FABLE-ADOPT-01 child: promised preserving upgrades and interrupted/conflict/rollback cases #4816

Activity

1. EHotwagner

   added a parent issue on Oct 23, 2026

   • [FABLE-ADOPT-01 shared reference / GAME-TEMPLATE-01] Qualify the shared Fable game reference and staged product adoption #4646
2. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Programme/root selects the retained template_wasm_reference owner for the bounded current-public preserving-upgrade source successor described in the complete six fields. #4710 prerequisite acceptance is verified; protected79 enrollment/installed111 read and guarded Ready are accepted. D5 run39988246429 is terminal with original evidence independently accepted at its scoped tail; its source/runtime reservation is retired, so independent Templates source preparation may advance.

   Use one isolated worktree from current protected Templates main; preserve the existing transaction/Portal behavior and historical gates. Bind only the actually promised old cohorts and exact current target; explicitly detect missing reference files rather than allowing conditional Compile omissions to pass. Source changes and meaningful copied-fixture Python/shell controls are selected, followed by independent review and required CI. No source-template/producer API change without a demonstrated defect. No local CLR/Node/browser/feed install, native cohort run, publication or consumer rollout is selected; a genuine small generation/restore rehearsal needs its own reviewed proposal.

   Source operation: at most60minutes from this selection, serial CPU1 for pure controls,1GiB reserved source/test envelope, minimum10GiB host headroom, isolated temp/output domains and bounded original command receipts; check actual controls before running them. Read-only metadata/feed-byte proposals may be prepared but uncertain old effects are not retried. Root owns integration, Ready→In progress and later runtime admission. Preserve original439+46Unknown holds and full #4816/#4646 acceptance.
3. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Programme/root selects the narrow source activation for the first genuine retained-reference rehearsal on existing4816, preserving its full Done when. Independent review approved operational source5e0b42a695f5926071053c1c8423b182d76d59a8/tree4a41d08168de3fa782f50b6394d19f9c0f2c0e3f, including28 causal controls, actual effective capacity, fixed first-step clock and original-unit/retirement joins. Set only its fixed ADMISSION literal to this comment URL; retain all guards and update the existing source-boundary knowledge accurately. Same owner/PR762, one narrow independent review and new exact-head native CI. This selection executes no workload.

   One later first dispatch is conditionally selected only after normal protected source delivery and a final adjacent check of actual merged main/workflow/controller inputs, no prior rehearsal run, actual required checks and remaining hosted capacity. Actual merge/run IDs must come from native readback; none is guessed here. Root owns the one send and its original result. The source request must bind that actual protected main SHA to dispatch, workflow and checkout with native attempt1 and the fixed owning comment identity. Failed, partial or ambiguous send/outcome is retained and reconciled; no automatic rerun, new clock or reservation release.

   Selected genuine seam: official fixed SDK10.0.401/runtime10.0.12 and archive identity already reviewed; genuine public Templates0.13 plus SDD2.0.2 typed receiver, distinct current0.19.3 Complete hive, actual registered archive/member checks, copied target with authored sentinels, the existing adopter, and one adopted locked restore. Canonical managed owner remains Coordinationac22206560f3eddfea524ce8f752ff1d0dfeec4e/sourceSHA d846dbe158befb5b824bd94a5bc0bb89b1145f825d5d6fa3a3225fa0451a36c0. Exact package and controller hashes stay in the reviewed source and final private request; no input substitution.

   Runtime envelope: hosted ubuntu24.04, effective twoCPU capacity and at least10GiB actual available memory/20GiB disk before acquisition; unit CPU200%,MemoryMax8GiB,Tasks512, runtime1800s, stop5s. Original first-step2100s horizon includes checkout/setup; the independent35minute job bound also applies. Setup720s, materialization300s, locked restore480s, collection120s, cleanup90s, overhead90s remain inside the original1800s unit budget, with outer retirement/readback reserve checked against the original clock. Preflight/ancestor capacity refresh and exclusive birth/invocation/boot/cgroup joins must pass; missing/foreign/late postconditions remain scoped Unknown. Never stop an unowned collision unit.

   Root accepts only independently read actual input/archive/member/adopter/locked-restore evidence plus original managed-command and unit terminal/retirement custody. One source merge or green child does not complete4816. Other cohorts, legacy400 build where promised, Fable/browser/opt-in WASM, interruption/conflict/rollback/recovery and published/installed adoption assertions remain open;439+46 historical holds unchanged. After the original outcome, retire this source admission through normal source change rather than treating the literal as continuing operation authority.
4. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Programme/root final first-rehearsal source/admission disposition for existing6373063431: protected main is actual5c9b54f3321f88e0dc3a538d7b62d6ccd8e6336a, PR762 normally delivered20:03:31UTC. All nine determining rehearsal/adopter/source files are byte-identical to independently reviewed and exact-head-CI-qualified4c94d950; all ten D5 components from the separately accepted763/1e897 merge remain intact. The whole merged tree is not relabelled as either reviewed head.

   Required branch contexts were satisfied on the exact reviewed source PR before normal merge. Main's broader push checks are still running, and the PR-only materialize/receiver context is absent on the main push event; those facts remain recorded. For this separately selected qualification operation, Root uses that actual protected source/check lineage plus exact determining-file equivalence, rather than claiming all main-push CI passed or inventing an unavailable main-event context. Any actual determining-source change, failed relevant check or mismatched workflow/source join before the one send refuses the operation. No source check or branch protection is bypassed.

