[UTEL] Complete operational collection and selected receiver adoption

Owner

Programme /root owns programme reconciliation and cross-repository acceptance. /root/v2_acceptance owns the selected first offline local-diagnostic source slice and combined .github integration; /root/passive_capture completed the modern native-capture reader/journal/spool source window and records its bounded candidate closure; Programme /root owns further runtime acceptance. Coordination provider owners and Home/SystemAdmin retain their implementation, receiver, credential and native-operation scopes.

Done when

Operational UTEL collection is qualified across the selected producer, receiver/store and delivery paths, with actual dispatch and usage coverage, recovery/correction and explicit unsupported or Unknown cases. Historical effects are reconciled under their original identities; a fresh success does not settle them.

Current deliverable

Accepted4705/4707 scopes remain: actual compatible Host0.8.0/uv14 cutover, genuine canonical transport/fact admission,48canonical joins/12real browser assertions and scoped independent retirement. Later batch2 reconciliation6495426191 freshly verifies the original October23 applied post/independent acceptance6369730466 and settlement6369752837:24new identities plus prior25unchanged,49current identities/zero corrections, processed1/awaiting0, credential removal and original retirement. A current bounded stable local client read agrees: two applied outcomes with original digests,0ready files, sequence2/pending=false and two retained producer gaps. This is current client state, not fresh receiver health/ingestion. No batch2 drain is pending. PR4922/ab171b8d separately delivers the source fault-coverage report and active Atlas49ee4a3f, with reviewed/tested/delivered tree identity and all relevant checks green. It adds no runtime test/gate. Whole attribution/interruption/Unknown/recovery/correction/retention/rollback and adoption remain owed.

Next action

After the user-prioritized shared runner→bake→registration→firstBAR boundary, Root/Home select the remaining genuine interruption/Unknown/recovery/correction and attribution/retention/rollback/adoption journey with exact current source/configuration/custody and separate original bounds. Reuse accepted4705/4707 and October23batch2 remote application/settlement; current local metadata shows no ready batch or pending intent. Do not send batch2 again, request another credential for it, invent an ordinal or repoint/clone queued state. Root retains the exact next runtime selection; Home is already application custodian. The source transport-coverage evaluation is delivered; any optional narrow storage-operation fixture remains a separate later scoped decision, not another completion prerequisite.

Blocked on

Remaining genuine installed interruption/Unknown/recovery/correction, complete attribution, retention/rollback and adoption assertions need their actual current inputs/custody and separate operation selection after the primary shared-native/firstBAR path. Compatible Host0.8.0/uv14 cutover, authenticated durable ingestion and batch2 application/settlement are accepted, not missing original suppliers or pending drains. Today's client state supplies no fresh remote health/receipt readback. Original outage-time gaps, failed/Unknown effects and all439inherited+46later holds remain unreleased. No complete modern-provider/period coverage, zero unknown cost, off-machine recovery or wholeUTEL acceptance follows.

Acceptance evidence

2026-10-29 batch2/current-client reconciliation6495426191 and source coverage/capture acceptance6495254001 supersede older pending-drain/source-preparation planning only. Full Done when/history/OPEN/Blocked preserved.

2026-10-29 supplier reconciliation6494527715 retains closed4705/4707 actual acceptance and all original limits; full Done when and historical evidence remain unchanged. No new native operation or field transition.

The independently accepted canonical continuation used two fixed genuine CLI 0.106 capture/report calls with complete matching raw output and scoped process cleanup. It advanced 24 to 48 native identities and one to two ready batches, preserved all prior observations and the first batch, and retained owner/generation and source cursor continuity. Fresh before/after checks preserved old diagnostic/offline queues, canonical configuration/descriptor/public CA and the global 0.106 selector; canonical producer state intentionally advanced. Restricted original receipts and Root acceptance retain the original 0.528-second execution and timely collection. This is partial historical-prefix normal continuation only: attribution, cost and delivery remain Unknown, with no complete current programme population, installed crash/full-spool recovery, authenticated receiver or browser acceptance. No further capture follows from this reconciliation.

