diff --git a/history/fp-driver-d2-bafed7a7.sh b/fp-driver-d2.sh index 08efcb94..487c9d1e 100644 --- a/history/fp-driver-d2-bafed7a7.sh +++ b/fp-driver-d2.sh @@ -178,8 +178,28 @@ TEARDOWN_COMMAND_FILE="$PRESERVED_D2/teardown-command.pinned" # the emitted lit # SCRATCHPAD: a reviewed pin that a session teardown can # delete is not a pin, and the review that admitted it is # the only reason it may be dispatched at all. -TEARDOWN_COMMAND_SHA256='' # UNPINNED. Fill BOTH or neither; a file without its hash is - # refused exactly like no file at all. +# PINNED 2026-09-13 (doyle F3VCR5KO): the emitted payload is ACCEPTED as the reviewed +# RULE-REMOVAL CANDIDATE. Acceptance is not permission to execute it -- it is what would make a +# dispatch under a future grant legitimate at all. +TEARDOWN_B64_FILE="$PRESERVED_D2/d3/decoded-todlando/d3-payload.b64" + # THE REVIEWED PAYLOAD ITSELF, at its permanent path. The + # authority is doyle's pin below, not this driver's opinion. +TEARDOWN_B64_SHA256='416280dbece2601203c74c3f8e2c46e13009125fa5870166894e079329fb1d43' +# WHY TWO FILES AND ONE PIN. The bytes dispatched to an elevated leg must be the PRODUCT'S OWN +# emitted line, never one this driver assembles; the bytes REVIEWED are the base64 payload inside +# it. So the literal is kept verbatim in TEARDOWN_COMMAND_FILE and the check is that the payload +# INSIDE that literal is byte-for-byte the reviewed file, which in turn hashes to the pin above. +# Nothing is composed, and nothing unreviewed can ride along inside a literal that merely looks +# right. +RULE_PROBE="$PRESERVED_D2/rule-probe.ps1" +RULE_PROBE_SHA256='1e007cdc84582b4739137b06505b7e2f242581f6dafc8546a5ae89be2cf11756' + # THE INDEPENDENT POST-REMOVAL CHECK. The product reporting its + # own success is the claim under test, and the census counts + # ActiveStore rules by GROUP and PORT -- neither can say which + # owned NAME is gone, nor anything at all about PersistentStore. + # This probe addresses each name by InstanceID in each store. + # It is evidence, so it is pinned like any other instrument. +TEARDOWN_PIN_STATE=UNCHECKED # set by teardown_pin_verify; reported whatever it says CI_REPO='BigscreenVR/spt-bs-core' # the CODE repo (D3). Issues live elsewhere. PREP_EPOCH=$(date +%s) # the PREPARATION clock starts at process start RUN_EPOCH='' # THE EXPERIMENTAL CLOCK DOES NOT EXIST UNTIL GO, and an unset @@ -568,6 +588,149 @@ handoff_exit() { # (reads HO_RECEIPT) CLEANUP_EPOCH=0 CLEANUP_STOP_STATE=NOT_REACHED # which gate outcome step 1 took (IR-124) TEARDOWN_DISPATCH=NOT_REACHED # whether a teardown command was dispatched, and why not +REMOVAL_CHECK=NOT_REACHED # the INDEPENDENT reading, by name and by store +REMOVAL_PRE=NOT_REACHED # the same reading taken BEFORE any teardown was asked for +# ---- THE PINNED REMOVAL INSTRUMENT, VERIFIED TWICE (doyle 2026-09-13) -------- +# Once BEFORE GO -- a run that cannot remove what it is about to create must never open the +# window -- and again immediately BEFORE USE, because the file can change in between and the +# first reading would then be about bytes nobody is dispatching. Each call names its context so +# the two readings cannot be mistaken for one another in the ledger. +# +# WHAT THE INSTRUMENT IS, read from the decoded payload: it removes the two OWNED rules from +# PersistentStore after asserting each rule's group and TCP protocol, then re-reads BOTH stores +# and throws if anything remains. IT STOPS NO LISTENER AND REMOVES NO PROCESS. The listener and +# process disposition stays exactly where it was -- a separate, observation-gated question that +# this command neither answers nor affects. +teardown_pin_verify() { # CONTEXT -> 0 when the reviewed instrument