5cecd4fa8e27eef79fa9fd2138f029ee3d80dd1251610d5b825 |
| 206 | @legacy cde3ef0427644dba60c278c1516b7f9007290e8f5f169916d12d9f0961e832c3 internal/hostops/purge.go BeginPurge legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Purge passes separately verified completion-fence evidence through existing start guard; broad purge lifecycle remains legacy. file:Exec@417,file:Exec@423 7b478df842b9fa2f40233c1139b39d0147578055891c13d8bb54d2a38886783e |
| 207 | internal/hostops/purge.go BeginPurge legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Purge passes separately verified completion-fence evidence through existing start guard; broad purge lifecycle remains legacy. file:Exec@417,file:Exec@423 7b478df842b9fa2f40233c1139b39d0147578055891c13d8bb54d2a38886783e |
| 208 | internal/hostrelocate/participant.go Participant.Step authority C,D Participant re-reads claim and installation identity around effects; root stop receipts and fresh participation bound probes, with generic orchestration retained. file:Exec@1181,file:Read@1612,file:Read@247,file:Read@6531 82352989c52e7400d870f6f2b0f760be73587b45181248fdf611c822b3360fb7 |
| 209 | internal/hostrelocate/participant.go Participant.Sweep authority C,D Sweep reads fresh claim before retiring a participant; absence never manufactures a local discharge. file:Read@296 b6dd6b151bc6883778b3c97541976073067673702132c7ebd82c0c616dd26a0f |
| 210 | @legacy b7ba3d10dc7c69783c7d86538b2d81e6d69ca90982a9ae1891d96ea81498ae90 internal/hostrelocate/participant.go Participant.recordProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Probe-result journal update uses fresh claim; generic retry/progress bookkeeping remains outside root history authority. file:Read@139 64b4da2512afdc9c95acc11efea8d8329de64301c70ce6f3507c2af1aeb3d089 |
| 211 | internal/hostrelocate/participant.go Participant.recordProbe legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Probe-result journal update uses fresh claim; generic retry/progress bookkeeping remains outside root history authority. file:Read@139 64b4da2512afdc9c95acc11efea8d8329de64301c70ce6f3507c2af1aeb3d089 |
| 212 | internal/hostrelocate/participant.go Participant.sameInstallation authority C Installation comparison binds fresh operation, executor, phase, prepared object, incarnation, stamp and session. file:Exec@366,file:Read@142 a093d83ebaa1deaee5c869c19ffd10a845f07a329a1513362616cd7f540713f9 |
| 213 | internal/hostrelocate/worker.go Worker.ConvertLanding authority C Landing conversion requires verified local worker and termination-fence authority before claim conversion. file:Exec@526 bf1123e98c6f19cd185df3e302dc9993462fa949979c391d206ec686a25a3c6a |
| 214 | internal/hostrelocate/worker.go Worker.Start authority C,D Relocation start binds verified worker and source/target identity, checks termination fence and discharge; placement policy stays legacy. file:Exec@418,file:Read@263 e54d4e653365d56c129e681978da6f4d9462a8206c6e343cca4b2dbba9aa2216 |
| 215 | internal/hostrelocate/worker.go Worker.Step authority C,D Worker transitions revalidate claim and fence and consume verified root stop receipts; generic transition timing remains legacy. file:Exec@2084,file:Exec@3062,file:Exec@5974,file:Exec@7191,file:Read@249 d88281277c0d646d2c4109a869fa585e679fec6b35e7784fedf2a3294e15e782 |
| 216 | @legacy eaa361197ef14d0691b7e10b4aa501e28a86ac8d11ec342bc903becf434317c0 internal/hostrelocate/worker.go Worker.releaseOverdue legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Overdue release records a stuck operation from authoritative timestamps; this is operation timeout bookkeeping, not a root execution lease. file:Exec@419 3e0ef9c7c4796ef1f8c40dabd207437c78b31f0895423df7587c25fef10c9c0a |
| 217 | internal/hostrelocate/worker.go Worker.releaseOverdue legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Overdue release records a stuck operation from authoritative timestamps; this is operation timeout bookkeeping, not a root execution lease. file:Exec@419 3e0ef9c7c4796ef1f8c40dabd207437c78b31f0895423df7587c25fef10c9c0a |