Independent original-operation acceptance now additionally verifies published Host 0.7 production staging (55 exact payloads; old live service unchanged) and the distinct canonical persistent CLI 0.106 local capture (three zero-exit, reaped calls in 0.679 seconds; 24 native-prefix observations, one ready batch and identical capture/report bytes). Restricted original receipts and independent readback retain the exact clocks, stream hashes, source/package joins and scoped process cleanup. Prior diagnostic/offline state and selector bytes were preserved; current binding-4 preimage evidence was unavailable and is not claimed. These results do not establish prospective complete coverage, resume/full-spool behavior, authenticated receiver delivery, production cutover or browser acceptance. The earlier late-collection original and all failed/partial bootstraps remain unqualified.

Current independent reconciliation and Home source disposition records the accepted disposable old-backup restore, genuine published schema-12-to-13-to-14 migration and Host 0.7 backup/isolated restore. Restricted original receipts, raw streams, original clocks, package/source joins and independent Root acceptance preserve both failed/partial bootstraps and the distinct successful continuation. The actual backend reported SQLite 3.53.4; all 15 original facts and source-permitted table/journal changes were verified, with the original backup and live old receiver unchanged. Coordinator/Creator source PR4680 merged at 21:07 UTC; publication/installed adoption remain separate. Proper canonical TLS is accepted, but no authenticated application ingestion, browser journey, production cutover, durable replacement custody or HDD/off-machine recovery is claimed. Home v6 r4's 43-control independent SOURCE PASS does not qualify native execution. The full outcome remains open; all historical evidence below is retained.

Accepted original Host0.7 candidate/preflight/publication and promoted release above, with native all-eight/journal/feeds/custody joins; current guarded Host0.7 source delivery PR4678, exact accepted source/tree and actual engine/package runs above; earlier guarded source delivery PR4675, exact engine/package runs and source/tree correspondence above; current Atlas contract/telemetry-host records source/receipt-profile boundaries and contract/passive-native-usage-observations retains partial capture, attribution and delivery separation. Accepted original candidate run39124245029, source/tree and authenticated artifact above; the prospective native Action results and root acceptance are retained in restricted custody under Atlas private/telemetry/installed-candidate-native-capture-boundary. Original trial deviations remain retained separately. owning plan; release and selected-store acceptance; containment evidence and authority evidence. Broader installed/fleet coverage is not established by those scoped milestones. Unified v3 outcome index. Existing-rights information accepted; manager-reader source task selected. No repeated policy listing is requested. Source selection does not establish actual manager-reader access or native acceptance; original failed listings and reservations remain unchanged. Home confirmed selected-plan read and implementation start.

The passive collection decision in the owning source candidate records local-observation independence and the separately open modern-reader/receiver acceptance windows. Delivered Atlas IDs platform/passive-local-telemetry-readiness-boundary and programme/forward-recovery-unavailable-history retain source-only limits; protected delivery is verified at315cb9a7a592b90e4afa9507c9ce04f912aa671b. The first offline and following modern passive-capture source windows are complete. The modern source contract is contract/passive-native-usage-observations, with executable-qualification process record platform/executable-qualification-and-final-assembly; source scope remains distinct from installed behavior and receiver acceptance. The broader UTEL outcome and modern provider/receiver acceptance remain open. Earlier complete issue bodies, owners and receipts remain preserved in original custody.

Receiver input reconciliation: [verified current access/service metadata](https://github.com/FS-GG/.github/issues/4516#issuecomment-6253495420), [completed stable address](https://github.com/FS-GG/.github/issues/4516#issuecomment-6253487948), and [independent address disposition/next owner action](https://github.com/FS-GG/.github/issues/4516#issuecomment-6253569367). Private topology, custody and operation receipts remain restricted.

Receiver backup/isolated restore, actual TLS refusal and current export-source disposition; same-journal original-context source boundary. Original receipts and operational topology remain restricted.

Canonical TLS, current isolated-tool result and delivered export/journal source reconciliation. Restricted Atlas retains private operational custody; full outcome and original Unknowns remain open.

Decomposition design and scoped remaining acceptance: https://github.com/FS-GG/.github/issues/4701; `docs/coordination/2026-10-19-board-clearing-lifecycle-design.md` (owning source plan; publication remains separate). Next bounded result: https://github.com/FS-GG/.github/issues/4705; native creation/link/enrollment and actual acceptance remain separate.

## Accepted deterministic orchestration integration — 2026-10-21

The user accepted the comprehensive framework and product workspace orchestration design and requested Coordination-board incorporation. That LEARN issue holds the complete design, source findings, replacement contracts, delivery sequence and integrated acceptance.

