{
  "schema_version": 1,
  "source_revision": "11a303996d5503d29ede77598243ddc66f735279",
  "status": "Design checklist, not implementation or coverage proof. All production functions branching on Hibernate at base classified; additional indirect/serializer/control families listed separately.",
  "policy_branch_consumers": [
    {
      "file": "cli.go",
      "function": "func runInstances(args []string)",
      "current_policy_reads_or_writes": [
        {
          "line": 340,
          "source": "if t.Hibernate {"
        }
      ],
      "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "cli.go",
      "function": "func runRouteHibernate(r *registry.Registry, rt registry.Route, on, dryRun bool)",
      "current_policy_reads_or_writes": [
        {
          "line": 1341,
          "source": "if rt.Hibernate == on {"
        },
        {
          "line": 1346,
          "source": "if err := r.SetHibernate(rt.Host, on); err != nil {"
        },
        {
          "line": 1350,
          "source": "fmt.Printf(\"%s%s: hibernate %v -> %v\\n\", prefix, rt.Host, rt.Hibernate, on)"
        }
      ],
      "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "cli.go",
      "function": "func replicationRail(rt registry.Route) error",
      "current_policy_reads_or_writes": [
        {
          "line": 1604,
          "source": "if !rt.Hibernate {"
        },
        {
          "line": 1623,
          "source": "return fmt.Errorf(\"route hibernates but its row names no database (db_path is empty) \u2014 box-wide litestream excludes a hibernating route only when it knows WHERE its database is (`r.Hibernate && r.DBPath != \\\"\\\"`, ops.FleetDBs), \"+"
        }
      ],
      "required_integration": "Instance listing must distinguish management and sleep; hibernate control refuses opted-in policy; replication rail uses exec replication ownership.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/activator/activator.go",
      "function": "func (a *Service) sweepOnce()",
      "current_policy_reads_or_writes": [
        {
          "line": 1228,
          "source": "if !rt.Hibernate || rt.Status != \"ready\" {"
        }
      ],
      "required_integration": "Shared managed predicate in serve/due admission; idle predicate only for idle stop; proactive desired reconciliation and fence precedence across begin/wake/restart/sweep.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/activator/activator.go",
      "function": "func (a *Service) serve(w http.ResponseWriter, r *http.Request, rt registry.Route, proxy http.Handler, stamp bool) bool",
      "current_policy_reads_or_writes": [
        {
          "line": 1382,
          "source": "if rt.Kind != \"instance\" || !rt.Hibernate {"
        }
      ],
      "required_integration": "Shared managed predicate in serve/due admission; idle predicate only for idle stop; proactive desired reconciliation and fence precedence across begin/wake/restart/sweep.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/appconfig/sync.go",
      "function": "func syncHost(rt registry.Route, m *Manifest, defaultMissing bool, priv *ecdh.PrivateKey, envDir string, restart func(host string) error, ack func(ConfigAck))",
      "current_policy_reads_or_writes": [
        {
          "line": 472,
          "source": "case rt.Hibernate:"
        }
      ],
      "required_integration": "Unit config path keeps ordinary behavior; new mode cannot be mistaken for unit merely because Hibernate=false. Exec config materialization uses its own path and respects active pins.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/caps/converge.go",
      "function": "func Converge(o Ops, p Plan) (Result, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 221,
          "source": "if p.Set.Daemon && p.Hibernate {"
        },
        {
          "line": 237,
          "source": "if p.Hibernate {"
        }
      ],
      "required_integration": "Unit-only capabilities remain excluded from new exec policy; regression proves no unit startup fallback. Explicit ManagedByActivator in Plan; reject Daemon before writes even with Hibernate=false.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/apiinstancemove.go",
      "function": "func (s *Server) moveGate(w http.ResponseWriter, r *http.Request) (acct *Account, app, host string, rec *provision.Record, ok bool)",
      "current_policy_reads_or_writes": [
        {
          "line": 69,
          "source": "if !rec.HibernateOrDefault() {"
        }
      ],