| 218 | internal/hostrelocate/worker.go Worker.self authority C,D Worker identity requires current active directory enrollment, home-region match and termination-fence check. file:Read@84 3a9d0a6b1e1717ee940201a6c583716c092a8e7b3c42fae5ca74834cb616c88b |
| 219 | internal/instancectl/server.go runWithClaim authority C,D,G Claim instance controller adds held-release RPC dispatch within existing launch/participation execution boundary. data-literal@1453,file:CommandContext@623,file:CommandContext@801,file:Statfs@1474 9ffd703746e7f88781ca5892378c242508249507a91fa06985b66c997b4e762b |
| 220 | internal/instancectl/server.go type Server diagnostic H3 Server field declaration carries handler types only; no authority decision executes in this declaration. file:Statfs@2708 b99d029e7cf5519ddecff072d9f469139a71aec3a674687e1fafef4b47706882 |
| 221 | internal/instancefs/instancefs.go ReadBeneathLimit hint H3 Delegates bounded payload reading; returned bytes require caller validation and do not grant authority. 3158dcc886b9c700448c128fe4f4568909156a2efd505f5f66569065f63ad3c3 |
| 222 | @legacy 9958caf95d6c736a947119e066ec6391f2a70149e08f1b67d240f84cceef9f58 internal/instancefs/instancefs.go readLimit legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded payload reader rejects oversized input; generic instance payload transport remains outside root authority families. file:ReadAll@80 58f221e7b9e5d6d4ef944b4896f1ba41ee78b242fe3cb79ad32f59da421ab147 |
| 223 | internal/instancefs/instancefs.go readLimit legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Bounded payload reader rejects oversized input; generic instance payload transport remains outside root authority families. file:ReadAll@80 58f221e7b9e5d6d4ef944b4896f1ba41ee78b242fe3cb79ad32f59da421ab147 |
| 224 | internal/instancefs/instancefs_linux.go OpenBeneath hint H3 Delegates descriptor-safe payload opening; the path does not grant a root action. 087cc70ea26d269cd0607281077e62ae8919b636df49b3a3c76ccdcb88d7e40e |
| 225 | @legacy cadd3722b1b634c3759b0c516b74a76de1158200e53bbf4faae38248c14ef5fc internal/instancefs/instancefs_linux.go OpenRootBeneath legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Descriptor-relative payload root opener prevents symlink traversal; generic payload filesystem helper is not an independent authority grant. file:OpenRoot@184 612a90e841b7071ef67b7b9868b54e0d0b27f0e4c0cf6351db10ed1b348118df |
| 226 | internal/instancefs/instancefs_linux.go OpenRootBeneath legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Descriptor-relative payload root opener prevents symlink traversal; generic payload filesystem helper is not an independent authority grant. file:OpenRoot@184 612a90e841b7071ef67b7b9868b54e0d0b27f0e4c0cf6351db10ed1b348118df |
| 227 | @legacy f2702ca9cc41ddcb5552332f8077f200ce07d0e68bb4804787f5157884ec7762 internal/instancefs/instancefs_linux.go openAt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Openat2 payload helper checks descriptor type and no-follow flags; generic safe payload IO remains legacy. file:Fstat@681,file:Openat2@253 3c1584031b45c0fa3863972864b3d112a210fc4ab779e89398655c39d0ed7021 |
| 228 | internal/instancefs/instancefs_linux.go openAt legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Openat2 payload helper checks descriptor type and no-follow flags; generic safe payload IO remains legacy. file:Fstat@681,file:Openat2@253 3c1584031b45c0fa3863972864b3d112a210fc4ab779e89398655c39d0ed7021 |
| 229 | @legacy e964026d5155201e04d584319ed6f71a96ab0202b0bd8eb6928595c3a8d5c6b5 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Provision reconcile calls exported RouteFor after helper rename; broad provisioning and route convergence remain outside targeted root