# Plan 14 census ruling 292 (amadan #292, the edge-restart lease strand; Astra rounds 1 to 3): the agent's shutdown gates, the legacy run unit's termination proof before an aborted start's lease goes, the retried conditional lease release, and root's per-host ordering of legacy run starts against stops. Approved by platform-1e as census-ruling-292, extended for the proof units and the instance-control rows.
# Agent-side boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record. Root-side boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read. If any agent-side unit here ever runs as root, or any unit reads beyond that boundary, it stops being legacy and needs the Plan 14 owner's ruling. Earlier overlays are immutable.
@legacy	da7f39bcd686e64850d4ecf625bc938a416c621b77f5d1103782de0c99e03e56	internal/activator/activator.go	Service.BeginSidecarRequest	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a sidecar-marked request is answered as asleep and an exited child is left to Shutdown's own stop, never recycled as an unexpected exit. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@259,registry:Host@333	93734e46bc8257b10ed6cb3c3af4146165a92a83d50ce1b44e0d030356d39b6b
internal/activator/activator.go	Service.BeginSidecarRequest	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a sidecar-marked request is answered as asleep and an exited child is left to Shutdown's own stop, never recycled as an unexpected exit. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@259,registry:Host@333	93734e46bc8257b10ed6cb3c3af4146165a92a83d50ce1b44e0d030356d39b6b
@legacy	9ab43c1b1c04a27a3efa4a2f24b8030c4cfdcbd9e2a0c225d6e0eebc02011927	internal/activator/activator.go	Service.begin	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a request is refused (errShuttingDown) on every pass of its loop, before it can wake or recycle anything. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1702,registry:Host@1781,registry:Host@326,registry:Host@910,whole:Route@1711,whole:Route@1718	2f4449d5665d0e84c17a6618e2aa4cd6394808b169c7f05a3f27f634f626b010
internal/activator/activator.go	Service.begin	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, a request is refused (errShuttingDown) on every pass of its loop, before it can wake or recycle anything. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1702,registry:Host@1781,registry:Host@326,registry:Host@910,whole:Route@1711,whole:Route@1718	2f4449d5665d0e84c17a6618e2aa4cd6394808b169c7f05a3f27f634f626b010
@legacy	b6bfb87b76a780fe09bccdec6637427719cc2cf891a8ddd946c2802415d6de00	internal/activator/activator.go	Service.doWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a failed start of the legacy run unit is marked for the termination proof before its lease goes, and every bail-out gives the lease back through giveBack, which keeps a failed release for retry. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:DBPath@1032,registry:DBPath@1048,registry:DBPath@1175,registry:DBPath@1186,registry:DBPath@20307,registry:Host@1014,registry:Host@1166,registry:Host@1277,registry:Host@174,registry:Host@2137,registry:Host@3858,registry:Host@861,registry:Host@936,registry:Replication@20342,registry:Seed@11113,registry:Socket@1061,registry:Socket@1077,registry:Socket@1200,registry:Socket@1211,whole:Route@10018,whole:Route@11214,whole:Route@11285,whole:Route@1231,whole:Route@1237,whole:Route@1303,whole:Route@1311,whole:Route@13669,whole:Route@15527,whole:Route@159,whole:Route@16173,whole:Route@17480,whole:Route@17634,whole:Route@17990,whole:Route@18084,whole:Route@18756,whole:Route@19755,whole:Route@19903,whole:Route@2027,whole:Route@20416,whole:Route@21314,whole:Route@21409,whole:Route@3481,whole:Route@3740,whole:Route@3810,whole:Route@3816,whole:Route@3885,whole:Route@3893,whole:Route@4681,whole:Route@5680,whole:Route@6713,whole:Route@7594,whole:Route@9176,whole:Route@9368,whole:Route@959	7e6b169869d79b18322cc09d5a7cdb48eb207e9de12d55363ae1295120d5a712