      "required_integration": "Opted-in resident exec refuses old move API even though Hibernate=false; it cannot enter unit/external migration.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/apiinstances.go",
      "function": "func (s *Server) healthByHost(ctx context.Context, routeFor map[string]registry.Route) map[string]string",
      "current_policy_reads_or_writes": [
        {
          "line": 296,
          "source": "out[h] = healthWord(rt.Kind, status, rt.Hibernate, rep[h],"
        }
      ],
      "required_integration": "New dedicated policy door and field reporting; health reports managed residency correctly; ordinary PATCH preserves policy without bypass.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/apirestartscope.go",
      "function": "func restartRouteRows(routes []registry.Route) []apiRestartRoute",
      "current_policy_reads_or_writes": [
        {
          "line": 385,
          "source": "Host: rt.Host, Environment: rt.Environment, Unit: rt.Unit, Hibernate: rt.Hibernate,"
        }
      ],
      "required_integration": "Restart UI/API classification identifies activator ownership independently of sleep.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/apiroutes.go",
      "function": "func (s *Server) handleAPIRoutes(w http.ResponseWriter, r *http.Request)",
      "current_policy_reads_or_writes": [
        {
          "line": 152,
          "source": "Health: health[rt.Host], Hibernate: rt.Hibernate, Unit: rt.Unit,"
        }
      ],
      "required_integration": "Include lifecycle policy in route response; Hibernate remains false.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/instances.go",
      "function": "func (f *instanceFetcher) Report(ctx context.Context, routes []RouteView) *InstanceReport",
      "current_policy_reads_or_writes": [
        {
          "line": 90,
          "source": "if rt.Host == \"\" || rt.Kind == \"static\" || rt.Status != \"ready\" || rt.Hibernate {"
        }
      ],
      "required_integration": "Instance status collection includes resident activator instances.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/overview.go",
      "function": "func assembleOverview(view *AppView, acct string, metrics []InstanceMetrics, versions []VersionView) OverviewStats",
      "current_policy_reads_or_writes": [
        {
          "line": 138,
          "source": "} else if rt.Hibernate {"
        }
      ],
      "required_integration": "Report desired residency and actual health accurately; do not infer externally owned from Hibernate=false.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/overview.go",
      "function": "func assembleInstanceRows(view *AppView, acct *Account, metrics []InstanceMetrics) []InstanceRow",
      "current_policy_reads_or_writes": [
        {
          "line": 257,
          "source": "Hibernate: rt.Hibernate,"
        },
        {
          "line": 259,
          "source": "HealthWord: healthWord(rt.Kind, status, rt.Hibernate, byHost[rt.Host].Reporting(),"
        }
      ],
      "required_integration": "Report desired residency and actual health accurately; do not infer externally owned from Hibernate=false.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/server.go",
      "function": "func (s *Server) appResourceMetrics(ctx context.Context, view *AppView, acct *Account) []InstanceMetrics",
      "current_policy_reads_or_writes": [
        {
          "line": 2643,
          "source": "hib[rt.Host] = rt.Hibernate"
        },
        {
          "line": 2654,
          "source": "am[i].Hibernate = hib[am[i].Host]"
        }
      ],
      "required_integration": "Resident exec metrics remain included despite Hibernate=false.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/console/view.go",
      "function": "func Assemble(regPath string, s release.Store, pub ed25519.PublicKey, acct string, apps []string, dns DNSTargets) ([]AppView, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 609,
          "source": "Version: rt.Version, Channel: ch, Hibernate: rt.Hibernate,"
        }
      ],
      "required_integration": "Carry lifecycle field into view projections; preserve ownership and health classification.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/edge/edge.go",
      "function": "func (e *Edge) Reload() error",
      "current_policy_reads_or_writes": [
        {
          "line": 650,
          "source": "hib := e.act != nil && t.Kind == \"instance\" && t.Hibernate && !viaTunnel"
        },
        {
          "line": 677,
