FABRIC-CI-1 / FCI-1: bind exact Work to a durable converged-cell reservation - #9693

APPROVED — scaffold temporary-introduction decision only, bound to exact head cd4ac0a5a1675a7a71ab6f8d30da7ea572f17be3, tree 7051f0a1b8209f02479227536aa330387bc0140a.

Exact derived new-obligation set: one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. The already-merged FCI-EVIDENCE-0 calibration carrier and tools/fabric_ci_evidence_driver.sh are not part of this approval; they remain governed by review 5061394769 and merge commit 2afe322f774dbc908afc6106bf3fa55372fccf89.

Approval basis: modeled lifecycle actuation sufficient to sequence this wet gate from .dag does not yet exist. This file is narrowly bounded to sequencing the fixed FCI-1 production assertions and actuators: exact-binary calibration first, fixed host/EUID and prestate checks, named-file framed transport through the merged evidence driver, fixed systemd submitter units, the canonical reservation/release path, the submitter-owned-root falsifier, positive allocation-store restoration, and persistent-cell comparison. It exposes no arbitrary Work command and does not re-ingest diagnostic rendering as data.

This is scaffold admission, not authorization for Plan A, Plan B, the FCI-1 wet execution, or merge. Those retain their separately stated gates and receipts.

Dissolve-on: modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

Any push changes the subject identity and invalidates this approval.

APPROVED — scaffold temporary-introduction decision only, bound to exact head 00760003ea6090d17828fa3a9d87f8fde84d6493, tree b7466cd724af01156d02865f3cf6fe5bcebfbc84.

Exact derived new-obligation set: one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. Its content and dissolution condition are unchanged from the previously approved scaffold population; the earlier approval expired only because the PR head moved. No other changed file carries a scaffold declaration.

Approval basis: modeled lifecycle actuation sufficient to sequence this wet gate from .dag does not yet exist. The carrier remains narrowly bounded to the fixed FCI-1 sequence: exact-binary evidence calibration first; fixed host/EUID and prestate assertions; named-file framed transport through the merged evidence driver; fixed systemd submitter units; canonical reservation/release and positive allocation-store restoration; the submitter-owned-root falsifier; and persistent-cell comparison. It exposes no arbitrary Work command and does not re-ingest diagnostic rendering as data.

The host precondition is stronger on this head: it no longer carries a copied sudoers digest. It independently hashes the installed file and the exact-tree generated provisioning/srv3/gunbc-ghrunner.sudoers projection, refuses either unavailable arm, and admits only equality. This dissolves the stale-literal class rather than updating its value.

This is scaffold admission, not authorization for Plan A, Plan B, either plan hash, either apply, the FCI-1 wet execution, undrafting, or merge. Those retain their separate gates and receipts.

Dissolve-on: modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

Any push changes the subject identity and invalidates this approval.

APPROVED — scaffold temporary-introduction decision only, bound to exact head 89d61714ada92d3d013ff5ecb7110013636b8d6e, tree e8703b85b8242fb79f37d7a5c7aa7223b93fe9ba.

Exact derived new-obligation set: one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. Direct comparison from the previously approved head 00760003ea6090d17828fa3a9d87f8fde84d6493 to this head is one commit and does not modify that path; the carrier bytes and dissolution condition are unchanged. No other changed file carries a SCAFFOLD declaration.

Approval basis is unchanged: modeled lifecycle actuation sufficient to sequence this wet gate from .dag does not yet exist. The carrier remains narrowly bounded to exact-binary evidence calibration first; fixed host/EUID and prestate assertions; named-file framed transport through the merged evidence driver; fixed systemd submitter units; canonical reservation/release and positive allocation-store restoration; the submitter-owned-root falsifier; and persistent-cell comparison. It exposes no arbitrary Work command and does not re-ingest diagnostic rendering as data.

The branch movement repaired allocation-store prestate admission outside the scaffold population. Spending the prior approval rather than preserving a baseline incapable of disagreement was the correct ordering; this review does not independently authorize or grade that plan artifact.

This is scaffold admission, not authorization for Plan A, Plan B, either plan hash, either apply, the FCI-1 wet execution, undrafting, or merge. Those retain their separate gates and receipts.

Dissolve-on: modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

Any push changes the subject identity and invalidates this approval.

APPROVED — scaffold temporary-introduction decision only, bound to exact head cbd623577557ff8dffe8bf519e6f57290038cfbc, tree c9cef46d9abcc4fa1283f7be866449c4c4439ed8.

Exact derived new-obligation set: one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. Its bytes are identical to the previously approved head 89d61714ada92d3d013ff5ecb7110013636b8d6e; the PR diff contains no other SCAFFOLD declaration. The dissolution condition remains unchanged: modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

Approval basis is unchanged: modeled lifecycle actuation sufficient to sequence this wet gate from .dag does not yet exist. The carrier remains narrowly bounded to exact-binary evidence calibration first; fixed host/EUID and prestate assertions; named-file framed transport through the merged evidence driver; fixed systemd submitter units; canonical reservation/release and positive allocation-store restoration; the submitter-owned-root falsifier; and persistent-cell comparison. It exposes no arbitrary Work command and does not re-ingest diagnostic rendering as data.

The integration after #9780 removed the allocation-store prerequisite implementation from this PR rather than retaining a second authority: the current PR has 10 changed files and the one-file scaffold population remains unchanged. All five exact-head checks are SUCCESS.

This is scaffold admission, not authorization for Plan A hash 9f35b486b4dddb8a, Plan B, either apply, the FCI-1 wet execution, undrafting, or merge. Those retain their separate gates and receipts.

Any push changes the subject identity and invalidates this approval.

PARTIAL APPLY AUTHORIZATION — bound to exact PR head cbd623577557ff8dffe8bf519e6f57290038cfbc, tree c9cef46d9abcc4fa1283f7be866449c4c4439ed8, and the exact self-built binary whose provenance the gate manager verified against that subject.