scope. registry:Account@17339,registry:Account@18431,registry:Account@31147,registry:Account@31193,registry:App@17312,registry:App@18404,registry:App@31167,registry:App@31205,registry:ClaimOwnership@17926,registry:DBPath@23258,registry:DBPath@23273,registry:DBPath@23519,registry:DBPath@24050,registry:DBPath@24063,registry:Gate@21067,registry:Gate@21207,registry:Gate@21472,registry:Hibernate@20045,registry:Hibernate@20363,registry:Hibernate@20714,registry:Hibernate@21002,registry:Host@12707,registry:Host@31125,registry:Host@31293,registry:Host@31408,registry:Host@31753,registry:Host@31850,registry:Host@31986,registry:Host@32144,registry:Host@32246,registry:Kind@18068,registry:Kind@18331,registry:Kind@23176,registry:Kind@23189,registry:Kind@23299,registry:Kind@23312,registry:Kind@23961,registry:Kind@23972,registry:Kind@30361,registry:Kind@31977,registry:Kind@32135,registry:Kind@32237,registry:Pool@30453,registry:Provisioned@17288,registry:Provisioned@18380,registry:Provisioned@30411,registry:Region@30442,registry:Replication@20448,registry:Replication@20575,registry:Seed@21678,registry:Socket@23224,registry:Socket@23239,registry:Socket@23536,registry:Socket@24020,registry:Socket@24033,registry:Unit@23142,registry:Unit@23155,registry:Unit@23987,registry:Unit@23998,whole:ClaimOwnership@17929,whole:ClaimOwnership@17946,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13197,whole:Route@13946,whole:Route@14302,whole:Route@14311,whole:Route@14357,whole:Route@16933,whole:Route@17404,whole:Route@17414,whole:Route@17771,whole:Route@17778,whole:Route@17846,whole:Route@18169,whole:Route@18812,whole:Route@20135,whole:Route@23368,whole:Route@24847,whole:Route@24892,whole:Route@24902,whole:Route@25765,whole:Route@26517,whole:Route@29809,whole:Route@30478,whole:Route@32057 49532dc978a617588559a3150fc87441e2fab5262b2627b24dadd1321e2f96e4 |
| 230 | internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Provision reconcile calls exported RouteFor after helper rename; broad provisioning and route convergence remain outside targeted root scope. registry:Account@17339,registry:Account@18431,registry:Account@31147,registry:Account@31193,registry:App@17312,registry:App@18404,registry:App@31167,registry:App@31205,registry:ClaimOwnership@17926,registry:DBPath@23258,registry:DBPath@23273,registry:DBPath@23519,registry:DBPath@24050,registry:DBPath@24063,registry:Gate@21067,registry:Gate@21207,registry:Gate@21472,registry:Hibernate@20045,registry:Hibernate@20363,registry:Hibernate@20714,registry:Hibernate@21002,registry:Host@12707,registry:Host@31125,registry:Host@31293,registry:Host@31408,registry:Host@31753,registry:Host@31850,registry:Host@31986,registry:Host@32144,registry:Host@32246,registry:Kind@18068,registry:Kind@18331,registry:Kind@23176,registry:Kind@23189,registry:Kind@23299,registry:Kind@23312,registry:Kind@23961,registry:Kind@23972,registry:Kind@30361,registry:Kind@31977,registry:Kind@32135,registry:Kind@32237,registry:Pool@30453,registry:Provisioned@17288,registry:Provisioned@18380,registry:Provisioned@30411,registry:Region@30442,registry:Replication@20448,registry:Replication@20575,registry:Seed@21678,registry:Socket@23224,registry:Socket@23239,registry:Socket@23536,registry:Socket@24020,registry:Socket@24033,registry:Unit@23142,registry:Unit@23155,registry:Unit@23987,registry:Unit@23998,whole:ClaimOwnership@17929,whole:ClaimOwnership@17946,whole:Route@12689,whole:Route@12700,whole:Route@12718,whole:Route@13197,whole:Route@13946,whole:Route@14302,whole:Route@14311,whole:Route@14357,whole:Route@16933,whole:Route@17404,whole:Route@17414,whole:Route@17771,whole:Route@17778,whole:Route@17846,whole:Route@18169,whole:Route@18812,whole:Route@20135,whole:Route@23368,whole:Route@24847,whole:Route@24892,whole:Route@24902,whole:Route@25765,whole:Route@26517,whole:Route@29809,whole:Route@30478,whole:Route@32057 49532dc978a617588559a3150fc87441e2fab5262b2627b24dadd1321e2f96e4 |
| 231 | internal/provision/reconcile.go RouteFor authority C,E3 Canonical record-to-route construction is now also used by root landing registration, deriving path and update policy independently of agent rows. registry:Addr@1233,registry:Addrs@1242,registry:DBPath@1181,registry:DBPath@879,registry:Health@1252,registry:Hibernate@1125,registry:Socket@1143,registry:Socket@841,whole:Route@1290 1c4494874260ffd65c4061ce6ae7924ff90b17a9eb5d101e7fc6dd67de563c65 |