internal/activator/activator.go	Service.doWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a failed start of the legacy run unit is marked for the termination proof before its lease goes, and every bail-out gives the lease back through giveBack, which keeps a failed release for retry. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:DBPath@1032,registry:DBPath@1048,registry:DBPath@1175,registry:DBPath@1186,registry:DBPath@20307,registry:Host@1014,registry:Host@1166,registry:Host@1277,registry:Host@174,registry:Host@2137,registry:Host@3858,registry:Host@861,registry:Host@936,registry:Replication@20342,registry:Seed@11113,registry:Socket@1061,registry:Socket@1077,registry:Socket@1200,registry:Socket@1211,whole:Route@10018,whole:Route@11214,whole:Route@11285,whole:Route@1231,whole:Route@1237,whole:Route@1303,whole:Route@1311,whole:Route@13669,whole:Route@15527,whole:Route@159,whole:Route@16173,whole:Route@17480,whole:Route@17634,whole:Route@17990,whole:Route@18084,whole:Route@18756,whole:Route@19755,whole:Route@19903,whole:Route@2027,whole:Route@20416,whole:Route@21314,whole:Route@21409,whole:Route@3481,whole:Route@3740,whole:Route@3810,whole:Route@3816,whole:Route@3885,whole:Route@3893,whole:Route@4681,whole:Route@5680,whole:Route@6713,whole:Route@7594,whole:Route@9176,whole:Route@9368,whole:Route@959	7e6b169869d79b18322cc09d5a7cdb48eb207e9de12d55363ae1295120d5a712
@legacy	4f1feca518693fadcefc38fae71c707ad244308ae62f88db3f6af44f538ee9c1	internal/activator/activator.go	Service.sweepOnce	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, the sweep returns before it recycles, due-wakes or starts anything. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Hibernate@12146,registry:Hibernate@21304,registry:Hibernate@5109,registry:Hibernate@6767,registry:Hibernate@9147,registry:Host@21373,registry:Host@21431,registry:Host@21824,registry:Host@22555,registry:Host@22637,registry:Host@23702,registry:Host@23881,registry:Host@23930,registry:NextDue@22510,registry:Status@21320,whole:Route@12148,whole:Route@14068,whole:Route@15778,whole:Route@15968,whole:Route@16261,whole:Route@16433,whole:Route@16580,whole:Route@20791,whole:Route@22224,whole:Route@22564,whole:Route@22571,whole:Route@23517,whole:Route@23914,whole:Route@5111,whole:Route@6769,whole:Route@9149	55664900e468c0ef1b3bef3bee3699a7341622ebbd94634da6820d0cc4a9d579
internal/activator/activator.go	Service.sweepOnce	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; once Shutdown has begun, the sweep returns before it recycles, due-wakes or starts anything. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Hibernate@12146,registry:Hibernate@21304,registry:Hibernate@5109,registry:Hibernate@6767,registry:Hibernate@9147,registry:Host@21373,registry:Host@21431,registry:Host@21824,registry:Host@22555,registry:Host@22637,registry:Host@23702,registry:Host@23881,registry:Host@23930,registry:NextDue@22510,registry:Status@21320,whole:Route@12148,whole:Route@14068,whole:Route@15778,whole:Route@15968,whole:Route@16261,whole:Route@16433,whole:Route@16580,whole:Route@20791,whole:Route@22224,whole:Route@22564,whole:Route@22571,whole:Route@23517,whole:Route@23914,whole:Route@5111,whole:Route@6769,whole:Route@9149	55664900e468c0ef1b3bef3bee3699a7341622ebbd94634da6820d0cc4a9d579
@legacy	eba2b8a74d4615e23626ac96c87ef8b192de7f42c0a430f978adafeec871db6f	internal/activator/activator.go	Service.wake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a wake that starts after Shutdown began is cancelled before its lease, and one that finishes is stopped, with swaps on or off. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Socket@6807,registry:Socket@6968,whole:Route@2091,whole:Route@2148,whole:Route@5344,whole:Route@6760,whole:Route@6809,whole:Route@6970,whole:Route@8209,whole:Route@8230	25e8f2be15ec434d2bc414e0d144a3f77bd433a81b08f5a0be5be212df24071c
internal/activator/activator.go	Service.wake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a wake that starts after Shutdown began is cancelled before its lease, and one that finishes is stopped, with swaps on or off. Claims: claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Socket@6807,registry:Socket@6968,whole:Route@2091,whole:Route@2148,whole:Route@5344,whole:Route@6760,whole:Route@6809,whole:Route@6970,whole:Route@8209,whole:Route@8230	25e8f2be15ec434d2bc414e0d144a3f77bd433a81b08f5a0be5be212df24071c