UTEL integration: observe the ordinary deterministic controller, framework workspaces and product workspaces through the existing observation store. Add bounded references for assessments, candidate/exclusion reasons, profile/specification identity, assignments, real waits, native lifecycle/configuration/resource use and accepted outcomes. Retain retrievable assessment artifacts, whole-original lineage, immutable provenance and explicit missing coverage. PostgreSQL execution authority and SQLite observations remain separate. LEARN statistical enrollment is optional and cannot block otherwise qualified ordinary execution. Preserve the existing receiver, installed crash/full-spool, correction, coverage and recovery acceptance.

Source incorporation: the existing accountable owner includes this requirement when preparing the relevant next contract/roadmap delivery and captures its durable ADR/Atlas references. No new implementation owner, worker dispatch, runtime activation, publication, issue closure, project-field change or reservation release is made by this issue amendment. Existing original evidence, operations and remaining acceptance are preserved.

User research incorporation — transport fault coverage against OpenTelemetry

Root/existing UTEL owner uses OTel resiliency as a coverage benchmark for the CURRENT SQLite-WAL/immutable-batch/receipt/dedup/correction implementation. Map receiver outage beyond retry horizon, full queue, process restart before/after durable handoff, full/failed disk, duplicate/lost acknowledgement, misconfiguration and correction replay to existing executable tests and actual remaining operational assertions. Mark covered, missing or unavailable evidence; add a focused test only for an identified gap.

For each hop distinguish queued, durable locally, accepted remotely and corrected/projected. Upstream acceptance without a retained receipt remains ambiguous; retry must preserve original batch/operation identity and existing receiver dedup semantics. Storage failure must not be reported as successful delivery or zero cost. Keep original outage-time observation gaps separate from accepted4707 receiver/browser scope.

No additional collector framework/exporter migration is selected; the current scope excludes that replacement. Reconsider an exporter adapter only for a demonstrated maintenance benefit with equivalent attribution/corrections/receipts and explicit scope decision. Whole4638/4640 still needs genuine installed receiver/interruption/recovery/assessment/adoption evidence.

Reference: https://opentelemetry.io/docs/collector/resiliency/

This is a bounded evaluation disposition incorporating the user’s research, not runtime/publication authority or a new completion dependency. Existing owner, accepted source, full Done when and actual operational prerequisites remain. Home native managed-owner work stays primary. Use the existing v3 prior-art appendix as research: docs/roadmaps/fsgg-v3/02-prior-art-and-research.md explicitly does not amend operating policy. Root owns eventual concise cited decision capture at reviewed delivery; owning issue remains authoritative meanwhile. Benefits unmeasured. No additional scheduler, status ledger or framework is selected.

Root supplier reconciliation — accepted live receiver/cutover and genuine receipt supersede the stale pending-installation/ingestion body; full UTEL remains open.

Fresh native reads verify4705 and4707 CLOSED/COMPLETED. 4705 independent acceptance6344445603 establishes one genuine pre-existing25-event passive-home-canonical-v1 batch durably received/applied by actual Host0.8.0/uv14, canonical fact admissions and ingest facts+25, matching original envelope digest and unchanged neighboring receipts. Credential copies were deleted as selected. It explicitly leaves batch2 pending,2producer gaps, programme/activity attribution Unknown, and the original reservation/effect holds unchanged. No new send or current queue state is inferred here.

4707 final acceptance6396226736 reuses that upstream guarantee and accepts current receiver configuration10402680,48/48 canonical joins,12actual browser assertions and independent unit/process/cgroup/profile retirement. Its earlier actual Host0.8.0 schema14 compatible cutover and faithful migration are accepted, not merely staged Host0.7. Retained outage-time producer gaps and failed-supervisor effects remain unproved. This child acceptance is not complete parent attribution, interruption/recovery/correction, retention/rollback or assessment/adoption.

Root's next operational selection must first read current canonical association/queue/batch identities, receiver/store/configuration and existing credential-reference custody, through Home's existing protected route. Only an actual unchanged pending original can be considered for a separately admitted credential delivery/drain; no invented next ordinal, replay, repointing, cloning or client-secret reuse. Reconcile any already completed retention cleanup before selecting it; elapsed time alone is not cleanup evidence. Attribution completeness, genuine interruption/Unknown/recovery/correction and actual installed adoption remain at their owning scopes. The independent optional transport-coverage research6470054902 does not add another completion prerequisite.