          "source": "if e.act == nil && t.Kind == \"instance\" && t.Hibernate && !viaTunnel {"
        }
      ],
      "required_integration": "Validated shared management predicate drives proxy/manager choice and RetireExcept set; unsupported policy refuses; canonical alias routes never duplicate process.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/agent.go",
      "function": "func makeStartRoute(reg *registry.Registry, startUnit func(unit string) error) func(host string) error",
      "current_policy_reads_or_writes": [
        {
          "line": 2640,
          "source": "if err != nil || rt == nil || rt.Hibernate || rt.Unit == \"\" {"
        }
      ],
      "required_integration": "Boot/fast/serial/adoption integrate resident desired loop; false Hibernate must not invoke unit fallback; durable fence reconstruction precedes startup.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/caps_pass.go",
      "function": "func buildPlans(routes []registry.Route, load func(rt registry.Route) (*release.Manifest, error)) ([]caps.Plan, []string)",
      "current_policy_reads_or_writes": [
        {
          "line": 192,
          "source": "p := caps.Plan{Host: rt.Host, App: rt.App, Grants: g, Hibernate: rt.Hibernate}"
        }
      ],
      "required_integration": "Explicit policy rejects unit capability plans; preserve existing unit behavior.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/movespass.go",
      "function": "func movesPass(ctx context.Context, s release.Store, w *movesWorker) error",
      "current_policy_reads_or_writes": [
        {
          "line": 169,
          "source": "if rec.Pool != \"\" || !rec.HibernateOrDefault() || (rec.Kind != \"\" && rec.Kind != \"instance\") {"
        }
      ],
      "required_integration": "New policy never enters existing mirror/delete/purge move paths; stale record snapshots must refuse before side effects.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/restart.go",
      "function": "func restartPass(ctx context.Context, routes []registry.Route, store release.Store, marksPath string, restart func(host string) error)",
      "current_policy_reads_or_writes": [
        {
          "line": 656,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "Ordinary restart routes through managed exec stop then proactive resident restart; never unit fallback.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/restartscope.go",
      "function": "func restartScopeLeg(ctx context.Context, routes []registry.Route, store release.Store, apps [][2]string,",
      "current_policy_reads_or_writes": [
        {
          "line": 256,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "Scoped restart applies same manager distinction and cannot clear maintenance fence.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/socket_advice.go",
      "function": "func warnExternalSockets(routes []registry.Route, serving func(socket string) bool, owns func(host string) bool) []registry.Route",
      "current_policy_reads_or_writes": [
        {
          "line": 38,
          "source": "if rt.Hibernate && owns(rt.Host) {"
        }
      ],
      "required_integration": "Resident exec with false Hibernate is owned, not an external socket warning; live owner proof still separate from listening socket.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/host/socket_advice.go",
      "function": "func socketAdvisoryLoop(reg *registry.Registry, svc *activator.Service)",
      "current_policy_reads_or_writes": [
        {
          "line": 76,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "Resident exec with false Hibernate is owned, not an external socket warning; live owner proof still separate from listening socket.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/ops/hibernate_verify.go",
      "function": "func HibernatingHosts(reg *registry.Registry) ([]HibernatingRoute, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 58,
          "source": "if r.Hibernate && r.DBPath != \"\" {"
        }
      ],
      "required_integration": "Include all activator-owned exec replica paths in lease-backed restore probe; reporting name must not misclassify as sleeping.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/ops/litestream.go",
      "function": "func FleetDBsWithSkipped(reg *registry.Registry, dataDir string) (dbs []string, skipped []string, err error)",
      "current_policy_reads_or_writes": [
        {
          "line": 349,
          "source": "if r.Hibernate && r.DBPath != \"\" {"