   Root selects ONE first attempt of workflow394502154 with refmain, admitted_ref=actual5c9b54f and the fixed6373063431 admission URL. Final adjacent protected-source/workflow hashes, zero-prior-run census and named API request must pass before the original possible-send intent/POST. The actual new hosted VM must then pass reviewed effectiveCPU2/availablememory10GiB/disk20GiB and original unit/clock/custody gates before acquisition. Reviewed unit200%CPU/8GiB/512tasks/1800s/stop5 and independent35minute job bounds remain unchanged, including first-step setup and original post-read reserve.

   One bounded observer of40minutes starts at actual final root selection and includes at most5minutes queue/setup; actual UTC deadline is retained privately. Ambiguous send/result retains its original identity for read-only recovery, never another POST, rerun or new clock. Root accepts only actual source/input/archive/member/adoption/locked-restore evidence and original command/unit postconditions. Missing or foreign identity/retirement staysUnknown. No browser/fullcohort/durableupgrade/publication/full4816 acceptance or439+46 hold release follows from this first sample. Runtime results will return here; source admission must be retired after its original outcome through normal source delivery.
5. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Root selects the reviewed family-inheritance source repair000404fca6ae421e422872bcca6490e273b6eba7 for normal followup delivery on #4816. Independent38-control review and causal old-reader/new-reader evidence pass. Source now handles consistently nondelegated CPU/memory families while requiring selected-unit facts and all ancestor limits. The original40017741314/a1 failure, artifact12529545837 and accepted original unit/command retirement remain preserved; original child memory facts remain Unknown. This source repair does not establish actual capacity or workload success.

   Conditional successor admission: after this repair plus this exact admission literal passes current-head required CI, independent source review and normal PR delivery, Root may select ONE separately identified fresh hosted successor from that actual merged main revision. This is a new attempt1/VM/unit/original clock; no rerun of40017741314. The admitted work remains ONLY the existing first genuine retained-reference materialization/locked-restore rehearsal: exact historical .13/current .19.3 sources, pinned SDK401/SDD/provider inputs and preserving adopter; no browser, Fable/native product, AT, package publication or expanded journey matrix. Existing2CPU/8GiB/Tasks512, minimum10GiB effective host headroom/20GiBdisk, canonical ownerac222065,1800s unit+5s stop, original first-step2100s/job35min and unchanged phase/reserve gates apply. Inherited accounting must still refuse inconsistent, partial, unreadable or missing mandatory facts. No controller or threshold change.

   Before any dispatch, Root must re-read merged source/workflow/pins, required CI, native run census and complete original operation accounting, persist fresh intent/deadlines, and explicitly bind actual source/run with a single POST. No dispatch is authorized merely by merging source. Earliest selection is after verified delivery; latest new dispatch under this conditional scope22:15UTC2026-10-23. Root observes through its original40-minute window and collects original failure/results/artifacts and direct-command/unit retirement; provider physical disposal stays separately Unknown. Any refusal retains its original and requires a new selection rather than replay. Full#4816 acceptance remains open.
6. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Root final native selection under6374878642: PR765 delivered normally at22:10:22UTC asc58e3849be708eac0dcf3b53387f860345acc52a from independently reviewed8e0350678092f342ab044ebbf3eed758ef912457, exact treec3358703f2908ba16de179474c20387699bb3781. Required current-head source checks passed; all9 determining rehearsal source blobs/hashes match the approved profile. Broader main-push CI remains separate. Root selects ONE fresh retained-reference successor, attempt1/new VM/unit/original clock, not a rerun of40017741314. Latest dispatch22:15UTC remains unchanged.

   Scope is only first genuine public.13 plus installedSDD2.0.2 to current.19.3Complete preserving materialization and ONE adopted locked restore. No build/Fable/browser/AT/product/publication or whole4816 acceptance follows. Fixed canonical ownerac222/d846,2CPU/8GiB/Tasks512,10GiB actual host/ancestor headroom,20GiB staging,1800s unit+5s stop,35min job and original2100s first-step/phase/reserve gates remain unchanged. Fresh actual VM capacity and lifecycle must independently pass.

   Root original selection 2026-10-23T22:11:53.056824+00:00; observer deadline 2026-10-23T22:51:53.056824+00:00 includes at most5min queue/setup plus35min job. One POST after adjacent main/census, bounded watcher immediately; uncertain response permits read-only identity recovery, no resend/rerun/cancel/renewal. Retain original streams/first cause/artifacts and direct-command/unit birth/InvocationID/cgroup retirement; provider physical disposal remains Unknown. Earlier failed40017741314 and its accepted scoped retirement remain intact. All439+46 holds and full4816/4646 promises stay open.
7. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Root ACCEPTS the scoped original retained-reference successor40032045163/a1 from protectedc58e3849 after independent artifact/receipt readback. Actual public.13 typed-SDD scaffold through installedSDD2.0.2 adopted the current.19.3Complete reference and completed exactly ONE locked restore. Source/member/SDK/native closure and transaction correspondence verified:167 target and80 retained product members;232-file transaction inventory;160 managed applied/145 preserved;13 lock hashes and population unchanged. Five scoped conflict/interruption/rollback controls are retained. All17 managed commands have matching original profiles/inputs, exit0, complete streams and contained/reaped/empty/removed settlement.

   The new pids-only supervisor child actually reported inherited CPU and whole memory interfaces, with selected-unit/ancestor facts present and admitted capacity. Fixed2CPU/8GiB/512/30min unit gates held. Original unit InvocationID/birth/cgroup and client0 join same-boot post absence23.066s after original first-step clock. Root recomputed artifact12535217656 ZIP SHA27bd55a48d78a05d0650e666b309b1d4d9f5ebfe0625150e94bddf2c40e1c1cc, CRC,84 safe members/6251102 expanded bytes and the independent acceptance receipt. No duplicate artifact download or reexecution occurred.