| 232 | internal/provision/reconcile.go mintHeld authority C Held-row mint dispatch now reaches root registration for remote landing; exported canonical route construction preserves local legacy behavior. registry:ClaimOwnership@1338,registry:HoldOp@894,registry:Kind@1488,registry:Kind@1768,registry:Status@883,whole:ClaimOwnership@1341,whole:ClaimOwnership@1358,whole:Route@1213,whole:Route@1220,whole:Route@1595,whole:Route@977 7fae368f0465f2922f9a552358b0ab156ee5718d19dad46976c16cfdba57ee82 |
| 233 | internal/registry/registry.go Registry.Upsert authority E3 Registry upsert clears consumed update settings on tenant identity change, preventing previous tenant policy/history from authorizing adoption. file:Exec@1271,registry:Account@4265,registry:Addr@4001,registry:Addrs@4359,registry:App@4070,registry:Args@4413,registry:Backing@4167,registry:BuildState@4636,registry:Canary@4130,registry:Caps@4291,registry:CertExpiresAt@4248,registry:Channel@4095,registry:ClaimIncarnation@4483,registry:ClaimOwner@4517,registry:ClaimRowID@4531,registry:ClaimStamp@4503,registry:CreatedAt@166,registry:CreatedAt@187,registry:CreatedAt@4400,registry:DBPath@4034,registry:DNSCheckedAt@4230,registry:DNSStatus@4217,registry:Environment@4276,registry:FleetBox@4347,registry:Gate@4392,registry:GoodDemand@4586,registry:GoodDigest@4572,registry:GoodVersion@4557,registry:Health@4368,registry:Hibernate@4112,registry:Hibernate@812,registry:HoldOp@4545,registry:Host@3967,registry:IdleSeconds@4421,registry:Kind@271,registry:Kind@288,registry:Kind@3983,registry:LastError@4019,registry:MaxRunSeconds@4436,registry:NextDue@4156,registry:Platform@4204,registry:Pool@4077,registry:PrevVersion@4055,registry:Provisioned@4315,registry:Region@4085,registry:Replica@1159,registry:Replica@4471,registry:Replicas@1173,registry:Replicas@4455,registry:Replication@4141,registry:Replication@828,registry:Seed@4331,registry:ServingVersion@4600,registry:Slug@3975,registry:Socket@3991,registry:Status@226,registry:Status@245,registry:Status@4009,registry:StatusNamed@4184,registry:Steering@4380,registry:Tunnel@4299,registry:Unit@4339,registry:UpdateSettings@4618,registry:Version@4044,registry:remote@47,registry:remote@77,registry:sql@1271,whole:Route@128,whole:Route@136,whole:remoteClient@49,whole:remoteClient@79 aa3eaabe71e64bc67262247454b1e48a611e08d24cbdf27cdb36d3c7d108d71f |
| 234 | internal/release/adopt.go settingsTarget authority E3 Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant. registry:App@2868,registry:App@2968,registry:App@3253,registry:BuildState@2571,registry:GoodVersion@3278,registry:Host@1204,registry:Host@1614,registry:Host@2132,registry:Host@2379,registry:Host@2668,registry:Host@320,registry:Host@3264,registry:Host@3676,registry:Host@4331,registry:Host@4519,registry:Host@593,registry:UpdateSettings@447,whole:Route@1078,whole:Route@2168,whole:Route@2175,whole:Route@2733,whole:Route@2740,whole:Route@386,whole:Route@404,whole:Route@549 9ce3888303cdc4f5bbf5a6587442a98bae68b3c4f37066dfa006a75fde9d3782 |
| 235 | internal/release/buildstate.go Consumed.DecidedFor diagnostic H3 DecidedFor filters displayed consumed decisions by tenant identity; it does not grant adoption authority. registry:App@152,whole:Route@136 34e8dec931a5255e1e4ff1fa243bb394353ca6df0080a1ec792092d5100d2224 |
| 236 | internal/release/buildstate.go Consumed.ForeignTo authority E3 ForeignTo binds consumed decisions to account/app before root release history can be reused. registry:App@154,whole:Route@138 1a44d2d6502b845ac937ab9e06d50ec655ae3944ce3a179a4f8c92852eaf66de |
| 237 | internal/release/materializeheld.go VerifyHeldLive authority C,E1 Held verification wrapper retains selected held lock and delegates root proof validation of live bytes. whole:Route@183,whole:Route@265 cf2a02f7006093416d618ee3368ecde12b7065dbaffa8a37f7d5c1d32ff9155d |
| 238 | internal/release/materializeheld.go VerifyHeldLiveUnder authority C,E1 Under-lock held verification enforces claim-aware shape and delegates root proof validation. whole:Route@188,whole:Route@270 0bb023413d83ab570efd09cc804867ce88e804a3374c54748f98f0e92687b827 |
| 239 | internal/release/materializeheld.go verifyHeldLive authority B2,C,E1 Live held verification consumes the configured root proof gate and verifies pinned bytes under the same held lock. registry:Host@1012,registry:Host@1030,registry:Host@434,registry:Host@708,whole:Route@592,whole:Route@839 6959d47d27a76ce9cb607254cd5841e63be1f9a080a0e784c9022c8fad1cea1b |