Atlas github/utel-producer-association-identity@f7993302f695430a0ee938b1b3684fdfec4055bddb378b52c81785c0319e8c98 was retrieved and all3 immutable source citations independently verified. Home is already the user-selected application custodian, not an unrecovered external owner. Root WORKING on reconciliation/source selection and primary4778 review; Home WORKING on current runner source repairs. No second custodian or telemetry operation is requested during that checkpoint. After that boundary, Root owns the smallest current identity/custody read and exact remaining operation selection with Home; completion is actual current readback, not this historical supplier correction. All439+46 Unknown holds remain. Whole4638 remains OPEN/Blocked.

Root accepts the requested transport-coverage preparation6470054902 at source/documentation scope.

PR4922 merged2026-10-29T11:18:45Z asab171b8d397a07bc8541854ffd9298b54bd8e905. Reviewed/tested/delivered treed91418376d6edc8696eed367fad31dfd5e0c5f5c is identical; independent exact-head source review APPROVE, all53 observed checks succeeded and2 intentionally skipped, with native head/App15368 joins. The report maps eight fault scenarios to existing source assertions and separately retains4705/4707 installed scope. Local18Atlas controls/history/guidance and maintained projection/manifest checks pass; original missing-tool/dependency/generated-bytecode failures remain recorded, not erased. No telemetry tests, runtime fault operation or publication was performed for this prose/capture delivery.

Active Atlas github/utel-transport-fault-coverage@49ee4a3f2a8918bdbbafb312cfa807d9982800d13d29ee292c6c0daad8b9b8f1 was independently retrieved after protected delivery. All457baseline entries remain and both shipped seeds agree. This closes the research-coverage capture gap only; other current native/contract capture gaps remain Root-owned.

Existing retry/spool/dedup/crash/correction controls are not to be duplicated merely to claim progress. Actual storage-operation failure is a possible narrow future test selection, not a new completion prerequisite. Root owns any later scoped choice. Full4638/4640 still require genuine current custody and remaining installed interruption/Unknown/recovery/correction/attribution/retention/rollback/assessment/adoption. No source/knowledge merge closes either Outcome, changes StatusBlocked, sends a batch, restores credentials or releases any original hold. Root continues primary4778 source diagnosis and reconsideration of independently useful remaining work; Home retains existing custody/runner ownership.

Root current-client and prior-original reconciliation — batch2 was already applied and settled; no drain/credential restoration for it is needed.

The determining retained acceptance is later than4705's October22 window: Root6369730466 independently accepts the original October23 applied post, exact24batch2 identities/kinds/revisions/canonical digests, all prior25facts/five receipts unchanged,49current identities/zero corrections, actual provenance/profile and retirement. Root6369752837 records the one completed producer settlement at16:32:07UTC, exit0/processed1/awaitingApplication0, exact applied original, credential removal/path absence and collector retirement. Both native comments were freshly read. No new send/post/settle was run.

A bounded read-only stable-file observation of the existing mounted canonical client at2026-10-29 verifies the unchanged association scope, two applied local outcomes with the accepted original digests,0ready files, sequence2/pending=false and the same two explicit producer-gap codes. Config480B SHA256c43be85fe26268113e1144f00b47ada91005525d03eb5febf521a5718c216059; current private metadata3159B SHA256cb1345ae19be84bfa8316d96d8da3678e12064385ad4fae244487970b45587c9. The configured engine is a bare command and resolves on currentPATH; a literal-path existence test would not establish absence. No raw producer events, keys or source copies enter this public record.

This current observation proves the local client view only, not a fresh receiver/store read or current remote service health. The genuine prior remote acceptance/settlement is reused from its canonical original record.4707's later48-observation/browser joins retain their accepted scope. The older pending-batch2 wording is historical, superseded for next-action selection by this reconciliation; do not mint a new ordinal, resend, clone/repoint queued state or request another credential for this completed batch.

Root next selects the remaining genuine interruption/Unknown/recovery/correction/attribution/retention/rollback/assessment/adoption journey with Home after the primary shared-native/firstBAR boundary, reusing accepted source/receipt evidence and refreshing only determining current inputs. Home retains application custody, Root integration/selection; no new telemetry runtime worker or operation is active. Primary4778 source diagnosis remains active in parallel. All original failed/Unknown effects and439+46holds remain. Whole4638/4640 stay OPEN/Blocked.

The delivered4922 report deliberately describes4705's earlier historical acceptance scope; this later accepted batch2 receipt/settlement is the authoritative continuation for future operation selection. Root owns incorporating that navigation at the next meaningful knowledge delivery rather than repeating another qualification or publication.