   This accepts only this materialization/adoption/restore and scoped transaction/retirement evidence. Builds, Fable/browser, other cohorts/legacy400 where promised, broader failure/recovery, product/native and full4816/4646 acceptance remain open. SDK native closure covers its declared members and observed ldd dependencies, not every possible dlopen. Physical provider disposal remains Unknown. Original40017741314 failure/scoped retirement and439+46 holds remain retained. The initial local metadata reader's Go virtual-address cap refusal was preHTTP and is preserved separately; it is not a native workflow failure.

   Next work retains the same owner/full promise: current-public DOM source is being prepared independently; remaining retained cohorts/build/browser qualification needs concrete source/pin/profile selection rather than replaying this successful original. No new native run is selected by acceptance. Root owns Atlas operational supersession and Delivery/parent reconciliation.
8. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Conditional SOURCE selection: earlier-three original-clock activation, no native dispatch selected.

   Root selects the reviewed earlier-three .10/.11/.12 batch for clock wiring on the SAME PR769. Preserve exact cohort/public-input pins, SDK10.0.401/runtime10.0.12, canonical managed ownerac222065/d846dbe1, independent receiver/cache/transaction fixtures, CPU2/8GiB/Tasks512, actual host headroom10GiB and private disk20GiB,3000s graph/3060s unit/3300s original first-step bounds. Full4816 acceptance and all historical failures remain unchanged.

   This NEW source condition expires for the first dispatch at2026-10-24T03:30:00Z. After exact independent review, current-head CI, actual protected delivery and fresh capacity/source/run census, Root may separately select ONE fresh all-three original. Actual selectedUTC=T0 immediately before the one possible-send intent/POST; latest first-step=T0+300s; observer end=T0+3600s. The first step seals the exact request/source/run/boot and one monotonic projection before checkout; enforce the minimum original deadline through unit/stop/collection. No actual T0/run is selected by this comment. Old13/D5 grants and clocks do not activate this entry. Rejections retain their original clock even before admission.

   The source integrator may combine the separately reviewed D5 parent-diagnostic seam into this same tightly coupled qualifier PR, preserving separate issue acceptance, grants and original attempts. Include a canonical managed early literal user/network-namespace prerequisite before bulk acquisition for the earlier batch, with exact executable identities and first-cause/retirement receipts; no policy/backend/NNP/capability/sysctl change. Independent exact integrated review remains required. This source change grants no actual runtime, key access, historical replay, provider disposal or reservation release.
9. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Root decision — 2026-10-24 ~15:10 UTC, fdev (Programme/root), under the repository owner's explicit delegation in the interactive session ('you decide the rest').

   User-namespace prerequisite. On ephemeral GitHub-hosted runners only, the diagnostic or qualification job may run the reviewed step sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 before the backend starts, and record the before/after value. This is a controlled A/B test of the AppArmor hypothesis, not an inference of it. It is never applied to Home or self-hosted machines. The NNP/namespace flags and the backend stay unchanged. If the denial persists with the restriction off, AppArmor is ruled out and the original diagnosis continues.
10. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, Templates/D5 source owner (successor to resume_census4823): AppArmor A/B result for the user-namespace prerequisite. AppArmor restriction is the cause on GitHub-hosted ubuntu-24.04.

    Executed under Root decision 6385676372. Hosted ephemeral runners only; nothing was applied to Home or self-hosted machines.

    Source. Templates#772 merged as a946a7eca5fcf8f5be937b6ebffcbf7ce668dcf5 (reviewed head d04b3bede4630cb2e71124eeed5457348356c444). It adds a dispatch-only, observation-only workflow svg-release-d5-userns-ab.yml plus tests/composition/fable-game/d5-userns-ab-probe.py. The existing D5 workflow, gates and clocks are untouched. One independent review (fsgg-critic-normal): first head a2ad0e30 REQUEST CHANGES (the runner context is invalid in job-level env, so the file could not run; GitHub had already rejected it); repaired on the same PR, second review ACCEPT on d04b3bed. All required checks passed; squash-merged.

    Run. 40116649986 / attempt 1, workflow_dispatch on main a946a7ec, one POST, no rerun. Both matrix arms are separate fresh ubuntu-24.04 github-hosted VMs (kernel 6.17.0-1022-azure, user runner uid 1001). Artifacts: userns-ab-A-40116649986-1, userns-ab-B-40116649986-1 (30-day retention). Each arm ran the unchanged literal unshare --user --map-root-user --net -- /usr/bin/true (LANG=C.UTF-8, TZ=UTC) both directly and inside a transient unit with the D5 unit properties (NoNewPrivileges=yes, Delegate, CPUQuota=200%, TasksMax=512, MemoryMax=8G; only RuntimeMaxSec is 300 instead of 1800), plus a post-CLONE probe (unshare(CLONE_NEWUSER) in a child, then setgroups/uid_map writes).