        }
      ],
      "required_integration": "Exclude all activator-owned exec DBs from root replicator, not only Hibernate=true; prove no duplicate WAL replicator.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/provision.go",
      "function": "func (r Record) HibernateOrDefault() bool",
      "current_policy_reads_or_writes": [
        {
          "line": 320,
          "source": "func (r Record) HibernateOrDefault() bool {"
        },
        {
          "line": 321,
          "source": "if r.Hibernate != nil {"
        },
        {
          "line": 322,
          "source": "return *r.Hibernate"
        }
      ],
      "required_integration": "Additive field/default/validation; no unknown value fallback; preserve field across all serializers and CAS retry.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/provision.go",
      "function": "func ValidateShape(rec Record) error",
      "current_policy_reads_or_writes": [
        {
          "line": 430,
          "source": "if rec.Hibernate != nil && *rec.Hibernate {"
        },
        {
          "line": 444,
          "source": "if len(rec.AddrsOrDefault()) > 0 && rec.Hibernate != nil && *rec.Hibernate {"
        }
      ],
      "required_integration": "Additive field/default/validation; no unknown value fallback; preserve field across all serializers and CAS retry.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/reconcile.go",
      "function": "func everywhereClass(rec Record) bool",
      "current_policy_reads_or_writes": [
        {
          "line": 156,
          "source": "if rec.HibernateOrDefault() {"
        }
      ],
      "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/reconcile.go",
      "function": "func everywhereRoute(rt registry.Route) bool",
      "current_policy_reads_or_writes": [
        {
          "line": 200,
          "source": "if rt.Unit != \"\" || rt.Hibernate || rt.Backing != \"\" || rt.Tunnel != \"\" || rt.Caps != \"\" {"
        }
      ],
      "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/reconcile.go",
      "function": "func routeFor(rec Record, dataDir, seed string) registry.Route",
      "current_policy_reads_or_writes": [
        {
          "line": 294,
          "source": "Hibernate: rec.HibernateOrDefault(), StatusNamed: rec.StatusNamedOrDefault(),"
        }
      ],
      "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/provision/reconcile.go",
      "function": "func Reconcile(ctx context.Context, s release.Store, reg *registry.Registry, cfg ReconcileConfig) error",
      "current_policy_reads_or_writes": [
        {
          "line": 828,
          "source": "if rec.Hibernate != nil && existing.Hibernate != *rec.Hibernate {"
        },
        {
          "line": 830,
          "source": "if !*rec.Hibernate && existing.Replication != \"\" {"
        },
        {
          "line": 834,
          "source": "log.Printf(\"provision: dry-run: would converge %s hibernate %v -> %v%s\", rec.Host, existing.Hibernate, *rec.Hibernate, dropped)"
        },
        {
          "line": 835,
          "source": "} else if err := reg.SetHibernate(rec.Host, *rec.Hibernate); err != nil {"
        },
        {
          "line": 838,
          "source": "log.Printf(\"provision: converged %s hibernate %v -> %v%s\", rec.Host, existing.Hibernate, *rec.Hibernate, dropped)"
        }
      ],
      "required_integration": "Transactional projection of lifecycle+false Hibernate with replication preserved; no everywhere/remote ownership widening; raw listing validates policy. Validate row/record lifecycle before convergeOwned; quarantine regression preserving v1 row/root exclusion; checked stop, no external handoff.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/registry/registry.go",
      "function": "func scanRoute(scan func(...any) error) (Route, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 709,
          "source": "t.Hibernate = hib != 0"
        }
      ],
      "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/registry/registry.go",
      "function": "func (r *Registry) Upsert(t Route) error",
      "current_policy_reads_or_writes": [
        {
          "line": 890,
          "source": "if !t.Hibernate {"
        },
        {
          "line": 926,
          "source": "b2i(t.Hibernate), b2i(t.Canary), t.Replication, t.NextDue, t.Backing,"
        }
      ],
      "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/registry/registry.go",
      "function": "func (r *Registry) SetHibernate(host string, on bool) error",