| 240 | @legacy c3e5eca07d2e6f351a79c69cf2b71a7870b48c1126268f982661ae3cafd5edf5 internal/release/store.go OpenObject legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Remote object opener requires context-bounded streaming and refuses unsupported fallback; generic payload transport stays legacy. file:Open@130 f51ca9a8bb0eaa8798e54aebfe4e371e6be64212e3083141110953d480980d2c |
| 241 | internal/release/store.go OpenObject legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Remote object opener requires context-bounded streaming and refuses unsupported fallback; generic payload transport stays legacy. file:Open@130 f51ca9a8bb0eaa8798e54aebfe4e371e6be64212e3083141110953d480980d2c |
| 242 | internal/release/updatetarget.go NextConsumed authority E3 Next consumed settings reset foreign decisions and stamp canonical tenant plus effective update policy. file:Read@1004,file:Read@1251,registry:App@2021,registry:Host@352,registry:Host@89,registry:UpdateSettings@1778,whole:Route@1781,whole:Route@2013,whole:Route@2024,whole:Route@307,whole:Route@355,whole:Route@92 3b91075b79b25b120004590dbdbe53a947b4f276deccdad4ce3e9b1fdb308b5b |
| 243 | @legacy b353e4b9ccd421990fec06b46c45f0dac489837bc504e1d4891e9e6c50406df1 internal/sim/hostlife/mutate.sh external legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Hostlife mutation script adds two-box simulation cases and expected witnesses; test harness is pinned by the conservative external envelope, not production root authority. file:external@0 dc77fbf65aad69eb9d8b79e97005a72e4da0b1a7f35601bd24cc55c3263be359 |
| 244 | internal/sim/hostlife/mutate.sh external legacy accepted-legacy accepted-legacy;rev3=merge-ruling-2;basis=Hostlife mutation script adds two-box simulation cases and expected witnesses; test harness is pinned by the conservative external envelope, not production root authority. file:external@0 dc77fbf65aad69eb9d8b79e97005a72e4da0b1a7f35601bd24cc55c3263be359 |
| 245 | @remove internal/provision/reconcile.go routeFor |
| 246 | @removed internal/provision/reconcile.go routeFor C,E3 Renamed RouteFor and reviewed as canonical root landing route construction. |
| 247 | @coverage . 50dbe9c2e4f4024972f3474b171287919de24ea2ce8c872d831367ed09d7c778 |
| 248 | @coverage cmd/console c67b1c2de7d0c23458b837fa67296e646d27791d369ee363daa636314ff4563f |
| 249 | @coverage internal/activator 1ee0ecf5a926adf6918749240db078ba0d2f2879fb1cd31629a74a66f75b50ac |
| 250 | @coverage internal/console 41714f3779b343460800cb25b31782dc7d5c1e83b2aacf7d8d0a28f39c47bf76 |
| 251 | @coverage internal/console/templates 6492b7455fa3315105339cca03edb4372ac0d9bf746c018e13a308cf0b74cc05 |
| 252 | @coverage internal/edgesfile 553af147ca4882b8425afddf1ed250ee40a6cac92361d667cb4a690393be5272 |
| 253 | @coverage internal/host 101625bb4dc26d58bb36d71a589b631d27e6d7b2a3298a0458342826606604df |
| 254 | @coverage internal/hostbox afb08c287eaccb43adde1c488bd122482711ce4e29ecb675c9428f27130c3d93 |
| 255 | @coverage internal/hostclaim feaf701db4b49ce92733b9d6c1fa1c0ae8efc6e13439ce201fca1a9e24dcf927 |
| 256 | @coverage internal/hostfiles 554285c123758375c13388b2fa42f654819392dac0b027816a713548ec17dcc6 |
| 257 | @coverage internal/hostguard 9a9f6ce8dc7dd8c6fec2f52e1e928e0ae133eebdcc4b6417824d150036c60f0e |
| 258 | @coverage internal/hostops f1607e7a75af365c5a8977405e7df7b970614b4423593b9bd69805636a03a5a2 |
| 259 | @coverage internal/hostrelocate b8973c260be53365767539c9e355aebf15aeae063ee8f5d4eb248d2bba5c24cc |
| 260 | @coverage internal/instancectl de726ae384f2f5ad82f9ae90ac8a7c25b2db894f310e976ae9695b8704f3d1e1 |
| 261 | @coverage internal/instancefs 41940b734d708c6a916ba001c7b3a1c903e84ea3421614071ae76e896f3c0fcc |
| 262 | @coverage internal/instancekey cd02b5b212e4ffbd56d36d1a68af3e6ee0a51d7155cebd1a82f9f52d5da8b118 |
| 263 | @coverage internal/moves 5218cf9bd31f6347ae49a595a32455f441b1718ecfa0a9559f99036d32f56498 |
| 264 | @coverage internal/provision a5c7116ee1a063ecdbe8bd5ea1832370ce66960ab13cc7afd34c0973dd21b457 |