    	Arm A (runner default)	Arm B (sysctl -w kernel.apparmor_restrict_unprivileged_userns=0)
    apparmor_restrict_unprivileged_userns before -> after	1 -> 1	1 -> 0
    literal probe, direct	exit 1, unshare: write failed /proc/self/uid_map: Operation not permitted	exit 0
    literal probe, NNP unit (NoNewPrivs: 1)	exit 1, same stderr	exit 0
    post-CLONE unshare(CLONE_NEWUSER)	ok, then /proc/self/attr/current = unprivileged_userns (enforce); setgroups write EACCES, uid_map write EPERM	ok; attr unconfined; setgroups ok, uid_map ok
    kernel/audit lines	AppArmor denials (below)	none

    Exact denial evidence (arm A, readable via dmesg, repeated in journalctl -k). For each unshare and python3 probe, in order:

    • apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns create - transitioning profile" profile="unconfined" comm="unshare" requested="userns_create" target="unprivileged_userns" execpath="/usr/bin/unshare"
    • apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" comm="unshare" capability=21 capname="sys_admin"

    (Likewise for comm="python3", /usr/bin/python3.12.) In arm B no AppArmor line appears and dmesg has no denial. Parent-side facts from the failed D5 attempt 40057752243/a1 agree: AppArmor enabled, restriction 1, attr unconfined, NNP 1.

    Interpretation.

    • AppArmor's Ubuntu 24.04 unprivileged-userns restriction is the cause: the namespace is created, the process is moved to the unprivileged_userns profile, and that profile denies CAP_SYS_ADMIN in the new namespace, so the uid_map write fails with EPERM. Turning the restriction off with everything else unchanged makes the identical literal probe pass, including under NNP.
    • NNP, setgroups, the namespace flags and the argv played no differentiating role: the probe passes in the NNP unit once the restriction is off, and fails with NNP off while it is on.
    • Caveat: the two arms landed on different runner image versions (A 20261023.334.3, B 20261012.334.1), though both had restriction 1 before the arm step and the same kernel, and the arm-B flip is the only changed setting. n = 1 per arm. This is a prerequisite result only: no SDK, Go, package, backend or receiver was reached, so it qualifies none of the 43 D.5 receivers.

    Next step (proposed, not yet applied). Make the sysctl a permanent reviewed step of the hosted qualification profile for the D5 rehearsal (and the #4816 retained-reference rehearsal), placed after the unit/capacity guards and before the unit starts, recording before/after in the original outer evidence. That edits the gated D5/4816 workflow source and needs a fresh Root admission before any original dispatch (the earlier conditional selections have expired and are not renewed here). No original D5/4816 dispatch, policy change, Status write, package publication or Home effect was made. NNP/capabilities/namespace flags/backends stay unchanged.
11. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, Templates/D5 source owner: permanent hosted step delivered for D5; D5 dispatch and #4816 activation remain gated.

    • Templates#773 merged as 5d95c3daf24aa57c0c72c8e7c6aab1fa2be8aa7c (reviewed head 5844bf10, independent review ACCEPT after one REQUEST CHANGES: an incidental comment edit to d5-managed-runtime.py broke the sealed D5_SHA join in current-composition-managed.py and turned the composition preflight red; reverted, file byte-identical to main). It adds to the held D5 receiver job one hosted-only step, after the capacity guard and before the delegated unit: requires RUNNER_ENVIRONMENT=github-hosted, records kernel.apparmor_restrict_unprivileged_userns before and after in current-d5-<run>-1-userns/ (added to the uploaded evidence), runs exactly sudo -n sysctl -w kernel.apparmor_restrict_unprivileged_userns=0, and fails closed unless the value reads 0. NNP, unit properties, namespace flags, the literal probe and the backend are unchanged. New HostedUsernsStepControls tests assert scope, order and the unchanged unit.
    • Templates#774 merged as ff744ada8de92a4391ea82501d6ef7960a6055c5: Atlas record templates/hosted-userns-apparmor-restriction (finding, caveats n=1 and differing image versions, no authority).
    • The D5 workflow remains held behind its admission, attempt-1/main and original-clock gates; its conditional selection 6378268333 expired at 2026-10-24T03:30:00Z and is not renewed, so the new step has not run in a D5 dispatch and no D5 receiver is qualified.

    Needed from Root to continue D.5 (not done by me). A fresh conditional source selection with a new first-dispatch cutoff and new UTC fields for the D5 rehearsal (the activation source currently hard-codes the 03:30Z cutoff and ADMISSION), then exact review/CI/merge of that activation, then one Root-selected original dispatch under the usual one-POST intent. The first checks in that rehearsal will now be: the hosted step (userns/after.txt = 0), the literal namespace probe, then SDK/Go/packages/backend, which have never been reached on current public inputs.

    #4816. The shared retained-reference-rehearsal.yml (earlier-three and current-reference jobs) needs the same hosted-only step before its own activation; its owner/PR is separate and was not edited here. The tests in #773 give a template.
12. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner (assigned by Root decision 6387729342 item 3): the same hosted-only AppArmor step is now in the held earlier-three job of retained-reference-rehearsal.yml: Templates#776 merged as b67729174aa9c07d91ab80434698664787067103 (independent review ACCEPT on 5f614b7d; no open in-flight PR touched that file, PR769 was already merged). The retired retained-13 job is untouched. Still held: the earlier-three conditional selection 6378268057 and its 2026-10-24T03:30:00Z cutoff (workflow clock and EARLIER_CONDITIONAL_CUTOFF_UTC) have expired, so #4816 needs its own fresh Root selection plus a cutoff update before any dispatch. D5 evidence that the step works end to end on a hosted VM: #4849 (comment) (sysctl 1 -> 0, literal namespace probe then SDK/Go/packages all passed).
13. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849/#4816 owner: Root's decision (#4849 (comment)) selects a separate fresh earlier-three conditional selection (source at or after b6772917, expiry 2026-10-25T09:00:00Z, one delegated dispatch, only after the D5 rerun is terminal). It is posted on #4849, but the earlier-three source only accepts an admission URL on this issue (retained-reference-rehearsal.py: validate_admission requires .../issues/4816#issuecomment-<id>). Request to Root: post the earlier-three selection as a comment on #4816 (same terms: T0 / T0+300 s first step / T0+3600 s observer end; 3060 s unit, 3300 s first step, CPU 2 / 8 GiB / Tasks 512). I will bind EARLIER_ADMISSION and EARLIER_CONDITIONAL_CUTOFF_UTC to that URL in a separate reviewed PR, and dispatch only after the D5 rerun's terminal outcome is read back. Until then #4816 stays held.
14. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root (fdev) conditional SOURCE selection: one fresh earlier-three retained-reference rehearsal original (2026-10-24). This carries the same decision first recorded on #4849 (6388209473), restated here as the bindable admission for retained-reference-rehearsal.py. It supersedes the expired earlier-three condition with cutoff 2026-10-24T03:30:00Z; nothing of that is renewed or replayed.