AUTHORIZED ONCE: Plan A only, on srv3:

• plan bundle hash 9f35b486b4dddb8a
• scope fabric-execution-cells-only
• member-set / observed-baseline 2c339d71b9c5bd10
• prior_generation=3
• plan_generation=4

Immediately before dispatch, refuse unless the downloaded/local artifact recomputes to that exact bundle hash; every coordinate above matches; the executable is the verified exact-head binary; the generation store still reads 3; and production apply re-observation admits the artifact without host, scope, member-set, baseline, or observation drift. The authorization covers exactly the nine plan-scoped fabric-cell operations fixed by the bundle (three owned-directory ensures, five slice property ensures, and one slice start) plus the production apply envelope’s separately modeled shared ensure of /var/lib/gunbc/fleet-converge before the host-global flock. The installed sudoers projection at this head carries all of those exact argv values. No other plan-scoped operation is authorized.

After Plan A, independently read back the exact three-member cell substrate, UID/GID standing, slice properties, slice active standing, allocation namespace non-mutation, and generation-store value 4; do not rely on apply stdout as the receipt.

NOT AUTHORIZED: Plan B hash fc62dfb9cd4df863 in the requested A→B sequence. Both artifacts were minted against prior_generation=3, but the fence is not scope-specific. All fleet-converge scopes share /var/lib/gunbc/fleet-converge/plan_generation and /var/lib/gunbc/fleet-converge/plan_generation.lock. A successful Plan A runs its apply.sh and then commits generation 4 under that lock. Plan B still expects 3, so its locked guard must report LeaseGenerationStale before running Plan B’s two plan-scoped directory operations. Attempting the stale artifact is therefore not an authorized second apply.

Required continuation: complete and positively verify Plan A, then regenerate Plan B from the same exact approved binary/head. With no allocation-store drift, its scope and member-set/baseline should remain fabric-allocation-store-only / 44913a7a7a0f78d0, its action population should remain exactly the ordered namespace and leaf 0700 root:root ensures, but it must carry prior_generation=4, plan_generation=5, and a new bundle hash. Bring that exact new hash for authorization.

This does not authorize the FCI-1 wet run, #9693 undrafting, or merge. Any PR head movement invalidates this authorization.

MODELED-ROUTE APPLY AUTHORIZATION — one-shot, bound to exact PR head cbd623577557ff8dffe8bf519e6f57290038cfbc, tree c9cef46d9abcc4fa1283f7be866449c4c4439ed8.

This supersedes the Plan A authorization in review 5062719965. That earlier authorization named an SSH-produced artifact outside the production artifact-consumption route and may not be used.

AUTHORIZED ONCE: dispatch .github/workflows/fleet-converge.yml on ref session/smart-wren-406 with exactly:

• host=srv3
• mode=apply
• plan_artifact_hash=9f35b486b4dddb8a
• plan_workflow_run_id=33353552969

The authorized producer is successful workflow-dispatch run 33353552969 at this exact head. Its unique fleet-converge-plan artifact is artifact ID 9744507892, archive digest sha256:00aeaa41191eb6f52882630e29aae3c992dded6c139441fcd100115485ce9ea3. I independently unpacked it and verified the complete expected artifact population and these coordinates:

• subject host srv3
• scope fabric-execution-cells-only
• member-set and observed-baseline 2c339d71b9c5bd10
• prior_generation=3
• plan_generation=4
• empty Spark typed-actions wire
• bundle token 9f35b486b4dddb8a
• exactly nine plan-scoped operations: five systemctl set-property, one slice start, and the three ordered cell-directory ensures

The modeled route must remain the route. The apply workflow must build and verify binaries from its own exact head_sha, download artifact name fleet-converge-plan from run 33353552969, compare the supplied token with the artifact token, and then let fleet_converge_apply_wet re-observe host/scope/member-set/baseline, recompute the bundle, and enforce generation under the host-global flock. No copying binaries, changing checkout traversal, changing principal, or invoking the entry directly outside that workflow is authorized.

PRE-DISPATCH / EARLY-RUN REFUSALS:

• the branch ref or the newly created apply run's head_sha is not exactly cbd623577557ff8dffe8bf519e6f57290038cfbc;
• artifact 9744507892 is absent, expired, renamed, duplicated in that run, or its archive digest differs;
• the installed srv3 sudoers artifact is not the independently read-back 96-line projection at 430ae6d42ed7d715ef430818e0500fd6efb1da18ce7d8fab799ed2439b5bf5c0;
• the generation store does not read exactly 3;
• /opt/fabric-cells or /var/lib/gunbc/fabric is no longer absent before production re-observation;
• any artifact coordinate or realized argv differs from the population above.

The authorization covers those nine plan-scoped operations plus the production apply envelope's separately modeled shared ensure of /var/lib/gunbc/fleet-converge as ghrunner:ghrunner mode 0755 before the host-global flock. No other plan-scoped effect is authorized.

INDEPENDENT POSTCHECK REQUIRED: generation store exactly 4; exact admitted three-member cell substrate; /opt/fabric-cells and /opt/fabric-cells/srv3-06 root:root; attempts root ghrunner:ghrunner; all five slice properties exactly 17179869184 / 16106127360 / 34359738368 / 16384 / 100; slice active; no Work process started; /var/lib/gunbc/fabric still absent; no Plan B effect. Apply stdout alone is not the receipt.

This does not authorize Plan B, the FCI-1 wet run, #9693 undrafting, or merge. Any PR head movement invalidates this authorization.

PLAN B MODELED-ROUTE APPLY AUTHORIZATION — one-shot, bound to exact PR head cbd623577557ff8dffe8bf519e6f57290038cfbc, tree c9cef46d9abcc4fa1283f7be866449c4c4439ed8.

