The route-proof world's hand-built promotion is deleted: the world runs over
stub host programs, so Routing installs and proves the route for real and
every former promote_by_hand is a real step. The salvage fixtures of the old
B2 are not ported.
New tests pin each ruling under its own mutation: a full ledger still admits
and counts every survival actuation, first deployments are metered, a refused
preflight starts no private-mount unit and fails at once with the reopen time,
the actuation log slides, a clock step stalls nothing past one window, a
failed challenge ends the pass instead of losing a CAS, a proved challenge
clears the degradation, both storms are bounded, restarts are spaced,
counted in the mint and read from the target's own log (unreadable history no
longer stops crash recovery), and the v3 lift is pinned over golden bytes cut
with the 583b2a7 encoder, refusing a record that shows retired meters.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
8212b9d15d