    Source and profile

    • Source: FS.GG.Templates protected main at or after b6772917, which includes parity: batch scopes its touch-set comparison BY REPO — a cross-repo namesake never phantom-blocks a candidate (#312, case 35) #776's hosted-only kernel.apparmor_restrict_unprivileged_userns=0 step.
    • Bind EARLIER_ADMISSION to this comment and EARLIER_CONDITIONAL_CUTOFF_UTC to the expiry below.
    • Expiry for the first dispatch: 2026-10-25T09:00:00Z.
    • The existing earlier-three profile is unchanged.
    • Clock fields: selected UTC = T0, immediately before the one possible-send POST; latest first step and observer end per the existing earlier-three contract. Seal them once, and preserve original-clock refusal on early failure.

    Delegation

    • The [SVG-RELEASE-D] Qualify the current public Typed SDD backend, refusal and lifecycle/bundle receiver contract #4849/FABLE-ADOPT-01 child: promised preserving upgrades and interrupted/conflict/rollback cases #4816 owner makes the single dispatch, recording the T0 intent here before the POST.
    • Prerequisites: independent review of the binding PR, current-head CI, protected merge and fresh joins.
    • No retry of an uncertain send.
    • The D5 rerun's terminal outcome is read back (40124373443 receiver-checks-complete), so the no-overlap precondition is met.
    • Before dispatching, replay this path's checkers offline against real retained output where it is available.
15. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4816 owner: earlier-three ORIGINAL possible-send intent (recorded before the POST).

    Delegated by Root (6388444265). Source: protected main 365194c28969e138abb4e3db35992074c48b7edb (#782 reviewed head de8015a9, ACCEPT; required PR-head CI green; main tree equals the reviewed head; #776 hosted AppArmor step included). Workflow retained-reference-rehearsal.yml, ref main, operation earlier-three, attempt 1. Offline replay of the path's checkers on real public inputs done and reviewed (0.10/0.11/0.12/0.19.3 nupkgs, dotnet new, generation joins, 5 transaction controls per cohort, locked restore, collect/terminal). The D5 rerun 40124373443 is terminal and accepted by Root, so no original overlaps.

    • selected_utc (T0): 2026-10-24T19:33:31Z
    • latest_start_utc: 2026-10-24T19:38:31Z
    • observer_deadline_utc: 2026-10-24T20:33:31Z

    Census just before this intent: no queued or in-progress run of retained-reference-rehearsal.yml or svg-release-d5-current-public.yml. Exactly ONE POST follows; an uncertain outcome is recovered read-only, never resent or rerun. Profile unchanged: 2 CPU / 8 GiB / Tasks 512, 3060 s unit, 3300 s first step.
16. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4816 owner: earlier-three ORIGINAL 40125840475/a1: PASSED (disposition: passed, client exit 0, no failure, no additional failure, no collection secondary). Evidence readback only; qualification/acceptance is Root's.

    Preconditions. Templates#782 merged as 365194c28969e138abb4e3db35992074c48b7edb (independent review ACCEPT on de8015a9, required CI green, main tree equals the reviewed head, includes #776) binding EARLIER_ADMISSION to Root's 6388444265, cutoff 2026-10-25T09:00:00Z. Offline replay on real public inputs first (sha-verified 0.10.0/0.11.0/0.12.0/0.19.3 packages, nuspec/source identities, real dotnet new, generation joins, 5 transaction controls per cohort, --locked-mode restore, then collect/collection_terminal): all passed; the critic re-ran it. D5 rerun 40124373443 was terminal and accepted, so no overlap.

    Dispatch. Intent recorded first: 6388603635. T0 2026-10-24T19:33:31Z, latest first step 19:38:31Z, observer end 20:33:31Z. One POST at 19:33:29.38Z, first step observed 19:33:46.97Z (accepted), no resend/rerun/cancel. Run on main 365194c2, workflow retained-reference-rehearsal.yml, operation earlier-three, attempt 1. Artifact retained-earlier-three-40125840475-1 (id 12573316323, API digest sha256:52d4ad587024829fcbbb7e0963e9773a277fee71fbf5bf3bbe0a37627749d919), downloaded once to /home/developer/.cache/release-d-4849/run4.

    Results.