@legacy	aa5ac6f18801ee88c600b00d7f964d5d5c68f4c1c9a745066dabd5fd9eb04c79	internal/activator/backend_exec.go	ExecBackend.spawnUnitFrom	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; what changed: a failed start of the original run unit (generation 0) that root may still carry out is marked legacyStartUncertain, its text unchanged, so the failed wake's cleanup proves the unit stopped before the lease goes. It does not widen what is spawned or how. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1071,registry:Host@1473,registry:Host@1576,registry:Host@1994,registry:Host@2474,registry:Host@3400,registry:Host@3986,registry:Host@4256,registry:Host@4476,registry:Host@4661,registry:Host@5056,registry:Host@5337,registry:Host@5399,registry:Host@5552,registry:Host@5591,registry:Host@5870,registry:Host@5964,whole:Route@1167,whole:Route@1402,whole:Route@194,whole:Route@2678,whole:Route@4309,whole:Route@5490,whole:Route@5649,whole:Route@758,whole:Route@856	036895b3ad78d31d9b788f85ce11736ed21adadfa3d6a04683de5cef1b3fe963
internal/activator/backend_exec.go	ExecBackend.spawnUnitFrom	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; what changed: a failed start of the original run unit (generation 0) that root may still carry out is marked legacyStartUncertain, its text unchanged, so the failed wake's cleanup proves the unit stopped before the lease goes. It does not widen what is spawned or how. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1071,registry:Host@1473,registry:Host@1576,registry:Host@1994,registry:Host@2474,registry:Host@3400,registry:Host@3986,registry:Host@4256,registry:Host@4476,registry:Host@4661,registry:Host@5056,registry:Host@5337,registry:Host@5399,registry:Host@5552,registry:Host@5591,registry:Host@5870,registry:Host@5964,whole:Route@1167,whole:Route@1402,whole:Route@194,whole:Route@2678,whole:Route@4309,whole:Route@5490,whole:Route@5649,whole:Route@758,whole:Route@856	036895b3ad78d31d9b788f85ce11736ed21adadfa3d6a04683de5cef1b3fe963
@legacy	64b4b59426a6ca65d46cd603776efb3b340f5353d7b3479a3c934c85c644b5a4	internal/activator/backend_exec.go	ExecBackend.LegacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; stops the host's original run unit through instance-control's existing /stop and proves it gone from systemctl show state and cgroup.events, as the exit observer reads. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@174,registry:Host@225,registry:Host@268,registry:Host@623	59ee0ef2591b7596fdeedd65786dac0b671e54140055247c5caef3a576347f3d
internal/activator/backend_exec.go	ExecBackend.LegacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; stops the host's original run unit through instance-control's existing /stop and proves it gone from systemctl show state and cgroup.events, as the exit observer reads. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@174,registry:Host@225,registry:Host@268,registry:Host@623	59ee0ef2591b7596fdeedd65786dac0b671e54140055247c5caef3a576347f3d
@legacy	28136608ac1b1e67bf0844caebd2011456b6bf560a984e925a026cf6ef403f47	internal/activator/backend_unit.go	SplitBackend.LegacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; forwards an exec row to the exec half's LegacyRunGone and refuses a unit-backed row, reading Backing as SplitBackend.Layout does. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	file:Exec@240,registry:Backing@89,registry:Host@200,registry:Host@305,whole:Route@364	13f8a08cb85de111beae3e48dfb48fe64a2269f7d6fbb0539d7e68dc674f16aa
internal/activator/backend_unit.go	SplitBackend.LegacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; forwards an exec row to the exec half's LegacyRunGone and refuses a unit-backed row, reading Backing as SplitBackend.Layout does. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	file:Exec@240,registry:Backing@89,registry:Host@200,registry:Host@305,whole:Route@364	13f8a08cb85de111beae3e48dfb48fe64a2269f7d6fbb0539d7e68dc674f16aa
@legacy	7549e1150abccb1e9f62229dbc25c435adb23bf1a08e013273b9a68c06e9462b	internal/activator/containment.go	Service.legacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; runs the backend's termination proof for the route under its own budget, never past Shutdown's. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	whole:Route@573	680bd2d7f55e99e5aef3b3ec89a00465811b87dc2a68ad8e4b3364443156f43f