      "current_policy_reads_or_writes": [
        {
          "line": 1565,
          "source": "func (r *Registry) SetHibernate(host string, on bool) error {"
        }
      ],
      "required_integration": "Add column, scan/upsert/fingerprint coverage; dedicated atomic lifecycle projection; legacy SetHibernate(false) clears replication and cannot be used for mode installation. Both Upsert INSERT and ON CONFLICT preserve rung iff OwnsExecReplication (including nonempty DBPath); no v1 downgrade.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/release/adopt.go",
      "function": "func PassFilter(ctx context.Context, reg *registry.Registry, s Store, pub ed25519.PublicKey, optDir string, restart func(host string) error, extra func(registry.Route) bool, opts ...PassOption) error",
      "current_policy_reads_or_writes": [
        {
          "line": 772,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/release/adopt.go",
      "function": "func adoptHost(ctx context.Context, reg *registry.Registry, s Store, optDir string, bake *FirstSeen, poisoned map[string]bool, rt registry.Route, ptr *ChannelPointer, restart func(host string) error, now time.Time, cfg passConfig, holds map[string]time.Duration, ignore bool)",
      "current_policy_reads_or_writes": [
        {
          "line": 1207,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/release/adopt.go",
      "function": "func capabilityPlan(rt registry.Route, m *Manifest, canRestart bool) (caps.Plan, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 1276,
          "source": "Hibernate:    rt.Hibernate,"
        }
      ],
      "required_integration": "New mode is exec-managed despite false Hibernate; defer to proactive restart with pins/fence upheld, preserve unit-only capability paths.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/schedule/converge.go",
      "function": "func StatusFor(reg *registry.Registry, rt registry.Route, box string, now time.Time, idle time.Duration) (Status, error)",
      "current_policy_reads_or_writes": [
        {
          "line": 329,
          "source": "if !rt.Hibernate {"
        }
      ],
      "required_integration": "Status describes no idle sleep while retaining actual scheduled-work behavior; timer frequency is never the residency mechanism.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "internal/status/snapshot.go",
      "function": "func CollectBox(routes []registry.Route, p Probes, now time.Time) Box",
      "current_policy_reads_or_writes": [
        {
          "line": 481,
          "source": "case r.Hibernate:"
        }
      ],
      "required_integration": "Report actual resident process/health/version; false Hibernate does not imply absence of activator-managed status.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    },
    {
      "file": "restart.go",
      "function": "func runRestartScoped(sess *apiSession, acct apiAcct, app, host, environment string, dryRun bool)",
      "current_policy_reads_or_writes": [
        {
          "line": 173,
          "source": "if rt.Hibernate {"
        }
      ],
      "required_integration": "CLI restart output correctly distinguishes resident managed lifecycle and does not promise unit start.",
      "classification": "production consumer; requires regression or explicit unchanged-behavior assertion"
    }
  ],
  "additional_consumers": [
    {
      "file_or_family": "internal/provision/provision.go",
      "functions": "GetRecordETag/ListRecords/CreateRecord/UpdateRecord/updateRecord",
      "required_integration": "All Record JSON serialization and decode preserves/validates lifecycle; record identity/projection stable."
    },
    {
      "file_or_family": "internal/provision/reconcile.go",
      "functions": "ListAllRecords/convergeOwned/routeFor",
      "required_integration": "Raw listed records and projected Routes include same validated lifecycle; no hand-built second default."
    },
    {
      "file_or_family": "internal/host/steering_loop.go",
      "functions": "steeredRoutesFromRecords/steeringPass",
      "required_integration": "Nonlocal owners do not start residents; record-to-route projections preserve lifecycle; empty region is not single-owner proof."
    },
    {
      "file_or_family": "internal/appconfig/syncexec.go",
      "functions": "SyncExec/syncExecHost/reapConfigEnv",
      "required_integration": "Existing socket-based sync remains applicable; pin/fence checks prevent writes/reap while maintenance owns environment."