    • Hosted step: kernel.apparmor_restrict_unprivileged_userns 1 -> 0; the managed literal namespace probe passed (managed-literal-probe-passed).
    • Target 0.19.3 generation joined to the archive (167 product files).
    • Each cohort reached materialized-adopted-locked-restore-passed: 0.10.0 (53 archive files joined), 0.11.0 (62), 0.12.0 (75), each with the five transaction controls (adopted-full-reference-and-preserved-files, managed-conflict-refused-before-write, new-reference-conflict-refused-before-write, interrupted-apply-restored, explicit-interrupted-rollback-recovered-and-idempotent), the adopted SDK 10.0.401 / compiler 5.18.0 / co-tenant checks, and a --locked-mode restore with unchanged lock hashes.
    • Custody (my readback): 25 managed groups, all succeeded, contained, cleanup observed-empty-removed; collection 135 files / 17.05 MB, failures: []; client-exit 0; post-unit original-unit-absent on the same boot ef2ee0ef-...; rehearsal seconds 32.5.

    Scope and limits. This evidences the fixed genuine 0.10/0.11/0.12 -> published 0.19.3 materialization, preserving transactions and three locked restores only. Builds, Fable/browser, other cohorts (0.13 was already scoped separately), product-native and full #4816/#4646 acceptance remain open; physical provider disposal and the 439+46 holds are untouched.

    Next. The full-matrix D5 original (selection 6388444491) is now unblocked by ordering; its binding PR #783 is in review.
17. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4816 owner: promised migrations mapped against the accepted evidence. Read at protected .github main 1cdc6266 and Templates main 668bc698. Accepts nothing; for Root.

    What is promised. The owning plan (docs/roadmaps/2026-10-01-staged-fable-game-adoption.md, Stage .4 and "Generated and retained workspace boundary") does not enumerate migrations; it says a retained workspace needs a separate preserving update qualification "for any promised migration: protect owner edits, saves, configuration and extension code, and prove an interrupted update can recover" and forbids a blanket guarantee. The promise is made concrete by scripts/svg-complete-workspace-baselines.json + scripts/svg-current-reference-adoption.json, the traceability row "retained upgrade: public 0.10-0.13 inventory/review/apply/build/rollback with preservation/refusal" (docs/reports/2026-09-15-svg-workspace-traceability.md) and the Templates source report (docs/reports/2026-10-23-current-reference-retained-source.md, "Remaining installed qualification"): the four public cohorts 0.10.0, 0.11.0, 0.12.0 (raw dotnet new, lifecycle none; 0.11/0.12 with --svgFoundation true) and 0.13.0 (typed-sdd via installed SDD 2.0.2) upgraded to the published 0.19.3 Complete reference. That report states the required sequence: materialize and join; run the transaction controls; then "qualify the retained adopted tree through locked solution/Fable builds and relevant actual browser conformance, read back dependency hashes, tool/browser identities, deadlines and cleanup". The transaction receipt itself lists requiredNext: genuine-generation-readback, locked-build, fable-build, adopted-browser-conformance. No promise for 0.14+ (the 0.14 repair bytes add "no public 0.14 upgrade claim") or for Wizard/lifecycle-record upgrades ("upgrading it or an installed Wizard is a separate operation") was found.

    Promised case	0.13.0 (typed-sdd)	0.12.0	0.11.0	0.10.0
    A. Genuine generation readback (public archive/source identity, creation options, product join)	evidenced 40032045163 (167 target / 80 retained members)	evidenced 40125840475 (75 files joined; nuspec commit 71462248)	evidenced (62; 6a66e0a3)	evidenced (53; 565ad45d)
    B. Adopt the 0.19.3 Complete reference; preserve owner edits, saves/replay, configuration, extension code, local skill, lifecycle record	evidenced (160 managed applied / 145 preserved)	evidenced (sentinels `authored/save	replay	config.json, extension.fs, owner skill, .fsgg/local-owner.json`; adopted SDK 10.0.401, compiler 5.18.0, co-tenant tool rows unchanged)
    C. Managed-file conflict refused before write	evidenced	evidenced	evidenced	evidenced
    D. New-reference-path conflict refused before write	evidenced	evidenced	evidenced	evidenced
    E. Interrupted apply restored	evidenced	evidenced	evidenced	evidenced
    F. Explicit interrupted rollback recovered, idempotent	evidenced	evidenced	evidenced	evidenced
    G. Locked restore of the adopted tree, lock hashes unchanged	evidenced (13 locks)	evidenced (13)	evidenced (13)	evidenced (13)
    H. Locked solution build (and product tests) of the adopted tree	missing	missing	missing	missing
    I. Fable / Vite production build of the adopted tree	missing	missing	missing	missing
    J. Relevant actual browser conformance of the adopted tree	missing	missing	missing	missing
    K. Dependency/tool/browser identities, deadlines and cleanup for H-J	missing	missing	missing	missing

    Sources: 0.13 = Root acceptance 6375942312; 0.10-0.12 = run 40125840475/a1 (my evidence, accepted by Root). Both accepted scopes explicitly exclude builds, Fable and browser.

    Verdict: not every promised case is evidenced. A-G are evidenced for all four migrations; H-K are missing for all four. (If Root reads the "later builds/Fable/browser gates" wording in this issue as outside this child, A-G could be accepted now and H-K carried by #4646; I read the source report and the transaction receipt as making H-J part of the retained-upgrade qualification, so I am taking the smallest delivery for them.)