| 265 | @coverage internal/registry bb6028d50884545209c11e65131dc3389a0991c9a94a0954965e0df4b82b3232 |
| 266 | @coverage internal/release a1836b7c685b543641bd6184d95cc541a3ee754986c57f6d3394f78fafc260d0 |
| 267 | @coverage internal/sim/hostlife eaac101ea7970c74fee621e5cd7515ec7e4907bc5874c65eab86666af0f7dc61 |
| 268 | @coverage internal/status d5ef42fe4dc2cb72d1ce5e133e2c95a3e85960a222eb424f00b259b961b8d976 |
| 269 | @coverage internal/updatewords 93bb83474bad5d20281c34e72fadf56e2847e9a7eee2385a78f46a11fc39a3b6 |
| 270 | @coverage internal/hostexec 778261669d5e079b9f98d74807557fd5de5c4e0f663bd0f9d380cdad77ffbcf8 |
| 271 | @coverage internal/rootparticipation aca36bd46a7879b200c765a3e66ed01329158546a258de6facc922c95e18bf75 |
| 272 | internal/host/rootexecution_authority.go ClaimRootHTTP.executionAuthority authority D Fresh claim, deployment binding and root installation authorize participation, including the retained source only. file:Read@553 107989f561409fd8c11c2666d0672b8dbeb368842fe00ad6a7b84fece2150438 |
| 273 | internal/host/rootexecution_read.go rootExecutionRead authority D Production root observer selects the descriptor-checked participation reader. c70216cd8e62430b43669d6cea5bcb9101fcb31c04aea178a951a620c369b1e5 |
| 274 | internal/hostexec/participation.go PreinstallationParticipant authority D D1 selects only the fresh claim executor or named target in its allowed phase; Exec is a claim field, not a process invocation. No installation authority. file:Exec@1035,file:Exec@1307,file:Exec@276 f14568ea08c9d439d7239ac9d5d596a134a17627e1eac878c074629ca2ba7304 |
| 275 | internal/hostexec/rootbroker.go RootBroker.Execute authority D Broker binds exact live kernel peer and request; renewal cannot cross the prior cutoff; recovery retains positive settlement requirements. file:Read@3231,file:Read@4649 b5ae9d292ed58cf8016ca69910bfb524b4bbefdacb7110152c90501d5b509c38 |
| 276 | internal/hostexec/rootbroker.go RootBroker.deny authority D D2 compares the current root token before durable loss and live-lock revocation; cleanup is bounded independently of request cancellation. file:Read@117 e29e9132d0ceb540000a1836249fda71c4a75b4746d6037a42cbf6e2e2752b9d |
| 277 | internal/hostexec/rootbroker.go RootBroker.read authority D D1/D2 decode the retained root participation record; missing or malformed state grants nothing. file:Read@113 8a2fb0134e9c24bbe448efc35f193e60d01e909a3129b465aa16f682eb4114f1 |
| 278 | internal/hostexec/rootread.go ReadRoot authority D Root census, update marker, tuple, kernel identity, deadline and live lock; final launch and serving-settlement witnesses exercise the production reader. file:Read@2013,file:Read@228,file:Read@490 0151eab12e55ebf3674f66c9a48d6f7f991a6b5dc529491a25adcbfa77e4101c |
| 279 | internal/rootparticipation/ledger.go Ledger.Acquire authority D D3 excludes updates and persists the root acquisition census intent before the reservation callback. file:Read@345 a0800db3005f69f6379e4483e596bd880c501077591a3c748ab2f52407af7d9c |
| 280 | internal/rootparticipation/ledger.go Ledger.BeginUpdate authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. 30693165b147fb2e3be15a9804c05e67338191b614c690920b1b567b446d16e6 |
| 281 | internal/rootparticipation/ledger.go Ledger.Census authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. ba4f2145b81958ee57b96788aed80b07280590bfc423f87fdbaa1b97a74d4671 |
| 282 | internal/rootparticipation/ledger.go Ledger.EndUpdate authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. a195c06a975c858be0d5826cdbd23eb7bbe410b4cef52361b8355c8e25c0e2dd |
| 283 | internal/rootparticipation/ledger.go Ledger.idle authority D D3 enumerates root records and requires settled obligations plus an independently supplied launch/kernel census. file:Read@429 b7b27590041bac6bec3de245b7fe20da7965cb2a9e52725c888f8a83313ff9f3 |
| 284 | internal/hostexec/rootclient.go requestIdentity authority D D1 supplies collision-resistant request correlation only; root authenticates peer and authority independently. file:Read@73 2acec351fdc4ab671e65b4a9bb5017aeb094fbf78fad8e34d713e48a2846c158 |