    },
    {
      "file_or_family": "internal/host/schedule_wiring.go",
      "functions": "newScheduleDeps/scheduleToken/activatorDeliverer",
      "required_integration": "Preserve actual scheduling; local token preparation synchronized with fence from b6e5c2f; no frequency workaround."
    },
    {
      "file_or_family": "internal/activator/backend_exec.go",
      "functions": "Acquire/Restore/Seed/Start/instanceEnv",
      "required_integration": "Preserve process user, DB/socket/lease/replica paths; resident recovery never calls Seed; handle returned resources on errors."
    },
    {
      "file_or_family": "internal/activator/backend_unit.go",
      "functions": "SplitBackend.pick/UnitBackend",
      "required_integration": "New policy must select exec; unit Lease/Rep are inert and never satisfy exec maintenance proof."
    },
    {
      "file_or_family": "internal/registry/registry.go",
      "functions": "Fingerprint/SnapshotFingerprint/routeColumns",
      "required_integration": "Field must reach fingerprints, persistent snapshots, SQL column order and migration; unknown policy fails closed."
    },
    {
      "file_or_family": "internal/console/channelmove.go",
      "functions": "executePendingRouteChannel",
      "required_integration": "Delayed writes preserve field; active maintenance rechecked at execution."
    },
    {
      "file_or_family": "internal/console/fleets.go",
      "functions": "placeAppTarget",
      "required_integration": "Refuse conflicting placement before console SQL/registry mutations, not only final record CAS."
    },
    {
      "file_or_family": "internal/console/domainattach.go",
      "functions": "attachDomain/detachDomain/rollbackAttach",
      "required_integration": "Lifecycle/guard identity continuity survives aliases and failed cleanup; no host reuse bypass."
    },
    {
      "file_or_family": "internal/release/trash.go",
      "functions": "TrashApp/RestoreApp/PurgeApp",
      "required_integration": "Reviewed lifecycle claims and guarded deletion remain mandatory; this mode adds no general claim kind."
    },
    {
      "file_or_family": "internal/host/systemapply.go",
      "functions": "systemApplier.Run and rollback paths",
      "required_integration": "Enforced policy-aware binary floor before activation; signed-floor design is a separate review dependency."
    },
    {
      "file_or_family": "internal/edge/storedoor.go",
      "functions": "aclWrite",
      "required_integration": "Keep policy records and control guards unwritable through app/fleet arbitrary store door."
    },
    {
      "file_or_family": "instances_cli.go / apimode.go",
      "functions": "new lifecycle command/API DTO and instance record response DTO",
      "required_integration": "Supported proposed human-owner lifecycle operation; no raw box instructions. Clean-install mode remains separate."
    },
    {
      "file_or_family": "internal/maintenanceguard / internal/activator/maintenance.go",
      "functions": "guard reconstruction/FenceAndStop/resume integration",
      "required_integration": "Guard/claim/fence primitives are merged in base11a; worker/resume integration remains unimplemented. Resident loop cannot override denial or synthesize resume."
    },
    {
      "file_or_family": "internal/activator/activator.go",
      "functions": "Shutdown/actWaking/wake publication",
      "required_integration": "Close admission, cancel/join wake, checked cleanup of late Start resources, replica close before lease close; deadline means uncertainty, never acceptable orphan."
    },
    {
      "file_or_family": "cli.go",
      "functions": "runAdd/replicationRail",
      "required_integration": "Use OwnsExecReplication including nonempty DBPath; retain legacy refusal/default behavior elsewhere."