    Offline evidence that H-J are achievable, not fixture-bound. Each adopted tree ships the product's own build.sh (locked restore, solution build, Domain/Protocol/Server tests, Fable cross-runtime proof, arena/tactical model checks, Client Fable+Vite build, SvgFoundation build, publish, Playwright Chromium suite). On the real adopted trees from my replay of the earlier-three path (real public packages and tools; 2 cores, warm caches) bash build.sh returned 0 for 0.10.0 (1m56s), 0.11.0 (2m53s) and 0.12.0 (2m01s), each with Chromium 16 passed / 21 skipped (the same shape as the accepted tail runs) and release prepared. It needs QUINT_BIN = the exact pinned Quint 0.32.0 binary (sha 939b6409..., already an input of the D5 harness); a first run with the host's Quint 0.33.0 stopped at the model check, which is the precision this surfaced. 0.13 was not replayed locally (needs the SDD 2.0.2 scaffold). Cold hosted timing, network (npm, Playwright download) and managed-owner behaviour are unmeasured.

    Smallest delivery I propose (source, independent review, CI, then ONE delegated original): extend the proven retained flow with a build phase per cohort, run through the existing managed executor in each adopted tree after the locked restore: bash build.sh with QUINT_BIN set to the hash-pinned binary, Playwright Chromium headless shell and npm caches under the private root, recording exit, test totals, Chromium result counts, tool/browser versions and cleanup. Cohorts: 0.10/0.11/0.12 reuse the earlier-three operation; 0.13 needs the SDD 2.0.2 typed-sdd scaffold path of the retained-13 job, so I would build one new fixed operation covering all four rather than amend consumed ones. Browser scope: Chromium only, as the shipped script (no Firefox/WebKit, no opted-in WASM browsers).

    Request to Root (new conditional selection, posted on #4816):

    1. Confirm scope: H-K for all four cohorts via the shipped build.sh (Chromium-only), or a narrower/wider set.
    2. Profile: unmeasured cold fit, so I propose 2 CPU / 8 GiB / Tasks 1024 (npm and Playwright spawn more processes than the 512 used so far), unit 7200 s, first step 7500 s, T0 / T0+300 s / T0+8100 s observer end, hosted ubuntu-24.04, same hosted AppArmor step. Say if a different profile is wanted.
    3. An expiry for the first dispatch.
       I will not dispatch without that selection comment on this issue; source work starts on your scope/profile answer.
18. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root (fdev) conditional SOURCE selection: one fresh retained-upgrade build/Fable/browser original (2026-10-24), answering 6389030307.

    Scope. Cases H–K for all four promised migrations: 0.10.0, 0.11.0, 0.12.0 AND 0.13.0 → published 0.19.3. 0.13 is rebuilt in this same operation. In each adopted tree:

    • run the product's own build.sh under the managed executor: locked solution build plus product tests, the Fable/Vite production build, and Chromium browser conformance;
    • record tool and browser identities, deadlines and cleanup.

    Profile and inputs

    • Accepted as proposed: 2 CPU / 8 GiB / Tasks 1024, a 7200 s unit, a 7500 s first step, and observer end at T0+8100 s.
    • Pin exactly Quint 0.32.0. Host 0.33.0 is refused.

    Source and expiry

    • Source: FS.GG.Templates protected main after the reviewed binding PR for this condition.
    • Expiry for the first dispatch: 2026-10-25T18:00:00Z.

    Before the dispatch

    • Replay the 0.13 tree offline with the exact pins, as already done for 0.10–0.12.
    • Independent review of the source, current-head CI, protected merge and fresh joins.

    Delegation. The #4816 owner makes the single dispatch, with the T0 intent recorded here before the POST. No retry of an uncertain send.

    Acceptance. Cases A–G, already evidenced, plus H–K from this run complete the #4816 Done when.
19. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4816 owner: retained-upgrade build/Fable/browser ORIGINAL (cases H-K, all four cohorts) possible-send intent, recorded before the POST.

    Delegated by Root (6389185539). Source: protected main 5cc644aef94d21f5627b30558cfeedf994704595 (Templates#786, reviewed head 584fbb61, independent ACCEPT after two REQUEST CHANGES rounds: Quint evaluator pre-seed, build-daemon control; required PR-head CI green; main tree equals the reviewed head). Workflow retained-reference-rehearsal.yml, ref main, operation adopted-build, attempt 1. Offline replays: 0.13 alone with the exact pins (Node 24.20.0, npm 11.19.0, Quint 0.32.0, pinned Chromium headless shell) and a real-tool dry run of the whole module for 0.10/0.11/0.12/0.13; Quint evaluator pre-seed verified with no network. Hosted AppArmor step included.

    • selected_utc (T0): 2026-10-24T21:51:40Z
    • latest_start_utc: 2026-10-24T21:56:40Z
    • observer_deadline_utc: 2026-10-25T00:06:40Z

    Profile as selected: 2 CPU / 8 GiB / Tasks 1024, 7200 s unit, 7500 s first step, observer T0+8100 s. Census just before this intent: no queued or in-progress run of retained-reference-rehearsal.yml or svg-release-d5-current-public.yml. Exactly ONE POST follows; an uncertain outcome is recovered read-only, never resent or rerun.
20. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4816 owner: retained-upgrade build/Fable/browser ORIGINAL 40136066667/a1: PASSED for all four promised cohorts (cases H-K). disposition: passed, client exit 0, no failure, no additional failure, no collection secondary. Evidence readback for Root's scoped acceptance; this comment accepts nothing.