is present and intact + local ctx="$1" sha b64 + TEARDOWN_PIN_STATE=UNCHECKED + if [ -z "$TEARDOWN_B64_SHA256" ]; then + TEARDOWN_PIN_STATE=UNPINNED + record "TEARDOWN_PIN($ctx)=UNPINNED - no reviewed pin is configured. An empty pin is this run saying it has no authorized command to hand an elevated leg." + return 1 + fi + if [ ! -f "$TEARDOWN_B64_FILE" ]; then + TEARDOWN_PIN_STATE=MISSING_REVIEWED_PAYLOAD + record "TEARDOWN_PIN($ctx)=MISSING_REVIEWED_PAYLOAD [$TEARDOWN_B64_FILE] - the reviewed bytes are not where the pin says they live." + return 1 + fi + if [ ! -f "$TEARDOWN_COMMAND_FILE" ]; then + TEARDOWN_PIN_STATE=MISSING_COMMAND_LITERAL + record "TEARDOWN_PIN($ctx)=MISSING_COMMAND_LITERAL [$TEARDOWN_COMMAND_FILE] - the product's emitted line is absent, and this driver does not compose one." + return 1 + fi + sha=$(sha256sum "$TEARDOWN_B64_FILE" | cut -d' ' -f1) + if [ "$sha" != "$TEARDOWN_B64_SHA256" ]; then + TEARDOWN_PIN_STATE=REVIEWED_PAYLOAD_HASH_MISMATCH + record "TEARDOWN_PIN($ctx)=REVIEWED_PAYLOAD_HASH_MISMATCH measured=$sha pinned=$TEARDOWN_B64_SHA256 - different bytes are a different command." + return 1 + fi + b64=$(sed -n 's/.*-EncodedCommand \([A-Za-z0-9+/=]*\).*/\1/p' "$TEARDOWN_COMMAND_FILE") + if [ -z "$b64" ]; then + TEARDOWN_PIN_STATE=LITERAL_CARRIES_NO_ENCODEDCOMMAND + record "TEARDOWN_PIN($ctx)=LITERAL_CARRIES_NO_ENCODEDCOMMAND - the literal is not the shape the reviewed payload rides in; REFUSED rather than guessed at." + return 1 + fi + if ! printf '%s' "$b64" | cmp -s - "$TEARDOWN_B64_FILE"; then + TEARDOWN_PIN_STATE=LITERAL_PAYLOAD_DIFFERS_FROM_REVIEWED + record "TEARDOWN_PIN($ctx)=LITERAL_PAYLOAD_DIFFERS_FROM_REVIEWED - what was reviewed is not what would be dispatched: REFUSED." + return 1 + fi + TEARDOWN_PIN_STATE=VERIFIED + record "TEARDOWN_PIN($ctx)=VERIFIED reviewed_b64_sha256=$sha - the dispatchable literal carries the reviewed payload byte for byte" + return 0 +} +# ---- THE INDEPENDENT POST-REMOVAL READING (doyle 2026-09-13) ----------------- +# It answers one question the product's verdict and the group/port census cannot: is EACH owned +# NAME gone from EACH store. Its outcomes are named separately because they are different facts +# and they are not equally bad: +# +# CONFIRMED both names absent in both stores, with both per-store controls alive +# PARTIAL some absent, some present -- a removal that took one rule and not the +# other. THE SUCCESSFUL HALF IS NOT A SUCCESS: what remains is admission +# that is still open, and no retry is issued. +# ACTIVESTORE_RESIDUE PersistentStore clean, ActiveStore still holding an owned name. The +# persistent rule is gone and the LIVE one is not, so the host is still +# admitting on it. Named on its own because a reader who sees "removed +# from the store it was written to" would otherwise call this clean. +# FAILED every owned name still present +# UNREADABLE_* the probe did not run, is not the pinned probe, its controls are dead, +# or it returned fewer readings than names x stores. An instrument that +# could not look is NOT a host that is clean. +# +# EVERY OUTCOME EXCEPT CONFIRMED IS PENDING/review at the call site. None of them dispatches +# anything: this function reads, and the run reports. +removal_check() { # TAG -> sets REMOVAL_CHECK + # TAGGED, because this now runs TWICE and the two readings are different facts: one BEFORE any + # teardown is asked for (is there anything to remove at all?) and one AFTER (did the removal + # happen?). A single un-tagged transcript would let a reader take one for the other. + local tag="${1:-post}" out rc absent present unread readings ctl_stores ctl_ok active_present persist_present psha + REMOVAL_CHECK=UNREADABLE + out="$R/rule-probe-$tag.out" + if [ ! -f "$RULE_PROBE" ]; then + REMOVAL_CHECK=UNREADABLE_NO_PROBE + record "REMOVAL_CHECK=UNREADABLE_NO_PROBE [$RULE_PROBE] - the independent probe is absent; this run cannot confirm removal itself." + return + fi + psha=$(sha256sum "$RULE_PROBE" | cut -d' ' -f1) + if [ "$psha" != "$RULE_PROBE_SHA256" ]; then + REMOVAL_CHECK=UNREADABLE_PROBE_UNPINNED + record "REMOVAL_CHECK=UNREADABLE_PROBE_UNPINNED measured=$psha pinned=$RULE_PROBE_SHA256 - evidence from an unpinned instrument is not evidence." + return + fi + pwsh -NoProfile -File "$RULE_PROBE" -Names "$RULE_TAILNET","$RULE_LAN" -ControlName "$CONTROL_RULE" > "$out" 2>&1 + rc=$? + exits "rule_probe_${tag}_EXIT=$rc" + if [ "$rc" -ne 0 ]; then + REMOVAL_CHECK=UNREADABLE_PROBE_EXIT_$rc + record "REMOVAL_CHECK=UNREADABLE probe_exit=$rc - see $out. A failed probe is not an absent rule." + return + fi + ctl_stores=$(grep -c '^RULEPROBE_CONTROL_OK ' "$out" 2>/dev/null) + ctl_ok=$(grep -c '^RULEPROBE_CONTROL_OK .* ok=True$' "$out" 2>/dev/null) + readings=$(grep -c '^RULEPROBE store=' "$out" 2>/dev/null) + absent=$(grep -c '^RULEPROBE store=.* state=ABSENT' "$out" 2>/dev/null) + present=$(grep -c '^RULEPROBE store=.* state=PRESENT' "$out" 2>/dev/null) + unread=$(grep -c '^RULEPROBE store=.* state=UNREADABLE' "$out" 2>/dev/null) + active_present=$(grep -c '^RULEPROBE store=ActiveStore .* state=PRESENT' "$out" 2>/dev/null) + persist_present=$(grep -c '^RULEPROBE store=PersistentStore .* state=PRESENT' "$out" 2>/dev/null) + # grep -c prints 0 and EXITS 1 on no match. An `|| echo 0` after it appends a SECOND line, so + # the variable holds two lines of zero instead of one and every numeric test below errors + # out -- measured by control d1, which read PARTIAL where the answer was UNREADABLE_CONTROLS. + record "REMOVAL_PROBE($tag) readings=$readings absent=$absent present=$present unreadable=$unread active_present=$active_present persistent_present=$persist_present controls=$ctl_ok/$ctl_stores" + if [ "$ctl_stores" -lt 2 ] || [ "$ctl_ok" -ne "$ctl_stores" ]; then + REMOVAL_CHECK=UNREADABLE_CONTROLS + record "REMOVAL_CHECK=UNREADABLE_CONTROLS - a store whose positive/negative control did not hold cannot report absence: a dead predicate reads every name as gone." + return + fi + if [ "$readings" -ne 4 ]; then + REMOVAL_CHECK=UNREADABLE_INCOMPLETE + record "REMOVAL_CHECK=UNREADABLE_INCOMPLETE readings=$readings expected=4 (2 names x 2 stores) - a missing reading is a gap, never an absence." + return + fi + if [ "$unread" -ne 0 ]; then + REMOVAL_CHECK=UNREADABLE_STATE + record "REMOVAL_CHECK=UNREADABLE_STATE unreadable=$unread - at least one name could not be resolved either way." + return + fi + if [ "$present" -eq 0 ]; then + REMOVAL_CHECK=CONFIRMED + record "REMOVAL_CHECK=CONFIRMED - both owned names measured ABSENT in BOTH stores by this run's own instrument, with each store's controls alive in the same sample." + return + fi + if [ "$persist_present" -eq 0 ] && [ "$active_present" -gt 0 ]; then + REMOVAL_CHECK=ACTIVESTORE_RESIDUE + record "REMOVAL_CHECK=ACTIVESTORE_RESIDUE active_present=$active_present - the persistent rule is gone and the LIVE one is not. The host is still admitting on it: PENDING/review, and nothing is retried." + return + fi + if [ "$absent" -gt 0 ]; then + REMOVAL_CHECK=PARTIAL + record "REMOVAL_CHECK=PARTIAL absent=$absent present=$present - one owned name was removed and another was not. A half-removal is open admission, not a partial success: PENDING/review, and NO second dispatch is issued." + return + fi + REMOVAL_CHECK=FAILED + record "REMOVAL_CHECK=FAILED present=$present - every owned name is still there. The instrument ran and removed nothing: PENDING/review." +} # AN