| 285 | internal/hostexec/rootserving.go RootBroker.servingView authority D Tokenless serving needs completed migration and settled root state; preinstallation grants no privileged effect. file:Read@444 5b72b542a7f26a5f09ddb95d48e913a89cb76e08c99542a8c81d7fa9a2e298be |
| 286 | internal/host/claimlaunch_execpermit.go ClaimLaunchRoot.execPermit authority D Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks. file:Read@157 795354a21d94cfe2eaf955dc913e88079426947e9547ebe83b79332bfdd7f3f1 |
| 287 | internal/host/rootexecution_read.go readRootExecution authority D Descriptor-checked root opener shared by root Prepare/Check, initial launch authorization and final executable checks; no agent fallback. file:Open@291 2f70b4203a803b3fe0cd1e57c21106433a5af6a14dad8217e67bd24a28ad2b2f |
| 288 | internal/host/rootexecution_read.go productionClaimLocal.checkRootParticipation authority D Root observer binds participation to enrolled actor; TestPlan14ExecutionRootLocalIgnoresAgentAbsence. 9cb9f9b98b9f143c7ce9225dd8c6b7798ce17683ffa85dded31a9bf90bcaeab9 |
| 289 | internal/host/claimlaunch_authority.go ClaimLaunchRoot.authorize authority D Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation. de7e7f2ffebfc7d7e26e0c72492b3d9fb4b8766cefcd2648931f3f0ac975cf45 |
| 290 | internal/host/rootexecution_migration.go ClaimRootHTTP.executionAuthorityWithMigration authority D Root participation census supplies migration generation; TestPlan14ExecutionMigrationIsIndependent and TestPlan14ExecutionPreinstallationBindsMigration. 1c7f21b4296de5284a89ad4fa97b352cc6a59998156a22b07b6798291b778f7d |
| 291 | internal/hostexec/rootbroker.go RootBroker.recoverSettlement authority D Recovery serializes settlement with in-flight requests and requires cleanup, exact conditional release and CC9. TestPlan14ExecutionRecoverySettlesWithoutControllerToken and TestPlan14ExecutionRecoveryJoinsRemoteWrite. 88c7b2d1a863590e549a2477732badcb6e003289da8db46aee16a1d777a8f77d |
| 292 | internal/host/claimparticipation.go productionClaimLocal.participateHost authority D Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures. file:Read@121 035931959f2b44012e10624314b90bad360ca77f8fdf3d8300e2a29ffd33c0fb |
| 293 | internal/host/claimparticipation.go productionClaimLocal.prepareLegacyWith authority D Production selects the broker client; the old local controller path is selected only by explicit legacy test fixtures. file:Open@3226,file:ReadFile@2116 20a34982bf5184cba4e4691040ede402a2c93ccbc0571c9483ad28843a298673 |
| 294 | internal/host/guardtransaction.go systemApplier.checkGuardRecovery authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:ReadFile@408,file:ReadFile@635 b1efe974172ec1e07bb27dc98e39b56af2eb459afd28335123451dc14fa21e40 |
| 295 | internal/host/rootexecution_client.go productionClaimLocal.prepareWith authority D Agent selects the single root lease owner over authenticated RPC; its mirror grants no root authority. file:Read@3239 269e72c57424e72d9fdbdd9191eac625877cca4ef1eff12e66d55299c727409b |
| 296 | internal/host/rootexecution_recovery.go recoverRootExecution authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. 5d0d5ecefd1fa2ca18068408dbaa7bff327a16d05d170580af0ac7c066ea2559 |
| 297 | internal/host/rootexecution_runtime.go newClaimExecutionRuntime authority D Instance-control owns broker, checked store, monitor and bounded cleanup lifetime. file:Read@205 89dd8159a5181d315a3febff26646919ec4135807ea2cd2b1f89847d9f512f47 |
| 298 | internal/host/rootexecution_runtime.go var openClaimExecutionAuthority authority D Instance-control owns broker, checked store, monitor and bounded cleanup lifetime. file:Open@76 dc9e1a3d2ccc63de2eec84fe1727d4c741372a227eb423d508749c4347731433 |
| 299 | internal/host/rootexecution_settle.go ClaimRootHTTP.beginExecutionRecoveryFence authority D Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim. file:Read@146 dfbfdf5ae974363678e8e395ef0be2a64ea8c81c3f97ba766eeadccbba9c2fe6 |
| 300 | internal/host/rootexecution_settle.go ClaimRootHTTP.cleanupExecution authority D Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim. file:Read@2438,file:Read@3761 9f715acdc31d97f33c1ab6efe227bd248a91a7a150498974c151426c943a9025 |