Plan A is accepted as completed on the modeled route: workflow-dispatch run 33358561348, attempt 1, at this exact head concluded SUCCESS; its artifact-download and Fleet converge apply (CAS + generated apply.sh) steps both succeeded. The gate manager's independent postcheck is the standing receipt, not apply stdout.

AUTHORIZED ONCE: dispatch .github/workflows/fleet-converge.yml on ref session/smart-wren-406 with exactly:

• host=srv3
• mode=apply
• plan_artifact_hash=a0d32cf0e8cba914
• plan_workflow_run_id=33359140412

The authorized producer is successful workflow-dispatch run 33359140412 at the exact head above. Its unique, unexpired fleet-converge-plan artifact is ID 9746239099, size 2349 bytes, archive digest sha256:7a2557d73abc7e1ec26becb5925707ebb28c765a792ae50d46a6b2d0c1068ff0.

I independently unpacked the archive and verified the complete ten-file artifact population and these coordinates:

• subject host srv3
• scope fabric-allocation-store-only
• member-set and observed-baseline 44913a7a7a0f78d0
• prior_generation=4
• plan_generation=5
• empty Spark typed-actions wire
• bundle token a0d32cf0e8cba914
• prestate: /var/lib/gunbc/fabric positively absent under listed /var/lib/gunbc, with the allocation leaf absent because its namespace is absent
• exactly two ordered plan-scoped operations: ensure /var/lib/gunbc/fabric, then /var/lib/gunbc/fabric/allocation, both root:root mode 0700

The modeled route must remain the route. The apply workflow must build and verify binaries from its own exact head_sha, download artifact name fleet-converge-plan from run 33359140412, compare the supplied token with the artifact token, and then let fleet_converge_apply_wet re-observe host/scope/member-set/baseline, recompute the complete bundle, and enforce generation under the host-global flock. No direct entry invocation, copied binary, alternate checkout, changed principal, substituted artifact, or retry is authorized.

PRE-DISPATCH / EARLY-RUN REFUSALS:

• the branch ref or the newly created apply run's head_sha is not exactly cbd623577557ff8dffe8bf519e6f57290038cfbc;
• artifact 9746239099 is absent, expired, renamed, duplicated in run 33359140412, differs in archive digest, or any internal coordinate/action differs from the population above;
• installed srv3 sudoers is not the independently read-back 96-line projection at SHA-256 430ae6d42ed7d715ef430818e0500fd6efb1da18ce7d8fab799ed2439b5bf5c0, including the exact ordered namespace and leaf grants;
• the generation store does not read exactly 4;
• /var/lib/gunbc/fabric is no longer positively absent;
• production apply re-observation reports any host, scope, member-set, baseline, observation, bundle, or generation disagreement.

The authorization covers exactly the two plan-scoped directory ensures above, plus the production apply envelope's separately modeled idempotent ensure of /var/lib/gunbc/fleet-converge as ghrunner:ghrunner mode 0755, the host-global lock, and the generation-store commit to 5. No cell, runner, Work, reservation, or other plan-scoped effect is authorized.

INDEPENDENT POSTCHECK REQUIRED:

• generation store exactly 5;
• /var/lib/gunbc/fabric and /var/lib/gunbc/fabric/allocation both directories at root:root 0700;
• allocation leaf has no unexpected members before the FCI-1 wet run;
• the complete Plan A cell substrate remains unchanged: exact path ownership/modes, slice active standing, and all five resource properties;
• positive no-Work evidence remains: zero cgroup process population and kernel pids.current=0 (or a stronger independent equivalent), with no attempt member or child execution cgroup introduced;
• no runner-unit population change and no unrelated host effect.

Apply stdout alone is not the receipt. Any failure spends this one-shot authorization; stop and bring the refusal plus independently observed host state rather than retrying.

This does not authorize the FCI-1 wet run, #9693 undrafting, or merge. Any PR head movement invalidates this authorization.

WET RUN NOT AUTHORIZED — exact-head blocker found at cbd623577557ff8dffe8bf519e6f57290038cfbc, tree c9cef46d9abcc4fa1283f7be866449c4c4439ed8.

Plan B itself is accepted as completed on the modeled route: workflow-dispatch run 33362408308, attempt 1, at this exact head concluded SUCCESS; artifact download and fleet-converge apply both succeeded. The gate manager's independent host readback is the standing substrate receipt.

The wet instrument cannot reach its first canonical reservation from that reported state. Plan B correctly left /var/lib/gunbc/fabric/allocation as an empty directory. observe_cas_slot_state therefore reports CasReadableAbsent for slot srv3-06; fci1_allocation_prestate maps that to AllocationStoreAbsent; and fci1_assert_allocation_available explicitly returns ExitFailure("FCI-1 allocation store substrate is absent"). The shell calls that assertion before setting canonical_reservation_may_be_held=1 or starting either submitter. Running the current scaffold would deterministically refuse before the wet transaction and would establish no FCI-1 receipt.

This is a state-space conflation: Plan B established the store directory substrate, while the FCI-1 function interprets an absent slot as an absent store substrate. Do not seed a Free slot out of band to preserve this head or its scaffold approval; that would be an unmodeled durable control-plane mutation.

Accepting AllocationStoreAbsent in only fci1_assert_allocation_available is not sufficient. fci1_allocation_restoration also refuses every absent prestate, so both the success path and cleanup path would still fail after the first legitimate reservation/release. The restoration predicate additionally accepts any post > pre, which does not prove the exact lifecycle and would admit an unexpected extra generation.

A second standing blocker remains on this exact script: the reservation-generation-changed falsifier still calls fci1_assert_replace_held against the canonical allocation root. The prior wet-transaction ruling required this destructive mutation under a run-unique disposable control store, leaving the canonical positive path as reserve → independent observation → release.