Root/fdev ruling, 2026-10-30 (owner's standing decision grant): telemetry receiver route.

Corrections to the earlier Root statements.

The receiver is the FS.GG fsgg-telemetry-host HTTPS receiver. It is not OTLP.
The legacy Main Host 0.1.1 receiver (telemetry.main.internal = 169.254.1.2:8443) refuses connections from fdev.
The UTEL receiver fsgg-store (Host 0.8.0/uv14) is live inside fdev on :8447, after the 2026-10-30 full cutover. Its TLS was verified, with the CA "FS-GG Home Telemetry 20261003 CA".
--telemetry-unavailable local-clr-resource-hold on deliveries has nothing to do with the listener. It records held local CLR execution, and must not be described as a listener workaround.

Ruling.

The legacy Main 8443 listener is obsolete for new work. The VM is the only security zone, and the receiver moved into fdev under the owner's "full cutover" choice.
fdev's producer gets a fresh enrollment against fsgg-store under ADR-0094 custody: a distinct principal and key, explicit provision/enroll, and no repointing, cloning or re-sending of the old main-fsharp-dev queued state. That old queue stays historical and retained, and its coverage gap stays recorded.

#4638's own remaining journey (interruption/Unknown/recovery/correction plus assessment/adoption/rollback) is selected to run against the live fdev receiver. The batch2 identity is not re-sent. It stays sequenced after the shared-native/first-BAR path unless Root re-sequences it.

Root/fdev decisions, 2026-10-30, under the owner's standing decision grant. These cover the fresh telemetry enrollment (recipe in .github#4983).

Option B is admitted. A new workspace and store is created with init, with a fresh producer id that never appeared in association history. The live utel-home-20261003 counts (49/48) and batch2 stay untouched.
Receiver custody. Under the VM-only security-zone ruling, in-VM custody is cooperative. Root acts as receiver custodian inside fdev, using in-VM sudo under the owner's standing delegation, as for [LEARN-01.2/.4–.5 / Akka orchestration] Qualify installed LEARN observation, persistent receiver and causal acceptance #4647 and [V2-LANG-01.2 P3–P5 and full .5 adoption] Complete portable workspace execution and polyglot adoption #4648. Each custody step is recorded with before/after hashes. No secret value is printed or committed.
ADR-0094 "outside the development container". That requirement is superseded by the VM-only zone ruling. ADR-0094's other rules still bind: a distinct principal and key, no key reuse, explicit enrollment, and Programme accountability.
CA trust. /etc does not persist in fdev, so no system trust anchor is added. The producer uses SSL_CERT_FILE pointing at the public "FS-GG Home Telemetry 20261003 CA" kept under the persistent home. If the engine does not honour it, the result is recorded as Unknown and we stop.
Spool. A new empty spool root is used, and activate-remote runs via fdev-telemetry exec. The old queue and its gap are never touched.
Admitted now: journey steps J0 (baseline) and J1 (enroll plus health). That includes the receiver stop/start window. The rollback is staged before the first write.
Not yet admitted: J2 and later, each of which needs its own admission. J9 depends on Host 0.9.0 for Claude-transcript provenance, which is prospective; it is recorded as Unknown.

J0 + J1 executed under the Root decisions of 2026-10-30T20:38:09Z (fresh enrollment recipe in .github#4983). Option B: new workspace fdev-vm-20261030, new producer fdev-vm-main, stream coordination. No telemetry was submitted. The only drain tick ran on an empty spool. The old queue and utel-home-20261003 were not touched. No secret value was printed, logged or committed.

Result: J0 and J1 complete. One fault occurred and was rolled back and retried (see Fault).

J0 baseline (before any write)

host.json SHA-256 10402680a98cc06c9731b0988a9d90e95add23abde55b6cecc54096702eb8d69 (the configuration hash accepted on Qualify the first installed facts-and-coverage provider-to-browser journey #4707). Copy kept in the receiver config directory and in private scratch.
status --config JSON SHA-256 375346f984d3ff3dbed064e2125a3115860837ff4006b111ad270c99a715d737: one store, utel-home-20261003, ready, lifetimeReceipts 6, pending 0, schema 14.
Live store telemetry.sqlite3 SHA-256 13bb564a615dc9f294619fe44e6d2466f2e422646a91e8dda7f633f92053debb.
Old spool top-level listing hash 9ca9c42620405368eccebc4c72511728c4ecf545ec95d55219205fcec7a87f59.
Old client directory renamed to ~/.config/fs-gg/telemetry-main.retired-20261030 (contents intact, 0700).