    }
  ],
  "source_hashes": {
    "cli.go": "1b35d1d2f6cc61443a15221f5d70fc37e6d52c73faa8af3f9a141f52cb51b124",
    "internal/activator/activator.go": "9848bb1b316449ca84ba846b2b41a2a1e5ba6b72f2c8e1c0d475d97d2b9fb1d4",
    "internal/appconfig/sync.go": "a1641154ca3bbecf04165fc2108c758ec34c551d50bafe3eacbc640a59e3f08a",
    "internal/caps/converge.go": "553b01bb2c152f5775eb3651718524b5bfef988ee96ca44655192f71feb36579",
    "internal/console/apiinstancemove.go": "a8ffa0a75d5a12e53687157de95218cef483b7ee701789b9d56fe6a5bc8c102b",
    "internal/console/apiinstances.go": "58f44f23b6395e40d156556c1105df7d7b26fc940f3ada4700ec4d4f95442159",
    "internal/console/apirestartscope.go": "35547f8eb23c29956ce9ca09d60fbbc5548a686ce0d6a5a3cce80c2ece0e8031",
    "internal/console/apiroutes.go": "153f6fd2e2134e7ee60beed4019513c5aa10340c99dc26fd8e9ae0e530475114",
    "internal/console/instances.go": "d45c3b846b1f6764570c8fa3650d8d2297221045e9213359937b661a0ebe1ede",
    "internal/console/overview.go": "e6fcf46d481660f9196f602596825bfbcd11fd0e8c835d26dc4c09ae73de03aa",
    "internal/console/server.go": "107e5f4a7d287e689f3e88a2f5e5373f9613439f2018ed865ca105b4b6a586e8",
    "internal/console/view.go": "715c3a0889c3437404ec81d3a80db7d780302baf6f6bc0f366d6854a132d37a9",
    "internal/edge/edge.go": "f16eaf5ca39ed4994c323154f407f772eec09e817d6b95b804ef5191cb7c40eb",
    "internal/host/agent.go": "e2f60e1b9e13be7a56a60b49ec8c596ee1b9f53a2e346d4a9623dc630336f290",
    "internal/host/caps_pass.go": "24911bef47f0284da4c4702936c908ceafc0c4d118349453a2b15801602a1f32",
    "internal/host/movespass.go": "9e55d771299270b5f1ef99fe783ffc10385661dd5c5047e0d14441ea846646bb",
    "internal/host/restart.go": "b452c93bd3782555e572aeb000d92347d71d6322dbf8b784caf60e85c1e31e45",
    "internal/host/restartscope.go": "27131be84fe7390ac6fcc9f248fcc212cf66ba6e101b6d176f3db70ca7d6a522",
    "internal/host/socket_advice.go": "2d7c48b2990414552dec032efdbdad5aade83b3d731d6553224c36042bff307b",
    "internal/ops/hibernate_verify.go": "47cf2718eea93528666ec52620c2999cd4e1d142aab85bae168a4d5d339b4178",
    "internal/ops/litestream.go": "860481a660b07d64307611f0770ab350af8cf92eaf8fa6fe3600b36986ba5534",
    "internal/provision/provision.go": "81f55646a25ec95428123bbc6b3ddb1a64fe333ba6f390ade90e52e7f5420d55",
    "internal/provision/reconcile.go": "4bcd285f0096136a8f8d903b47d0aadc15a66d28e0139e63b44e786300ed39b1",
    "internal/registry/registry.go": "e00d18720b8fcb93e23ec63cfa8be87cb2357ec76e891d1cd1b725f25272b824",
    "internal/release/adopt.go": "c8baa3a48780125e6961d82b76457ddeb4c38819e097a9bac2ab34db8ebb9f74",
    "internal/schedule/converge.go": "7f98ff1a89e733fd4766107a16776c4a5934075a7992e876cf264e96cfc7e4dd",
    "internal/status/snapshot.go": "b0fa884b322025a6b7f78d135841647d9f7d9932d3d52d28e3ec948f4c087dcd",
    "restart.go": "b75bacbc12ae85e48ceca42d890d0364de9455d2a0e5175cb74c2568bd445247"
  },
  "test_requirement": "Each family must have behavioral regression or explicit unchanged-case test. Mutation controls target manager-vs-idle, root replication exclusion, rung preservation, startup coalescing, no seed, and maintenance retry refusal."
}