Required repair shape:

1. Separate directory-substrate standing from slot prestate. SlotAbsent and SlotFree{generation,...} are both available canonical prestates; held, unreadable and undecodable refuse.
2. Move the generation-change falsifier to a disposable run-unique store using the same production CAS mechanism.
3. Make canonical restoration exact, not merely monotone: with the falsifier removed from the canonical root, SlotAbsent → Held(1) → Free(2) and SlotFree(N) → Held(N+1) → Free(N+2). Any other generation, path, state, or release outcome refuses. Cleanup must consume the same exact fold.
4. Correct the postcheck language: a successful append-only CAS lifecycle cannot restore the allocation leaf to byte-empty. It must end semantically Free with durable generation history. Requiring an empty directory after success would contradict the store's no-delete construction.
5. Add discriminating controls for absent-slot admission, exact absent→free and free→free transitions, unexpected extra generation, and the disposable generation mutation.

Any repair push invalidates scaffold review 5062636554; request a new exact-head scaffold approval after this closure is frozen.

No root execution of tools/fabric_ci_fci1_live_instrument.sh, no wet reservation effect, no undrafting, and no merge is authorized on this head.

APPROVED — scaffold temporary-introduction decision only, bound to exact head 647314cf02bff663cc595f386c1fe3b0ecf6b4f9, tree b91fbb7843ce8015dabeb9885f65091036c2e790.

Exact derived new-obligation set: one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. Its bytes changed from the prior approved population as part of repair commit 8a48900a7f6db46ff882576574a25bbb5ead4a23, but the obligation population did not expand and the dissolution condition remains modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

Approval basis: modeled lifecycle actuation sufficient to sequence this wet gate from .dag still does not exist. The repaired carrier remains narrowly bounded to fixed FCI-1 entries: exact-tree binary calibration first; fixed host/EUID and substrate/prestate assertions; framed named-file transport; fixed transient submitter units with systemd-run status consumed; canonical reserve/observe/release sequencing through the production entries; the generation-change mutation on a run-unique disposable store; the exact SlotAbsent/SlotFree restoration fold on both ordinary and cleanup paths; and explicit RuntimeDirectory/unit terminal observations. It exposes no arbitrary Work command and does not construct the semantic reservation or restoration verdict in shell.

This review does not authorize root execution of the instrument, the FCI-1 wet reservation, undrafting, or merge. Wet authorization remains a separate ruling and still requires executed failure-closure evidence that every path leaves the canonical store in the exact expected Free generation with no residue, while every inability to observe refuses rather than passes. In particular, later no-unit-residue evidence must report the observed unit state; mere helper success is not a substitute for showing collection/removal.

Identity note: 647314cf02bff663cc595f386c1fe3b0ecf6b4f9 directly merges fa2d403dc8e08c6841b6521ae5209e1522449b95. During this review, main advanced to 9c34ed7a3b8b19226d35c992a3c37ec621530b34. That does not change this exact scaffold subject, but this approval establishes no current-main parity, integration carry, or merge readiness.

Any push changes the scaffold subject and invalidates this approval.

APPROVED — replacement scaffold temporary-introduction decision only, bound to exact head ead1fa42c5e4d3cfe9586fdfb2566467afafcb60, tree d8db46d3c16f8d665167c2b6a6c1d331cfb97516.

Prior scaffold approval 5066157275, bound to 647314cf02bff663cc595f386c1fe3b0ecf6b4f9, was correctly spent by this push and supplies no carry.

The exact derived new-obligation population remains one independently removable scaffold unit, tools/fabric_ci_fci1_live_instrument.sh. The parent delta is the single commit ead1fa42c5e4d3cfe9586fdfb2566467afafcb60; it changes that scaffold plus the production control entry and its enrolled witness, and introduces no second scaffold authority. The dissolution condition remains modeled lifecycle actuation sufficient to sequence a wet gate from .dag.

The strengthening closes the two static scaffold concerns named in the preceding ruling:

• AllocationSlotUnreadable now has an authorable, effect-free discriminator: fci1_assert_unreadable_slot_refused, paired with the enrolled witness_fci1_unreadable_slot_is_never_available, and invoked before host preconditions or reservation effects. An unreadable slot cannot satisfy availability.
• unit_terminal_observed now admits only raw LoadState=not-found with ActiveState=inactive|failed; a loaded terminal unit refuses. Successful observations emit the unit name and both raw states. The dependent RuntimeDirectory check rejects both an existing path and a symlink and emits the raw absent standing after the dependent capture and again from cleanup.

All five checks on this exact head are SUCCESS: required-witnesses-build, required-witnesses-floor, rust-unit-tests, fabric-evidence, and witnesses. The PR is open, mergeable, and still draft.

This approval authorizes only temporary inclusion of the named scaffold at this exact subject. It does not authorize root execution of the instrument, the FCI-1 wet reservation, any failure injection, undrafting, or merge. Wet authorization still requires the subsequent same-head packet to demonstrate every injected failure reaching the exact canonical semantically-Free generation with no residue, raw unit not-found, RuntimeDirectory absence, unchanged cell substrate, no Work start, and every unobservable condition refusing.

Current main is not integrated into this head, so this review makes no current-main-parity or merge-readiness claim. Any push, merge, amend, or other head movement invalidates this approval.

REQUEST CHANGES — final scaffold approval withheld at exact head 1a8f67130e66df5e0cba364d7481139762deada2, tree 3fb47ff0354eab8d8552c01ae417cf19f84a959c.

The major structural direction is accepted: the checkpoint vocabulary is closed and validated before the cleanup trap/effects; checkpoint exits use reserved status 86; cleanup is observation-directed rather than boolean-directed; a disposable store is removed only after its cleanup observer succeeds; and terminal zero-Work is now a live observation. All five exact-head checks are green. Those facts do not close the following failure/receipt gaps.