| 301 | internal/host/rootexecution_settle.go ClaimRootHTTP.settleExecution authority D Root cleanup checks exact retained installation, launch journal and kernel evidence; CC9 requires a fresh terminal or exclusion claim. file:Read@108 ecd07f9675915c9cc747246369f624bbdf9a6f45369f3efdc1b2b49a8bd0e69b |
| 302 | internal/host/systemparticipation.go systemApplier.beginExecutableChange authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:ReadFile@561 e60e0fbb88aec4fa4b43ec5ba819ff633e5593cb85b8475d41951b9e1f848b68 |
| 303 | internal/host/systemparticipation.go systemApplier.clearUpdateBegun authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:Lstat@240,file:Lstat@522 971dae18d92aab847128b375532d6b8a86338fbcc03ed7e82ad91e0cd5297810 |
| 304 | internal/hostfloor/disk.go Disk.Begin authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:Stat@151 3bafc18b88f16afd726564684adf3ef9874d8271c925bcd299b9cbcdb0ccebd0 |
| 305 | internal/hostfloor/disk.go Disk.WithParticipation authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. 250c5c9b3e8a696c60f83a4c3d42eb8ef84a2371f55d20b7eeb540be42f5e285 |
| 306 | internal/hostfloor/participation.go CheckParticipation authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. 2353e6bce63d2889d1fae0fb0e6b098d0fc1de665e794f01e7085e5373eae53d |
| 307 | internal/hostfloor/participation.go checkLegacyParticipation authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:ReadDir@339 e308eb277b9071c11efc6a3f1b6cbbbd7d59ca8420a3cc142b2f27af1d762379 |
| 308 | internal/rootparticipation/ledger.go Ledger.BeginUpdateWith authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@314 70e9ee76d88fde902d99ed61b852bebdc5d40cc40fd10834c5be6f6095df193c |
| 309 | internal/rootparticipation/ledger.go Ledger.EndUpdateWith authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@247 9c7fbfb25b613c16742673c9785171394fc2a9206c3f996a2549e5d4c85a8911 |
| 310 | internal/rootparticipation/ledger.go Ledger.UpdateID authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@110 41c1f1a6dd5baddadc384ef78f319fc3111f88e724ef0b39b3a3752a7057281d |
| 311 | internal/rootparticipation/ledger.go Ledger.readCensus authority D Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@136 db268d0dbd24db646bbdab2b88ad17b1c43b7963a51ce473ee0a8895a1f951e6 |
| 312 | internal/rootparticipation/production.go Open authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:Open@45,file:Open@5 82b11f7548ce7ace572a697f66b6ef22239fc3fdf2e85a7c5fde7b8720c4a75b |
| 313 | @remove internal/host/claimparticipation.go productionClaimLocal.prepareWith |
| 314 | @coverage internal/hostfloor e1b8271eaa6e464b4b5b9a480ea71e71ceafcf9750bf2f07ef2537713ba88d1e |
| 315 | internal/host/guardtransaction.go installFloorHook authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:Lstat@93,file:ReadDir@259 6956aea590b55d435ef0321a6e2b365f3df074bbe91d09acb6215f19e4de622c |
| 316 | internal/host/guardtransaction.go legacyGuardEntries authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:ReadFile@265 2d73ba69020ae86926e29d9e82da581517da3dbc23e4364b4cad8f7746a2d278 |
| 317 | internal/host/guardtransaction.go systemApplier.beginGuard authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:Read@679,file:Read@903 d5056ac9aa4bff1fc5add3e8ae59ce8352d2285446290e03663466c5097aa54c |
| 318 | internal/host/guardtransaction.go systemApplier.guardTransaction authority D Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. file:ReadFile@84 6d364c272ca45684115c5d61eb13249a5e4b93b92cc17ce2c306c3a7f05fa302 |
| 319 | internal/rootparticipation/production.go Ledger.UpdateRequired authority D Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol. file:Read@172 98feb072e094d618a23cd8239f182179eed4881eee5f063dc825693dbe13e064 |
| 320 | internal/rootparticipation/production.go OpenForUpdate authority D Select root participation when claims are enabled or a census exists; only absent state with claims off selects the legacy protocol. file:Open@56 41558ce678c04427ee55c0edbe68cd652402247a0c8449975c4a47d344182053 |
| 321 | |
amadan