internal/activator/containment.go	Service.legacyRunGone	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: new unit; runs the backend's termination proof for the route under its own budget, never past Shutdown's. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	whole:Route@573	680bd2d7f55e99e5aef3b3ec89a00465811b87dc2a68ad8e4b3364443156f43f
@legacy	0ea3b4516b2fa8a7b311af9bc14a061666175ad7b05942c32f76d4982c2ba3af	internal/activator/maintenance.go	Service.cleanupFailedWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; an aborted legacy run unit start is proven stopped before its lease goes, else retained with its lease; a failed release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1824,registry:Host@2031,registry:Host@2666,registry:Host@3006,registry:Host@3618,whole:Route@1691,whole:Route@2056,whole:Route@2060,whole:Route@2348,whole:Route@3031,whole:Route@3035	533ae97a1d2801faf9b0ef74eba10c268a7bac158e289aa296880fddf757c3eb
internal/activator/maintenance.go	Service.cleanupFailedWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; an aborted legacy run unit start is proven stopped before its lease goes, else retained with its lease; a failed release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	registry:Host@1824,registry:Host@2031,registry:Host@2666,registry:Host@3006,registry:Host@3618,whole:Route@1691,whole:Route@2056,whole:Route@2060,whole:Route@2348,whole:Route@3031,whole:Route@3035	533ae97a1d2801faf9b0ef74eba10c268a7bac158e289aa296880fddf757c3eb
@legacy	0a1e28f9d86865b0e22a7e0fc5562e93dfce43c985abd065f76e12d1576d0f2d	internal/activator/opset.go	Service.reapUnprovenWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a retained legacy start is retried through the same termination proof, and a failed raw release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	whole:Route@439,whole:Route@493	8543c417e6a98553b8500975d41679d8257495d6c077116aab2ada1d50aba647
internal/activator/opset.go	Service.reapUnprovenWake	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292;basis=Census ruling 292: changed legacy row; a retained legacy start is retried through the same termination proof, and a failed raw release is kept for retry. The termination proof only decides release-or-keep, and never starts, wakes or admits anything; unknown or error means keep. RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record.	whole:Route@439,whole:Route@493	8543c417e6a98553b8500975d41679d8257495d6c077116aab2ada1d50aba647
@legacy	80ed90a720baa7c64ac4413dff85f60f86bb78848f29c96ab448573a8cc13873	internal/instancectl/server.go	type Server	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292,J2,J4;basis=Census ruling 292: changed row, root-run (was diagnostic H3); the declaration gains the per-host legacy start attempts, stop counts, accept-order barriers, the connection counter and a test join budget, and still executes no decision. Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read.	file:Statfs@2708	3d2ba16fd871c32390edd658501aca37d335e881dbeb5d09b050d3f013d3f734
internal/instancectl/server.go	type Server	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-292,J2,J4;basis=Census ruling 292: changed row, root-run (was diagnostic H3); the declaration gains the per-host legacy start attempts, stop counts, accept-order barriers, the connection counter and a test join budget, and still executes no decision. Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read.	file:Statfs@2708	3d2ba16fd871c32390edd658501aca37d335e881dbeb5d09b050d3f013d3f734
# Envelopes, census ruling 292: each changed root source envelope below is accepted only because the units inside it are the ones listed above. internal/lease adds Held.ReleaseOwed and Held.RetryRelease: RetryRelease only repeats the same conditional delete against the same ETag, never an unconditional one. internal/instancectl adds legacystart.go (root, J2,J4): root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read.
@coverage	internal/activator	88538744825ca92fbb551105a60cc823d9e86b9ee6ecaedff9365f2f68a87710
@coverage	internal/lease	7ca044ef2fac40a860e9e80c83834929227fbefe32d55b1e61a60893ae129cb4
@coverage	internal/instancectl	a4317dea0de2980ce53afe3c0cfc0f0b17bdefda683073674e63e21cd980fc73