1. A real post-commit observation refusal can still leave the canonical slot held. fci1_live_reserve_and_observe_available commits first and only then builds the full RequiredBuildCellLifetimeSample. If the cell observation refuses after the CAS commit, the submitter returns before publishing the held wire. Cleanup sees the Held slot, but fci1_synthetic_held_sample depends on the same full cell observation; if it remains unobservable, cleanup returns CanonicalCleanupRefused without releasing. The same coupling exists for a disposable Held(1)/Held(2). That satisfies “cannot observe refuses” but violates the equally mandatory “every failure path restores and leaves no residue.” Repair this with a reservation-only typed cleanup observation/receipt, independent of the cell-substrate join, that verifies the exact slot, holder reservation/payload/content and generation before releasing once. Alternatively, durably publish that cleanup authority immediately after commit and before the fallible full-cell observation. Add a discriminator for the commit-succeeded/full-observation-refused path.

2. Several checkpoint runs still lose the raw evidence they are intended to prove. Cleanup never writes a cell before/after receipt. Therefore before-canonical-commit, after-canonical-commit-before-transport, after-held-preserved, after-release-before-grading, and runtime-directory-terminal can finish cleanup while cell_before remains only in FABRIC_CI_VALUE_ROOT, which cleanup deletes. In addition:

   • after-release-before-grading retains no held sample: CanonicalAlreadyExactFree has pre/post/restoration but not the held payload/content, while positive_before is deleted.
   • the generation falsifier retains no exact ReservationGenerationChanged(expected=1, observed=2) receipt or Held(1)→Held(2) coordinates; fci1_assert_generation_changed is only a green ProcessExit, and the Free(3) path can end with only the terminal Free observation;
   • the RuntimeDirectory falsifier retains no typed lifetime-dependent receipt or its held sample; dependent_before is deleted after a green assertion.

   Each checkpoint must preserve its own complete retained evidence before scratch deletion. A green assertion is not a raw observation. Cleanup must write the same sealed cell before/after coordinates for every effect-reachable checkpoint, and the canonical/disposable/lifetime receipts must retain the exact held samples and typed expected/observed verdicts.

3. Cell “cannot observe” states are still comparable as if they were observations. fci1_live_cell_observation serializes FabricCellObservationDenied and FabricCellObservationNotApplicable into ordinary strings, and fci1_path_owner_wire serializes PathOwnerUnobserved likewise. fci1_grade_and_write_cell_receipt then accepts byte equality. Two equal denials—or two equal owner-read failures—can therefore pass as an unchanged cell. Replace the string-only acquisition with a closed admitted/refused result: denied, not-applicable, or any owner/group read failure must make both the before acquisition and after grade refuse, never enter the comparable admitted carrier. While repairing this receipt, expose the five live boundary-property values as well as the derived boundary digest; the current member state digest/hash is not the requested raw property population.

4. The zero-Work service census is active-only. fci1_zero_work_observation reaches host_converge_slice1_enumerate_units, which wraps systemctl_list_units_active_services. An inactive or failed fabric-cell@*.service is omitted and can yield supervisor_units=[]. This repository already distinguishes that blind reader from systemctl_list_units_all_states; use the all-state population for the zero-service claim, with an unreadable enumeration refusing.

5. The exact terminal subject and the retained-bundle contract remain under-specified. fci1_allocation_prestate erases CellFree.released_by, so canonical/disposable cleanup can admit a Free value at the expected generation without proving it is the Free payload for this reservation. Carry and compare the release identity/content in the terminal observation. Also make the bundle self-identifying and complete: retain an actual CheckpointReached receipt, the unit/RuntimeDirectory observations, emit the exact receipt-root plus finalized manifest digest, and enforce a checkpoint-specific required file roster. The current manifest hashes whatever files happen to exist, so a bundle missing the receipts above can still record cleanup_verdict=0.

The checkpoint injection mechanism itself is acceptable; no signal/race-based replacement is requested. This review is the controlling exact-head scaffold ruling. No root execution, wet reservation, checkpoint run, undraft, or merge is authorized on this head. Any repair push spends this subject and requires a new full-head/tree scaffold ruling.

REQUEST CHANGES — exact-head scaffold approval withheld

Subject:

head  719b0350bd1525dbf4ebaa9f3016e7cd828040ca
tree  2695d186d79e8fce2c06221ea070fa1f0fff211e

The five checks are green and several parts of review 5068553241 did move in the required direction: cleanup now has a reservation-only carrier, the generation and lifetime falsifiers write typed receipts, cell denial and outer owner-read failure take refusal arms, the service census includes inactive/failed units, and the slot observer retains Free release identity/payload/content. The scaffold is still not safe to execute. Five blocking findings remain.

1. The disposable cleanup authority is stale after Held(1) -> Held(2), so even the ordinary positive run cannot finish

generation_authority_path is written only by the first fci1_live_reserve_and_observe_available, so it names the generation-1 holding. fci1_assert_replace_held then commits generation 2 and accepts no authority path, so the stored authority is never advanced.

Cleanup requires exact authority/holding generation equality, while exact-Free admission requires post_generation == authority_generation + 1. The consequences are deterministic:

• generation-held-two and generation-changed-observed enter cleanup with Held(2) against authority(1), so cleanup refuses and leaves the disposable root;
• the ordinary path and generation-free-before-removal release Held(2) to Free(3), then grade Free(3) against authority(1), which can admit only Free(2).

Thus the no-checkpoint run itself reaches generation-terminal and refuses, and its trap repeats the same refusal. This is not a missing wet receipt; it is a source-level impossible green.

The replacement transition needs its own exact generation-2 cleanup authority, made available before or atomically with the replacement commit, and the matrix needs a discriminator that executes Held(2) -> Free(3) through that authority.