UNSTARTED CLOCK IS NOT A FULL BUDGET. Before go() there is no experimental window at # all, and a caller asking how much of it remains is asking about something that does not # exist yet. Echoing EXP_BUDGET_S there would hand an activity step a full window it was @@ -1085,7 +1248,7 @@ cleanup() { # after the subject is gone would pin bytes nobody could re-derive. ( cd "$R" && sha256sum d2-t1.json d2-t2.json d2-t3.json d2-t1.json.b64 d2-t2.json.b64 d2-t3.json.b64 \ 2>"$R/manifest.err" > "$R/MANIFEST.sha256" ) - record "D2_MANIFEST written before teardown ($(grep -c . "$R/MANIFEST.sha256" 2>/dev/null || echo 0) documents hashed; any absent point is named in manifest.err and stays a labelled gap)" + record "D2_MANIFEST written before teardown ($(grep -c . "$R/MANIFEST.sha256" 2>/dev/null) documents hashed; any absent point is named in manifest.err and stays a labelled gap)" guard_assert cleanup-pre-teardown # status recorded; it cannot exit (see note above) # THE TEARDOWN COMMAND IS NOT THIS DRIVER'S TO COMPOSE (doyle 2026-09-13). # The predecessor handed the elevated leg `serve lan --stop` -- the autostarting verb of @@ -1101,24 +1264,44 @@ cleanup() { # and the elevated leg cannot tell them apart. While TEARDOWN_COMMAND_SHA256 is empty this # driver asks for NO teardown and says so: PENDING/review is an honest verdict, a fabricated # command is not. - if [ -z "$TEARDOWN_COMMAND_SHA256" ] || [ ! -f "$TEARDOWN_COMMAND_FILE" ]; then - TEARDOWN_DISPATCH=WITHHELD_UNPINNED + # NOTHING IS REMOVED ON A MARKER ALONE (doyle GUS4EENB). fw_mutation_may_have_occurred is + # set BEFORE the setup is dispatched, deliberately, so that a REFUSED setup still tears + # down. It is therefore a statement about what this run INTENDED, never about what the host + # holds -- the same confusion that made IR-124: in run 20260913T041410Z the setup was + # DECLINED, nothing was ever created, and the marker still drove a command. + # + # THE MARKER DECIDES WHETHER THE QUESTION IS ASKED. THE MEASUREMENT DECIDES WHETHER A + # COMMAND IS REQUESTED. Same shape as the listener gate above, and the same three answers: + # ABSENT (CONFIRMED) -- there is nothing to remove: NO dispatch. The disposition is + # NOTHING_TO_REMOVE, which is a measurement, not a removal. + # UNREADABLE -- attribution could not be established: NO dispatch, PENDING/review. + # An unreadable host is not an empty one and is not a licence either. + # anything present -- there IS something to remove: verify the pin and dispatch. + removal_check pre-teardown + REMOVAL_PRE="$REMOVAL_CHECK" + if [ "$REMOVAL_PRE" = CONFIRMED ]; then + TEARDOWN_DISPATCH=NOT_NEEDED_MEASURED_ABSENT + CLEANUP_VERDICT=NOTHING_TO_REMOVE + record "TEARDOWN_NOT_NEEDED - both owned names measured ABSENT in both stores before any teardown was asked for, with each store's controls alive in the same sample. NO command is dispatched: asking an elevated leg to remove what is not there is how residue gets manufactured." + elif [ "${REMOVAL_PRE#UNREADABLE}" != "$REMOVAL_PRE" ]; then + TEARDOWN_DISPATCH=WITHHELD_UNREADABLE_STATE + CLEANUP_VERDICT=PENDING + record "TEARDOWN_WITHHELD state=$REMOVAL_PRE - the owned rules could not be read either way before teardown. NO command is dispatched and nothing is spawned; disposition PENDING/review." + cfail "teardown withheld: the pre-teardown reading was $REMOVAL_PRE. This is a REFUSAL TO ACT on an unreadable measurement, not a failed action." + # VERIFIED A SECOND TIME, IMMEDIATELY BEFORE USE (doyle 2026-09-13). The pre-GO reading + # was about the file as it stood then; these are the bytes about to be handed to an + # elevated leg, and only a reading taken here can speak for them. + elif ! teardown_pin_verify pre-dispatch; then + TEARDOWN_DISPATCH="WITHHELD_$TEARDOWN_PIN_STATE" CLEANUP_VERDICT=PENDING - record "TEARDOWN_WITHHELD - no product-emitted cleanup command is pinned. NO teardown is requested and NO command is reconstructed. Bootstrap-owned rules MAY REMAIN and their removal is PENDING/review; the state markers in $ST are left set deliberately." - cfail "teardown not dispatched: the product-emitted cleanup command is not yet obtained, decoded, reviewed and pinned. This is a REFUSAL TO ACT, not a failed action." + record "TEARDOWN_WITHHELD state=$TEARDOWN_PIN_STATE - NO teardown is requested and NO command is reconstructed or substituted. Bootstrap-owned rules MAY REMAIN and their removal is PENDING/review; the state markers in $ST are left set deliberately." + cfail "teardown not dispatched (state=$TEARDOWN_PIN_STATE). This is a REFUSAL TO ACT, not a failed action, and a missing instrument is never replaced by a composed one." else - tc_sha=$(sha256sum "$TEARDOWN_COMMAND_FILE" | cut -d" " -f1) - if [ "$tc_sha" != "$TEARDOWN_COMMAND_SHA256" ]; then - TEARDOWN_DISPATCH=WITHHELD_HASH_MISMATCH - CLEANUP_VERDICT=PENDING - cfail "the pinned teardown command file does not match its pin ($tc_sha != $TEARDOWN_COMMAND_SHA256). Different bytes are a different command: REFUSING to dispatch it." - else - TEARDOWN_DISPATCH=DISPATCHED - record "TEARDOWN_COMMAND_PINNED sha256=$tc_sha - dispatching the product-emitted literal VERBATIM, exactly as the binary rendered it (never re-wrapped, re-typed or re-encoded)" - handoff_request teardown \ - "remove bootstrap-owned TCP admission created or possibly created by this run, using the PRODUCT-EMITTED cleanup command below VERBATIM" \ - "$(cat "$TEARDOWN_COMMAND_FILE")" - fi + TEARDOWN_DISPATCH=DISPATCHED + record "TEARDOWN_COMMAND_PINNED reviewed_b64_sha256=$TEARDOWN_B64_SHA256 - dispatching the product-emitted literal VERBATIM, exactly as the binary rendered it (never re-wrapped, re-typed or re-encoded). It removes OWNED RULES ONLY: it stops no listener and removes no process." + handoff_request teardown \ + "remove bootstrap-owned TCP admission created or possibly created by this run, using the PRODUCT-EMITTED cleanup command below VERBATIM. It removes rules only -- do not stop any listener and do not kill any process on the strength of this request." \ + "$(cat "$TEARDOWN_COMMAND_FILE")" fi if [ "$TEARDOWN_DISPATCH" = DISPATCHED ]; then # The wait is bounded by WHAT IS LEFT OF THE REPORTING DEADLINE, not by a fixed 300s: @@ -1141,12 +1324,20 @@ cleanup() { grep -q 'LAN_FIREWALL_CLEAN' "$HO_OUT" 2>/dev/null && verdict=1 grep -q 'tag=cleanup-teardown-post .* subj_group=0 subj_29470=0' "$R/census.log" && absent=1 grep -q 'tag=cleanup-teardown-post .* valid=YES' "$R/census.log" && valid=1 - record "TEARDOWN_CHECK receipt_exit=$t_rc census_exit=$c_rc clean_verdict=$verdict named_rules_absent=$absent census_valid=$valid" - if [ "$t_rc" -eq 0 ] && [ "$c_rc" -eq 0 ] && [ "$verdict" -eq 1 ] && [ "$absent" -eq 1 ] && [ "$valid" -eq 1 ]; then - record "TEARDOWN_VERIFIED — zero teardown exit AND a successful census AND the product's own LAN_FIREWALL_CLEAN verdict AND the owned named rules measured ABSENT" + # INDEPENDENT POST-REMOVAL CHECK (doyle 2026-09-13). Everything above is either the + # product's own verdict -- the claim under test -- or a census that counts ActiveStore + # rules by GROUP and PORT. Neither can say WHICH owned name is gone, and neither reads + # PersistentStore at all, so a removal that took one rule and failed on the other, or that + # emptied PersistentStore while leaving ActiveStore residue, could pass both. This probe + # addresses each owned name by InstanceID in EACH store and is the reading that decides. + removal_check