J1 receiver side (as `fsgg-store-dev` via in-VM sudo; host process runs as in-container `telemetry`)

Fresh CSPRNG token written straight to /srv/telemetry/config/home-20261003/fdev-vm-main-v1.secret (0600, 65 bytes). Never displayed.
Redacted diff (the file holds paths only, no secrets):

@@ -8,6 +8,10 @@
   {
    "WorkspaceId": "utel-home-20261003",
    "Root": "/srv/telemetry/data/utel-home-store14-v1/utel-home-20261003"
+  },
+  {
+   "WorkspaceId": "fdev-vm-20261030",
+   "Root": "/srv/telemetry/data/fdev-vm-store14-v1/fdev-vm-20261030"
   }
  ],
  "Credentials": [
@@ -26,6 +30,14 @@
    "ProducerId": "codex-passive-home-01",
    "StreamId": "native-usage",
    "Revoked": false
+  },
+  {
+   "Reference": "fdev-vm-main-v1",
+   "SecretFile": "/srv/telemetry/config/home-20261003/fdev-vm-main-v1.secret",
+   "WorkspaceId": "fdev-vm-20261030",
+   "ProducerId": "fdev-vm-main",
+   "StreamId": "coordination",
+   "Revoked": false
   }
  ],
  "BrowserPrincipals": [

New host.json SHA-256 01948d4418c2886c4ee5f7a251a7371a2781f1725ad6f40ea6136a691bc15c4d.
Stopped only the supervisor program telemetry-home (a narrower scope than stopping fsgg-store.service; the container and sshd stayed up). init returned already-provisioned on the retry (the store was created in the first attempt), enroll-producer returned enrolled, preflight returned ready with stores 2.
After start: status shows utel-home-20261003 identical to the J0 entry (ready, 6 receipts, pending 0), and fdev-vm-20261030 ready with 0 receipts. Status JSON SHA-256 0603b489c16fb01de17529f136511a84c06827c7e3790a9f5992ec8255e1780e. Live store sqlite hash unchanged.

J1 producer side

New ~/.config/fs-gg/telemetry-main (0700): producer-main.secret 0400 (equal to the receiver file by cmp, not printed), telemetry-ca.crt and client.json (endpoint https://fsgg-store.lan:8447, workspace/producer/stream as above).
CA: "FS-GG Home Telemetry 20261003 CA", SHA-256 fingerprint CB:20:40:91:E8:5C:82:09:FA:FE:89:EB:4E:AD:1E:AE:29:F3:4E:E5:D4:45:BA:3D:62:9A:21:29:D9:3F:79:C8; the file hash 4073c67a4a073bbd04497d57421b71d8d042e5204d9743bd87beee6f76cc089b equals the receiver's own public ca.crt. No /etc anchor was added.
SSL_CERT_FILE honoured by the .NET runtime on fdev: an unauthenticated GET fails TLS without it and returns 401 with it. The engine's own TLS path is Unknown until the first real submit or drain of a ready file, because activate-remote and an empty drain make no network call.
First authenticated request fdev-telemetry health: exit 0, body {"status":"ready"} (output SHA-256 682c055ddf7d0afe32b7b2646e1635ab3c83f65884a37aecdc8549e7031a3417).
activate-remote --credential-reference main with new empty spool ~/.local/share/fs-gg-private/telemetry-spool-fdev-vm-20261030 returned activated. ~/.config/fs-gg/telemetry.json SHA-256 c8dc92176eddda8fbe34c7ef7fd11b8c91663e388415a4738d0218566d4af4d4.
workspace status: configured, pending 0, pendingDurablyReceived 0, pendingUnacknowledged 0 (SHA-256 d8fa0d02e7c5b01d38a0d740a8f62771be9ec70096852e44141f029278cfa8a0).
The 21:43:43 CET drain-timer tick printed "draining remote telemetry" and {"schema":"fsgg.telemetry.workspace-drain/1","processed":0,"awaitingApplication":0}. The "waiting for released durable-receipt CLI" message is gone.
Old spool listing hash after: 9ca9c426… (unchanged).