2. Publishing cleanup authority after commit leaves a modeled residue edge

fci1_live_reserve_and_observe_available first receives CellReserved and only then performs Filesystem.Write(cleanup_path, authority). ReservationCleanupAuthorityWriteRefused therefore occurs after the durable holding exists. On that branch the trap cannot decode an authority; canonical and disposable cleanup refuse without releasing.

This moves the old gap one instruction earlier: full-cell observation refusal is recoverable only if the post-commit authority write succeeded. It does not close write failure, process loss, or any interruption between commit and publication.

Pre-materialize the exact expected authority before the CAS commit, or make authority publication part of the same atomic effect. A failed authority publication must imply no commit occurred. Add the opposite control for commit eligibility with authority publication refused.

3. Manifest finalization manufactures missing evidence instead of refusing it

There is one fixed required_receipts roster for every checkpoint. For every absent member, cleanup writes a shell-authored ReceiptCoordinateNotReached|... file without setting cleanup_status, and then compares the population after those placeholders have filled it.

That is neither checkpoint-exact nor missing-member refusal. A required producer that exits zero but emits no receipt is silently converted into a complete manifest. It also means the ordinary path intentionally carries placeholders for phase-inapplicable files, but no typed relation says which absences are legal for which checkpoint.

Derive an exact required/allowed population from the selected checkpoint. A missing required real receipt must refuse finalization. A not-reached coordinate may exist only as a typed checkpoint-specific disposition, not as a universal shell fallback capable of replacing any evidence file.

4. The cell carrier still does not seal one observation

fci1_cell_receipt_observation acquires an admitted fabric probe, then reads the three owner/group coordinates and the raw boundary values. But its admitted wire is built by fci1_cell_observation_wire(decision), and that renderer performs three additional live owner/group reads through fci1_path_owner_wire.

Therefore an outer owner read can succeed, a second owner read can fail, and the carrier still returns Fci1CellReceiptAdmitted with owner_group_unobserved=... embedded as comparable text. The boundary has the same subject split: the member digest comes from the probe's boundary acquisition, while the five raw properties are read again afterward. fci1_live_cell_observation then transports only wire, discarding the raw baseline fields.

The equality fold and retained before/after coordinates are still not projections of one sealed observation. Acquire probe members, owners, and raw boundary properties once into one admitted/refused value; make every renderer pure; transport the complete baseline value rather than only the string wire.

5. The purported all-state service census still names only three states

systemctl_list_units_all_states binds the exact selector active,inactive,failed, and Systemctl.ListUnits passes that as --state. That closes the earlier inactive/failed blind spot, but it is not a state-complete population: a matching unit in any other runtime state is omitted and may yield supervisor_units=[].

For a zero-population claim, enumerate the complete matching loaded-unit population without a state subset, then judge it. An unreadable enumeration must continue to refuse.

Disposition

exact-head scaffold approval       REFUSED
root instrument execution          NOT AUTHORIZED
wet reservation                    NOT AUTHORIZED
checkpoint injection               NOT AUTHORIZED
undraft                            NOT AUTHORIZED
merge                              NOT AUTHORIZED

Do not execute this head. Any repair push spends this exact review subject and requires another full-head/tree scaffold ruling. Wet authorization remains a later, separate ruling even after scaffold approval.

REQUEST CHANGES — exact-head scaffold approval withheld

Bound subject:

head  8265651fec850c1e717b42547053148b553d88ae
tree  fc28db7814812d6b13ec8c469fc841ddb134cf44

The corrections in the handoff are accepted. The red on 5c0004072... did not establish a carrier defect: one failure was inherited generated drift repaired by composing current main, and the other reproduced on pure main. The measured srv3/session-container/BuildBuddy contrast also supports the intended abstraction: the missing fact is a finite execution entitlement, not machine RAM or architecture. The typed Fci1BoundedExecutionContext, its single property-population projection, live cgroup/manager agreement, one-axis cwd/budget controls, and exact normal-exit-86 live row are all the right direction.

Twenty-one enrolled and executed witnesses are materially stronger than zero. They do not yet supply scaffold approval, because two answerability gaps remain at the exact boundary this pass is intended to close.

1. The executed bootstrap route is still a second systemd-run authority

extdeps.systemd.systemd_run now owns systemd_run_property_argv, systemd_run_transient_wait_unit_argv, and the RunTransientAndWait operation. But fci1_bounded_execution_context_emit.dag independently emits the complete shell grammar four more times:

systemd-run --quiet --wait --collect --unit=...
  --property=WorkingDirectory=...
  --property=MemoryMax=...
  --property=MemoryHigh=...
  -- ...

The committed bootstrap fragment is what the live instrument and bounded controls actually call. They do not consume systemd_run_transient_wait_unit_argv or the modeled operation. Thus a mutation to the purported systemd authority — removing --wait, moving --, dropping a property, or changing lifecycle vocabulary — can leave the executed FCI-1 route byte-identical.

The emit witness does not close that gap. It compares the emitter with another complete literal spelling of the same fragment, including the numerical values and every launcher word. That mirror can red on edits to the emitter, but it cannot red when the generic modeled authority and the executed bootstrap route diverge. This is the same class as the earlier local-fold agreement witness.

Repair this to one route. Either:

1. derive the bootstrap launcher/template from the modeled wait-operation/property authority and make the generated artifact a projection of that authority; or
2. make one modeled shell-template authority the sole producer consumed by both the generic operation and FCI-1.

Do not retain one typed argv authority plus an independently authored emitted command that happens to agree today. The qualifying witness must join the committed executable artifact to the one authority at token identity; it may not compare two local restatements.

2. Status 0 plus unit collection does not establish normal completion

The new model itself records the relevant limitation: systemd-run --wait has been observed to return 0 for a signal-killed default transient service, while normal nonzero exits may be preserved. That distinction is load-bearing here because the new finite memory ceiling makes OOM/signal termination an in-domain outcome.