post-teardown + record "TEARDOWN_CHECK receipt_exit=$t_rc census_exit=$c_rc clean_verdict=$verdict named_rules_absent=$absent census_valid=$valid independent_removal=$REMOVAL_CHECK" + if [ "$t_rc" -eq 0 ] && [ "$c_rc" -eq 0 ] && [ "$verdict" -eq 1 ] && [ "$absent" -eq 1 ] && [ "$valid" -eq 1 ] && [ "$REMOVAL_CHECK" = CONFIRMED ]; then + record "TEARDOWN_VERIFIED — zero teardown exit AND a successful census AND the product's own LAN_FIREWALL_CLEAN verdict AND the owned named rules measured ABSENT by an INDEPENDENT per-name, per-store probe" CLEANUP_VERDICT=VERIFIED else - cfail "TEARDOWN NOT VERIFIED (receipt_exit=$t_rc census_exit=$c_rc clean_verdict=$verdict absent=$absent census_valid=$valid). Owned rules MAY REMAIN. The state marker is left set deliberately." + CLEANUP_VERDICT=PENDING + cfail "TEARDOWN NOT VERIFIED (receipt_exit=$t_rc census_exit=$c_rc clean_verdict=$verdict absent=$absent census_valid=$valid independent_removal=$REMOVAL_CHECK). Owned rules MAY REMAIN; removal is PENDING/review and is NOT retried. The state marker is left set deliberately." fi else cfail "no verified teardown receipt; bootstrap-owned rules MAY REMAIN. State markers left in $ST deliberately." @@ -1248,7 +1439,13 @@ cleanup() { # residual process associated with this home, and no listener still bound. Live OR # UNREADABLE residual state is PENDING, and PENDING never ends at zero -- each of those # branches has already written a cleanup failure, which the r8 handler turns into exit 6. - if [ "$CLEANUP_VERDICT" != VERIFIED ] || [ "$RESIDUE_COUNT" != 0 ] || [ "${LISTENER_STATE:-UNMEASURED}" != ABSENT ]; then + # NOTHING_TO_REMOVE IS A TERMINAL MEASURED STATE, NOT A WEAK 'VERIFIED' (doyle GUS4EENB). + # A run whose setup was declined created nothing, so no removal could be measured and VERIFIED + # is not available to it -- but neither is PENDING/review the truth, because there is nothing + # outstanding. It still has to clear the SAME two other facts: no residual process of this + # home, and no listener still bound. Either of those forces PENDING exactly as before. + if { [ "$CLEANUP_VERDICT" != VERIFIED ] && [ "$CLEANUP_VERDICT" != NOTHING_TO_REMOVE ]; } \ + || [ "$RESIDUE_COUNT" != 0 ] || [ "${LISTENER_STATE:-UNMEASURED}" != ABSENT ]; then CLEANUP_VERDICT=PENDING fi if [ "$left" -le 0 ]; then @@ -1837,8 +2034,21 @@ if [ -n "$ack_missing" ]; then fi record "PREPARED_ACK_VERIFIED - the executor reports PREPARED and NOT_STARTED and measured the pinned executable as $EXE_SHA" +# THE REMOVAL INSTRUMENT IS REQUIRED BEFORE THE WINDOW OPENS (doyle 2026-09-13). +# A run that cannot remove what it is about to create must never create it. The predecessor +# discovered its missing teardown at CLEANUP -- after the rules existed -- and could then only +# report PENDING and leave them for a human. Checking here costs no experimental time (this is +# still preparation) and turns that PENDING into a run that never started. +# +# THIS IS A PRECONDITION, NOT A PERMISSION. Verifying the instrument does not authorize its use +# any more than the PREPARED acknowledgment authorizes the setup; it establishes that the removal +# this run will owe is one it can actually hand over, pinned and reviewed. +if ! teardown_pin_verify pre-go; then + die "the reviewed rule-removal instrument is not available (state=$TEARDOWN_PIN_STATE). The experimental window is NEVER OPENED: nothing is dispatched, nothing is created, and there is nothing to tear down. This is a refusal to start, not a failed run." +fi + # THE WINDOW OPENS HERE AND NOWHERE ELSE. -go "prepared acknowledgment verified" +go "prepared acknowledgment verified and the reviewed removal instrument verified" abort_check deadline_check elevated-setup