Fault and findings

First stop window: podman exec without -i dropped stdin, so host.json was installed empty, enroll-producer refused (invalid-configuration), and my rollback wrote it empty again. The host could not spawn for about 13 seconds. I restored host.json from the in-container cp -p copy (hash back to 10402680…, original mtime), restarted, and verified: J0 status hash identical, live sqlite hash identical, no-auth health 401. Window 1 ran 20:39:37Z to 20:40:09Z. The retry used -i and a post-install hash check; window 2 ran 20:40:35Z to 20:40:52Z.
activate-remote refused configuration-directory-unsafe: ~/.config/fs-gg was 0755 and the engine requires exactly 0700. I set it to 0700 (it holds only the telemetry client directories). Rollback is chmod 755.
The drain timer runs without SSL_CERT_FILE. It is harmless while the spool is empty, but the first real drain of a ready file needs the variable in its environment (for example a user-unit drop-in under the persistent home). I made no such change and ask Root to admit it with J2.

Timeline (UTC)

2026-10-30T20:38:57Z start J0/J1 under Root admission comment IC_kwDOS6feoM8AAAABhWVSKA (2026-10-30T20:38:09Z)
2026-10-30T20:38:57Z old client dir renamed to telemetry-main.retired-20261030
2026-10-30T20:39:06Z rollback staged: host.json hash+copy (scratch + beside original)
2026-10-30T20:39:11Z J0 baseline status captured
2026-10-30T20:39:25Z fresh token written to /srv/telemetry/config/home-20261003/fdev-vm-main-v1.secret (0600 telemetry); value not displayed
2026-10-30T20:39:37Z STOP window begins: supervisorctl stop telemetry-home
2026-10-30T20:39:43Z host.json replaced (after-hash 01948d4418c2886c4ee5f7a251a7371a2781f1725ad6f40ea6136a691bc15c4d)
2026-10-30T20:39:45Z init ok (new store)
2026-10-30T20:39:46Z ROLLBACK triggered: enroll refused
2026-10-30T20:39:56Z FAULT: stdin not forwarded by podman exec (no -i); host.json written empty; init had run; restoring from in-container copy
2026-10-30T20:40:09Z host.json restored (hash 10402680a98cc06c9731b0988a9d90e95add23abde55b6cecc54096702eb8d69); telemetry-home start issued
2026-10-30T20:40:28Z fixed: podman exec -i; stdin staging verified against after-hash
2026-10-30T20:40:35Z STOP window 2 begins
2026-10-30T20:40:40Z host.json installed, hash 01948d4418c2886c4ee5f7a251a7371a2781f1725ad6f40ea6136a691bc15c4d
2026-10-30T20:40:42Z enroll-producer ok
2026-10-30T20:40:43Z preflight accepted
2026-10-30T20:40:52Z telemetry-home start issued (STOP window 2 ends)
2026-10-30T20:41:00Z receiver restarted; status after captured
2026-10-30T20:41:20Z producer dir created: secret 0400, public CA, client.json
2026-10-30T20:41:24Z first authenticated request: fdev-telemetry health
2026-10-30T20:41:46Z activate-remote with new spool /home/developer/.local/share/fs-gg-private/telemetry-spool-fdev-vm-20261030
2026-10-30T20:41:59Z FINDING: activate-remote refused configuration-directory-unsafe (~/.config/fs-gg was 0755; engine requires 0700); chmod 700 (was 755)
2026-10-30T20:41:59Z activate-remote result: see exit above
2026-10-30T20:42:03Z workspace status captured

Corrections are recorded in .github#4983 (head b511c2c). Rollback for everything above: restore host.json from host.json.before-fdev-vm-enroll-20261030 and restart telemetry-home; enroll-producer --revoked for the principal; rename the retired client directory back; chmod 755 ~/.config/fs-gg. J2 and later are not admitted and were not started.

Step	Producer view	Receiver `fdev-vm-20261030`
Before	pending 0	lifetimeReceipts 0, pending 0
After capture	pending 1, pendingUnacknowledged 1, no marker	unchanged (0)
Drain 1	marker status `durably-received` (processed 0, awaitingApplication 1)	lifetimeReceipts 1, pendingReceipts 0
Drain 2	outcome status `applied` (processed 1, awaitingApplication 0), ready file removed	lifetimeReceipts 1