The positive parent and submitter rows currently do only:

fci1_run_bounded_...(pure entry)
assert unit LoadState=not-found

They require no inner terminal value produced after the gunbc entry completes. Therefore a signal-killed/OOM-killed service that emerges as systemd-run status 0 can satisfy both observations: shell success and collection. The exact exit 86 -> 86 row proves one normal-exit branch; it does not distinguish normal zero from signal death reported as zero.

Add a run-unique, subject-bound normal-completion receipt written only after the pure entry returns its expected typed result. Require that receipt in both positive routes and make absence, malformed content, wrong unit/run identity, or signal termination refuse. For the wet driver, an outer status 0 must likewise be insufficient without the exact inner evidence identity/terminal receipt. Do not call the outcome Completed merely from the systemd-run process code when the boundary admits that it cannot classify signal death.

3. The owed mutation must mutate the subject authority, not its oracle

After the two repairs, perform the declared red/restore demonstration through the actual no-reservation route. At minimum:

single authority omits finite MemoryMax
  -> regenerated executable route changes
  -> parent and submitter pure controls refuse HostBudgetUnreadable

byte-identical authority restore + regeneration
  -> both controls return to green

Also demonstrate the normal-completion carrier by preventing its publication while preserving unit collection; the positive control must red. A mutation of the witness's expected literal, a mock response, or an unused modeled route does not count.

The receipt must bind the mutation and restore trees, generated-artifact digests, binary digests, exact control route, and zero-effect observations. This is evidence of discrimination for named axes, not a claim that arbitrary witness non-vacuity is universally decidable.

Current disposition

typed bounded-execution-context concept       ACCEPTED
finite MemoryMax / MemoryHigh derivation       ACCEPTED IN DIRECTION
live manager+cgroup agreement                  ACCEPTED IN DIRECTION
one-axis cwd/budget matrix                      ACCEPTED IN DIRECTION
executed launcher has one authority             NOT ESTABLISHED
normal completion under bounded execution       NOT ESTABLISHED
subject-mutation red/restore                     STILL REQUIRED
exact-head scaffold approval                     REFUSED
root bounded controls                            NOT AUTHORIZED
root FCI-1 execution                             NOT AUTHORIZED
checkpoint injection                             NOT AUTHORIZED
host mutation / Plan replay                      NOT AUTHORIZED
undraft / merge                                  NOT AUTHORIZED
source repair                                    AUTHORIZED

The ownerless 500 ms floor-cost instability and the stale pull-request merge-run subject are separate gate/instrument defects. They are not attributed to FCI-1 source here, but a failed required workflow cannot be used as exact-head green evidence. Bring the replacement full head/tree after the source repair and CI adjudication; no operational authorization carries across the push.

REQUEST CHANGES — the timing refusal is non-adjudicating, and two previously ordered source boundaries remain open on the current head.

Bound subject:

head  3049061c17d567d7638e591515dc0320aeaa4b61
tree  df2cc55d94d63c6afd19e7ba2bf61f9f14148ff2
run   33648868054 — terminal failure

Accepted closures

The newest source repair is real. fci1_assert_replace_held now returns the non-Held prestate refusal before constructing or writing the replacement cleanup-authority path; the missing branch close that initially made the else ineffective is present on this head. The sentinel/dispatch cleanup work and the source mutation that made the enrolled target witness plus its same-axis companions red are useful evidence. Twenty-one enrolled witnesses executed and returned true before the required floor refused.

That mutation establishes that the mutated .dag fact is load-bearing to those witness verdicts. It does not, by itself, establish that the same fact owns the shell words actually executed on srv3.

1. The modeled launcher is still not the executed bootstrap launcher

The generic authority remains systemd_run_transient_wait_unit_argv plus systemd.SystemdRun.RunTransientAndWait. It owns the ordered launcher vocabulary and property/command expansion.

The bootstrap emitter still independently writes complete commands for:

fci1_run_bounded_driver
fci1_run_bounded_submitter
fci1_run_bounded_dependent_submitter
fci1_run_unbounded_memory_control

Each function re-authors systemd-run, --quiet, --wait, --collect, the unit spelling, the property words, --, and command expansion. The wet instrument and controls execute those emitted shell functions, not systemd_run_transient_wait_unit_argv.

Therefore the source mutation can make the .dag witnesses red while the executed bootstrap command remains unchanged, or vice versa. The mutation is discriminating over one subject; it has not yet made that subject the execution authority.

The required repair from review 5091370073 still stands: model one launcher template whose tokens include literal words plus unit/property/command expansion sites, and derive both the service transport and bootstrap Bash from that template. An equivalent single-authority construction is admissible; two complete spellings are not.

The authority mutation demonstration must then show:

remove finite MemoryMax at the one template/property authority
→ regenerate
→ parent and submitter actual command bytes both change
→ actual pure routes refuse HostBudgetUnreadable

restore authority byte-identically
→ regenerate
→ both actual routes complete

A floor-only witness red does not replace that executed red.

2. Collection plus status zero still does not prove normal inner completion

The positive controls still call fci1_run_bounded_driver / fci1_run_bounded_submitter and then require only terminal unit collection. The bounded /bin/bash -c wrapper validates cgroup files and execs gunbc; it writes no run-unique terminal receipt after gunbc returns the expected typed result.

This repository's own systemd boundary already records that exact signal-death status is not reliably preserved by this systemd-run --wait realization. Thus these two worlds remain observationally collapsed:

inner gunbc reaches the expected typed success and exits normally
inner process is signal-killed while systemd-run reports status zero, then unit collects

The ordinary exit 86 -> 86 row proves normal nonzero propagation. It does not distinguish the zero/signal pair.