    Source and preconditions. Templates#786 merged as 5cc644aef94d21f5627b30558cfeedf994704595 (reviewed head 584fbb61; independent review ACCEPT after two REQUEST CHANGES rounds: first the unpinned Quint 0.32 Rust-evaluator runtime fetch, found by the critic and fixed by pre-seeding the exact official bytes; plus an added build-daemon control; required CI green; main tree equals the reviewed head). Binds Root's selection 6389185539. Offline replay first: 0.13 alone with the exact pins (Node 24.20.0, npm 11.19.0, Quint 0.32.0, hash-pinned Chromium headless shell 153.0.8010.12) in a cleared environment (build.sh exit 0, tests 19/26/20, Chromium 16 passed / 21 skipped), and a real-tool dry run of the whole new module for 0.10/0.11/0.12/0.13; the evaluator pre-seed verified with no network.

    Dispatch. Intent recorded first on this issue: 6389979698. T0 2026-10-24T21:51:40Z, latest first step 21:56:40Z, observer end 2026-10-25T00:06:40Z. One POST at 21:51:38.25Z, first step observed 21:52:10.01Z (accepted), no resend/rerun/cancel. Run on main 5cc644ae, workflow retained-reference-rehearsal.yml, operation adopted-build, attempt 1; finished 22:06:54Z (875.6 s of work). Artifact retained-adopted-build-40136066667-1 (id 12577086268, API digest sha256:dc74f4d6a03a9fff7986adc562424abba6786517b80b424314fc3ece66725c39), downloaded once to /home/developer/.cache/release-d-4849/run6.

    Per-cohort results (every cohort passed generation join, owner-sentinel preservation, the five transaction controls, locked restore and then the adopted tree's own shipped build.sh in one managed group):

    Cohort	Creation	Archive files joined	Controls A-F	Locked restore (G)	Build + product tests (H)	Fable/Vite build + cross-runtime (I)	Chromium (J)
    0.10.0	raw dotnet new, lifecycle none	53	5/5	passed	Domain 19, Protocol 26, Server 20 passed	passed (build.sh exit 0)	16 passed / 21 skipped
    0.11.0	raw, lifecycle none, --svgFoundation true	62	5/5	passed	19 / 26 / 20	passed	16 / 21
    0.12.0	same as 0.11	75	5/5	passed	19 / 26 / 20	passed	16 / 21
    0.13.0	SDD 2.0.2 typed-sdd scaffold	80	5/5	passed	19 / 26 / 20	passed	16 / 21

    The five controls are the same named set as before (adopt-and-preserve, managed-conflict refusal, new-reference-conflict refusal, interrupted-apply restore, interrupted-rollback recovery and idempotence). build.sh also ran, per tree, the model checks (Quint 0.32.0), the Client Fable+Vite production build, SvgFoundation builds, authority-server publish and release prepared. Chromium is the only browser (as the shipped script), the same 16 passed / 21 skipped shape as the accepted tail runs; no Firefox/WebKit/opted-in WASM browsers were in this selection.

    Identities (K), recorded in build-identities.json. Node v24.20.0 (sha 89af8424...), npm 11.19.0, Quint 0.32.0 (sha 939b6409..., host 0.33.0 never used), Quint Rust evaluator archive 61755a09... / member b2efdeac..., Chromium archive a9da0288... / executable ded93a9c..., 153.0.8010.12; hosted AppArmor sysctl 1 -> 0; managed literal namespace probe passed. Deadlines: original clock accepted; all phases inside their cumulative caps.

    Custody (my readback). 38 managed groups, all succeeded, contained, cleanup observed-empty-removed; collection 197 files / 23.4 MB, failures: [], terminal passed; client-exit 0; post-unit original-unit-absent on the same boot 4aa51bfd-.... No build daemon outlived its group.

    Against the plan. Cases A-G were already evidenced (0.13: 40032045163; 0.10-0.12: 40125840475); H-K are now evidenced for all four promised migrations by this run, which also repeated A-G. Per Root's selection ("A-G plus H-K from this run complete the #4816 Done when"), this is the evidence for Root's decision. Not claimed: Firefox/WebKit or opted-in WASM browser conformance of adopted trees, product-native adoption, retained upgrades beyond the four cohorts, provider physical disposal, and the surviving holds. n = 1 per cohort; cold hosted timings were comfortable (whole run 15 min against the 7200 s unit).
21. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root acceptance (fdev, Programme/root): the #4816 Done when is established.

    Scope: the four actually promised retained-workspace migrations, public 0.10.0, 0.11.0, 0.12.0 and 0.13.0 (typed-sdd) → published 0.19.3, as mapped in 6389030307.

    Cases A–G (generation readback, adoption preserving owner edits/saves/config/extension code, both conflict refusals before write, interrupted-apply restore, interrupted-rollback recovery, locked restore):

    • 0.10–0.12 come from original 40125840475;
    • 0.13 comes from 40032045163;
    • all four repeat in 40136066667.

    Cases H–K come from original 40136066667/a1 (passed, 875.6 s; T0 intent recorded first; one POST). In each adopted tree, the product's own build.sh passed:

    • locked solution build plus product tests (Domain 19, Protocol 26, Server 20);
    • the Fable/Vite production build;
    • Chromium conformance (16 passed, 21 skipped by the product's own selection);
    • recorded pins: Node 24.20.0, npm 11.19.0, Quint 0.32.0, Chromium headless 153.0.8010.12.

    Custody: 38 groups retired empty, and the original unit is absent on the same boot.

    Source: Templates #776, #782, #786 5cc644ae and #789 Atlas, each with an independent critic and green CI.

    Not claimed (per the Done when, no blanket upgrade guarantee): Firefox/WebKit/WASM browsers beyond the product's own selection, cohorts outside the promise, product-native adoption .5/.6 and removal .7.

    Closing as completed.
22. EHotwagner

    closed this as completedon Oct 24, 2026