Imagination pass for cut tree-executable-members (session
self-2026-10-23-eureka-b): seal, digest and receipt facts, symlink rule,
live binary and install path, disk sizing for the acceptance job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reading the clock after the cached result still left the answer to ordering; the
one place freshness is decided is the age subtraction, and monotonic time cannot
run backwards, so a result stamped after the reading is fresher than it and ages
zero. The bound test names 86400 and 86401 so raising the constant is caught.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The test clock's wall now starts a Unix-epoch away from the monotonic clock, so a
deadline or schedule that reads the wrong source fails. serving_state reads the
cached probe before the clock (a stamp is taken before it is stored, so the later
reading is never behind it) and ages with saturating_sub; the test that pinned the
old wrong answer is replaced by a deterministic descheduled-reader test. The
lease-wait, startup and heartbeat seconds are bounded to one day at parse with a
refusal that names the flag and not the value, and every deadline is computed by
one saturating helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clock gains monotonic_millis; the cached health result's age, the freshness
decision, the probe schedule, heartbeat and lease/startup deadlines all read it.
Wall time stays on the signed record only. A result stamped after now is not
evidence. Tests step the wall clock both ways, pin the warming-proof cap, and
bound the lease-timeout join.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PresenceAcceptor serves one connection at a time within a 1 s deadline and never ends on an accept error; a dead presence thread fails the unit. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The member candidate port is derived from the candidate port; both stable sockets get firewall rules; native targets render the same bytes as before. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul s1 fixes. Credential placeholders resolve files under
$CREDENTIALS_DIRECTORY only, never an environment variable. The route
acceptor has a first-byte deadline, a total challenge deadline and a
connection cap with unspawned refusal; a dead acceptor degrades presence.
The shared lease lock is a plain descriptor the child inherits, so the lock
lives as long as any writer. Tests pin a late-healthy child and a hung probe.
One commit: the spawner and lease trait signatures change together with
their fakes. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Does not build-verified yet; tests follow. drivers.rs: holder-side lease read, one lease-binding rule shared with grant.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Cuts c2-phase-split, c2b-owner-deadlines, c2c-post-fence-forward, c2d-continuity-yields with their Soul passes; installed on Yggdrasil 2026-10-20 00:34 UTC.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
If the boot lift returned Err, boot logged and served with nothing held, so
every pending continuity abort ran and stopped a running candidate. Boot now
sets lift_unsettled; retry_held_lift runs the lift for each continuity abort
until one succeeds, and no abort step runs before. Boot's call moves into
Engine::boot_lift so the failure is testable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The lift kept an abort running for any awaits_handover Deploy, so a braked
Deploy released a held record to an abort that stopped the only copy of the
body. One predicate, deploy_the_continuity_yields_to (candidate unproven, a
waiting Deploy that deploy_can_move), is now what both the deadline's yield
and the lift ask (rulings c2d-yield-only-unproven-to-movable,
c2c-lift-defers-on-observe-error).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two tests, from Soul's h2 attacks: a running candidate at boot beside a braked
stop-then-start Deploy at its Sealing tail, and a held (unobservable)
candidate when such a Deploy appears. Both must leave the candidate unstopped.
They fail here: the lift treats any awaits_handover Deploy as a reason to keep
aborting.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serving_proven (Committing, or routing evidence recorded) ends the yield:
yields_to_a_deploy replaces retries_forward, and wait_for_owner reads it, so
a Deploy no longer waits on an owner that will keep serving. deploy_can_move
asks the deployment brake live for a Deploy at its Sealing tail, so a braked
Deploy draws no yield and the yield happens once the brake releases. The
tests of 04389e6 are repaired to reach their worlds (the failures they
showed at 1beca61 were the right ones). Rulings
c2d-yield-only-unproven-to-movable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fail at 1beca61 (the c2d logic is 81bfb03's): a Committing continuity past
its deadline yields to a waiting Deploy and stops serving; a stop-then-start
Deploy at its Sealing tail with the deployment brake unreleased draws the
yield. The second test releases the brake and pins that the yield then
happens and closes the continuity's operator-required incident Recovered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An abort over a candidate the boot lift could not observe is held in
process memory: resume_candidate runs no step of it and retries the lift
each pass (retry_held_lift) until observation answers Ok (lifted) or the
driver proves the candidate dead (the abort proceeds). The predicate and
write move into consider_lifting_continuity_abort, which boot and the
retry share. Ruling c2c-lift-defers-on-observe-error.
The page and the expire refusal name the manual exit from the plan's
workload binding: a unit to stop for systemd, a process to kill for a
host actuator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fails at 81bfb03: an observe error leaves the abort running and its first
step stops the candidate. Also pins the lease_withdrawal==Complete conjunct
(case LeaseWithdrawalRecordedComplete) and makes the refusal table's
dead-candidate case provably dead (SwitchWorkload::bury).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
resume_candidate removes the transaction's backoff when the resolver
moved its record, so a yield abort is not held behind the forward retry's
backoff (ruling c2d-yield-mechanics). return_wedged_continuity_aborts_forward
skips an abort whose target holds a Deploy awaiting the handover. Tests:
the yield table, the unit rows, the c2b waiter-still-ends row, the
backoff spend, and lift case (vii).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A continuity past its deadline at or past Fencing begins its own
post-fencing abort when a Deploy on its target awaits the handover; the
waiter keeps waiting on an owner that retries forward. Adds
retries_forward and awaits_handover, both derived.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Red at e529858: the waiter ends FailedBeforeFencing owner-left-to-operator.
The yield (ruling continuity-yields-to-deploy) lands in the next commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflict in begin_post_fencing_abort: kept c2's now_millis binding and
the hotfix's bounded_detail in place of truncate. The owner-wait note
written by wait_for_owner now goes through bounded_detail too; every
other c2/c2b/c2c detail writer already did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