Require a run-unique completion receipt, bound at least to route, nonce, exact binary/entry identity and expected typed outcome, written only after the inner pure entry returns that outcome. The outer control must require the exact receipt in addition to status and collection. Missing, stale, symlinked, duplicate or wrong-run content refuses. Add the opposite mutation: suppress or corrupt completion publication while allowing the unit to collect, and require both positive routes to red.

3. The 500 ms result is a broken answer, not a green to chase

The six-run measurements support the common-mode diagnosis:

cpu_ms(run, witness)
  = shared_run_context(run)
  + witness_marginal(witness)
  + residual

The shared run term dominates the identity term. Precision: six samples do not prove mathematical unboundedness of the distribution. They prove that the repository models and enforces no upper bound on that shared term, which is sufficient to invalidate a fixed per-witness source-correctness threshold.

Do not rerun 33648868054 to hunt a sub-500 sample. A green replay would classify a different realization of the same tree, not answer whether the tree is correct. Do not raise the number, and do not add these fourteen identities to an identity-grained cost-debt roster; the observed defect is at run-context grain.

The source authority is not actually ownerless: v2.workflow.required_floor owns required_floor_claim_cpu_safety_limit_ms and changed_witness_cpu_deadline. The operational session may be archived, but the repair belongs to that authority and its executor realization.

Minimum admissible repair:

1. separate semantic witness verdict from execution-safety interruption;
2. represent interrupted CPU measurement as right-censored/non-adjudicated, never as a claim failure or a measured duration;
3. carry execution-context identity on completed observations too;
4. move shared preparation/common-mode cost to a run-level observation, leaving only a justified marginal quantity at witness identity grain;
5. until that denominator exists, make the 500 ms performance line observational rather than preemptive for this correctness path, while retaining a separately named, substantially coarser runaway-safety boundary that does not attribute its firing to witness semantics.

The current run remains not adjudicated because execution was interrupted and required timing/provenance receipts were not completed. It cannot support scaffold approval. A source repair and new push are required; a rerun of this event is not.

4. #10021 is not presently a merge predecessor

A separate commit-bound review on #10021 has found that it equates guest-visible Firecracker RAM with outer host-cgroup MemoryMax, omitting VMM/realization overhead, and calls six guest vCPUs the cell's CPU envelope while the cell currently realizes only relative CPUWeight, not an absolute CPU entitlement. Its green pair discriminates exact equality, but exact equality is the wrong law. That PR is blocked pending a host/guest envelope split.

Consequently, do not wait for or perform the current #10021 merge, and do not authorize the srv3 controls on this pre-integration FCI head.

Current disposition

replacement prestate before actuation       ACCEPTED
missing branch close                        ACCEPTED
witness enrollment/execution                ACCEPTED
reported source mutation discrimination     ACCEPTED at witness subject
single executed launcher authority          OPEN
normal inner completion discriminator       OPEN
500 ms correctness attribution              REFUSED
run 33648868054                              NON-ADJUDICATING
#10021 current-head merge                    NOT AUTHORIZED
srv3 bounded-control argv                    NOT AUTHORIZED on this head
scaffold approval                            WITHHELD
wet matrix / checkpoint injection            NOT AUTHORIZED
undraft / merge #9693                        NOT AUTHORIZED

Controlling sequence

The three source repairs may proceed in parallel:

A. #10021: separate host cell envelope, guest machine envelope, and realization budget
B. required-floor: separate run-context cost, witness marginal cost, and runaway safety
C. #9693: one launcher template + run-unique normal-completion receipts

Then:

merge corrected A and B to main
→ merge then-current main into #9693
→ regenerate only through authority
→ exact-head required CI reaches a complete verdict
→ freeze full head/tree and checkout-local binary
→ request one-shot authorization for exactly:
     sudo <absolute-exact-checkout>/tools/fabric_ci_fci1_bounded_execution_controls.sh
→ adjudicate actual parent/submitter positive and negative receipts
→ fresh scaffold ruling
→ separate wet authorization

Current main has already advanced beyond both open subjects. No root command or branch merge is authorized merely to preserve today's composition.

AMENDMENT TO REVIEW 5092882385 — the immediate timing predecessor now has a concrete owner, and it is narrower than redesigning the whole 500 ms policy.

#10068 at head a556a51ce98a6a3c1e99820706dbbcd6d7989832 adds the common producer gunbc.self_host_compile_phase_frontier.compile_phase_frontier_standing to the cross-claim pure-share authority. Its changed event subject measured one shared fill serving 22 claims across three modules, moved the relevant consumers from approximately 430–503 / 494–502 ms to 75–107 ms, reached interrupted_before_verdict=0, and completed all required jobs successfully. Review 5092929804 accepts that content while withholding merge authorization for its now-stale main composition.

This changes the FCI-1 predecessor as follows:

immediate source of this head's 501/500 censoring
  -> #10068 is the owner and candidate repair

whole 500 ms per-claim policy / run-context attribution defect
  -> remains open and is NOT retired by #10068

FCI-1 need not wait for the entire performance-policy redesign if, after #10068 lands and current main is integrated, its new exact-head floor receipt establishes a complete semantic partition with every required FCI witness reaching a verdict, failed=0, and interrupted_before_verdict=0. That run is usable for correctness because no timing arm censored the semantic observation; the 500 ms number itself is not cited as evidence.

This is not permission to rerun the current event, raise the threshold, or accept a lucky sub-500 redraw. #10068 changes the charged work and predicts a large directional drop; it is a new subject, not a replay.

The other blockers in 5092882385 are unchanged:

one launcher-template authority              OPEN
run-unique normal-completion receipt         OPEN
#10021 current equality-based microVM model  BLOCKED
srv3 control execution                       NOT AUTHORIZED
scaffold approval                             WITHHELD

#10094's broader zero-walk cross-frame serve may repair other producer families, but is not an FCI-1 predecessor once the exact compile-phase producer repair in #10068 lands.