Done-when element	In this slice	Evidence
Producer, fresh enrollment	Accepted. New workspace `fdev-vm-20261030` on the live receiver, distinct principal and key, explicit enrollment, no repointing or re-sending of the old queue	J0 to J2 and the recipe (PR #4983, merged)
Receiver/store	Accepted. New store alongside `utel-home-20261003`; both read normally; the old store and old spool were hash-identical after every step, including now	J3, J4, J7, comments above; controls re-read 2026-10-31T18:07Z
Delivery path	Accepted. Unattended drain (four ticks, then all of waves 1 to 2b); lost acknowledgement; revocation; retention bounds	J5, J11, J12, J13
Recovery/correction	Partly. Backup and copy restore into a copy only; correction mechanism on a throwaway Host (synthetic, not natural)	J7, J8
Usage coverage	Claude Code usage now measured: Host 0.9.0 published, read back, org feed verified independently (observer PR #5006 merged), live cutover, one Claude capture, then the closed backlog	steps 1 to 9
Browser	Accepted for the scoped assessment (not a rerun of the earlier twelve assertions)	J10
Historical effects	Untouched. The old store, old spool and legacy queue were only read	controls

Path (under `/srv/telemetry/`)	Files	Bytes
`backups/fdev-s7-seal-20261031/`	4	2,101,248
`releases/host-0.8.0/`	56	17,528,064
`backups/fdev-vm-j7-20261030`	5	1,049,235
`supervisor.d/telemetry-home.conf.before-s7`	1	689
`config/home-20261003/host.json.before-J10-20261030`	1	1,833
`config/home-20261003/host.json.before-fdev-vm-enroll-20261030`	1	1,472
Total	68	20,682,541

Element	Status
Producer, receiver/store, delivery paths	Met. Fresh enrollment, new store beside the old, unattended drain and capture on timers, retention bounds checked (J0 to J13, steps 1 to 9)
Usage coverage	Met for Claude, forward-only. Host 0.9.0 published, read back and cut over; 11,501 backlog identities exact against an independent recomputation; continuous capture of new and grown transcripts now running
Dispatch coverage	Unsupported. Usage is per response, not attributed to dispatches (no codex-exec dispatch ran; Claude attribution stays Unknown)
Recovery and correction	Partly met, rest explicit Unknown. Backup and copy restore, lost acknowledgement, revocation and a labelled-synthetic correction passed. Natural correction, installed interruption and recovery assertions are Unknown
Explicit unsupported or Unknown cases	Met by this list: dispatch attribution; natural correction; receiver-side expiry of applied receipts; disk-full behaviour (J6, never run); off-machine backup pull (#5043, closed not planned); closed transcripts that predate the baseline (not counted, by the forward-only decision); responses after a malformed transcript row (reader skips them until the next prompt); a stopped timer is not coverage (the marker disables it until cleared)
Historical effects reconciled under original identities	Closed by decision, not by evidence. Root decided the work is forward-only; #5044 (historical reconciliation) and #5043 (off-machine pull) are closed as not planned. The old store, old spool and legacy queue were only read, never changed, and their held effects stay unreleased

[UTEL] Complete operational collection and selected receiver adoption #4638

Description

Owner

Done when

Current deliverable

Next action

Blocked on

Acceptance evidence

Activity

EHotwagner commented on Oct 28, 2026

EHotwagner commented on Oct 29, 2026

EHotwagner commented on Oct 29, 2026

EHotwagner commented on Oct 29, 2026

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

J0 baseline (before any write)

J1 receiver side (as fsgg-store-dev via in-VM sudo; host process runs as in-container telemetry)

J1 producer side

Fault and findings

Timeline (UTC)

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

Drain-unit drop-in

Engine honours SSL_CERT_FILE

The capture (normal producer path, no synthetic input)

Delivery

Unchanged controls

Notes and Unknowns

Timeline (UTC)

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

EHotwagner commented on Oct 30, 2026

65 remaining items

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

EHotwagner commented on Oct 31, 2026

Done-when, mapped to this slice

Step 9 (closed backlog) is closed, with these numbers

Coverage limits (recorded, not repaired)

Explicit Unknown or unsupported cases

Root-retained, outside this slice

Deliveries and knowledge

EHotwagner commented on Nov 1, 2026

EHotwagner commented on Nov 1, 2026

1. Rollback artifacts deleted (after a read-only health check)

2. Continuous capture: live

3. Forward scope and the Done-when

4. Knowledge

EHotwagner commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

J1 receiver side (as `fsgg-store-dev` via in-VM sudo; host process runs as in-container `telemetry`)

Engine honours `SSL_CERT_FILE`